aws-service-stack 0.18.447 → 0.18.449

package/dist/model/caller.model.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallerKind = void 0;
+var CallerKind;
+(function (CallerKind) {
+    CallerKind["GUEST"] = "guest";
+    CallerKind["USER"] = "user";
+    CallerKind["RETAILER"] = "retailer";
+    CallerKind["SUPPLIER"] = "supplier";
+    CallerKind["ADMIN"] = "admin";
+})(CallerKind || (exports.CallerKind = CallerKind = {}));
+//# sourceMappingURL=caller.model.js.map

package/dist/model/caller.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.model.js","sourceRoot":"","sources":["../../src/model/caller.model.ts"],"names":[],"mappings":";;;AAAA,IAAY,UAMX;AAND,WAAY,UAAU;IACpB,6BAAe,CAAA;IACf,2BAAa,CAAA;IACb,mCAAqB,CAAA;IACrB,mCAAqB,CAAA;IACrB,6BAAe,CAAA;AACjB,CAAC,EANW,UAAU,aAAV,UAAU,GAAV,UAAU,QAMrB","sourcesContent":["export enum CallerKind {\n  GUEST = \"guest\",\n  USER = \"user\",\n  RETAILER = \"retailer\",\n  SUPPLIER = \"supplier\",\n  ADMIN = \"admin\",\n}\n\nexport interface CallerPoolConfig {\n  userPoolId: string;\n  kind: CallerKind.USER | CallerKind.RETAILER | CallerKind.SUPPLIER | CallerKind.ADMIN;\n  /** null/undefined = any client of the pool */\n  clientIds?: string[] | null;\n}\n\nexport interface Caller {\n  kind: CallerKind;\n  claims?: Record<string, any>;\n}\n\nexport interface CallerVerifier {\n  /** Returns the verified JWT payload (incl. iss). Throws when invalid. */\n  verify(token: string): Promise<Record<string, any>>;\n}\n"]}

package/dist/model/index.d.ts

@@ -7,4 +7,5 @@ export * from "./validation.model";
 export * from "./dynamodb.model";
 export * from "./base.config";
 export { Permission as RolePermission } from "./role.model";
+export * from "./caller.model";
 //# sourceMappingURL=index.d.ts.map

package/dist/model/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/model/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/model/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,cAAc,gBAAgB,CAAC"}

package/dist/model/index.js

@@ -22,4 +22,5 @@ __exportStar(require("./filter.model"), exports);
 __exportStar(require("./validation.model"), exports);
 __exportStar(require("./dynamodb.model"), exports);
 __exportStar(require("./base.config"), exports);
+__exportStar(require("./caller.model"), exports);
 //# sourceMappingURL=index.js.map

package/dist/model/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/model/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+CAA6B;AAC7B,+CAA6B;AAC7B,sDAAoC;AACpC,iDAA+B;AAC/B,qDAAmC;AACnC,mDAAiC;AACjC,gDAA8B","sourcesContent":["export * from \"./cognito-user.model\";\nexport * from \"./http.model\";\nexport * from \"./base.model\";\nexport * from \"./date-string.model\";\nexport * from \"./filter.model\";\nexport * from \"./validation.model\";\nexport * from \"./dynamodb.model\";\nexport * from \"./base.config\";\nexport { Permission as RolePermission } from \"./role.model\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/model/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,+CAA6B;AAC7B,+CAA6B;AAC7B,sDAAoC;AACpC,iDAA+B;AAC/B,qDAAmC;AACnC,mDAAiC;AACjC,gDAA8B;AAE9B,iDAA+B","sourcesContent":["export * from \"./cognito-user.model\";\nexport * from \"./http.model\";\nexport * from \"./base.model\";\nexport * from \"./date-string.model\";\nexport * from \"./filter.model\";\nexport * from \"./validation.model\";\nexport * from \"./dynamodb.model\";\nexport * from \"./base.config\";\nexport { Permission as RolePermission } from \"./role.model\";\nexport * from \"./caller.model\";\n"]}

