aws-service-stack 0.18.371 → 0.18.373

package/README.md

@@ -445,9 +445,9 @@ Each permission is stored in DynamoDB with the composite key `role#resource#scop
 ```typescript
 interface Permission {
   id: string;
-  role: string;         // Cognito group name: "Manager", "Agent"
-  resource: string;     // API resource: "property", "order"
-  scope: string;        // Data scope: "Organization", "Branch", "Agent"
+  role: string; // Cognito group name: "Manager", "Agent"
+  resource: string; // API resource: "property", "order"
+  scope: string; // Data scope: "Organization", "Branch", "Agent"
   method: {
     get?: boolean;
     post?: boolean;
@@ -468,8 +468,8 @@ import { EntityConfigImpl, ScopeMap } from "@chinggis/core";
 
 const scopeMap: ScopeMap = new Map([
   ["Organization", { filterField: "orgId", claimKey: "custom:orgId" }],
-  ["Branch",       { filterField: "branchId", claimKey: "custom:branch" }],
-  ["Agent",        { filterField: "agentId", claimKey: "custom:agent" }],
+  ["Branch", { filterField: "branchId", claimKey: "custom:branch" }],
+  ["Agent", { filterField: "agentId", claimKey: "custom:agent" }],
 ]);
 
 export class PropertyConfig extends EntityConfigImpl {
@@ -503,11 +503,12 @@ When both `ROLE_TABLE` and `SCOPE_MAP` are configured, `ControllerApi` automatic
 When `ROLE_PATH` is configured, permission management endpoints are automatically available:
 
 ```
-GET     /properties/role              # List all permissions
-POST    /properties/role              # Create a permission
-PATCH   /properties/role              # Update a permission
-DELETE  /properties/role              # Delete a permission
-POST    /properties/role/add-role     # Create a Cognito user pool group
+GET     /properties/role               # List all permissions
+POST    /properties/role               # Create a permission
+PATCH   /properties/role               # Update a permission
+DELETE  /properties/role               # Delete a permission
+POST    /properties/role/add-role      # Create a Cognito user pool group
+POST    /properties/role/add-user-role # Add a User to cognito group
 ```
 
 #### Create a Permission

package/dist/_examples/controller/property/property.config.js

@@ -44,9 +44,7 @@ class PropertyConfig extends base_config_1.EntityConfigImpl {
         this.setDynamoDB(tableName, ownerFieldName, indexMap)
             .setOpenSearch(exports.openSearch_order.domain, exports.openSearch_order.index)
             .setPolicies(policyList)
-            .setScopes(scopeMap)
-            .setRoleTable("Permission-dev")
-            .setRolePath("/permission/plp");
+            .setPermissionMap({ scopeMap, roleTable: "Permission-dev", rolePath: "/permission/plp" });
     }
 }
 exports.PropertyConfig = PropertyConfig;

package/dist/_examples/controller/property/property.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"property.config.js","sourceRoot":"","sources":["../../../../src/_examples/controller/property/property.config.ts"],"names":[],"mappings":";;;AAAA,4DAA8D;AAC9D,yCAAwG;AACxG,8FAM0D;AAE1D,2BAA2B;AACd,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,wGAAwG;IAChH,KAAK,EAAE,OAAO;CACf,CAAC;AACW,QAAA,IAAI,GAAG,WAAW,CAAC,CAAC,gBAAgB;AAEjD,sBAAsB;AACtB,MAAa,cAAe,SAAQ,8BAAgB;IAClD;QACE,WAAW;QACX,MAAM,SAAS,GAAG,cAAc,CAAC;QACjC,MAAM,cAAc,GAAG,SAAS,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,qBAAc,EAAE;aAClC,SAAS,CAAC,SAAS,CAAC;aACpB,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;aAC1D,GAAG,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;aACrE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE1E,cAAc;QACd,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,CAAC;QAEvC,MAAM,UAAU,GAAqB;YACnC,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,EAAE,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,EAAE,aAAC,CAAC,MAAM,EAAE,aAAC,CAAC,KAAK,CAAC,EAAE;YACvE,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,SAAS,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8CAAQ,EAAE;YAC/E,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,eAAe,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8CAAQ,EAAE;YACrF,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,2BAA2B,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE;YAC7E,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAC7E,EAAE,MAAM,EAAE,iBAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,YAAI,EAAE,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAM,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAC5F,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,iCAAO,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YACjG,EAAE,MAAM,EAAE,iBAAC,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAM,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAClG,EAAE,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE;SAC7D,CAAC;QAEF,SAAS;QACT,MAAM,QAAQ,GAAG,IAAI,eAAQ,EAAE;aAC5B,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aAC3D,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;aAClE,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEzE,OAAO;QACP,KAAK,CAAC,YAAI,EAAE,eAAe,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC;aAClD,aAAa,CAAC,wBAAgB,CAAC,MAAM,EAAE,wBAAgB,CAAC,KAAK,CAAC;aAC9D,WAAW,CAAC,UAAU,CAAC;aACvB,SAAS,CAAC,QAAQ,CAAC;aACnB,YAAY,CAAC,gBAAgB,CAAC;aAC9B,WAAW,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;CACF;AAzCD,wCAyCC;AAED,qCAAqC;AACxB,QAAA,eAAe,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["import { EntityConfigImpl } from \"../../../model/base.config\";\nimport { Access as a, DynamoIndexMap, EndpointPolicy, HttpMethod as m, ScopeMap } from \"@chinggis/core\";\nimport {\n  CREATE,\n  REPLACE,\n  RESPONSE_FIELDS_DETAILS as FIELDS_D,\n  RESPONSE_FIELDS_LIST as FIELDS_L,\n  UPDATE,\n} from \"../../repositories/order/order-repo-db.interface\";\n\n// OpenSearch configuration\nexport const openSearch_order = {\n  domain: \"https://search-amplify-opense-1ddfdekgbbpwe-kgxh6aum57h2wc4moozm2jcvom.ap-southeast-1.es.amazonaws.com\",\n  index: \"order\",\n};\nexport const path = \"/property\"; // url path base\n\n// Order configuration\nexport class PropertyConfig extends EntityConfigImpl {\n  constructor() {\n    // DYNAMODB\n    const tableName = \"Property-dev\";\n    const ownerFieldName = \"ownerId\";\n    const indexMap = new DynamoIndexMap()\n      .setFields(\"ownerId\")\n      .set(\"byAgent\", { field: \"agentId\", rFields: [\"agentId\"] })\n      .set(\"propertyByBranch\", { field: \"branchId\", rFields: [\"branchId\"] })\n      .set(\"byOrg\", { field: \"organizationId\", rFields: [\"organizationId\"] });\n\n    // PERMISSIONS\n    const adminGroupNames = [\"adminUsers\"];\n\n    const policyList: EndpointPolicy[] = [\n      { method: m.GET, path: `${path}`, access: [a.USER, a.PUBLIC, a.ADMIN] },\n      { method: m.GET, path: `${path}/search`, access: [a.USER], response: FIELDS_L },\n      { method: m.GET, path: `${path}/search/query`, access: [a.USER], response: FIELDS_L },\n      { method: m.GET, path: `${path}/search/query/total-count`, access: [a.USER] },\n      { method: m.GET, path: `${path}/{id}`, access: [a.USER], response: FIELDS_D },\n      { method: m.POST, path: `${path}`, access: [a.USER], validator: CREATE, response: FIELDS_D },\n      { method: m.PUT, path: `${path}/{id}`, access: [a.USER], validator: REPLACE, response: FIELDS_D },\n      { method: m.PATCH, path: `${path}/{id}`, access: [a.USER], validator: UPDATE, response: FIELDS_D },\n      { method: m.DELETE, path: `${path}/{id}`, access: [a.USER] },\n    ];\n\n    // SCOPES\n    const scopeMap = new ScopeMap()\n      .set(\"branch\", { filterField: \"branchId\", claimKey: \"sub\" })\n      .set(\"agent\", { filterField: \"agentId\", claimKey: \"custom:agent\" })\n      .set(\"org\", { filterField: \"organizationId\", claimKey: \"custom:org\" });\n\n    // INIT\n    super(path, adminGroupNames);\n    this.setDynamoDB(tableName, ownerFieldName, indexMap)\n      .setOpenSearch(openSearch_order.domain, openSearch_order.index)\n      .setPolicies(policyList)\n      .setScopes(scopeMap)\n      .setRoleTable(\"Permission-dev\")\n      .setRolePath(\"/permission/plp\");\n  }\n}\n\n// Export default Order configuration\nexport const CONFIG_PROPERTY = new PropertyConfig();\n"]}
+{"version":3,"file":"property.config.js","sourceRoot":"","sources":["../../../../src/_examples/controller/property/property.config.ts"],"names":[],"mappings":";;;AAAA,4DAA8D;AAC9D,yCAAwG;AACxG,8FAM0D;AAE1D,2BAA2B;AACd,QAAA,gBAAgB,GAAG;IAC9B,MAAM,EAAE,wGAAwG;IAChH,KAAK,EAAE,OAAO;CACf,CAAC;AACW,QAAA,IAAI,GAAG,WAAW,CAAC,CAAC,gBAAgB;AAEjD,sBAAsB;AACtB,MAAa,cAAe,SAAQ,8BAAgB;IAClD;QACE,WAAW;QACX,MAAM,SAAS,GAAG,cAAc,CAAC;QACjC,MAAM,cAAc,GAAG,SAAS,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,qBAAc,EAAE;aAClC,SAAS,CAAC,SAAS,CAAC;aACpB,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;aAC1D,GAAG,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;aACrE,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE1E,cAAc;QACd,MAAM,eAAe,GAAG,CAAC,YAAY,CAAC,CAAC;QAEvC,MAAM,UAAU,GAAqB;YACnC,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,EAAE,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,EAAE,aAAC,CAAC,MAAM,EAAE,aAAC,CAAC,KAAK,CAAC,EAAE;YACvE,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,SAAS,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8CAAQ,EAAE;YAC/E,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,eAAe,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,8CAAQ,EAAE;YACrF,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,2BAA2B,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE;YAC7E,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAC7E,EAAE,MAAM,EAAE,iBAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,YAAI,EAAE,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAM,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAC5F,EAAE,MAAM,EAAE,iBAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,iCAAO,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YACjG,EAAE,MAAM,EAAE,iBAAC,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,gCAAM,EAAE,QAAQ,EAAE,iDAAQ,EAAE;YAClG,EAAE,MAAM,EAAE,iBAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,YAAI,OAAO,EAAE,MAAM,EAAE,CAAC,aAAC,CAAC,IAAI,CAAC,EAAE;SAC7D,CAAC;QAEF,SAAS;QACT,MAAM,QAAQ,GAAG,IAAI,eAAQ,EAAE;aAC5B,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;aAC3D,GAAG,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;aAClE,GAAG,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEzE,OAAO;QACP,KAAK,CAAC,YAAI,EAAE,eAAe,CAAC,CAAC;QAC7B,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC;aAClD,aAAa,CAAC,wBAAgB,CAAC,MAAM,EAAE,wBAAgB,CAAC,KAAK,CAAC;aAC9D,WAAW,CAAC,UAAU,CAAC;aACvB,gBAAgB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC9F,CAAC;CACF;AAvCD,wCAuCC;AAED,qCAAqC;AACxB,QAAA,eAAe,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["import { EntityConfigImpl } from \"../../../model/base.config\";\nimport { Access as a, DynamoIndexMap, EndpointPolicy, HttpMethod as m, ScopeMap } from \"@chinggis/core\";\nimport {\n  CREATE,\n  REPLACE,\n  RESPONSE_FIELDS_DETAILS as FIELDS_D,\n  RESPONSE_FIELDS_LIST as FIELDS_L,\n  UPDATE,\n} from \"../../repositories/order/order-repo-db.interface\";\n\n// OpenSearch configuration\nexport const openSearch_order = {\n  domain: \"https://search-amplify-opense-1ddfdekgbbpwe-kgxh6aum57h2wc4moozm2jcvom.ap-southeast-1.es.amazonaws.com\",\n  index: \"order\",\n};\nexport const path = \"/property\"; // url path base\n\n// Order configuration\nexport class PropertyConfig extends EntityConfigImpl {\n  constructor() {\n    // DYNAMODB\n    const tableName = \"Property-dev\";\n    const ownerFieldName = \"ownerId\";\n    const indexMap = new DynamoIndexMap()\n      .setFields(\"ownerId\")\n      .set(\"byAgent\", { field: \"agentId\", rFields: [\"agentId\"] })\n      .set(\"propertyByBranch\", { field: \"branchId\", rFields: [\"branchId\"] })\n      .set(\"byOrg\", { field: \"organizationId\", rFields: [\"organizationId\"] });\n\n    // PERMISSIONS\n    const adminGroupNames = [\"adminUsers\"];\n\n    const policyList: EndpointPolicy[] = [\n      { method: m.GET, path: `${path}`, access: [a.USER, a.PUBLIC, a.ADMIN] },\n      { method: m.GET, path: `${path}/search`, access: [a.USER], response: FIELDS_L },\n      { method: m.GET, path: `${path}/search/query`, access: [a.USER], response: FIELDS_L },\n      { method: m.GET, path: `${path}/search/query/total-count`, access: [a.USER] },\n      { method: m.GET, path: `${path}/{id}`, access: [a.USER], response: FIELDS_D },\n      { method: m.POST, path: `${path}`, access: [a.USER], validator: CREATE, response: FIELDS_D },\n      { method: m.PUT, path: `${path}/{id}`, access: [a.USER], validator: REPLACE, response: FIELDS_D },\n      { method: m.PATCH, path: `${path}/{id}`, access: [a.USER], validator: UPDATE, response: FIELDS_D },\n      { method: m.DELETE, path: `${path}/{id}`, access: [a.USER] },\n    ];\n\n    // SCOPES\n    const scopeMap = new ScopeMap()\n      .set(\"branch\", { filterField: \"branchId\", claimKey: \"sub\" })\n      .set(\"agent\", { filterField: \"agentId\", claimKey: \"custom:agent\" })\n      .set(\"org\", { filterField: \"organizationId\", claimKey: \"custom:org\" });\n\n    // INIT\n    super(path, adminGroupNames);\n    this.setDynamoDB(tableName, ownerFieldName, indexMap)\n      .setOpenSearch(openSearch_order.domain, openSearch_order.index)\n      .setPolicies(policyList)\n      .setPermissionMap({ scopeMap, roleTable: \"Permission-dev\", rolePath: \"/permission/plp\" });\n  }\n}\n\n// Export default Order configuration\nexport const CONFIG_PROPERTY = new PropertyConfig();\n"]}

