aws-service-stack 0.18.376 → 0.18.377

package/dist/controller/controller-role.d.ts

@@ -46,8 +46,11 @@ export declare class ControllerRole {
     checkAdminPermission(cognitoGroups: string[], adminGroups: string[]): boolean;
     private isAdmin;
     private validate;
+    private isSearchPath;
     private extractRoles;
     private resolveScope;
     private applyScopeFilter;
+    private applyScopeToBody;
+    private applyAllScopeValues;
     private clearScopeFilters;
 }

package/dist/controller/controller-role.js

@@ -144,15 +144,23 @@ class ControllerRole {
         if (!roles.length) {
             throw new exception_1.ErrorHttp({ code: 403, error: "PermissionDenied" }, "Permission denied: Role Not Found");
         }
+        const scope = this.resolveScope(req, scopeMap);
+        const method = req.methode.toUpperCase();
+        if (method === "POST") {
+            this.applyScopeToBody(req, scopeMap);
+        }
+        else if (method === "GET" && this.isSearchPath(req)) {
+            this.applyAllScopeValues(req, "filter", scopeMap);
+        }
+        else {
+            this.applyScopeFilter(req, scope, scopeMap);
+        }
         if (adminGroups?.length && this.isAdmin(roles, adminGroups)) {
             return;
         }
-        const scope = this.resolveScope(req, scopeMap);
-        const method = req.methode.toUpperCase();
         for (const role of roles) {
             const allowed = await this.permissionService.hasPermission(role, resource, scope, method);
             if (allowed) {
-                this.applyScopeFilter(req, scope, scopeMap);
                 return;
             }
         }
@@ -180,6 +188,10 @@ class ControllerRole {
             throw new exception_1.ErrorHttp({ code: 400, error: "BadRequest" }, formattedErrors);
         }
     }
+    isSearchPath(req) {
+        const path = req.event?.requestContext?.resourcePath ?? req.resourcePath ?? "";
+        return /\/(search\/query)(\/|$)/i.test(path);
+    }
     extractRoles(req) {
         return req.identity?.groups ?? [];
     }
@@ -208,6 +220,29 @@ class ControllerRole {
         req.filter[mapping.filterField] = claimValue;
         delete req.filter?.scope;
     }
+    applyScopeToBody(req, scopeMap) {
+        if (!req.body)
+            req.body = {};
+        req.body.ownerId = req.identity?.sub;
+        this.applyAllScopeValues(req, "body", scopeMap);
+    }
+    applyAllScopeValues(req, target, scopeMap) {
+        if (target === "filter") {
+            if (!req.filter)
+                req.filter = {};
+            this.clearScopeFilters(req, scopeMap);
+        }
+        const obj = target === "filter" ? req.filter : req.body;
+        for (const [scope, mapping] of scopeMap) {
+            const claimKey = mapping.claimKey ?? "custom:" + scope;
+            const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey] || req.identity?.sub;
+            if (claimValue) {
+                obj[mapping.filterField] = claimValue;
+            }
+        }
+        if (target === "filter")
+            delete req.filter?.scope;
+    }
     clearScopeFilters(req, scopeMap) {
         for (const [, entry] of scopeMap) {
             delete req.filter[entry.filterField];

package/dist/controller/controller-role.js.map

@@ -1 +1 @@
-{"version":3,"file":"controller-role.js","sourceRoot":"","sources":["../../src/controller/controller-role.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,4CAAyC;AAIzC,sEAAkE;AAClE,iDAAoG;AACpG,8DAA4E;AAC5E,sDAAuD;AAEvD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,GAAG,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;IACnD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC;IAC7C,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACxD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAEvD,MAAM,QAAQ,GAAG,OAAC,CAAC,MAAM,CAAC;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACrD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;IACnD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAC;AAQH;;;;;;;GAOG;AACH,MAAa,cAAc;IACN,iBAAiB,CAAoB;IAEvC,SAAS,GAAiC;QACzD,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;QACzF,iBAAiB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;QAC9F,eAAe,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7E,oBAAoB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