package/dist/model/validation.model.d.ts

@@ -1,8 +1,18 @@
-import { HttpMethod } from "../index.js";
+import type { HttpMethod } from "../index.js";
+import type { CallerKind } from "./caller.model";
 export interface ResponseFields {
     include?: string[];
     exclude?: string[];
 }
+export interface ClaimRef {
+    claim: string;
+}
+export declare const claim: (name: string) => ClaimRef;
+export type ViewFilterValue = string | number | boolean | string[] | ClaimRef;
+export interface PolicyView {
+    filter?: Record<string, ViewFilterValue>;
+    response?: ResponseFields;
+}
 /** Path-based permission definition */
 export interface EndpointPolicy {
     method: HttpMethod;
@@ -10,6 +20,10 @@ export interface EndpointPolicy {
     access?: Access[];
     validator?: any;
     response?: ResponseFields;
+    /** Who may call; absent = legacy `access` rules */
+    kinds?: CallerKind[];
+    /** Per-caller-kind forced filter and response fields */
+    view?: Partial<Record<CallerKind, PolicyView>>;
 }
 export declare enum RequestType {
     GUEST = "guest",

package/dist/model/validation.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.model.d.ts","sourceRoot":"","sources":["../../src/model/validation.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,MAAM;IAChB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;CAClB"}
+{"version":3,"file":"validation.model.d.ts","sourceRoot":"","sources":["../../src/model/validation.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,KAAK,SAAU,MAAM,KAAG,QAA6B,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,mDAAmD;IACnD,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,wDAAwD;IACxD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;CAChD;AAED,oBAAY,WAAW;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;CAClB;AAED,oBAAY,MAAM;IAChB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,KAAK,UAAU;IACf,MAAM,WAAW;CAClB"}

package/dist/model/validation.model.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Access = exports.RequestType = void 0;
+exports.Access = exports.RequestType = exports.claim = void 0;
+const claim = (name) => ({ claim: name });
+exports.claim = claim;
 var RequestType;
 (function (RequestType) {
     RequestType["GUEST"] = "guest";

package/dist/model/validation.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.model.js","sourceRoot":"","sources":["../../src/model/validation.model.ts"],"names":[],"mappings":";;;AAgBA,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EALW,WAAW,aAAX,WAAW,GAAX,WAAW,QAKtB;AAED,IAAY,MAMX;AAND,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,uBAAa,CAAA;IACb,yBAAe,CAAA;IACf,yBAAe,CAAA;IACf,2BAAiB,CAAA;AACnB,CAAC,EANW,MAAM,aAAN,MAAM,GAAN,MAAM,QAMjB","sourcesContent":["import { HttpMethod } from \"@chinggis/core\";\n\nexport interface ResponseFields {\n  include?: string[];\n  exclude?: string[];\n}\n\n/** Path-based permission definition */\nexport interface EndpointPolicy {\n  method: HttpMethod;\n  path: string;\n  access?: Access[];\n  validator?: any;\n  response?: ResponseFields;\n}\n\nexport enum RequestType {\n  GUEST = \"guest\",\n  USER = \"user\",\n  ADMIN = \"admin\",\n  SYSTEM = \"system\",\n}\n\nexport enum Access {\n  PUBLIC = \"public\",\n  USER = \"user\",\n  OWNER = \"owner\",\n  ADMIN = \"admin\",\n  SYSTEM = \"system\",\n}\n"]}
+{"version":3,"file":"validation.model.js","sourceRoot":"","sources":["../../src/model/validation.model.ts"],"names":[],"mappings":";;;AAYO,MAAM,KAAK,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAAtD,QAAA,KAAK,GAAL,KAAK,CAAiD;AAsBnE,IAAY,WAKX;AALD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,4BAAa,CAAA;IACb,8BAAe,CAAA;IACf,gCAAiB,CAAA;AACnB,CAAC,EALW,WAAW,aAAX,WAAW,GAAX,WAAW,QAKtB;AAED,IAAY,MAMX;AAND,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,uBAAa,CAAA;IACb,yBAAe,CAAA;IACf,yBAAe,CAAA;IACf,2BAAiB,CAAA;AACnB,CAAC,EANW,MAAM,aAAN,MAAM,GAAN,MAAM,QAMjB","sourcesContent":["import type { HttpMethod } from \"@chinggis/core\";\nimport type { CallerKind } from \"./caller.model\";\n\nexport interface ResponseFields {\n  include?: string[];\n  exclude?: string[];\n}\n\nexport interface ClaimRef {\n  claim: string;\n}\n\nexport const claim = (name: string): ClaimRef => ({ claim: name });\n\nexport type ViewFilterValue = string | number | boolean | string[] | ClaimRef;\n\nexport interface PolicyView {\n  filter?: Record<string, ViewFilterValue>;\n  response?: ResponseFields;\n}\n\n/** Path-based permission definition */\nexport interface EndpointPolicy {\n  method: HttpMethod;\n  path: string;\n  access?: Access[];\n  validator?: any;\n  response?: ResponseFields;\n  /** Who may call; absent = legacy `access` rules */\n  kinds?: CallerKind[];\n  /** Per-caller-kind forced filter and response fields */\n  view?: Partial<Record<CallerKind, PolicyView>>;\n}\n\nexport enum RequestType {\n  GUEST = \"guest\",\n  USER = \"user\",\n  ADMIN = \"admin\",\n  SYSTEM = \"system\",\n}\n\nexport enum Access {\n  PUBLIC = \"public\",\n  USER = \"user\",\n  OWNER = \"owner\",\n  ADMIN = \"admin\",\n  SYSTEM = \"system\",\n}\n"]}