package/dist/controller/controller-api.d.ts

@@ -15,7 +15,7 @@ export declare abstract class ControllerApi<R extends BaseEntity, T extends Crud
     processCrudRequestPre(req: HttpRequest): Promise<HttpRequest>;
     processCrudRequestPost(request: HttpRequest, response: R | List<R>): Promise<R | List<R>>;
     protected handleList(methode: HttpMethod, path: string, request: HttpRequest): Promise<any>;
-    protected handlePermission(req: HttpRequest, path: string): Promise<boolean | import("../model/index.js").RolePermission | import("../model/index.js").RolePermission[] | {
+    protected handlePermission(req: HttpRequest, path: string): Promise<boolean | void | import("../model/index.js").RolePermission | import("../model/index.js").RolePermission[] | {
         groupName: string;
         description?: string;
     }>;

package/dist/controller/controller-api.js

@@ -18,8 +18,8 @@ class ControllerApi {
         if (config.ADMIN_GROUP_NAME) {
             this.adminGroupNames = config.ADMIN_GROUP_NAME;
         }
-        if (config.ROLE_PATH && config.ROLE_TABLE && config.SCOPE_MAP) {
-            this.roleController = new controller_role_1.ControllerRole(config.ROLE_TABLE);
+        if (config.PERMISSION_MAP) {
+            this.roleController = new controller_role_1.ControllerRole(config.PERMISSION_MAP.roleTable);
         }
         this.service.setConfig(config);
     }
@@ -31,9 +31,9 @@ class ControllerApi {
         try {
             let req = (0, index_1.parseHttpRequest)(event, this.adminGroupNames);
             const policy = (0, index_1.findMatchedPolicy)(req.methode, event?.requestContext?.resourcePath, this.config.ENDPOINT_POLICY);
-            if (this.config.ROLE_TABLE && this.config.SCOPE_MAP?.size > 0 && this.roleController) {
+            if (this.config.PERMISSION_MAP && this.roleController) {
                 const resource = this.getResource();
-                await this.roleController.checkRbacAccess(req, resource, this.config.SCOPE_MAP);
+                await this.roleController.checkRbacAccess(req, resource, this.config.PERMISSION_MAP.scopeMap);
             }
             else {
                 this.checkPermission(policy?.access, req.requestType);
@@ -94,8 +94,12 @@ class ControllerApi {
         }
     }
     async handlePermission(req, path) {
-        if (req.methode === "POST" && (0, string_util_1.trimSpecialChar)(path) === (0, string_util_1.trimSpecialChar)(this.config.ROLE_PATH) + "/add-role")
-            return this.roleController.addRole("userPoolId", req.body.groupName, req.body.description);
+        if (req.methode === "POST" &&
+            (0, string_util_1.trimSpecialChar)(path) === (0, string_util_1.trimSpecialChar)(this.config.PERMISSION_MAP?.rolePath) + "/add-group")
+            return this.roleController.addRole(this.config.PERMISSION_MAP?.userPoolId, req.body.groupName, req.body.description);
+        if (req.methode === "POST" &&
+            (0, string_util_1.trimSpecialChar)(path) === (0, string_util_1.trimSpecialChar)(this.config.PERMISSION_MAP?.rolePath) + "/add-user-group")
+            return this.roleController.assignRole(this.config.PERMISSION_MAP?.userPoolId, req.identity.username, req.body.groupName);
         if (req.methode === "GET")
             return this.roleController.listPermissions();
         if (req.methode === "POST")
@@ -178,8 +182,8 @@ class ControllerApi {
         return this.service.save(entity, profileId, parentId, cognitoUser);
     }
     isPermissionRequest(path) {
-        if (this.config.ROLE_PATH && this.config.ROLE_TABLE && this.roleController) {
-            const rolePath = (0, string_util_1.trimSpecialChar)(this.config.ROLE_PATH);
+        if (this.config.PERMISSION_MAP && this.roleController) {
+            const rolePath = (0, string_util_1.trimSpecialChar)(this.config.PERMISSION_MAP.rolePath);
             const normalizedPath = (0, string_util_1.trimSpecialChar)(path);
             return normalizedPath.includes(rolePath);
         }

package/dist/controller/controller-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-api.js","sourceRoot":"","sources":["../../src/controller/controller-api.ts"],"names":[],"mappings":";;;AAAA,oCAgBkB;AAElB,4CAA2D;AAE3D,sDAAuD;AAEvD,uDAAmD;AAEnD,MAAsB,aAAa;IACd,OAAO,CAAI;IACpB,MAAM,CAAe;IACrB,eAAe,CAAW;IAE5B,cAAc,CAAiB;IAEvC,YAAsB,WAAc,EAAE,MAAoB;QACxD,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAE3B,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjD,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9D,IAAI,CAAC,cAAc,GAAG,IAAI,gCAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,+CAA+C;IACrC,WAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA2B;QAClD,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,IAAA,wBAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAExD,MAAM,MAAM,GAA+B,IAAA,yBAAiB,EAC1D,GAAG,CAAC,OAAO,EACX,KAAK,EAAE,cAAc,EAAE,YAAY,EACnC,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAElD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7D,GAAG,CAAC,KAAK,CACP,UAAU,GAAG,CAAC,QAAQ,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,OAAO,YAAY,GAAG,CAAC,QAAQ,CAAC,GAAG,eAAe,GAAG,CAAC,QAAQ,CAAC,OAAO,cAAc,GAAG,CAAC,QAAQ,CAAC,QAAQ,iBAAiB,GAAG,CAAC,WAAW,EAAE,CACnM,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,yCAAyC;YACzC,6CAA6C;YAC7C,SAAS;YAET,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,QAAQ,GAAQ,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAEvD,IAAI,QAAQ;gBAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;;gBACrE,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;YAEvE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAA,yBAAiB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAExE,OAAO,IAAA,yBAAiB,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,IAAA,4BAAgB,EAAC,GAAG,CAAC,CAAC;YACpC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,IAAA,yBAAiB,EAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,SAAS,CAAC,MAAoB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAgB;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAoB,EAAE,QAAqB;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,IAAY,EAAE,OAAoB;QAChF,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1F,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,eAAe,EAAE,CAAC;YAC5G,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAED,IACE,OAAO,KAAK,KAAK;YACjB,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,2BAA2B,EAC9F,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC;YACpG,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,GAAgB,EAAE,IAAY;QAC7D,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW;YAC1G,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAE7F,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExF,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,WAAgB,EAAE,aAA2B;QAC1F,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC;QAEnE,yBAAyB;QACzB,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,aAA2B;QACxE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAE5G,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAES,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,aAA2B;QACvE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEpE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,2BAA2B,QAAQ,YAAY,CAAC,CAAC;IACzG,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAW,EAAE,aAA2B;QACtF,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAEzG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC;QAErB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAS,EAAE,WAAwB;QAClE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACxF,CAAC;QAED,iBAAiB;QACjB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QACzD,IAAI,SAAS,GAAG,OAAO,CAAC;QACxB,IAAI,QAAgB,CAAC;QAErB,mCAAmC;QACnC,IAAI,WAAW,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACzC,QAAQ,GAAG,aAAa,CAAC;QAC3B,CAAC;aAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAExC,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE1F,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;YAChC,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC;QAClC,CAAC;QAED,iDAAiD;QACjD,OAAO,MAAM,CAAC,aAAa,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC;QAEtB,cAAc;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IAIS,mBAAmB,CAAC,IAAY;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAES,aAAa,CAAC,OAAmB,EAAE,IAAY;QACvD,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG;YACnB,QAAQ;YACR,GAAG,QAAQ,SAAS;YACpB,GAAG,QAAQ,OAAO;YAClB,GAAG,QAAQ,eAAe;YAC1B,GAAG,QAAQ,2BAA2B;SACvC,CAAC;QAEF,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;QAEnE,OAAO,WAAW,IAAI,aAAa,CAAC;IACtC,CAAC;IAES,eAAe,CAAC,OAAmB,EAAE,IAAY;QACzD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,aAAa,GAAG,OAAO,KAAK,OAAO,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,aAAa,IAAI,cAAc,CAAC;IACzC,CAAC;IAES,eAAe,CAAC,OAAmB,EAAE,IAAY;QACzD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,cAAc,GAAG,OAAO,KAAK,QAAQ,CAAC;QAC5C,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,cAAc,IAAI,cAAc,CAAC;IAC1C,CAAC;IAES,cAAc,CAAC,OAAmB,EAAE,IAAY;QACxD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAES,aAAa,CAAC,OAAmB,EAAE,IAAY;QACvD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,KAAK,MAAM,CAAC;QACvC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAES,YAAY,CAAC,OAAmB,EAAE,IAAY;QACtD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAgB;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,QAAa,EAAE,cAA8B;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAA,oBAAY,EAAC,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,KAAK,GAAG,IAAA,oBAAY,EAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,IAAA,oBAAY,EAAC,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,yDAAyD;IACjD,kBAAkB,CAAC,WAAwB;QACjD,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,mBAAW,CAAC,KAAK;gBACpB,OAAO,cAAM,CAAC,KAAK,CAAC;YACtB,KAAK,mBAAW,CAAC,IAAI;gBACnB,OAAO,cAAM,CAAC,IAAI,CAAC;YACrB,KAAK,mBAAW,CAAC,KAAK;gBACpB,OAAO,cAAM,CAAC,MAAM,CAAC;YACvB,KAAK,mBAAW,CAAC,MAAM;gBACrB,OAAO,cAAM,CAAC,MAAM,CAAC;YACvB;gBACE,OAAO,cAAM,CAAC,MAAM,CAAC;QACzB,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,eAAe,CAAC,aAAuB,EAAE,WAAwB;QACvE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAEhE,mGAAmG;QACnG,MAAM,aAAa,GACjB,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC1C,CAAC,WAAW,KAAK,mBAAW,CAAC,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7E,IAAI,aAAa;YAAE,OAAO;QAE1B,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,EAAE,CACvF,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAY,EAAE,OAAgB,EAAE,SAAiB;QACrE,IAAI,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;QACtE,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACpD,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAEO,WAAW,CAAC,WAAgB;QAClC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAO,CAAC;QACjC,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACjF,CAAC;IAEO,eAAe,CAAC,MAAW,EAAE,WAAgB;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,CAAC;YACH,IAAA,0BAAkB,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF;AA1XD,sCA0XC","sourcesContent":["import {\n  Access,\n  APIResponse,\n  BaseEntity,\n  createApiResponse,\n  