;KACpG,CAAC;IAEF,YAAY,aAAqB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,sCAAiB,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAKnB;QACC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,OAA4E;QAE5E,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB,EAAE,WAAoB;QACvE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,SAAiB;QACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACtE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,IAAA,wBAAc,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACxE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,IAAA,6BAAmB,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAc;QAC/E,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAED,8EAA8E;IAC9E,yDAAyD;IACzD,8EAA8E;IAE9E,KAAK,CAAC,uBAAuB,CAC3B,GAAgB,EAChB,IAAY,EACZ,aAA4B,EAC5B,WAAqB;QAErB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE5D,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAE/D,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,IAAI,cAAc,KAAK,GAAG,QAAQ,GAAG,MAAM,EAAE,EAAE,CAAC;oBAC9C,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C;gBACE,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,GAAgB,EAAE,QAAgB,EAAE,QAAkB,EAAE,WAAsB;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QAED,IAAI,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1F,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,4BAA4B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,MAAM,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,aAAuB,EAAE,WAAqB;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,OAAO,CAAC,aAAmC,EAAE,WAAqB;QACxE,OAAO,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;IAC9E,CAAC;IAEO,QAAQ,CAAsB,MAAS,EAAE,IAAa;QAC5D,IAAI,CAAC;YACH,OAAO,IAAA,oCAAkB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,IAAA,8BAAY,EAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAgB;QACnC,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,GAAgB,EAAE,QAAkB;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC;QAEnF,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;QAEjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,kBAAkB,KAAK,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAgB,EAAE,KAAa,EAAE,QAAkB;QAC1E,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,KAAK,CAAC;QACvD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAC3B,CAAC;IAEO,iBAAiB,CAAC,GAAgB,EAAE,QAAkB;QAC5D,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AA/ND,wCA+NC","sourcesContent":["import { z } from \"zod\";\nimport { ErrorHttp } from \"../exception\";\nimport { Permission } from \"../model/role.model\";\nimport { PermissionMap, ScopeMap } from \"../model/base.model\";\nimport { HttpRequest } from \"../utils/http/http.util\";\nimport { PermissionService } from \"../service/permission.service\";\nimport { createGroup, deleteGroup, addUserToGroup, removeUserFromGroup } from \"../function/cognito\";\nimport { validateWithSchema, formatErrors } from \"../utils/validation.util\";\nimport { trimSpecialChar } from \"../utils/string.util\";\n\n// ---------------------------------------------------------------------------\n// DTO Schemas\n// ---------------------------------------------------------------------------\n\nconst MethodSchema = z.object({\n  GET: z.boolean().optional(),\n  POST: z.boolean().optional(),\n  PATCH: z.boolean().optional(),\n  PUT: z.boolean().optional(),\n  DELETE: z.boolean().optional(),\n});\n\nconst AddPermissionDto = z.object({\n  role: z.string().min(1, \"Role is required\"),\n  resource: z.string().min(1, \"Resource is required\"),\n  scope: z.string().min(1, \"Scope is required\"),\n  method: MethodSchema,\n});\n\nconst UpdatePermissionDto = z.object({\n  role: z.string().min(1, \"Role is required\").optional(),\n  resource: z.string().min(1, \"Resource is required\").optional(),\n  scope: z.string().min(1, \"Scope is required\").optional(),\n  method: MethodSchema.optional(),\n});\n\nconst IdParamDto = z.string().min(1, \"Id is required\");\n\nconst GroupDto = z.object({\n  userPoolId: z.string().min(1, \"UserPoolId is required\"),\n  groupName: z.string().min(1, \"GroupName is required\"),\n  description: z.string().optional(),\n});\n\nconst UserGroupDto = z.object({\n  userPoolId: z.string().min(1, \"UserPoolId is required\"),\n  username: z.string().min(1, \"Username is required\"),\n  groupName: z.string().min(1, \"GroupName is required\"),\n});\n\n// ---------------------------------------------------------------------------\n// Route map for permission sub-paths (POST only)\n// ---------------------------------------------------------------------------\n\ntype RouteHandler = (permissionMap: PermissionMap, body: any) => Promise<any>;\n\n/**\n * ControllerRole — centralized Permission CRUD + RBAC access enforcement.