package/dist/utils/auth/caller.d.ts

@@ -0,0 +1,9 @@
+import { type Caller, type CallerPoolConfig, type CallerVerifier } from "../../model/caller.model";
+/** Throws a 500 config error unless `pools` is an array of `{ userPoolId: string, kind: user|retailer|supplier|admin }` */
+export declare function validateCallerPools(pools: unknown): CallerPoolConfig[];
+/** Verifier for the pools (cached per pool config); an invalid pool config is a 500 config error */
+export declare function createCallerVerifier(pools: CallerPoolConfig[]): CallerVerifier;
+/** Parses and validates the CALLER_POOLS env value (memoized per string); invalid -> 500 config error */
+export declare function parseCallerPoolsEnv(value: string | undefined): CallerPoolConfig[] | undefined;
+export declare function resolveCaller(authorization: string | undefined, pools: CallerPoolConfig[], adminGroups: string[], verifier?: CallerVerifier): Promise<Caller>;
+//# sourceMappingURL=caller.d.ts.map

package/dist/utils/auth/caller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.d.ts","sourceRoot":"","sources":["../../../src/utils/auth/caller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,MAAM,EAAc,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQ/G,2HAA2H;AAC3H,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAQtE;AAED,oGAAoG;AACpG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,cAAc,CAiB9E;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,EAAE,GAAG,SAAS,CAa7F;AAmBD,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,EAAE,gBAAgB,EAAE,EACzB,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,CAAC,CA2BjB"}