EndpointPolicy,\n  findMatchedPolicy,\n  formatErrors,\n  HttpMethod,\n  HttpRequest,\n  List,\n  parseHttpRequest,\n  removeFields,\n  RequestType,\n  ResponseFields,\n  validateWithSchema,\n} from \"../index\";\nimport { APIGatewayProxyEvent } from \"aws-lambda\";\nimport { errorHandlerHttp, ErrorHttp } from \"../exception\";\nimport { CognitoUser, EntityConfig } from \"@chinggis/types\";\nimport { trimSpecialChar } from \"../utils/string.util\";\nimport { CrudService } from \"../service\";\nimport { ControllerRole } from \"./controller-role\";\n\nexport abstract class ControllerApi<R extends BaseEntity, T extends CrudService<R>> {\n  protected readonly service: T;\n  protected config: EntityConfig;\n  protected adminGroupNames: string[];\n\n  private roleController: ControllerRole;\n\n  protected constructor(baseService: T, config: EntityConfig) {\n    this.service = baseService;\n\n    if (!config) return;\n\n    this.config = config;\n\n    if (config.ADMIN_GROUP_NAME) {\n      this.adminGroupNames = config.ADMIN_GROUP_NAME;\n    }\n\n    if (config.ROLE_PATH && config.ROLE_TABLE && config.SCOPE_MAP) {\n      this.roleController = new ControllerRole(config.ROLE_TABLE);\n    }\n\n    this.service.setConfig(config);\n  }\n\n  /** Return constructor-defined resource name */\n  protected getResource(): string {\n    return this.config.BASE_PATH.replace(\"/\", \"\");\n  }\n\n  async resolveCrudRequest(event: APIGatewayProxyEvent): Promise<APIResponse> {\n    try {\n      let req = parseHttpRequest(event, this.adminGroupNames);\n\n      const policy: EndpointPolicy | undefined = findMatchedPolicy(\n        req.methode,\n        event?.requestContext?.resourcePath,\n        this.config.ENDPOINT_POLICY,\n      );\n\n      if (this.config.ROLE_TABLE && this.config.SCOPE_MAP?.size > 0 && this.roleController) {\n        const resource = this.getResource();\n        await this.roleController.checkRbacAccess(req, resource, this.config.SCOPE_MAP);\n      } else {\n        this.checkPermission(policy?.access, req.requestType);\n      }\n\n      this.validateRequest(policy?.validator, req.body);\n\n      if (req.identity) {\n        log.debug(\"groups: \" + JSON.stringify(req.identity.groups, null, 2));\n        log.debug(`claims:${JSON.stringify(req.identity, null, 2)}`);\n        log.debug(\n          `groups:${req.identity.groups}, isAdmin:${req.identity.isAdmin}, userId:${req.identity.sub}, profileId:${req.identity.profile}, username:${req.identity.username}, requestType:${req.requestType}`,\n        );\n      }\n\n      //      if (req.isAdmin) {\n      //        delete req.filter[\"profileId\"];\n      //        delete req.filter[\"ownerParentId\"];\n      //      }\n\n      req = await this.processCrudRequestPre(req);\n\n      let response: any = await this.handleCrudByMethod(req);\n\n      if (response) response = await this.processCrudRequestPost(req, response);\n      else response = await this.processCrudRequest(req); // Custom Endpoints\n\n      if (!policy?.response) {\n        return createApiResponse(200, response);\n      }\n\n      const filteredResponse = this.filterResponse(response, policy.response);\n\n      return createApiResponse(200, filteredResponse);\n    } catch (err) {\n      const error = errorHandlerHttp(err);\n      log.error(error);\n      return createApiResponse(error.statusCode, error.content);\n    }\n  }\n\n  setConfig(config: EntityConfig): void {\n    this.config = config;\n  }\n\n  async processCrudRequestPre(req: HttpRequest): Promise<HttpRequest> {\n    return req;\n  }\n\n  async processCrudRequestPost(request: HttpRequest, response: R | List<R>): Promise<R | List<R>> {\n    return response;\n  }\n\n  protected async handleList(methode: HttpMethod, path: string, request: HttpRequest): Promise<any> {\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH)) {\n      return await this.service.find(request?.filter || {});\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search\") {\n      return this.service.search(request?.filter || {});\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search/query\") {\n      return this.service.searchQuery(request?.filter);\n    }\n\n    if (\n      methode === \"GET\" &&\n      trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search/query/total-count\"\n    ) {\n      return this.service.searchQueryTotalCount(request?.filter);\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/scan\") {\n      return await this.service.scan(request?.filter || {});\n    }\n  }\n\n  protected async handlePermission(req: HttpRequest, path: string) {\n    if (req.methode === \"POST\" && trimSpecialChar(path) === trimSpecialChar(this.config.ROLE_PATH) + \"/add-role\")\n      return this.roleController.addRole(\"userPoolId\", req.body.groupName, req.body.description);\n\n    if (req.methode === \"GET\") return this.roleController.listPermissions();\n    if (req.methode === \"POST\") return this.roleController.addPermission(req.body);\n    if (req.methode === \"PATCH\") return this.roleController.updatePermission(req.entityId, req.body);\n    if (req.methode === \"DELETE\") return this.roleController.deletePermission(req.entityId);\n\n    throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] unsupported method\");\n  }\n\n  protected async handleUpdate(entityId: string, requestBody: any, requestedUser?: CognitoUser): Promise<R> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PATCH resource without id field\");\n\n    const entity = this.parseEntity(requestBody);\n\n    if (Object.keys(entity).length === 0) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No fields to update\");\n    }\n\n    const fieldName = this.config.DYNAMO_DB?.MAP?.partitionKey ?? \"id\";\n\n    // id change is forbidden\n    if (entity[fieldName]) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot modify the id field\");\n    }\n\n    entity[fieldName] = entityId;\n    return this.service.update(entity, requestedUser);\n  }\n\n  protected async handleDelete(entityId: string, requestedUser?: CognitoUser): Promise<boolean> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot delete resource without id field\");\n\n    return this.service.remove(entityId, requestedUser);\n  }\n\n  protected async handleFetch(entityId: string, requestedUser?: CognitoUser): Promise<R> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot fetch resource without id field\");\n\n    const result = await this.service.findById(entityId, requestedUser);\n\n    if (result) return result;\n\n    throw new ErrorHttp({ code: 404, error: \"NotFound\" }, `[CORE] Resource with ID ${entityId} not found`);\n  }\n\n  protected async handleReplace(entityId: string, entity: any, requestedUser?: CognitoUser) {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PUT resource without id field\");\n\n    if (!Object.keys(entity).length) {\n      throw new ErrorHttp({ code: 400, error: \"Bad Request\" }, \"[CORE] No entity provided for PUT update\");\n    }\n\n    if (!entityId) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PUT resource without id field\");\n    }\n\n    entity.id = entityId;\n\n    return this.service.update(entity, requestedUser);\n  }\n\n  protected async handlePostCreate(entity: R, cognitoUser: CognitoUser) {\n    if (!entity || Object.keys(entity).length === 0) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No entity payload provided\");\n    }\n\n    if (!entity.ownerId) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No ownerId provided\");\n    }\n\n    // Initialize IDs\n    const { ownerId, ownerParentId: inputParentId } = entity;\n    let profileId = ownerId;\n    let parentId: string;\n\n    // Determine parentId and profileId\n    if (cognitoUser.isAdmin && inputParentId) {\n      parentId = inputParentId;\n    } else if (cognitoUser.isParent) {\n      console.log(\"is parent becomming true\");\n\n      parentId = cognitoUser.profile;\n    } else {\n      console.log(\"is parent not becomming true\");\n      console.log(\"the value of isParent: \", cognitoUser.isParent, typeof cognitoUser.isParent);\n\n      parentId = cognitoUser.parentId;\n      profileId = cognitoUser.profile;\n    }\n\n    // Remove fields that shouldn't be saved directly\n    delete entity.ownerParentId;\n    delete entity.ownerId;\n\n    // Save entity\n    return this.service.save(entity, profileId, parentId, cognitoUser);\n  }\n\n  protected abstract processCrudRequest(event: HttpRequest): Promise<any>;\n\n  protected isPermissionRequest(path: string): boolean {\n    if (this.config.ROLE_PATH && this.config.ROLE_TABLE && this.roleController) {\n      const rolePath = trimSpecialChar(this.config.ROLE_PATH);\n      const normalizedPath = trimSpecialChar(path);\n      return normalizedPath.includes(rolePath);\n    }\n\n    return false;\n  }\n\n  protected isListRequest(methode: HttpMethod, path: string): boolean {\n    const basePath = trimSpecialChar(this.config.BASE_PATH);\n\n    const allowedPaths = [\n      basePath,\n      `${basePath}/search`,\n      `${basePath}/scan`,\n      `${basePath}/search/query`,\n      `${basePath}/search/query/total-count`,\n    ];\n\n    const isMethodGet = methode === \"GET\";\n    const isAllowedPath = allowedPaths.includes(trimSpecialChar(path));\n\n    return isMethodGet && isAllowedPath;\n  }\n\n  protected isUpdateRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodPatch = methode === \"PATCH\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodPatch && isExpectedPath;\n  }\n\n  protected isDeleteRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodDelete = methode === \"DELETE\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodDelete && isExpectedPath;\n  }\n\n  protected isFetchRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodGet = methode === \"GET\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  protected isPostRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}`;\n    const isMethodGet = methode === \"POST\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  protected isPutRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodGet = methode === \"PUT\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  private async handleCrudByMethod(req: HttpRequest): Promise<any> {\n    const path = req.event?.requestContext?.resourcePath;\n\n    const entity = this.parseEntity(req.body);\n\n    if (this.isPermissionRequest(path)) return this.handlePermission(req, path);\n    if (this.isUpdateRequest(req.methode, path)) return this.handleUpdate(req.entityId, entity, req.identity);\n    if (this.isDeleteRequest(req.methode, path)) return this.handleDelete(req.entityId, req.identity);\n    if (this.isFetchRequest(req.methode, path)) return this.handleFetch(req.entityId, req.identity);\n    if (this.isPutRequest(req.methode, path)) return this.handleReplace(req.entityId, entity, req.identity);\n    if (this.isPostRequest(req.methode, path)) return this.handlePostCreate(entity, req.identity);\n    if (this.isListRequest(req.methode, path)) return this.handleList(req.methode, path, req);\n\n    return null;\n  }\n\n  private filterResponse(response: any, responsePolicy: ResponseFields): any {\n    if (Array.isArray(response)) {\n      return removeFields(response, responsePolicy.include, responsePolicy.exclude);\n    }\n\n    if (response?.items && Array.isArray(response.items)) {\n      response.items = removeFields(response.items, responsePolicy.include, responsePolicy.exclude);\n      return response;\n    }\n\n    return removeFields([response], responsePolicy.include, responsePolicy.exclude)[0];\n  }\n\n  /** Map RequestType to Access for permission checking  */\n  private getUserAccessLevel(requestType: RequestType): Access {\n    switch (requestType) {\n      case RequestType.ADMIN:\n        return Access.ADMIN;\n      case RequestType.USER:\n        return Access.USER;\n      case RequestType.GUEST:\n        return Access.PUBLIC;\n      case RequestType.SYSTEM:\n        return Access.SYSTEM;\n      default:\n        return Access.PUBLIC;\n    }\n  }\n\n  /** Check if the user has permission for the current operation */\n  private checkPermission(allowedAccess: Access[], requestType: RequestType) {\n    const currentAccessLevel = this.getUserAccessLevel(requestType);\n\n    // This means USER can access OWNER-level permissions, but the service will verify actual ownership\n    const hasPermission =\n      allowedAccess.includes(currentAccessLevel) ||\n      (requestType === RequestType.USER && allowedAccess.includes(Access.OWNER));\n\n    if (hasPermission) return;\n\n    throw new ErrorHttp(\n      { code: 403, error: \"PermissionDenied\" },\n      `Access denied. Required: ${allowedAccess.join(\", \")}, Current: ${currentAccessLevel}`,\n    );\n  }\n\n  private setUserFilter(request: any, isAdmin: boolean, profileId: string) {\n    if (isAdmin && !profileId) return;\n    const ownerIdFieldName = this.config.OWNER_ID_FIELD_NAME || \"ownerId\";\n    request.filterAndSort[ownerIdFieldName] = profileId;\n    return request.filterAndSort;\n  }\n\n  private parseEntity(requestBody: any): R {\n    if (!requestBody) return {} as R;\n    return typeof requestBody === \"string\" ? JSON.parse(requestBody) : requestBody;\n  }\n\n  private validateRequest(schema: any, requestBody: any) {\n    if (!schema) return;\n\n    try {\n      validateWithSchema(schema, requestBody);\n    } catch (error) {\n      const formattedErrors = formatErrors(error);\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, formattedErrors);\n    }\n  }\n}\n"]}