\n *\n * All caching and DB orchestration lives in PermissionService.\n *\n * Scope validation, scope filtering, and permission checks are centralized here\n * so that ControllerApi (and any other consumer) delegates without duplicating logic.\n */\nexport class ControllerRole {\n  protected readonly permissionService: PermissionService;\n\n  private readonly subRoutes: Record<string, RouteHandler> = {\n    \"/add-group\": (pm, body) => this.addRole(pm.userPoolId, body.groupName, body.description),\n    \"/add-user-group\": (pm, body) => this.assignRole(pm.userPoolId, body.username, body.groupName),\n    \"/remove-group\": (pm, body) => this.removeRole(pm.userPoolId, body.groupName),\n    \"/remove-user-group\": (pm, body) => this.unassignRole(pm.userPoolId, body.username, body.groupName),\n  };\n\n  constructor(roleTableName: string) {\n    this.permissionService = new PermissionService(roleTableName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission CRUD\n  // ---------------------------------------------------------------------------\n\n  async addPermission(input: {\n    role: string;\n    resource: string;\n    scope: string;\n    method: Permission[\"method\"];\n  }): Promise<Permission> {\n    this.validate(AddPermissionDto, input);\n    return this.permissionService.createPermission(input);\n  }\n\n  async updatePermission(\n    id: string,\n    updates: Partial<Pick<Permission, \"role\" | \"resource\" | \"scope\" | \"method\">>,\n  ): Promise<Permission> {\n    this.validate(IdParamDto, id);\n    this.validate(UpdatePermissionDto, updates);\n    return this.permissionService.updatePermission(id, updates);\n  }\n\n  async deletePermission(id: string): Promise<boolean> {\n    this.validate(IdParamDto, id);\n    return this.permissionService.deletePermission(id);\n  }\n\n  async getPermission(id: string): Promise<Permission | null> {\n    this.validate(IdParamDto, id);\n    return this.permissionService.getPermissionById(id);\n  }\n\n  async listPermissions(): Promise<Permission[]> {\n    return this.permissionService.listPermissions();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Role (Cognito group)\n  // ---------------------------------------------------------------------------\n\n  async addRole(userPoolId: string, groupName: string, description?: string) {\n    this.validate(GroupDto, { userPoolId, groupName, description });\n    return createGroup(userPoolId, groupName, description);\n  }\n\n  async removeRole(userPoolId: string, groupName: string) {\n    this.validate(GroupDto, { userPoolId, groupName });\n    return deleteGroup(userPoolId, groupName);\n  }\n\n  async assignRole(userPoolId: string, username: string, groupName: string) {\n    this.validate(UserGroupDto, { userPoolId, username, groupName });\n    return addUserToGroup(userPoolId, username, groupName);\n  }\n\n  async unassignRole(userPoolId: string, username: string, groupName: string) {\n    this.validate(UserGroupDto, { userPoolId, username, groupName });\n    return removeUserFromGroup(userPoolId, username, groupName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission check\n  // ---------------------------------------------------------------------------\n\n  async hasPermission(role: string, resource: string, scope: string, method: string): Promise<boolean> {\n    return this.permissionService.hasPermission(role, resource, scope, method);\n  }\n\n  async getPermissionByKey(permissionKey: string): Promise<Permission | null> {\n    return this.permissionService.getPermissionByKey(permissionKey);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission request handler (routes from ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  async handlePermissionRequest(\n    req: HttpRequest,\n    path: string,\n    permissionMap: PermissionMap,\n    adminGroups: string[],\n  ): Promise<any> {\n    this.checkAdminPermission(req.identity.groups, adminGroups);\n\n    