package/dist/utils/auth/caller.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCallerPools = validateCallerPools;
+exports.createCallerVerifier = createCallerVerifier;
+exports.parseCallerPoolsEnv = parseCallerPoolsEnv;
+exports.resolveCaller = resolveCaller;
+const aws_jwt_verify_1 = require("aws-jwt-verify");
+const error_1 = require("aws-jwt-verify/error");
+const errors_1 = require("../../exception/errors");
+const exception_handler_1 = require("../../exception/exception-handler");
+const caller_model_1 = require("../../model/caller.model");
+const verifierCache = new Map();
+const poolsEnvCache = new Map();
+const POOL_KINDS = [caller_model_1.CallerKind.USER, caller_model_1.CallerKind.RETAILER, caller_model_1.CallerKind.SUPPLIER, caller_model_1.CallerKind.ADMIN];
+const configError = (message) => new errors_1.ErrorHttp(exception_handler_1.HTTP.INTERNAL_SERVER_ERROR, `Invalid CALLER_POOLS: ${message}`);
+/** Throws a 500 config error unless `pools` is an array of `{ userPoolId: string, kind: user|retailer|supplier|admin }` */
+function validateCallerPools(pools) {
+    if (!Array.isArray(pools))
+        throw configError("expected an array");
+    pools.forEach((pool, i) => {
+        if (!pool || typeof pool !== "object")
+            throw configError(`entry ${i} is not an object`);
+        if (typeof pool.userPoolId !== "string" || !pool.userPoolId)
+            throw configError(`entry ${i} needs userPoolId`);
+        if (!POOL_KINDS.includes(pool.kind))
+            throw configError(`entry ${i} has kind ${pool.kind}`);
+    });
+    return pools;
+}
+/** Verifier for the pools (cached per pool config); an invalid pool config is a 500 config error */
+function createCallerVerifier(pools) {
+    const key = JSON.stringify(pools);
+    let verifier = verifierCache.get(key);
+    if (!verifier) {
+        validateCallerPools(pools);
+        let jwtVerifier;
+        try {
+            jwtVerifier = aws_jwt_verify_1.CognitoJwtVerifier.create(pools.map((p) => ({ userPoolId: p.userPoolId, tokenUse: null, clientId: p.clientIds ?? null })));
+        }
+        catch (err) {
+            throw configError(err?.message ?? String(err));
+        }
+        verifier = { verify: async (token) => (await jwtVerifier.verify(token)) };
+        verifierCache.set(key, verifier);
+    }
+    return verifier;
+}
+/** Parses and validates the CALLER_POOLS env value (memoized per string); invalid -> 500 config error */
+function parseCallerPoolsEnv(value) {
+    if (!value?.trim())
+        return undefined;
+    const cached = poolsEnvCache.get(value);
+    if (cached)
+        return cached;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw configError("not valid JSON");
+    }
+    const pools = validateCallerPools(parsed);
+    poolsEnvCache.set(value, pools);
+    return pools;
+}
+/**
+ * JWKS/network trouble is 503, anything else an invalid token (401). That includes ParameterValidationError:
+ * at verify time the multi-issuer verifier throws it for a foreign or missing `iss` (client input).
+ * Config errors surface earlier, from createCallerVerifier, outside the verify try (500).
+ */
+function verifyFailure(err) {
+    if (err instanceof error_1.FetchError ||
+        err instanceof error_1.NonRetryableFetchError ||
+        err instanceof error_1.JwksNotAvailableInCacheError ||
+        err instanceof error_1.JwksValidationError) {
+        return new errors_1.ErrorHttp(exception_handler_1.HTTP.SERVICE_UNAVAILABLE, "Token keys are not available");
+    }
+    return new errors_1.ErrorHttp(exception_handler_1.HTTP.UNAUTHORIZED, "Invalid token");
+}
+async function resolveCaller(authorization, pools, adminGroups, verifier) {
+    if (!authorization)
+        return { kind: caller_model_1.CallerKind.GUEST };
+    const token = authorization.replace(/^Bearer\s+/i, "").trim();
+    // Built outside the try: a config error must surface as 500, not as an invalid token
+    const tokenVerifier = verifier ?? createCallerVerifier(pools);
+    let claims;
+    try {
+        claims = await tokenVerifier.verify(token);
+    }
+    catch (err) {
+        throw verifyFailure(err);
+    }
+    const poolId = String(claims.iss ?? "")
+        .split("/")
+        .pop();
+    const pool = pools.find((p) => p.userPoolId === poolId);
+    if (!pool)
+        throw new errors_1.ErrorHttp(exception_handler_1.HTTP.UNAUTHORIZED, "Unknown token issuer");
+    if (pool.kind === caller_model_1.CallerKind.ADMIN) {
+        const raw = claims["cognito:groups"];
+        const groups = Array.isArray(raw) ? raw : typeof raw === "string" ? [raw] : [];
+        const allowed = adminGroups.map((g) => g.toLowerCase());
+        const isAdmin = groups.some((g) => allowed.includes(String(g).toLowerCase()));
+        return { kind: isAdmin ? caller_model_1.CallerKind.ADMIN : caller_model_1.CallerKind.USER, claims };
+    }
+    return { kind: pool.kind, claims };
+}
+//# sourceMappingURL=caller.js.map