+{"version":3,"file":"controller-api.js","sourceRoot":"","sources":["../../src/controller/controller-api.ts"],"names":[],"mappings":";;;AAAA,oCAgBkB;AAElB,4CAA2D;AAE3D,sDAAuD;AAEvD,uDAAmD;AAEnD,MAAsB,aAAa;IACd,OAAO,CAAI;IACpB,MAAM,CAAe;IACrB,eAAe,CAAW;IAE5B,cAAc,CAAiB;IAEvC,YAAsB,WAAc,EAAE,MAAoB;QACxD,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAE3B,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACjD,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,CAAC,cAAc,GAAG,IAAI,gCAAc,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,+CAA+C;IACrC,WAAW;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA2B;QAClD,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,IAAA,wBAAgB,EAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAExD,MAAM,MAAM,GAA+B,IAAA,yBAAiB,EAC1D,GAAG,CAAC,OAAO,EACX,KAAK,EAAE,cAAc,EAAE,YAAY,EACnC,IAAI,CAAC,MAAM,CAAC,eAAe,CAC5B,CAAC;YAEF,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAChG,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACxD,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAElD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACrE,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC7D,GAAG,CAAC,KAAK,CACP,UAAU,GAAG,CAAC,QAAQ,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,OAAO,YAAY,GAAG,CAAC,QAAQ,CAAC,GAAG,eAAe,GAAG,CAAC,QAAQ,CAAC,OAAO,cAAc,GAAG,CAAC,QAAQ,CAAC,QAAQ,iBAAiB,GAAG,CAAC,WAAW,EAAE,CACnM,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,yCAAyC;YACzC,6CAA6C;YAC7C,SAAS;YAET,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAE5C,IAAI,QAAQ,GAAQ,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAEvD,IAAI,QAAQ;gBAAE,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;;gBACrE,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;YAEvE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;gBACtB,OAAO,IAAA,yBAAiB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAExE,OAAO,IAAA,yBAAiB,EAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,IAAA,4BAAgB,EAAC,GAAG,CAAC,CAAC;YACpC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,IAAA,yBAAiB,EAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,SAAS,CAAC,MAAoB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAgB;QAC1C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAoB,EAAE,QAAqB;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,UAAU,CAAC,OAAmB,EAAE,IAAY,EAAE,OAAoB;QAChF,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1F,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,eAAe,EAAE,CAAC;YAC5G,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,CAAC;QAED,IACE,OAAO,KAAK,KAAK;YACjB,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,2BAA2B,EAC9F,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,IAAI,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,EAAE,CAAC;YACpG,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,GAAgB,EAAE,IAAY;QAC7D,IACE,GAAG,CAAC,OAAO,KAAK,MAAM;YACtB,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,YAAY;YAE9F,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAChC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EACtC,GAAG,CAAC,IAAI,CAAC,SAAS,EAClB,GAAG,CAAC,IAAI,CAAC,WAAW,CACrB,CAAC;QAEJ,IACE,GAAG,CAAC,OAAO,KAAK,MAAM;YACtB,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,iBAAiB;YAEnG,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CACnC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,EACtC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EACrB,GAAG,CAAC,IAAI,CAAC,SAAS,CACnB,CAAC;QAEJ,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QACxE,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACjG,IAAI,GAAG,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExF,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACvF,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,WAAgB,EAAE,aAA2B;QAC1F,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7C,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC;QAEnE,yBAAyB;QACzB,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,aAA2B;QACxE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,gDAAgD,CAAC,CAAC;QAE5G,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAES,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,aAA2B;QACvE,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,+CAA+C,CAAC,CAAC;QAE3G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEpE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,2BAA2B,QAAQ,YAAY,CAAC,CAAC;IACzG,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAW,EAAE,aAA2B;QACtF,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,6CAA6C,CAAC,CAAC;QAEzG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,0CAA0C,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,6CAA6C,CAAC,CAAC;QACzG,CAAC;QAED,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC;QAErB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAS,EAAE,WAAwB;QAClE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC/F,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,4BAA4B,CAAC,CAAC;QACxF,CAAC;QAED,iBAAiB;QACjB,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;QACzD,IAAI,SAAS,GAAG,OAAO,CAAC;QACxB,IAAI,QAAgB,CAAC;QAErB,mCAAmC;QACnC,IAAI,WAAW,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;YACzC,QAAQ,GAAG,aAAa,CAAC;QAC3B,CAAC;aAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAExC,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE1F,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;YAChC,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC;QAClC,CAAC;QAED,iDAAiD;QACjD,OAAO,MAAM,CAAC,aAAa,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,CAAC;QAEtB,cAAc;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC;IAIS,mBAAmB,CAAC,IAAY;QACxC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtE,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAES,aAAa,CAAC,OAAmB,EAAE,IAAY;QACvD,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,YAAY,GAAG;YACnB,QAAQ;YACR,GAAG,QAAQ,SAAS;YACpB,GAAG,QAAQ,OAAO;YAClB,GAAG,QAAQ,eAAe;YAC1B,GAAG,QAAQ,2BAA2B;SACvC,CAAC;QAEF,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC,CAAC;QAEnE,OAAO,WAAW,IAAI,aAAa,CAAC;IACtC,CAAC;IAES,eAAe,CAAC,OAAmB,EAAE,IAAY;QACzD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,aAAa,GAAG,OAAO,KAAK,OAAO,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,aAAa,IAAI,cAAc,CAAC;IACzC,CAAC;IAES,eAAe,CAAC,OAAmB,EAAE,IAAY;QACzD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,cAAc,GAAG,OAAO,KAAK,QAAQ,CAAC;QAC5C,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,cAAc,IAAI,cAAc,CAAC;IAC1C,CAAC;IAES,cAAc,CAAC,OAAmB,EAAE,IAAY;QACxD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAES,aAAa,CAAC,OAAmB,EAAE,IAAY;QACvD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,KAAK,MAAM,CAAC;QACvC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAES,YAAY,CAAC,OAAmB,EAAE,IAAY;QACtD,MAAM,YAAY,GAAG,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACtE,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,CAAC;QACtC,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC;QAE9D,OAAO,WAAW,IAAI,cAAc,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAgB;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,QAAa,EAAE,cAA8B;QAClE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAA,oBAAY,EAAC,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,QAAQ,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,KAAK,GAAG,IAAA,oBAAY,EAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9F,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,IAAA,oBAAY,EAAC,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,yDAAyD;IACjD,kBAAkB,CAAC,WAAwB;QACjD,QAAQ,WAAW,EAAE,CAAC;YACpB,KAAK,mBAAW,CAAC,KAAK;gBACpB,OAAO,cAAM,CAAC,KAAK,CAAC;YACtB,KAAK,mBAAW,CAAC,IAAI;gBACnB,OAAO,cAAM,CAAC,IAAI,CAAC;YACrB,KAAK,mBAAW,CAAC,KAAK;gBACpB,OAAO,cAAM,CAAC,MAAM,CAAC;YACvB,KAAK,mBAAW,CAAC,MAAM;gBACrB,OAAO,cAAM,CAAC,MAAM,CAAC;YACvB;gBACE,OAAO,cAAM,CAAC,MAAM,CAAC;QACzB,CAAC;IACH,CAAC;IAED,iEAAiE;IACzD,eAAe,CAAC,aAAuB,EAAE,WAAwB;QACvE,MAAM,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAEhE,mGAAmG;QACnG,MAAM,aAAa,GACjB,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC1C,CAAC,WAAW,KAAK,mBAAW,CAAC,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,cAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAE7E,IAAI,aAAa;YAAE,OAAO;QAE1B,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,EAAE,CACvF,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,OAAY,EAAE,OAAgB,EAAE,SAAiB;QACrE,IAAI,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;QACtE,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACpD,OAAO,OAAO,CAAC,aAAa,CAAC;IAC/B,CAAC;IAEO,WAAW,CAAC,WAAgB;QAClC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAO,CAAC;QACjC,OAAO,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACjF,CAAC;IAEO,eAAe,CAAC,MAAW,EAAE,WAAgB;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,IAAI,CAAC;YACH,IAAA,0BAAkB,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,IAAA,oBAAY,EAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF;AA3YD,sCA2YC","sourcesContent":["import {\n  Access,\n  APIResponse,\n  BaseEntity,\n  createApiResponse,\n  EndpointPolicy,\n  findMatchedPolicy,\n  formatErrors,\n  HttpMethod,\n  HttpRequest,\n  List,\n  parseHttpRequest,\n  removeFields,\n  RequestType,\n  ResponseFields,\n  validateWithSchema,\n} from \"../index\";\nimport { APIGatewayProxyEvent } from \"aws-lambda\";\nimport { errorHandlerHttp, ErrorHttp } from \"../exception\";\nimport { CognitoUser, EntityConfig } from \"@chinggis/types\";\nimport { trimSpecialChar } from \"../utils/string.util\";\nimport { CrudService } from \"../service\";\nimport { ControllerRole } from \"./controller-role\";\n\nexport abstract class ControllerApi<R extends BaseEntity, T extends CrudService<R>> {\n  protected readonly service: T;\n  protected config: EntityConfig;\n  protected adminGroupNames: string[];\n\n  private roleController: ControllerRole;\n\n  protected constructor(baseService: T, config: EntityConfig) {\n    this.service = baseService;\n\n    if (!config) return;\n\n    this.config = config;\n\n    if (config.ADMIN_GROUP_NAME) {\n      this.adminGroupNames = config.ADMIN_GROUP_NAME;\n    }\n\n    if (config.PERMISSION_MAP) {\n      this.roleController = new ControllerRole(config.PERMISSION_MAP.roleTable);\n    }\n\n    this.service.setConfig(config);\n  }\n\n  /** Return constructor-defined resource name */\n  protected getResource(): string {\n    return this.config.BASE_PATH.replace(\"/\", \"\");\n  }\n\n  async resolveCrudRequest(event: APIGatewayProxyEvent): Promise<APIResponse> {\n    try {\n      let req = parseHttpRequest(event, this.adminGroupNames);\n\n      const policy: EndpointPolicy | undefined = findMatchedPolicy(\n        req.methode,\n        event?.requestContext?.resourcePath,\n        this.config.ENDPOINT_POLICY,\n      );\n\n      if (this.config.PERMISSION_MAP && this.roleController) {\n        const resource = this.getResource();\n        await this.roleController.checkRbacAccess(req, resource, this.config.PERMISSION_MAP.scopeMap);\n      } else {\n        this.checkPermission(policy?.access, req.requestType);\n      }\n\n      this.validateRequest(policy?.validator, req.body);\n\n      if (req.identity) {\n        log.debug(\"groups: \" + JSON.stringify(req.identity.groups, null, 2));\n        