if (req.methode === \"POST\") {\n      const normalizedPath = trimSpecialChar(path);\n      const rolePath = trimSpecialChar(permissionMap.rolePath ?? \"\");\n\n      for (const [suffix, handler] of Object.entries(this.subRoutes)) {\n        if (normalizedPath === `${rolePath}${suffix}`) {\n          return handler(permissionMap, req.body);\n        }\n      }\n\n      return this.addPermission(req.body);\n    }\n\n    switch (req.methode) {\n      case \"GET\":\n        return this.listPermissions();\n      case \"PATCH\":\n        return this.updatePermission(req.entityId, req.body);\n      case \"DELETE\":\n        return this.deletePermission(req.entityId);\n      default:\n        throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] unsupported method\");\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // RBAC access enforcement (used by ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  async checkRbacAccess(req: HttpRequest, resource: string, scopeMap: ScopeMap, adminGroups?: string[]): Promise<void> {\n    const roles = this.extractRoles(req);\n    \n    if (!roles.length) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, \"Permission denied: Role Not Found\");\n    }\n\n    if (adminGroups?.length && this.isAdmin(roles, adminGroups)) {\n      return;\n    }\n\n    const scope = this.resolveScope(req, scopeMap);\n    const method = req.methode.toUpperCase();\n\n    for (const role of roles) {\n      const allowed = await this.permissionService.hasPermission(role, resource, scope, method);\n      if (allowed) {\n        this.applyScopeFilter(req, scope, scopeMap);\n        return;\n      }\n    }\n\n    const key = `${roles.join(\",\")}#${resource}#${scope}`;\n    throw new ErrorHttp(\n      { code: 403, error: \"PermissionDenied\" },\n      `Permission denied: roles=${roles.join(\",\")} \"${key}.${method}\"`,\n    );\n  }\n\n  checkAdminPermission(cognitoGroups: string[], adminGroups: string[]) {\n    if (!this.isAdmin(cognitoGroups, adminGroups)) {\n      throw new ErrorHttp({ code: 403, error: \"Permission Denied\" }, \"[CORE] Permission Denied\");\n    }\n    return true;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Private helpers\n  // ---------------------------------------------------------------------------\n\n  private isAdmin(cognitoGroups: string[] | undefined, adminGroups: string[]): boolean {\n    return cognitoGroups?.some((group) => adminGroups.includes(group)) ?? false;\n  }\n\n  private validate<T extends z.ZodType>(schema: T, data: unknown): z.infer<T> {\n    try {\n      return validateWithSchema(schema, data);\n    } catch (error) {\n      const formattedErrors = formatErrors(error);\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, formattedErrors);\n    }\n  }\n\n  private extractRoles(req: HttpRequest): string[] {\n    return req.identity?.groups ?? [];\n  }\n\n  private resolveScope(req: HttpRequest, scopeMap: ScopeMap): string {\n    const scope = req.queryStringParameters?.scope || req.customQueryParameters?.scope;\n\n    if (!scope) return scopeMap.keys().next().value!;\n\n    if (!scopeMap.has(scope)) {\n      const allowed = Array.from(scopeMap.keys()).join(\", \");\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, `Invalid scope \"${scope}\". Allowed: ${allowed}`);\n    }\n\n    return scope;\n  }\n\n  private applyScopeFilter(req: HttpRequest, scope: string, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    this.clearScopeFilters(req, scopeMap);\n\n    const mapping = scopeMap.get(scope);\n    if (!mapping) return;\n\n    const claimKey = mapping.claimKey ?? \"custom:\" + scope;\n    const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey];\n\n    if (!claimValue) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, `Missing claim \"${claimKey}\" for scope \"${scope}\"`);\n    }\n\n    req.filter[mapping.filterField] = claimValue;\n    delete req.filter?.scope;\n  }\n\n  private clearScopeFilters(req: HttpRequest, scopeMap: ScopeMap): void {\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n    delete req.filter[\"scope\"];\n  }\n}\n"]}