package/dist/utils/auth/caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller.js","sourceRoot":"","sources":["../../../src/utils/auth/caller.ts"],"names":[],"mappings":";;;;;;AAAA,mDAAoD;AACpD,gDAK8B;AAC9B,mDAAmD;AACnD,yEAAyD;AACzD,2DAA+G;AAE/G,MAAM,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;AACxD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;AAC5D,MAAM,UAAU,GAAa,CAAC,yBAAU,CAAC,IAAI,EAAE,yBAAU,CAAC,QAAQ,EAAE,yBAAU,CAAC,QAAQ,EAAE,yBAAU,CAAC,KAAK,CAAC,CAAC;AAE3G,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,kBAAS,CAAC,wBAAI,CAAC,qBAAqB,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;AAEvH,2HAA2H;AAC3H,6BAAoC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAClE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QACxF,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,WAAW,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC9G,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,WAAW,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,OAAO,KAA2B,CAAC;AACrC,CAAC;AAED,oGAAoG;AACpG,8BAAqC,KAAyB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,WAA4D,CAAC;QACjE,IAAI,CAAC;YACH,WAAW,GAAG,mCAAkB,CAAC,MAAM,CACrC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAChG,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;QACD,QAAQ,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAwB,EAAE,CAAC;QACjG,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yGAAyG;AACzG,6BAAoC,KAAyB;IAC3D,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,IACE,GAAG,YAAY,kBAAU;QACzB,GAAG,YAAY,8BAAsB;QACrC,GAAG,YAAY,oCAA4B;QAC3C,GAAG,YAAY,2BAAmB,EAClC,CAAC;QACD,OAAO,IAAI,kBAAS,CAAC,wBAAI,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,kBAAS,CAAC,wBAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAEM,KAAK,wBACV,aAAiC,EACjC,KAAyB,EACzB,WAAqB,EACrB,QAAyB;IAEzB,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,yBAAU,CAAC,KAAK,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9D,qFAAqF;IACrF,MAAM,aAAa,GAAG,QAAQ,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;SACpC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;IAE1E,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAU,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACrC,MAAM,MAAM,GAAa,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,yBAAU,CAAC,KAAK,CAAC,CAAC,CAAC,yBAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC","sourcesContent":["import { CognitoJwtVerifier } from \"aws-jwt-verify\";\nimport {\n  FetchError,\n  JwksNotAvailableInCacheError,\n  JwksValidationError,\n  NonRetryableFetchError,\n} from \"aws-jwt-verify/error\";\nimport { ErrorHttp } from \"../../exception/errors\";\nimport { HTTP } from \"../../exception/exception-handler\";\nimport { type Caller, CallerKind, type CallerPoolConfig, type CallerVerifier } from \"../../model/caller.model\";\n\nconst verifierCache = new Map<string, CallerVerifier>();\nconst poolsEnvCache = new Map<string, CallerPoolConfig[]>();\nconst POOL_KINDS: string[] = [CallerKind.USER, CallerKind.RETAILER, CallerKind.SUPPLIER, CallerKind.ADMIN];\n\nconst configError = (message: string) => new ErrorHttp(HTTP.INTERNAL_SERVER_ERROR, `Invalid CALLER_POOLS: ${message}`);\n\n/** Throws a 500 config error unless `pools` is an array of `{ userPoolId: string, kind: user|retailer|supplier|admin }` */\nexport function validateCallerPools(pools: unknown): CallerPoolConfig[] {\n  if (!Array.isArray(pools)) throw configError(\"expected an array\");\n  pools.forEach((pool, i) => {\n    if (!pool || typeof pool !== \"object\") throw configError(`entry ${i} is not an object`);\n    if (typeof pool.userPoolId !== \"string\" || !pool.userPoolId) throw configError(`entry ${i} needs userPoolId`);\n    if (!POOL_KINDS.includes(pool.kind)) throw configError(`entry ${i} has kind ${pool.kind}`);\n  });\n  return pools as CallerPoolConfig[];\n}\n\n/** Verifier for the pools (cached per pool config); an invalid pool config is a 500 config error */\nexport function createCallerVerifier(pools: CallerPoolConfig[]): CallerVerifier {\n  const key = JSON.stringify(pools);\n  let verifier = verifierCache.get(key);\n  if (!verifier) {\n    validateCallerPools(pools);\n    let jwtVerifier: { verify: (token: string) => Promise<unknown> };\n    try {\n      jwtVerifier = CognitoJwtVerifier.create(\n        pools.map((p) => ({ userPoolId: p.userPoolId, tokenUse: null, clientId: p.clientIds ?? null })),\n      );\n    } catch (err) {\n      throw configError(err?.message ?? String(err));\n    }\n    verifier = { verify: async (token) => (await jwtVerifier.verify(token)) as Record<string, any> };\n    verifierCache.set(key, verifier);\n  }\n  return verifier;\n}\n\n/** Parses and validates the CALLER_POOLS env value (memoized per string); invalid -> 500 config error */\nexport function parseCallerPoolsEnv(value: string | undefined): CallerPoolConfig[] | undefined {\n  if (!value?.trim()) return undefined;\n  const cached = poolsEnvCache.get(value);\n  if (cached) return cached;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(value);\n  } catch {\n    throw configError(\"not valid JSON\");\n  }\n  const pools = validateCallerPools(parsed);\n  poolsEnvCache.set(value, pools);\n  return pools;\n}\n\n/**\n * JWKS/network trouble is 503, anything else an invalid token (401). That includes ParameterValidationError:\n * at verify time the multi-issuer verifier throws it for a foreign or missing `iss` (client input).\n * Config errors surface earlier, from createCallerVerifier, outside the verify try (500).\n */\nfunction verifyFailure(err: unknown): ErrorHttp {\n  if (\n    err instanceof FetchError ||\n    err instanceof NonRetryableFetchError ||\n    err instanceof JwksNotAvailableInCacheError ||\n    err instanceof JwksValidationError\n  ) {\n    return new ErrorHttp(HTTP.SERVICE_UNAVAILABLE, \"Token keys are not available\");\n  }\n  return new ErrorHttp(HTTP.UNAUTHORIZED, \"Invalid token\");\n}\n\nexport async function resolveCaller(\n  authorization: string | undefined,\n  pools: CallerPoolConfig[],\n  adminGroups: string[],\n  verifier?: CallerVerifier,\n): Promise<Caller> {\n  if (!authorization) return { kind: CallerKind.GUEST };\n  const token = authorization.replace(/^Bearer\\s+/i, \"\").trim();\n\n  // Built outside the try: a config error must surface as 500, not as an invalid token\n  const tokenVerifier = verifier ?? createCallerVerifier(pools);\n  let claims: Record<string, any>;\n  try {\n    claims = await tokenVerifier.verify(token);\n  } catch (err) {\n    throw verifyFailure(err);\n  }\n\n  const poolId = String(claims.iss ?? \"\")\n    .split(\"/\")\n    .pop();\n  const pool = pools.find((p) => p.userPoolId === poolId);\n  if (!pool) throw new ErrorHttp(HTTP.UNAUTHORIZED, \"Unknown token issuer\");\n\n  if (pool.kind === CallerKind.ADMIN) {\n    const raw = claims[\"cognito:groups\"];\n    const groups: string[] = Array.isArray(raw) ? raw : typeof raw === \"string\" ? [raw] : [];\n    const allowed = adminGroups.map((g) => g.toLowerCase());\n    const isAdmin = groups.some((g) => allowed.includes(String(g).toLowerCase()));\n    return { kind: isAdmin ? CallerKind.ADMIN : CallerKind.USER, claims };\n  }\n  return { kind: pool.kind, claims };\n}\n"]}