log.debug(`claims:${JSON.stringify(req.identity, null, 2)}`);\n        log.debug(\n          `groups:${req.identity.groups}, isAdmin:${req.identity.isAdmin}, userId:${req.identity.sub}, profileId:${req.identity.profile}, username:${req.identity.username}, requestType:${req.requestType}`,\n        );\n      }\n\n      //      if (req.isAdmin) {\n      //        delete req.filter[\"profileId\"];\n      //        delete req.filter[\"ownerParentId\"];\n      //      }\n\n      req = await this.processCrudRequestPre(req);\n\n      let response: any = await this.handleCrudByMethod(req);\n\n      if (response) response = await this.processCrudRequestPost(req, response);\n      else response = await this.processCrudRequest(req); // Custom Endpoints\n\n      if (!policy?.response) {\n        return createApiResponse(200, response);\n      }\n\n      const filteredResponse = this.filterResponse(response, policy.response);\n\n      return createApiResponse(200, filteredResponse);\n    } catch (err) {\n      const error = errorHandlerHttp(err);\n      log.error(error);\n      return createApiResponse(error.statusCode, error.content);\n    }\n  }\n\n  setConfig(config: EntityConfig): void {\n    this.config = config;\n  }\n\n  async processCrudRequestPre(req: HttpRequest): Promise<HttpRequest> {\n    return req;\n  }\n\n  async processCrudRequestPost(request: HttpRequest, response: R | List<R>): Promise<R | List<R>> {\n    return response;\n  }\n\n  protected async handleList(methode: HttpMethod, path: string, request: HttpRequest): Promise<any> {\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH)) {\n      return await this.service.find(request?.filter || {});\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search\") {\n      return this.service.search(request?.filter || {});\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search/query\") {\n      return this.service.searchQuery(request?.filter);\n    }\n\n    if (\n      methode === \"GET\" &&\n      trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/search/query/total-count\"\n    ) {\n      return this.service.searchQueryTotalCount(request?.filter);\n    }\n\n    if (methode === \"GET\" && trimSpecialChar(path) === trimSpecialChar(this.config.BASE_PATH) + \"/scan\") {\n      return await this.service.scan(request?.filter || {});\n    }\n  }\n\n  protected async handlePermission(req: HttpRequest, path: string) {\n    if (\n      req.methode === \"POST\" &&\n      trimSpecialChar(path) === trimSpecialChar(this.config.PERMISSION_MAP?.rolePath) + \"/add-group\"\n    )\n      return this.roleController.addRole(\n        this.config.PERMISSION_MAP?.userPoolId,\n        req.body.groupName,\n        req.body.description,\n      );\n\n    if (\n      req.methode === \"POST\" &&\n      trimSpecialChar(path) === trimSpecialChar(this.config.PERMISSION_MAP?.rolePath) + \"/add-user-group\"\n    )\n      return this.roleController.assignRole(\n        this.config.PERMISSION_MAP?.userPoolId,\n        req.identity.username,\n        req.body.groupName,\n      );\n\n    if (req.methode === \"GET\") return this.roleController.listPermissions();\n    if (req.methode === \"POST\") return this.roleController.addPermission(req.body);\n    if (req.methode === \"PATCH\") return this.roleController.updatePermission(req.entityId, req.body);\n    if (req.methode === \"DELETE\") return this.roleController.deletePermission(req.entityId);\n\n    throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] unsupported method\");\n  }\n\n  protected async handleUpdate(entityId: string, requestBody: any, requestedUser?: CognitoUser): Promise<R> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PATCH resource without id field\");\n\n    const entity = this.parseEntity(requestBody);\n\n    if (Object.keys(entity).length === 0) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No fields to update\");\n    }\n\n    const fieldName = this.config.DYNAMO_DB?.MAP?.partitionKey ?? \"id\";\n\n    // id change is forbidden\n    if (entity[fieldName]) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot modify the id field\");\n    }\n\n    entity[fieldName] = entityId;\n    return this.service.update(entity, requestedUser);\n  }\n\n  protected async handleDelete(entityId: string, requestedUser?: CognitoUser): Promise<boolean> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot delete resource without id field\");\n\n    return this.service.remove(entityId, requestedUser);\n  }\n\n  protected async handleFetch(entityId: string, requestedUser?: CognitoUser): Promise<R> {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot fetch resource without id field\");\n\n    const result = await this.service.findById(entityId, requestedUser);\n\n    if (result) return result;\n\n    throw new ErrorHttp({ code: 404, error: \"NotFound\" }, `[CORE] Resource with ID ${entityId} not found`);\n  }\n\n  protected async handleReplace(entityId: string, entity: any, requestedUser?: CognitoUser) {\n    if (!entityId)\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PUT resource without id field\");\n\n    if (!Object.keys(entity).length) {\n      throw new ErrorHttp({ code: 400, error: \"Bad Request\" }, \"[CORE] No entity provided for PUT update\");\n    }\n\n    if (!entityId) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] Cannot PUT resource without id field\");\n    }\n\n    entity.id = entityId;\n\n    return this.service.update(entity, requestedUser);\n  }\n\n  protected async handlePostCreate(entity: R, cognitoUser: CognitoUser) {\n    if (!entity || Object.keys(entity).length === 0) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No entity payload provided\");\n    }\n\n    if (!entity.ownerId) {\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] No ownerId provided\");\n    }\n\n    // Initialize IDs\n    const { ownerId, ownerParentId: inputParentId } = entity;\n    let profileId = ownerId;\n    let parentId: string;\n\n    // Determine parentId and profileId\n    if (cognitoUser.isAdmin && inputParentId) {\n      parentId = inputParentId;\n    } else if (cognitoUser.isParent) {\n      console.log(\"is parent becomming true\");\n\n      parentId = cognitoUser.profile;\n    } else {\n      console.log(\"is parent not becomming true\");\n      console.log(\"the value of isParent: \", cognitoUser.isParent, typeof cognitoUser.isParent);\n\n      parentId = cognitoUser.parentId;\n      profileId = cognitoUser.profile;\n    }\n\n    // Remove fields that shouldn't be saved directly\n    delete entity.ownerParentId;\n    delete entity.ownerId;\n\n    // Save entity\n    return this.service.save(entity, profileId, parentId, cognitoUser);\n  }\n\n  protected abstract processCrudRequest(event: HttpRequest): Promise<any>;\n\n  protected isPermissionRequest(path: string): boolean {\n    if (this.config.PERMISSION_MAP && this.roleController) {\n      const rolePath = trimSpecialChar(this.config.PERMISSION_MAP.rolePath);\n      const normalizedPath = trimSpecialChar(path);\n      return normalizedPath.includes(rolePath);\n    }\n\n    return false;\n  }\n\n  protected isListRequest(methode: HttpMethod, path: string): boolean {\n    const basePath = trimSpecialChar(this.config.BASE_PATH);\n\n    const allowedPaths = [\n      basePath,\n      `${basePath}/search`,\n      `${basePath}/scan`,\n      `${basePath}/search/query`,\n      `${basePath}/search/query/total-count`,\n    ];\n\n    const isMethodGet = methode === \"GET\";\n    const isAllowedPath = allowedPaths.includes(trimSpecialChar(path));\n\n    return isMethodGet && isAllowedPath;\n  }\n\n  protected isUpdateRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodPatch = methode === \"PATCH\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodPatch && isExpectedPath;\n  }\n\n  protected isDeleteRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodDelete = methode === \"DELETE\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodDelete && isExpectedPath;\n  }\n\n  protected isFetchRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodGet = methode === \"GET\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  protected isPostRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}`;\n    const isMethodGet = methode === \"POST\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  protected isPutRequest(methode: HttpMethod, path: string): boolean {\n    const expectedPath = `${trimSpecialChar(this.config.BASE_PATH)}/{id}`;\n    const isMethodGet = methode === \"PUT\";\n    const isExpectedPath = trimSpecialChar(path) === expectedPath;\n\n    return isMethodGet && isExpectedPath;\n  }\n\n  private async handleCrudByMethod(req: HttpRequest): Promise<any> {\n    const path = req.event?.requestContext?.resourcePath;\n\n    const entity = this.parseEntity(req.body);\n\n    if (this.isPermissionRequest(path)) return this.handlePermission(req, path);\n    if (this.isUpdateRequest(req.methode, path)) return this.handleUpdate(req.entityId, entity, req.identity);\n    if (this.isDeleteRequest(req.methode, path)) return this.handleDelete(req.entityId, req.identity);\n    if (this.isFetchRequest(req.methode, path)) return this.handleFetch(req.entityId, req.identity);\n    if (this.isPutRequest(req.methode, path)) return this.handleReplace(req.entityId, entity, req.identity);\n    if (this.isPostRequest(req.methode, path)) return this.handlePostCreate(entity, req.identity);\n    if (this.isListRequest(req.methode, path)) return this.handleList(req.methode, path, req);\n\n    return null;\n  }\n\n  private filterResponse(response: any, responsePolicy: ResponseFields): any {\n    if (Array.isArray(response)) {\n      return removeFields(response, responsePolicy.include, responsePolicy.exclude);\n    }\n\n    if (response?.items && Array.isArray(response.items)) {\n      response.items = removeFields(response.items, responsePolicy.include, responsePolicy.exclude);\n      return response;\n    }\n\n    return removeFields([response], responsePolicy.include, responsePolicy.exclude)[0];\n  }\n\n  /** Map RequestType to Access for permission checking  */\n  private getUserAccessLevel(requestType: RequestType): Access {\n    switch (requestType) {\n      case RequestType.ADMIN:\n        return Access.ADMIN;\n      case RequestType.USER:\n        return Access.USER;\n      case RequestType.GUEST:\n        return Access.PUBLIC;\n      case RequestType.SYSTEM:\n        return Access.SYSTEM;\n      default:\n        return Access.PUBLIC;\n    }\n  }\n\n  /** Check if the user has permission for the current operation */\n  private checkPermission(allowedAccess: Access[], requestType: RequestType) {\n    const currentAccessLevel = this.getUserAccessLevel(requestType);\n\n    // This means USER can access OWNER-level permissions, but the service will verify actual ownership\n    const hasPermission =\n      allowedAccess.includes(currentAccessLevel) ||\n      (requestType === RequestType.USER && allowedAccess.includes(Access.OWNER));\n\n    if (hasPermission) return;\n\n    throw new ErrorHttp(\n      { code: 403, error: \"PermissionDenied\" },\n      `Access denied. Required: ${allowedAccess.join(\", \")}, Current: ${currentAccessLevel}`,\n    );\n  }\n\n  private setUserFilter(request: any, isAdmin: boolean, profileId: string) {\n    if (isAdmin && !profileId) return;\n    const ownerIdFieldName = this.config.OWNER_ID_FIELD_NAME || \"ownerId\";\n    request.filterAndSort[ownerIdFieldName] = profileId;\n    return request.filterAndSort;\n  }\n\n  private parseEntity(requestBody: any): R {\n    if (!requestBody) return {} as R;\n    return typeof requestBody === \"string\" ? JSON.parse(requestBody) : requestBody;\n  }\n\n  private validateRequest(schema: any, requestBody: any) {\n    if (!schema) return;\n\n    try {\n      validateWithSchema(schema, requestBody);\n    } catch (error) {\n      const formattedErrors = formatErrors(error);\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, formattedErrors);\n    }\n  }\n}\n"]}

package/dist/controller/controller-role.js

@@ -72,16 +72,16 @@ class ControllerRole {
         const role = this.extractRole(req);
         const scope = this.resolveScope(req, scopeMap);
         const method = req.methode.toUpperCase();
-        if (role && scope) {
+        if (role) {
             const allowed = await this.permissionService.hasPermission(role, resource, scope, method);