+{"version":3,"file":"controller-role.js","sourceRoot":"","sources":["../../src/controller/controller-role.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,4CAAyC;AAIzC,sEAAkE;AAClE,iDAAoG;AACpG,8DAA4E;AAC5E,sDAAuD;AAEvD,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,GAAG,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;IAC3C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;IACnD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC;IAC7C,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACtD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,QAAQ,EAAE;IAC9D,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACxD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAEvD,MAAM,QAAQ,GAAG,OAAC,CAAC,MAAM,CAAC;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACrD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC;IACvD,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;IACnD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;CACtD,CAAC,CAAC;AAQH;;;;;;;GAOG;AACH,MAAa,cAAc;IACN,iBAAiB,CAAoB;IAEvC,SAAS,GAAiC;QACzD,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC;QACzF,iBAAiB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;QAC9F,eAAe,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7E,oBAAoB,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC;KACpG,CAAC;IAEF,YAAY,aAAqB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,sCAAiB,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,KAKnB;QACC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,OAA4E;QAE5E,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU;QAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,8EAA8E;IAC9E,uBAAuB;IACvB,8EAA8E;IAE9E,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,SAAiB,EAAE,WAAoB;QACvE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAChE,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,SAAiB;QACpD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,OAAO,IAAA,qBAAW,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACtE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,IAAA,wBAAc,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,QAAgB,EAAE,SAAiB;QACxE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,OAAO,IAAA,6BAAmB,EAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;IACnB,8EAA8E;IAE9E,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,KAAa,EAAE,MAAc;QAC/E,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QAC5C,OAAO,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClE,CAAC;IAED,8EAA8E;IAC9E,yDAAyD;IACzD,8EAA8E;IAE9E,KAAK,CAAC,uBAAuB,CAC3B,GAAgB,EAChB,IAAY,EACZ,aAA4B,EAC5B,WAAqB;QAErB,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE5D,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,IAAA,6BAAe,EAAC,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAE/D,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,IAAI,cAAc,KAAK,GAAG,QAAQ,GAAG,MAAM,EAAE,EAAE,CAAC;oBAC9C,OAAO,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,KAAK;gBACR,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACvD,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C;gBACE,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,2BAA2B,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,kDAAkD;IAClD,8EAA8E;IAE9E,KAAK,CAAC,eAAe,CAAC,GAAgB,EAAE,QAAgB,EAAE,QAAkB,EAAE,WAAsB;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1F,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,qBAAS,CACjB,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EACxC,4BAA4B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,MAAM,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,oBAAoB,CAAC,aAAuB,EAAE,WAAqB;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,OAAO,CAAC,aAAmC,EAAE,WAAqB;QACxE,OAAO,aAAa,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;IAC9E,CAAC;IAEO,QAAQ,CAAsB,MAAS,EAAE,IAAa;QAC5D,IAAI,CAAC;YACH,OAAO,IAAA,oCAAkB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,GAAG,IAAA,8BAAY,EAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,eAAe,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAgB;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC/E,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAEO,YAAY,CAAC,GAAgB;QACnC,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;IACpC,CAAC;IAEO,YAAY,CAAC,GAAgB,EAAE,QAAkB;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC;QAEnF,IAAI,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC;QAEjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,kBAAkB,KAAK,eAAe,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,GAAgB,EAAE,KAAa,EAAE,QAAkB;QAC1E,