package/dist/utils/auth/policy-view.d.ts

@@ -0,0 +1,42 @@
+import type { Caller } from "../../model/caller.model";
+import type { Filter } from "../../model/filter.model";
+import type { EndpointPolicy, ResponseFields } from "../../model/validation.model";
+/** Caller-mode config check: a policy `view` only takes effect together with `kinds` (500 otherwise) */
+export declare function assertViewHasKinds(policy: EndpointPolicy | undefined): void;
+/** Applies the caller kind check and the per-kind view (forced filters, response fields). Pure. */
+export declare function applyPolicyView(policy: EndpointPolicy, caller: Caller, filter: Filter): {
+    filter: Filter;
+    response?: ResponseFields;
+};
+/** Entity owner field names (subset of EntityConfig) that the service maps the owner aliases onto */
+export interface OwnerFieldNames {
+    OWNER_ID_FIELD_NAME?: string;
+    OWNER_PARENT_ID_FIELD_NAME?: string;
+}
+/**
+ * When the caller's view forces filter keys, drops client selectors that could bypass or replace them:
+ * `indexName`/`indexValue`/`indexSortName`/`indexSortValue` (index choice), range filters on a forced key,
+ * `rangeFilterBy/Min/Max` on a forced key, and every key whose base field is a forced key
+ * (`min_K`, `max_K`, `K__<op>`, `K.keyword*`, `K` + Min|Max|From|To|Start|End).
+ * When a forced key is an owner field (`profileId`, `ownerParentId`, `ownerId`, `owner.OWNER_ID_FIELD_NAME`,
+ * `owner.OWNER_PARENT_ID_FIELD_NAME`), all other owner aliases/fields are dropped from the client filter too,
+ * because the service maps them onto the owner field after the view and would overwrite the forced value. Pure.
+ */
+export declare function stripForcedSelectors(policy: EndpointPolicy, caller: Caller, filter: Filter, owner?: OwnerFieldNames): Filter;
+/**
+ * OpenSearch `search/query*` routes only read `field__op` keys, so a plain forced key would be ignored.
+ * Moves every forced key onto `K.keyword__eq` (scalar) or `K.keyword__in` (array, comma-joined) and removes
+ * every other client key for that field (`K`, `K__*`, `K.*`). Pure.
+ */
+export declare function applyForcedSearchQuery(filter: Filter, forced: Record<string, any>): Filter;
+/** Resolved forced filter of the caller's view; empty when the view forces nothing. Throws like applyPolicyView. */
+export declare function resolveForcedFilter(policy: EndpointPolicy, caller: Caller): Record<string, any>;
+/** Item matches a forced filter: an array value means membership, anything else equality on the item's field */
+export declare function matchesForcedFilter(item: Record<string, any> | null | undefined, forced: Record<string, any>): boolean;
+/**
+ * Guards a POST/PUT/PATCH body under a forced view: a body value for a forced key must match it (403 otherwise);
+ * on POST a missing scalar forced key is set from the forced value (array-valued keys are not injected).
+ * Returns the (possibly created) body; other methods and non-object bodies are returned unchanged.
+ */
+export declare function guardForcedBody(method: string, body: unknown, forced: Record<string, any>): unknown;
+//# sourceMappingURL=policy-view.d.ts.map