             if (!allowed) {
                 const key = `${role}#${resource}#${scope}`;
-                throw new exception_1.ErrorHttp({ code: 403, error: "PermissionDenied" }, `Permission denied: role="${role}" lacks "${key}.${method}"`);
+                throw new exception_1.ErrorHttp({ code: 403, error: "PermissionDenied" }, `Permission denied: role=${role} "${key}.${method}"`);
             }
             this.applyScopeFilter(req, scope, scopeMap);
         }
         else {
-            this.removeScopeFilter(req, scopeMap);
+            throw new exception_1.ErrorHttp({ code: 403, error: "PermissionDenied" }, `Permission denied: Role Not Found " `);
         }
     }
     // ---------------------------------------------------------------------------
@@ -93,11 +93,9 @@ class ControllerRole {
     }
     /** Resolve and validate the scope query param against the ScopeMap. */
     resolveScope(req, scopeMap) {
-        if (!scopeMap?.size)
-            return undefined;
         const scope = req.queryStringParameters?.scope || req.customQueryParameters?.scope;
         if (!scope)
-            return undefined;
+            return scopeMap.keys().next().value;
         if (!scopeMap.has(scope)) {
             const allowed = Array.from(scopeMap.keys()).join(", ");
             throw new exception_1.ErrorHttp({ code: 400, error: "BadRequest" }, `Invalid scope "${scope}". Allowed: ${allowed}`);

package/dist/controller/controller-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-role.js","sourceRoot":"","sources":["../../src/controller/controller-role.ts"],"names":[],"mappings":";;;AAAA,4CAAyC;AAIzC,sEAAkE;AAClE,iDAAkE;AAElE;;;;;;;GAOG;AACH,MAAa,cAAc;IACN,iBAAiB,CAAoB;IAExD,YAAY,aAAqB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,sCAAiB,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,OAAO;IACP,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAKnB;QACC,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,OAA4E;QAE5E,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB,EAAE,WAAoB;QACvE,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACtE,OAAO,IAAA,wBAAc,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAc;QAC/E,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,GAAgB,EAAE,QAAgB,EAAE,QAAkB;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAE1F,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,4BAA4B,IAAI,YAAY,GAAG,IAAI,MAAM,GAAG,CAC7D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAE9E,yCAAyC;IACjC,WAAW,CAAC,GAAgB;QAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,uEAAuE;IAC/D,YAAY,CAAC,GAAgB,EAAE,QAAkB;QACvD,IAAI,CAAC,QAAQ,EAAE,IAAI;YAAE,OAAO,SAAS,CAAC;QAEtC,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC;QACnF,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,kBAAkB,KAAK,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAgB,EAAE,KAAa,EAAE,QAAkB;QAC1E,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,KAAK,CAAC;QACvD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAC3B,CAAC;IAED,+FAA+F;IACvF,iBAAiB,CAAC,GAAgB,EAAE,QAAkB;QAC5D,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AA/JD,wCA+JC","sourcesContent":["import { ErrorHttp } from \"../exception\";\nimport { Permission } from \"../model/role.model\";\nimport { ScopeMap } from \"../model/base.model\";\nimport { HttpRequest } from \"../utils/http/http.util\";\nimport { PermissionService } from \"../service/permission.service\";\nimport { createGroup, addUserToGroup } from \"../function/cognito\";\n\n/**\n * ControllerRole — centralized Permission CRUD + RBAC access enforcement.\n *\n * All caching and DB orchestration lives in PermissionService.\n *\n * Scope validation, scope filtering, and permission checks are centralized here\n * so that ControllerApi (and any other consumer) delegates without duplicating logic.\n */\nexport class ControllerRole {\n  protected readonly permissionService: PermissionService;\n\n  constructor(roleTableName: string) {\n    this.permissionService = new PermissionService(roleTableName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // CRUD\n  // ---------------------------------------------------------------------------\n\n  async addPermission(input: {\n    role: string;\n    resource: string;\n    scope: string;\n    method: Permission[\"method\"];\n  }): Promise<Permission> {\n    return this.permissionService.createPermission(input);\n  }\n\n  async updatePermission(\n    id: string,\n    updates: Partial<Pick<Permission, \"role\" | \"resource\" | \"scope\" | \"method\">>,\n  ): Promise<Permission> {\n    return this.permissionService.updatePermission(id, updates);\n  }\n\n  async deletePermission(id: string): Promise<boolean> {\n    return this.permissionService.deletePermission(id);\n  }\n\n  async getPermission(id: string): Promise<Permission | null> {\n    if (!id) throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"Permission id is required\");\n    return this.permissionService.getPermissionById(id);\n  }\n\n  async listPermissions(): Promise<Permission[]> {\n    return this.permissionService.listPermissions();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Role (Cognito group)\n  // ---------------------------------------------------------------------------\n\n  async addRole(userPoolId: string, groupName: string, description?: string) {\n    return createGroup(userPoolId, groupName, description);\n  }\n\n  async assignRole(userPoolId: string, username: string, groupName: string): Promise<void> {\n    return addUserToGroup(userPoolId, username, groupName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission check\n  // ---------------------------------------------------------------------------\n\n  async hasPermission(role: string, resource: string, scope: string, method: string): Promise<boolean> {\n    return this.permissionService.hasPermission(role, resource, scope, method);\n  }\n\n  async getPermissionByKey(permissionKey: string): Promise<Permission | null> {\n    return this.permissionService.getPermissionByKey(permissionKey);\n  }\n\n  // ---------------------------------------------------------------------------\n  // RBAC access enforcement (used by ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Centralized RBAC check: validates scope, checks permission via DB, applies scope filter.\n   *\n   * Only runs when both `role` and `scope` are present in the request.\n   * When either is absent, scope filters are cleared to block user injection.\n   *\n   * @param req       The parsed HTTP request\n   * @param resource  The resource name (e.g. \"property\")\n   * @param scopeMap  The scope configuration from EntityConfig\n   */\n  async checkRbacAccess(req: HttpRequest, resource: string, scopeMap: ScopeMap): Promise<void> {\n    const role = this.extractRole(req);\n    const scope = this.resolveScope(req, scopeMap);\n    const method = req.methode.toUpperCase();\n\n    if (role && scope) {\n      const allowed = await this.permissionService.hasPermission(role, resource, scope, method);\n\n      if (!allowed) {\n        const key = `${role}#${resource}#${scope}`;\n        throw new ErrorHttp(\n          { code: 403, error: \"PermissionDenied\" },\n          `Permission denied: role=\"${role}\" lacks \"${key}.${method}\"`,\n        );\n      }\n\n      this.applyScopeFilter(req, scope, scopeMap);\n    } else {\n      this.removeScopeFilter(req, scopeMap);\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Scope helpers (private — single source of truth)\n  // ---------------------------------------------------------------------------\n\n  /** Extract user role from JWT groups. */\n  private extractRole(req: HttpRequest): string | undefined {\n    return req.identity?.groups?.[0];\n  }\n\n  /** Resolve and validate the scope query param against the ScopeMap. */\n  private resolveScope(req: HttpRequest, scopeMap: ScopeMap): string | undefined {\n    if (!scopeMap?.size) return undefined;\n\n    const scope = req.queryStringParameters?.scope || req.customQueryParameters?.scope;\n    if (!scope) return undefined;\n\n    if (!scopeMap.has(scope)) {\n      const allowed = Array.from(scopeMap.keys()).join(\", \");\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, `Invalid scope \"${scope}\". Allowed: ${allowed}`);\n    }\n\n    return scope;\n  }\n\n  /**\n   * Apply scope-based data filter from identity claims.\n   * Clears ALL scope-controlled filter fields first (block injection),\n   * then sets only the matched scope's claim value.\n   */\n  private applyScopeFilter(req: HttpRequest, scope: string, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n\n    const mapping = scopeMap.get(scope);\n    if (!mapping) return;\n\n    const claimKey = mapping.claimKey ?? \"custom:\" + scope;\n    const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey];\n\n    if (!claimValue) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, `Missing claim \"${claimKey}\" for scope \"${scope}\"`);\n    }\n\n    req.filter[mapping.filterField] = claimValue;\n    delete req.filter?.scope;\n  }\n\n  /** Clear all scope-controlled filter fields — prevents user injection when no RBAC applies. */\n  private removeScopeFilter(req: HttpRequest, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n    delete req.filter[\"scope\"];\n  }\n}\n"]}
+{"version":3,"file":"controller-role.js","sourceRoot":"","sources":["../../src/controller/controller-role.ts"],"names":[],"mappings":";;;AAAA,4CAAyC;AAIzC,sEAAkE;AAClE,iDAAkE;AAElE;;;;;;;GAOG;AACH,MAAa,cAAc;IACN,iBAAiB,CAAoB;IAExD,YAAY,aAAqB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,sCAAiB,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,OAAO;IACP,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAKnB;QACC,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,OAA4E;QAE5E,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB,EAAE,WAAoB;QACvE,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACtE,OAAO,IAAA,wBAAc,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAc;QAC/E,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E;;;;;;;;;OASG;IACH,KAAK,CAAC,eAAe,CAAC,GAAgB,EAAE,QAAgB,EAAE,QAAkB;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAE1F,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,2BAA2B,IAAI,KAAK,GAAG,IAAI,MAAM,GAAG,CACrD,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,sCAAsC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,mDAAmD;IACnD,8EAA8E;IAE9E,yCAAyC;IACjC,WAAW,CAAC,GAAgB;QAClC,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,uEAAuE;IAC/D,YAAY,CAAC,GAAgB,EAAE,QAAkB;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC;QAEnF,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;QAEjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,kBAAkB,KAAK,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAgB,EAAE,KAAa,EAAE,QAAkB;QAC1E,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,KAAK,CAAC;QACvD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAC3B,CAAC;IAED,+FAA+F;IACvF,iBAAiB,CAAC,GAAgB,EAAE,QAAkB;QAC5D,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AA9JD,wCA8JC","sourcesContent":["import { ErrorHttp } from \"../exception\";\nimport { Permission } from \"../model/role.model\";\nimport { ScopeMap } from \"../model/base.model\";\nimport { HttpRequest } from \"../utils/http/http.util\";\nimport { PermissionService } from \"../service/permission.service\";\nimport { createGroup, addUserToGroup } from \"../function/cognito\";\n\n/**\n * ControllerRole — centralized Permission CRUD + RBAC access enforcement.\n *\n * All caching and DB orchestration lives in PermissionService.\n *\n * Scope validation, scope filtering, and permission checks are centralized here\n * so that ControllerApi (and any other consumer) delegates without duplicating logic.