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,KAAK,CAAC;QACvD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC;QAEpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACpH,CAAC;QAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;QAC7C,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IAC3B,CAAC;IAEO,gBAAgB,CAAC,GAAgB,EAAE,QAAkB;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;QACrC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAEO,mBAAmB,CAAC,GAAgB,EAAE,MAAyB,EAAE,QAAkB;QACzF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAExD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,GAAG,KAAK,CAAC;YACvD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;YACzG,IAAI,UAAU,EAAE,CAAC;gBACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;YACxC,CAAC;QACH,CAAC;QAED,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;IACpD,CAAC;IAEO,iBAAiB,CAAC,GAAgB,EAAE,QAAkB;QAC5D,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACF;AApQD,wCAoQC","sourcesContent":["import { z } from \"zod\";\nimport { ErrorHttp } from \"../exception\";\nimport { Permission } from \"../model/role.model\";\nimport { PermissionMap, ScopeMap } from \"../model/base.model\";\nimport { HttpRequest } from \"../utils/http/http.util\";\nimport { PermissionService } from \"../service/permission.service\";\nimport { createGroup, deleteGroup, addUserToGroup, removeUserFromGroup } from \"../function/cognito\";\nimport { validateWithSchema, formatErrors } from \"../utils/validation.util\";\nimport { trimSpecialChar } from \"../utils/string.util\";\n\n// ---------------------------------------------------------------------------\n// DTO Schemas\n// ---------------------------------------------------------------------------\n\nconst MethodSchema = z.object({\n  GET: z.boolean().optional(),\n  POST: z.boolean().optional(),\n  PATCH: z.boolean().optional(),\n  PUT: z.boolean().optional(),\n  DELETE: z.boolean().optional(),\n});\n\nconst AddPermissionDto = z.object({\n  role: z.string().min(1, \"Role is required\"),\n  resource: z.string().min(1, \"Resource is required\"),\n  scope: z.string().min(1, \"Scope is required\"),\n  method: MethodSchema,\n});\n\nconst UpdatePermissionDto = z.object({\n  role: z.string().min(1, \"Role is required\").optional(),\n  resource: z.string().min(1, \"Resource is required\").optional(),\n  scope: z.string().min(1, \"Scope is required\").optional(),\n  method: MethodSchema.optional(),\n});\n\nconst IdParamDto = z.string().min(1, \"Id is required\");\n\nconst GroupDto = z.object({\n  userPoolId: z.string().min(1, \"UserPoolId is required\"),\n  groupName: z.string().min(1, \"GroupName is required\"),\n  description: z.string().optional(),\n});\n\nconst UserGroupDto = z.object({\n  userPoolId: z.string().min(1, \"UserPoolId is required\"),\n  username: z.string().min(1, \"Username is required\"),\n  groupName: z.string().min(1, \"GroupName is required\"),\n});\n\n// ---------------------------------------------------------------------------\n// Route map for permission sub-paths (POST only)\n// ---------------------------------------------------------------------------\n\ntype RouteHandler = (permissionMap: PermissionMap, body: any) => Promise<any>;\n\n/**\n * ControllerRole — centralized Permission CRUD + RBAC access enforcement.\n *\n * All caching and DB orchestration lives in PermissionService.\n *\n * Scope validation, scope filtering, and permission checks are centralized here\n * so that ControllerApi (and any other consumer) delegates without duplicating logic.\n */\nexport class ControllerRole {\n  protected readonly permissionService: PermissionService;\n\n  private readonly subRoutes: Record<string, RouteHandler> = {\n    \"/add-group\": (pm, body) => this.addRole(pm.userPoolId, body.groupName, body.description),\n    \"/add-user-group\": (pm, body) => this.assignRole(pm.userPoolId, body.username, body.groupName),\n    \"/remove-group\": (pm, body) => this.removeRole(pm.userPoolId, body.groupName),\n    \"/remove-user-group\": (pm, body) => this.unassignRole(pm.userPoolId, body.username, body.groupName),\n  };\n\n  constructor(roleTableName: string) {\n    this.permissionService = new PermissionService(roleTableName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission CRUD\n  // ---------------------------------------------------------------------------\n\n  