package/dist/utils/auth/policy-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-view.d.ts","sourceRoot":"","sources":["../../../src/utils/auth/policy-view.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAY,cAAc,EAAE,cAAc,EAAmB,MAAM,8BAA8B,CAAC;AAa9G,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,IAAI,CAI3E;AAED,mGAAmG;AACnG,wBAAgB,eAAe,CAC7B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,CAyB/C;AAaD,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC;AAYD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE,eAAe,GACtB,MAAM,CA2BR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,MAAM,CAU1F;AAED,oHAAoH;AACpH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAK/F;AAED,gHAAgH;AAChH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC1B,OAAO,CAKT;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAgBnG"}

package/dist/utils/auth/policy-view.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertViewHasKinds = assertViewHasKinds;
+exports.applyPolicyView = applyPolicyView;
+exports.stripForcedSelectors = stripForcedSelectors;
+exports.applyForcedSearchQuery = applyForcedSearchQuery;
+exports.resolveForcedFilter = resolveForcedFilter;
+exports.matchesForcedFilter = matchesForcedFilter;
+exports.guardForcedBody = guardForcedBody;
+const errors_1 = require("../../exception/errors");
+const exception_handler_1 = require("../../exception/exception-handler");
+const reflection_util_1 = require("../reflection.util");
+const isClaimRef = (v) => typeof v === "object" && v !== null && !Array.isArray(v) && typeof v.claim === "string";
+/**
+ * A claim value that would act as a query operator: DynamoDB treats `*x*`, `x*`, `!x` and `a,b` as
+ * contains / begins_with / not-equal / IN, OpenSearch treats `*` and `,` as wildcard and list separators.
+ */
+function isOperatorValue(value) {
+    return typeof value === "string" && (value.includes("*") || value.includes(",") || value.startsWith("!"));
+}
+/** Caller-mode config check: a policy `view` only takes effect together with `kinds` (500 otherwise) */
+function assertViewHasKinds(policy) {
+    if (policy?.view && !policy.kinds) {
+        throw new errors_1.ErrorHttp(exception_handler_1.HTTP.INTERNAL_SERVER_ERROR, "policy view requires kinds");
+    }
+}
+/** Applies the caller kind check and the per-kind view (forced filters, response fields). Pure. */
+function applyPolicyView(policy, caller, filter) {
+    if (policy.kinds && !policy.kinds.includes(caller.kind)) {
+        throw new errors_1.ErrorHttp(exception_handler_1.HTTP.FORBIDDEN, "Caller kind is not allowed");
+    }
+    const view = policy.view?.[caller.kind];
+    if (!view)
+        return { filter: { ...filter }, response: policy.response };
+    const forced = {};
+    for (const [key, value] of Object.entries(view.filter ?? {})) {
+        if (isClaimRef(value)) {
+            const resolved = caller.claims?.[value.claim];
+            if (resolved === undefined || resolved === null || resolved === "") {
+                throw new errors_1.ErrorHttp(exception_handler_1.HTTP.FORBIDDEN, `Missing claim ${value.claim}`);
+            }
+            // A claim must be a literal: `*`, `,` and a leading `!` would turn the forced equality into an operator
+            if (isOperatorValue(resolved)) {
+                throw new errors_1.ErrorHttp(exception_handler_1.HTTP.FORBIDDEN, `Claim ${value.claim} contains a query operator`);
+            }
+            forced[key] = resolved;
+        }
+        else {
+            // Forced arrays are IN lists: marked so DynamoDB index selection never joins them into a key
+            forced[key] = Array.isArray(value) ? (0, reflection_util_1.markForcedIn)([...value]) : value;
+        }
+    }
+    return { filter: { ...filter, ...forced }, response: view.response ?? policy.response };
+}
+const RANGE_SUFFIXES = ["Min", "Max", "From", "To", "Start", "End"];
+/** True when a client filter key selects on forced field `forced` other than by plain equality on `forced` itself */