\n */\nexport class ControllerRole {\n  protected readonly permissionService: PermissionService;\n\n  constructor(roleTableName: string) {\n    this.permissionService = new PermissionService(roleTableName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // CRUD\n  // ---------------------------------------------------------------------------\n\n  async addPermission(input: {\n    role: string;\n    resource: string;\n    scope: string;\n    method: Permission[\"method\"];\n  }): Promise<Permission> {\n    return this.permissionService.createPermission(input);\n  }\n\n  async updatePermission(\n    id: string,\n    updates: Partial<Pick<Permission, \"role\" | \"resource\" | \"scope\" | \"method\">>,\n  ): Promise<Permission> {\n    return this.permissionService.updatePermission(id, updates);\n  }\n\n  async deletePermission(id: string): Promise<boolean> {\n    return this.permissionService.deletePermission(id);\n  }\n\n  async getPermission(id: string): Promise<Permission | null> {\n    if (!id) throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"Permission id is required\");\n    return this.permissionService.getPermissionById(id);\n  }\n\n  async listPermissions(): Promise<Permission[]> {\n    return this.permissionService.listPermissions();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Role (Cognito group)\n  // ---------------------------------------------------------------------------\n\n  async addRole(userPoolId: string, groupName: string, description?: string) {\n    return createGroup(userPoolId, groupName, description);\n  }\n\n  async assignRole(userPoolId: string, username: string, groupName: string): Promise<void> {\n    return addUserToGroup(userPoolId, username, groupName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission check\n  // ---------------------------------------------------------------------------\n\n  async hasPermission(role: string, resource: string, scope: string, method: string): Promise<boolean> {\n    return this.permissionService.hasPermission(role, resource, scope, method);\n  }\n\n  async getPermissionByKey(permissionKey: string): Promise<Permission | null> {\n    return this.permissionService.getPermissionByKey(permissionKey);\n  }\n\n  // ---------------------------------------------------------------------------\n  // RBAC access enforcement (used by ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  /**\n   * Centralized RBAC check: validates scope, checks permission via DB, applies scope filter.\n   *\n   * Only runs when both `role` and `scope` are present in the request.\n   * When either is absent, scope filters are cleared to block user injection.\n   *\n   * @param req       The parsed HTTP request\n   * @param resource  The resource name (e.g. \"property\")\n   * @param scopeMap  The scope configuration from EntityConfig\n   */\n  async checkRbacAccess(req: HttpRequest, resource: string, scopeMap: ScopeMap): Promise<void> {\n    const role = this.extractRole(req);\n    const scope = this.resolveScope(req, scopeMap);\n    const method = req.methode.toUpperCase();\n\n    if (role) {\n      const allowed = await this.permissionService.hasPermission(role, resource, scope, method);\n\n      if (!allowed) {\n        const key = `${role}#${resource}#${scope}`;\n        throw new ErrorHttp(\n          { code: 403, error: \"PermissionDenied\" },\n          `Permission denied: role=${role} \"${key}.${method}\"`,\n        );\n      }\n\n      this.applyScopeFilter(req, scope, scopeMap);\n    } else {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, `Permission denied: Role Not Found \" `);\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Scope helpers (private — single source of truth)\n  // ---------------------------------------------------------------------------\n\n  /** Extract user role from JWT groups. */\n  private extractRole(req: HttpRequest): string | undefined {\n    return req.identity?.groups?.[0];\n  }\n\n  /** Resolve and validate the scope query param against the ScopeMap. */\n  private resolveScope(req: HttpRequest, scopeMap: ScopeMap): string {\n    const scope = req.queryStringParameters?.scope || req.customQueryParameters?.scope;\n\n    if (!scope) return scopeMap.keys().next().value!;\n\n    if (!scopeMap.has(scope)) {\n      const allowed = Array.from(scopeMap.keys()).join(\", \");\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, `Invalid scope \"${scope}\". Allowed: ${allowed}`);\n    }\n\n    return scope;\n  }\n\n  /**\n   * Apply scope-based data filter from identity claims.\n   * Clears ALL scope-controlled filter fields first (block injection),\n   * then sets only the matched scope's claim value.\n   */\n  private applyScopeFilter(req: HttpRequest, scope: string, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n\n    const mapping = scopeMap.get(scope);\n    if (!mapping) return;\n\n    const claimKey = mapping.claimKey ?? \"custom:\" + scope;\n    const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey];\n\n    if (!claimValue) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, `Missing claim \"${claimKey}\" for scope \"${scope}\"`);\n    }\n\n    req.filter[mapping.filterField] = claimValue;\n    delete req.filter?.scope;\n  }\n\n  /** Clear all scope-controlled filter fields — prevents user injection when no RBAC applies. */\n  private removeScopeFilter(req: HttpRequest, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n    delete req.filter[\"scope\"];\n  }\n}\n"]}

package/dist/model/base.config.d.ts

@@ -1,4 +1,4 @@
-import { DynamoIndexMap, EndpointPolicy, ScopeMap, TraceChange } from "../index.js";
+import { DynamoIndexMap, EndpointPolicy, PermissionMap, TraceChange } from "../index.js";
 /** Generic DynamoDB Configuration */
 export declare class DynamoDBConfig {
     NAME: string;
@@ -23,9 +23,7 @@ export interface EntityConfig {
     OWNER_PARENT_ID_FIELD_NAME?: string;
     OWNER_ID_FIELD_NAME?: string;
     TRACE_CHANGE?: TraceChange;
-    SCOPE_MAP?: ScopeMap;
-    ROLE_TABLE?: string;
-    ROLE_PATH?: string;
+    PERMISSION_MAP?: PermissionMap;
 }
 /** Generic Entity Configuration Class **/
 export declare class EntityConfigImpl implements EntityConfig {
@@ -35,9 +33,7 @@ export declare class EntityConfigImpl implements EntityConfig {
     ENDPOINT_POLICY: EndpointPolicy[];
     ADMIN_GROUP_NAME: string[];
     TRACE_CHANGE?: TraceChange;
-    SCOPE_MAP?: ScopeMap;
-    ROLE_TABLE?: string;
-    ROLE_PATH?: string;
+    PERMISSION_MAP?: PermissionMap;
     OWNER_PARENT_ID_FIELD_NAME?: string;
     OWNER_ID_FIELD_NAME: string;
     constructor(basePath: string, adminGroupName?: string[]);
@@ -46,11 +42,8 @@ export declare class EntityConfigImpl implements EntityConfig {
     setDynamoDB(tableName: string, ownerFieldName: string, indexMap: DynamoIndexMap, ownerParentFieldName?: string): this;
     /** Set OpenSearch configuration */
     setOpenSearch(domain: string, index: string): this;
-    /** Set scope map for RBAC scope-based filtering */
-    setScopes(scopeMap: ScopeMap): this;
-    /** Set the DynamoDB table name for RBAC role permissions */
-    setRoleTable(tableName: string): this;
-    setRolePath(path: string): this;
+    /** Set permission map for RBAC: scope filtering, role table, and role path */
+    setPermissionMap(permissionMap: PermissionMap): this;
     /** Set path-based policies */
     setPolicies(policies: EndpointPolicy[]): this;
     /** Get configuration as a plain object (for BaseController compatibility) */

package/dist/model/base.config.js

@@ -33,9 +33,7 @@ class EntityConfigImpl {
     ENDPOINT_POLICY; // Path-based permission configuration
     ADMIN_GROUP_NAME; // Admin group name for Cognito
     TRACE_CHANGE;
-    SCOPE_MAP;
-    ROLE_TABLE;
-    ROLE_PATH;
+    PERMISSION_MAP;
     OWNER_PARENT_ID_FIELD_NAME;
     OWNER_ID_FIELD_NAME;
     constructor(basePath, adminGroupName) {
@@ -58,18 +56,9 @@ class EntityConfigImpl {
         this.OPEN_SEARCH = new OpenSearchConfig(domain, index);
         return this;
     }
-    /** Set scope map for RBAC scope-based filtering */
-    setScopes(scopeMap) {
-        this.SCOPE_MAP = scopeMap;
-        return this;
-    }
-    /** Set the DynamoDB table name for RBAC role permissions */
-    setRoleTable(tableName) {
-        this.ROLE_TABLE = tableName;
-        return this;
-    }
-    setRolePath(path) {
-        this.ROLE_PATH = path;
+    /** Set permission map for RBAC: scope filtering, role table, and role path */
+    setPermissionMap(permissionMap) {
+        this.PERMISSION_MAP = permissionMap;
         return this;
     }
     /** Set path-based policies */
@@ -88,9 +77,7 @@ class EntityConfigImpl {
             ADMIN_GROUP_NAME: this.ADMIN_GROUP_NAME,
             OWNER_PARENT_ID_FIELD_NAME: this.OWNER_PARENT_ID_FIELD_NAME,
             OWNER_ID_FIELD_NAME: this.OWNER_ID_FIELD_NAME,
-            SCOPE_MAP: this.SCOPE_MAP,
-            ROLE_TABLE: this.ROLE_TABLE,
-            ROLE_PATH: this.ROLE_PATH,
+            PERMISSION_MAP: this.PERMISSION_MAP,
         };
     }
 }

package/dist/model/base.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.config.js","sourceRoot":"","sources":["../../src/model/base.config.ts"],"names":[],"mappings":";;;AAEA,qCAAqC;AACrC,MAAa,cAAc;IACzB,IAAI,CAAS,CAAC,sBAAsB;IACpC,uBAAuB,CAAU;IACjC,gBAAgB,CAAS,CAAC,iCAAiC;IAC3D,GAAG,CAAiB;IAEpB,YAAY,SAAiB,EAAE,cAAsB,EAAE,QAAwB,EAAE,eAAwB;QACvG,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,uBAAuB,GAAG,eAAe,CAAC;QAC/C,IAAI,CAAC,gBAAgB,GAAG,cAAc,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;IACtB,CAAC;CACF;AAZD,wCAYC;AAED,uCAAuC;AACvC,MAAa,gBAAgB;IAC3B,MAAM,CAAS;IACf,KAAK,CAAS;IAEd,YAAY,MAAc,EAAE,SAAiB;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF;AARD,4CAQC;AAiBD,0CAA0C;AAC1C,MAAa,gBAAgB;IAC3B,SAAS,CAAS,CAAC,uCAAuC;IAC1D,SAAS,CAAiB,CAAC,yBAAyB;IACpD,WAAW,CAAmB,CAAC,2BAA2B;IAC1D,eAAe,CAAmB,CAAC,sCAAsC;IACzE,gBAAgB,CAAW,CAAC,+BAA+B;IAE3D,YAAY,CAAe;IAC3B,SAAS,CAAY;IACrB,UAAU,CAAU;IACpB,SAAS,CAAU;IAEnB,0BAA0B,CAAU;IACpC,mBAAmB,CAAS;IAE5B,YAAY,QAAgB,EAAE,cAAyB;QACrD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,cAAc,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,WAAwB;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,iCAAiC;IACjC,WAAW,CACT,SAAiB,EACjB,cAAsB,EACtB,QAAwB,EACxB,oBAA6B;QAE7B,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC/F,IAAI,CAAC,0BAA0B,GAAG,oBAAoB,CAAC;QACvD,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,aAAa,CAAC,MAAc,EAAE,KAAa;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mDAAmD;IACnD,SAAS,CAAC,QAAkB;QAC1B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,WAAW,CAAC,QAA0B;QACpC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;YAC3D,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;CACF;AAnFD,4CAmFC","sourcesContent":["import { DynamoIndexMap, EndpointPolicy, ScopeMap, TraceChange } from \"@chinggis/core\";\n\n/** Generic DynamoDB Configuration */\nexport class DynamoDBConfig {\n  NAME: string; // DynamoDB table name\n  OWNER_PARENT_FIELD_NAME?: string;\n  OWNER_FIELD_NAME: string; // DynamoDB index map for queries\n  MAP: DynamoIndexMap;\n\n  constructor(tableName: string, ownerFieldName: string, indexMap: DynamoIndexMap, parentFieldName?: string) {\n    this.NAME = tableName;\n    this.OWNER_PARENT_FIELD_NAME = parentFieldName;\n    this.OWNER_FIELD_NAME = ownerFieldName;\n    this.MAP = indexMap;\n  }\n}\n\n/** Generic OpenSearch Configuration */\nexport class OpenSearchConfig {\n  DOMAIN: string;\n  INDEX: string;\n\n  constructor(domain: string, indexName: string) {\n    this.DOMAIN = domain;\n    this.INDEX = indexName;\n  }\n}\n\n/** Configuration interface for type safety */\nexport interface EntityConfig {\n  BASE_PATH: string;\n  DYNAMO_DB: DynamoDBConfig;\n  OPEN_SEARCH: OpenSearchConfig;\n  ENDPOINT_POLICY: EndpointPolicy[];\n  ADMIN_GROUP_NAME: string[];\n  OWNER_PARENT_ID_FIELD_NAME?: string;\n  OWNER_ID_FIELD_NAME?: string;\n  TRACE_CHANGE?: TraceChange;\n  SCOPE_MAP?: ScopeMap;\n  ROLE_TABLE?: string;\n  ROLE_PATH?: string;\n}\n\n/** Generic Entity Configuration Class **/\nexport class EntityConfigImpl implements EntityConfig {\n  BASE_PATH: string; //Entity name for logging and debugging\n  DYNAMO_DB: DynamoDBConfig; // DynamoDB configuration\n  OPEN_SEARCH: OpenSearchConfig; // OpenSearch configuration\n  ENDPOINT_POLICY: EndpointPolicy[]; // Path-based permission configuration\n  ADMIN_GROUP_NAME: string[]; // Admin group name for Cognito\n\n  TRACE_CHANGE?: TraceChange;\n  SCOPE_MAP?: ScopeMap;\n  ROLE_TABLE?: string;\n  ROLE_PATH?: string;\n\n  OWNER_PARENT_ID_FIELD_NAME?: string;\n  OWNER_ID_FIELD_NAME: string;\n\n  constructor(basePath: string, adminGroupName?: string[]) {\n    this.BASE_PATH = basePath;\n    this.ADMIN_GROUP_NAME = adminGroupName || [\"admin\"];\n    this.ENDPOINT_POLICY = [];\n  }\n\n  setTraceChange(traceChange: TraceChange): void {\n    this.TRACE_CHANGE = traceChange;\n  }\n\n  /** Set DynamoDB configuration */\n  setDynamoDB(\n    tableName: string,\n    ownerFieldName: string,\n    indexMap: DynamoIndexMap,\n    ownerParentFieldName?: string,\n  ): this {\n    this.DYNAMO_DB = new DynamoDBConfig(tableName, ownerFieldName, indexMap, ownerParentFieldName);\n    this.OWNER_PARENT_ID_FIELD_NAME = ownerParentFieldName;\n    this.OWNER_ID_FIELD_NAME = ownerFieldName;\n    return this;\n  }\n\n  /** Set OpenSearch configuration */\n  setOpenSearch(domain: string, index: string): this {\n    this.OPEN_SEARCH = new OpenSearchConfig(domain, index);\n    return this;\n  }\n\n  /** Set scope map for RBAC scope-based filtering */\n  setScopes(scopeMap: ScopeMap): this {\n    this.SCOPE_MAP = scopeMap;\n    return this;\n  }\n\n  /** Set the DynamoDB table name for RBAC role permissions */\n  setRoleTable(tableName: string): this {\n    this.ROLE_TABLE = tableName;\n    return this;\n  }\n\n  setRolePath(path: string): this {\n    this.ROLE_PATH = path;\n    return this;\n  }\n\n  /** Set path-based policies */\n  setPolicies(policies: EndpointPolicy[]): this {\n    this.ENDPOINT_POLICY = policies;\n    return this;\n  }\n\n  /** Get configuration as a plain object (for BaseController compatibility) */\n  toObject(): EntityConfig {\n    return {\n      BASE_PATH: this.BASE_PATH,\n      DYNAMO_DB: this.DYNAMO_DB,\n      OPEN_SEARCH: this.OPEN_SEARCH,\n      ENDPOINT_POLICY: this.ENDPOINT_POLICY,\n      TRACE_CHANGE: this.TRACE_CHANGE,\n      ADMIN_GROUP_NAME: this.ADMIN_GROUP_NAME,\n      OWNER_PARENT_ID_FIELD_NAME: this.OWNER_PARENT_ID_FIELD_NAME,\n      OWNER_ID_FIELD_NAME: this.OWNER_ID_FIELD_NAME,\n      SCOPE_MAP: this.SCOPE_MAP,\n      ROLE_TABLE: this.ROLE_TABLE,\n      ROLE_PATH: this.ROLE_PATH,\n    };\n  }\n}\n"]}