async addPermission(input: {\n    role: string;\n    resource: string;\n    scope: string;\n    method: Permission[\"method\"];\n  }): Promise<Permission> {\n    this.validate(AddPermissionDto, input);\n    return this.permissionService.createPermission(input);\n  }\n\n  async updatePermission(\n    id: string,\n    updates: Partial<Pick<Permission, \"role\" | \"resource\" | \"scope\" | \"method\">>,\n  ): Promise<Permission> {\n    this.validate(IdParamDto, id);\n    this.validate(UpdatePermissionDto, updates);\n    return this.permissionService.updatePermission(id, updates);\n  }\n\n  async deletePermission(id: string): Promise<boolean> {\n    this.validate(IdParamDto, id);\n    return this.permissionService.deletePermission(id);\n  }\n\n  async getPermission(id: string): Promise<Permission | null> {\n    this.validate(IdParamDto, id);\n    return this.permissionService.getPermissionById(id);\n  }\n\n  async listPermissions(): Promise<Permission[]> {\n    return this.permissionService.listPermissions();\n  }\n\n  // ---------------------------------------------------------------------------\n  // Role (Cognito group)\n  // ---------------------------------------------------------------------------\n\n  async addRole(userPoolId: string, groupName: string, description?: string) {\n    this.validate(GroupDto, { userPoolId, groupName, description });\n    return createGroup(userPoolId, groupName, description);\n  }\n\n  async removeRole(userPoolId: string, groupName: string) {\n    this.validate(GroupDto, { userPoolId, groupName });\n    return deleteGroup(userPoolId, groupName);\n  }\n\n  async assignRole(userPoolId: string, username: string, groupName: string) {\n    this.validate(UserGroupDto, { userPoolId, username, groupName });\n    return addUserToGroup(userPoolId, username, groupName);\n  }\n\n  async unassignRole(userPoolId: string, username: string, groupName: string) {\n    this.validate(UserGroupDto, { userPoolId, username, groupName });\n    return removeUserFromGroup(userPoolId, username, groupName);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission check\n  // ---------------------------------------------------------------------------\n\n  async hasPermission(role: string, resource: string, scope: string, method: string): Promise<boolean> {\n    return this.permissionService.hasPermission(role, resource, scope, method);\n  }\n\n  async getPermissionByKey(permissionKey: string): Promise<Permission | null> {\n    return this.permissionService.getPermissionByKey(permissionKey);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Permission request handler (routes from ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  async handlePermissionRequest(\n    req: HttpRequest,\n    path: string,\n    permissionMap: PermissionMap,\n    adminGroups: string[],\n  ): Promise<any> {\n    this.checkAdminPermission(req.identity.groups, adminGroups);\n\n    if (req.methode === \"POST\") {\n      const normalizedPath = trimSpecialChar(path);\n      const rolePath = trimSpecialChar(permissionMap.rolePath ?? \"\");\n\n      for (const [suffix, handler] of Object.entries(this.subRoutes)) {\n        if (normalizedPath === `${rolePath}${suffix}`) {\n          return handler(permissionMap, req.body);\n        }\n      }\n\n      return this.addPermission(req.body);\n    }\n\n    switch (req.methode) {\n      case \"GET\":\n        return this.listPermissions();\n      case \"PATCH\":\n        return this.updatePermission(req.entityId, req.body);\n      case \"DELETE\":\n        return this.deletePermission(req.entityId);\n      default:\n        throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, \"[CORE] unsupported method\");\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // RBAC access enforcement (used by ControllerApi)\n  // ---------------------------------------------------------------------------\n\n  async checkRbacAccess(req: HttpRequest, resource: string, scopeMap: ScopeMap, adminGroups?: string[]): Promise<void> {\n    const roles = this.extractRoles(req);\n\n    if (!roles.length) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, \"Permission denied: Role Not Found\");\n    }\n\n    const scope = this.resolveScope(req, scopeMap);\n    const method = req.methode.toUpperCase();\n\n    if (method === \"POST\") {\n      