+{"version":3,"file":"base.config.js","sourceRoot":"","sources":["../../src/model/base.config.ts"],"names":[],"mappings":";;;AAEA,qCAAqC;AACrC,MAAa,cAAc;IACzB,IAAI,CAAS,CAAC,sBAAsB;IACpC,uBAAuB,CAAU;IACjC,gBAAgB,CAAS,CAAC,iCAAiC;IAC3D,GAAG,CAAiB;IAEpB,YAAY,SAAiB,EAAE,cAAsB,EAAE,QAAwB,EAAE,eAAwB;QACvG,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;QACtB,IAAI,CAAC,uBAAuB,GAAG,eAAe,CAAC;QAC/C,IAAI,CAAC,gBAAgB,GAAG,cAAc,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;IACtB,CAAC;CACF;AAZD,wCAYC;AAED,uCAAuC;AACvC,MAAa,gBAAgB;IAC3B,MAAM,CAAS;IACf,KAAK,CAAS;IAEd,YAAY,MAAc,EAAE,SAAiB;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF;AARD,4CAQC;AAeD,0CAA0C;AAC1C,MAAa,gBAAgB;IAC3B,SAAS,CAAS,CAAC,uCAAuC;IAC1D,SAAS,CAAiB,CAAC,yBAAyB;IACpD,WAAW,CAAmB,CAAC,2BAA2B;IAC1D,eAAe,CAAmB,CAAC,sCAAsC;IACzE,gBAAgB,CAAW,CAAC,+BAA+B;IAE3D,YAAY,CAAe;IAC3B,cAAc,CAAiB;IAE/B,0BAA0B,CAAU;IACpC,mBAAmB,CAAS;IAE5B,YAAY,QAAgB,EAAE,cAAyB;QACrD,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,cAAc,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,WAAwB;QACrC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED,iCAAiC;IACjC,WAAW,CACT,SAAiB,EACjB,cAAsB,EACtB,QAAwB,EACxB,oBAA6B;QAE7B,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC/F,IAAI,CAAC,0BAA0B,GAAG,oBAAoB,CAAC;QACvD,IAAI,CAAC,mBAAmB,GAAG,cAAc,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mCAAmC;IACnC,aAAa,CAAC,MAAc,EAAE,KAAa;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,gBAAgB,CAAC,aAA4B;QAC3C,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8BAA8B;IAC9B,WAAW,CAAC,QAA0B;QACpC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,QAAQ;QACN,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;YAC3D,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;IACJ,CAAC;CACF;AApED,4CAoEC","sourcesContent":["import { DynamoIndexMap, EndpointPolicy, PermissionMap, TraceChange } from \"@chinggis/core\";\n\n/** Generic DynamoDB Configuration */\nexport class DynamoDBConfig {\n  NAME: string; // DynamoDB table name\n  OWNER_PARENT_FIELD_NAME?: string;\n  OWNER_FIELD_NAME: string; // DynamoDB index map for queries\n  MAP: DynamoIndexMap;\n\n  constructor(tableName: string, ownerFieldName: string, indexMap: DynamoIndexMap, parentFieldName?: string) {\n    this.NAME = tableName;\n    this.OWNER_PARENT_FIELD_NAME = parentFieldName;\n    this.OWNER_FIELD_NAME = ownerFieldName;\n    this.MAP = indexMap;\n  }\n}\n\n/** Generic OpenSearch Configuration */\nexport class OpenSearchConfig {\n  DOMAIN: string;\n  INDEX: string;\n\n  constructor(domain: string, indexName: string) {\n    this.DOMAIN = domain;\n    this.INDEX = indexName;\n  }\n}\n\n/** Configuration interface for type safety */\nexport interface EntityConfig {\n  BASE_PATH: string;\n  DYNAMO_DB: DynamoDBConfig;\n  OPEN_SEARCH: OpenSearchConfig;\n  ENDPOINT_POLICY: EndpointPolicy[];\n  ADMIN_GROUP_NAME: string[];\n  OWNER_PARENT_ID_FIELD_NAME?: string;\n  OWNER_ID_FIELD_NAME?: string;\n  TRACE_CHANGE?: TraceChange;\n  PERMISSION_MAP?: PermissionMap;\n}\n\n/** Generic Entity Configuration Class **/\nexport class EntityConfigImpl implements EntityConfig {\n  BASE_PATH: string; //Entity name for logging and debugging\n  DYNAMO_DB: DynamoDBConfig; // DynamoDB configuration\n  OPEN_SEARCH: OpenSearchConfig; // OpenSearch configuration\n  ENDPOINT_POLICY: EndpointPolicy[]; // Path-based permission configuration\n  ADMIN_GROUP_NAME: string[]; // Admin group name for Cognito\n\n  TRACE_CHANGE?: TraceChange;\n  PERMISSION_MAP?: PermissionMap;\n\n  OWNER_PARENT_ID_FIELD_NAME?: string;\n  OWNER_ID_FIELD_NAME: string;\n\n  constructor(basePath: string, adminGroupName?: string[]) {\n    this.BASE_PATH = basePath;\n    this.ADMIN_GROUP_NAME = adminGroupName || [\"admin\"];\n    this.ENDPOINT_POLICY = [];\n  }\n\n  setTraceChange(traceChange: TraceChange): void {\n    this.TRACE_CHANGE = traceChange;\n  }\n\n  /** Set DynamoDB configuration */\n  setDynamoDB(\n    tableName: string,\n    ownerFieldName: string,\n    indexMap: DynamoIndexMap,\n    ownerParentFieldName?: string,\n  ): this {\n    this.DYNAMO_DB = new DynamoDBConfig(tableName, ownerFieldName, indexMap, ownerParentFieldName);\n    this.OWNER_PARENT_ID_FIELD_NAME = ownerParentFieldName;\n    this.OWNER_ID_FIELD_NAME = ownerFieldName;\n    return this;\n  }\n\n  /** Set OpenSearch configuration */\n  setOpenSearch(domain: string, index: string): this {\n    this.OPEN_SEARCH = new OpenSearchConfig(domain, index);\n    return this;\n  }\n\n  /** Set permission map for RBAC: scope filtering, role table, and role path */\n  setPermissionMap(permissionMap: PermissionMap): this {\n    this.PERMISSION_MAP = permissionMap;\n    return this;\n  }\n\n  /** Set path-based policies */\n  setPolicies(policies: EndpointPolicy[]): this {\n    this.ENDPOINT_POLICY = policies;\n    return this;\n  }\n\n  /** Get configuration as a plain object (for BaseController compatibility) */\n  toObject(): EntityConfig {\n    return {\n      BASE_PATH: this.BASE_PATH,\n      DYNAMO_DB: this.DYNAMO_DB,\n      OPEN_SEARCH: this.OPEN_SEARCH,\n      ENDPOINT_POLICY: this.ENDPOINT_POLICY,\n      TRACE_CHANGE: this.TRACE_CHANGE,\n      ADMIN_GROUP_NAME: this.ADMIN_GROUP_NAME,\n      OWNER_PARENT_ID_FIELD_NAME: this.OWNER_PARENT_ID_FIELD_NAME,\n      OWNER_ID_FIELD_NAME: this.OWNER_ID_FIELD_NAME,\n      PERMISSION_MAP: this.PERMISSION_MAP,\n    };\n  }\n}\n"]}

package/dist/model/base.model.d.ts

@@ -49,18 +49,14 @@ export interface RolePermission {
     role: string;
     permissions: string[];
 }
-/**
- * Map of scope name → { filterField, claimKey }.
- * Key is scope name (e.g. "branch", "agent", "org").
- *
- * Usage:
- *   new ScopeMap()
- *     .set("branch", { filterField: "branchId", claimKey: "custom:branch" })
- *     .set("agent",  { filterField: "agentId",  claimKey: "custom:agent" })
- *     .set("org",    { filterField: "orgId",    claimKey: "custom:org" })
- */
 export declare class ScopeMap extends Map<string, {
     filterField: string;
     claimKey?: string;
 }> {
 }
+export interface PermissionMap {
+    scopeMap: ScopeMap;
+    roleTable: string;
+    userPoolId?: string;
+    rolePath?: string;
+}

package/dist/model/base.model.js

@@ -6,16 +6,6 @@ var InclusionMode;
     InclusionMode["INCLUDE"] = "include";
     InclusionMode["EXCLUDE"] = "exclude";
 })(InclusionMode || (exports.InclusionMode = InclusionMode = {}));
-/**
- * Map of scope name → { filterField, claimKey }.
- * Key is scope name (e.g. "branch", "agent", "org").
- *
- * Usage:
- *   new ScopeMap()
- *     .set("branch", { filterField: "branchId", claimKey: "custom:branch" })
- *     .set("agent",  { filterField: "agentId",  claimKey: "custom:agent" })
- *     .set("org",    { filterField: "orgId",    claimKey: "custom:org" })
- */
 class ScopeMap extends Map {
 }
 exports.ScopeMap = ScopeMap;

package/dist/model/base.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.model.js","sourceRoot":"","sources":["../../src/model/base.model.ts"],"names":[],"mappings":";;;AAwDA,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;AACrB,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAOD;;;;;;;;;GASG;AACH,MAAa,QAAS,SAAQ,GAAuD;CAAG;AAAxF,4BAAwF","sourcesContent":["import { RequestType } from \"./validation.model\";\nimport { Action } from \"./http.model\";\n\nexport interface BaseEntity {\n  id?: string;\n  createdAt?: string;\n  updatedAt?: string;\n\n  createdBy?: any;\n  updatedBy?: any;\n\n  ownerId?: string;\n  ownerParentId?: string;\n\n  permission?: Map<string, Permission[]>;\n\n  history?: ChangeHistory[];\n\n  year?: string;\n  yearMonth?: string;\n}\n\nexport interface ChangedField {\n  fieldName: string;\n  oldValue: string;\n  newValue: string;\n}\n\nexport interface ChangeHistory {\n  action: string;\n  user: string;\n  date: string;\n  changes?: ChangedField[];\n}\n\nexport interface Permission {\n  role: RequestType;\n  actions: Action[];\n}\n\nexport interface Attachment {\n  thumbnail: string;\n  original: string;\n}\n\nexport interface List<T> {\n  items: Array<T>;\n  total?: number;\n  lastKey?: string;\n}\n\nexport interface TraceChange {\n  fields: string[];\n  mode: InclusionMode;\n}\n\nexport enum InclusionMode {\n  INCLUDE = \"include\",\n  EXCLUDE = \"exclude\",\n}\n\nexport interface RolePermission {\n  role: string;\n  permissions: string[];\n}\n\n/**\n * Map of scope name → { filterField, claimKey }.\n * Key is scope name (e.g. \"branch\", \"agent\", \"org\").\n *\n * Usage:\n *   new ScopeMap()\n *     .set(\"branch\", { filterField: \"branchId\", claimKey: \"custom:branch\" })\n *     .set(\"agent\",  { filterField: \"agentId\",  claimKey: \"custom:agent\" })\n *     .set(\"org\",    { filterField: \"orgId\",    claimKey: \"custom:org\" })\n */\nexport class ScopeMap extends Map<string, { filterField: string; claimKey?: string }> {}\n"]}
+{"version":3,"file":"base.model.js","sourceRoot":"","sources":["../../src/model/base.model.ts"],"names":[],"mappings":";;;AAwDA,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,oCAAmB,CAAA;IACnB,oCAAmB,CAAA;AACrB,CAAC,EAHW,aAAa,6BAAb,aAAa,QAGxB;AAOD,MAAa,QAAS,SAAQ,GAAuD;CAAG;AAAxF,4BAAwF","sourcesContent":["import { RequestType } from \"./validation.model\";\nimport { Action } from \"./http.model\";\n\nexport interface BaseEntity {\n  id?: string;\n  createdAt?: string;\n  updatedAt?: string;\n\n  createdBy?: any;\n  updatedBy?: any;\n\n  ownerId?: string;\n  ownerParentId?: string;\n\n  permission?: Map<string, Permission[]>;\n\n  history?: ChangeHistory[];\n\n  year?: string;\n  yearMonth?: string;\n}\n\nexport interface ChangedField {\n  fieldName: string;\n  oldValue: string;\n  newValue: string;\n}\n\nexport interface ChangeHistory {\n  action: string;\n  user: string;\n  date: string;\n  changes?: ChangedField[];\n}\n\nexport interface Permission {\n  role: RequestType;\n  actions: Action[];\n}\n\nexport interface Attachment {\n  thumbnail: string;\n  original: string;\n}\n\nexport interface List<T> {\n  items: Array<T>;\n  total?: number;\n  lastKey?: string;\n}\n\nexport interface TraceChange {\n  fields: string[];\n  mode: InclusionMode;\n}\n\nexport enum InclusionMode {\n  INCLUDE = \"include\",\n  EXCLUDE = \"exclude\",\n}\n\nexport interface RolePermission {\n  role: string;\n  permissions: string[];\n}\n\nexport class ScopeMap extends Map<string, { filterField: string; claimKey?: string }> {}\n\nexport interface PermissionMap {\n  scopeMap: ScopeMap;\n  roleTable: string;\n  userPoolId?: string;\n  rolePath?: string;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-service-stack",
-  "version": "0.18.371",
+  "version": "0.18.373",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "author": "chinggis.systems",