this.applyScopeToBody(req, scopeMap);\n    } else if (method === \"GET\" && this.isSearchPath(req)) {\n      this.applyAllScopeValues(req, \"filter\", scopeMap);\n    } else {\n      this.applyScopeFilter(req, scope, scopeMap);\n    }\n\n    if (adminGroups?.length && this.isAdmin(roles, adminGroups)) {\n      return;\n    }\n\n    for (const role of roles) {\n      const allowed = await this.permissionService.hasPermission(role, resource, scope, method);\n      if (allowed) {\n        return;\n      }\n    }\n\n    const key = `${roles.join(\",\")}#${resource}#${scope}`;\n    throw new ErrorHttp(\n      { code: 403, error: \"PermissionDenied\" },\n      `Permission denied: roles=${roles.join(\",\")} \"${key}.${method}\"`,\n    );\n  }\n\n  checkAdminPermission(cognitoGroups: string[], adminGroups: string[]) {\n    if (!this.isAdmin(cognitoGroups, adminGroups)) {\n      throw new ErrorHttp({ code: 403, error: \"Permission Denied\" }, \"[CORE] Permission Denied\");\n    }\n    return true;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Private helpers\n  // ---------------------------------------------------------------------------\n\n  private isAdmin(cognitoGroups: string[] | undefined, adminGroups: string[]): boolean {\n    return cognitoGroups?.some((group) => adminGroups.includes(group)) ?? false;\n  }\n\n  private validate<T extends z.ZodType>(schema: T, data: unknown): z.infer<T> {\n    try {\n      return validateWithSchema(schema, data);\n    } catch (error) {\n      const formattedErrors = formatErrors(error);\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, formattedErrors);\n    }\n  }\n\n  private isSearchPath(req: HttpRequest): boolean {\n    const path = req.event?.requestContext?.resourcePath ?? req.resourcePath ?? \"\";\n    return /\\/(search\\/query)(\\/|$)/i.test(path);\n  }\n\n  private extractRoles(req: HttpRequest): string[] {\n    return req.identity?.groups ?? [];\n  }\n\n  private resolveScope(req: HttpRequest, scopeMap: ScopeMap): string {\n    const scope = req.queryStringParameters?.scope || req.customQueryParameters?.scope;\n\n    if (!scope) return scopeMap.keys().next().value!;\n\n    if (!scopeMap.has(scope)) {\n      const allowed = Array.from(scopeMap.keys()).join(\", \");\n      throw new ErrorHttp({ code: 400, error: \"BadRequest\" }, `Invalid scope \"${scope}\". Allowed: ${allowed}`);\n    }\n\n    return scope;\n  }\n\n  private applyScopeFilter(req: HttpRequest, scope: string, scopeMap: ScopeMap): void {\n    if (!req.filter) req.filter = {};\n\n    this.clearScopeFilters(req, scopeMap);\n\n    const mapping = scopeMap.get(scope);\n    if (!mapping) return;\n\n    const claimKey = mapping.claimKey ?? \"custom:\" + scope;\n    const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey];\n\n    if (!claimValue) {\n      throw new ErrorHttp({ code: 403, error: \"PermissionDenied\" }, `Missing claim \"${claimKey}\" for scope \"${scope}\"`);\n    }\n\n    req.filter[mapping.filterField] = claimValue;\n    delete req.filter?.scope;\n  }\n\n  private applyScopeToBody(req: HttpRequest, scopeMap: ScopeMap): void {\n    if (!req.body) req.body = {};\n    req.body.ownerId = req.identity?.sub;\n    this.applyAllScopeValues(req, \"body\", scopeMap);\n  }\n\n  private applyAllScopeValues(req: HttpRequest, target: \"filter\" | \"body\", scopeMap: ScopeMap): void {\n    if (target === \"filter\") {\n      if (!req.filter) req.filter = {};\n      this.clearScopeFilters(req, scopeMap);\n    }\n\n    const obj = target === \"filter\" ? req.filter : req.body;\n\n    for (const [scope, mapping] of scopeMap) {\n      const claimKey = mapping.claimKey ?? \"custom:\" + scope;\n      const claimValue = req.identity?.[claimKey] || req.identity?.attributes?.[claimKey] || req.identity?.sub;\n      if (claimValue) {\n        obj[mapping.filterField] = claimValue;\n      }\n    }\n\n    if (target === \"filter\") delete req.filter?.scope;\n  }\n\n  private clearScopeFilters(req: HttpRequest, scopeMap: ScopeMap): void {\n    for (const [, entry] of scopeMap) {\n      delete req.filter[entry.filterField];\n    }\n    delete req.filter[\"scope\"];\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-service-stack",
-  "version": "0.18.376",
+  "version": "0.18.377",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "author": "chinggis.systems",