+function isSelectorOf(key, forced) {
+    const lower = key.toLowerCase();
+    const forcedLower = forced.toLowerCase();
+    if (lower === `min_${forcedLower}` || lower === `max_${forcedLower}`)
+        return true;
+    if (key.startsWith(`${forced}__`) || key.startsWith(`${forced}.`))
+        return true;
+    return RANGE_SUFFIXES.some((suffix) => key === `${forced}${suffix}`);
+}
+/** Public owner aliases that the service (`parseOwnerFields`) rewrites onto the configured owner fields */
+const OWNER_ALIASES = ["profileId", "ownerParentId", "ownerId"];
+/** Owner alias and owner field names; the service may copy a client value from one onto another */
+function ownerTargets(owner) {
+    return [...OWNER_ALIASES, owner?.OWNER_ID_FIELD_NAME, owner?.OWNER_PARENT_ID_FIELD_NAME].filter((name) => !!name);
+}
+/**
+ * When the caller's view forces filter keys, drops client selectors that could bypass or replace them:
+ * `indexName`/`indexValue`/`indexSortName`/`indexSortValue` (index choice), range filters on a forced key,
+ * `rangeFilterBy/Min/Max` on a forced key, and every key whose base field is a forced key
+ * (`min_K`, `max_K`, `K__<op>`, `K.keyword*`, `K` + Min|Max|From|To|Start|End).
+ * When a forced key is an owner field (`profileId`, `ownerParentId`, `ownerId`, `owner.OWNER_ID_FIELD_NAME`,
+ * `owner.OWNER_PARENT_ID_FIELD_NAME`), all other owner aliases/fields are dropped from the client filter too,
+ * because the service maps them onto the owner field after the view and would overwrite the forced value. Pure.
+ */
+function stripForcedSelectors(policy, caller, filter, owner) {
+    const forcedKeys = Object.keys(policy.view?.[caller.kind]?.filter ?? {});
+    const result = { ...(filter ?? {}) };
+    if (!forcedKeys.length)
+        return result;
+    const owners = ownerTargets(owner);
+    if (forcedKeys.some((key) => owners.includes(key))) {
+        for (const name of owners)
+            if (!forcedKeys.includes(name))
+                delete result[name];
+    }
+    delete result.indexName;
+    delete result.indexValue;
+    delete result.indexSortName;
+    delete result.indexSortValue;
+    if (forcedKeys.includes(result.rangeFilterBy)) {
+        delete result.rangeFilterBy;
+        delete result.rangeFilterMin;
+        delete result.rangeFilterMax;
+    }
+    if (Array.isArray(result.rangeFilters)) {
+        result.rangeFilters = result.rangeFilters.filter((rf) => !forcedKeys.includes(rf.fieldName));
+        if (!result.rangeFilters.length)
+            delete result.rangeFilters;
+    }
+    for (const key of Object.keys(result)) {
+        if (forcedKeys.some((forced) => isSelectorOf(key, forced)))
+            delete result[key];
+    }
+    return result;
+}
+/**
+ * OpenSearch `search/query*` routes only read `field__op` keys, so a plain forced key would be ignored.
+ * Moves every forced key onto `K.keyword__eq` (scalar) or `K.keyword__in` (array, comma-joined) and removes
+ * every other client key for that field (`K`, `K__*`, `K.*`). Pure.
+ */
+function applyForcedSearchQuery(filter, forced) {
+    const result = { ...(filter ?? {}) };
+    for (const [key, value] of Object.entries(forced)) {
+        for (const name of Object.keys(result)) {
+            if (name === key || name.startsWith(`${key}__`) || name.startsWith(`${key}.`))
+                delete result[name];
+        }
+        if (Array.isArray(value))
+            result[`${key}.keyword__in`] = value.map(String).join(",");
+        else
+            result[`${key}.keyword__eq`] = value;
+    }
+    return result;
+}
+/** Resolved forced filter of the caller's view; empty when the view forces nothing. Throws like applyPolicyView. */
+function resolveForcedFilter(policy, caller) {
+    const forcedKeys = Object.keys(policy.view?.[caller.kind]?.filter ?? {});
+    if (!forcedKeys.length)
+        return {};
+    const { filter } = applyPolicyView(policy, caller, {});
+    return Object.fromEntries(forcedKeys.map((key) => [key, filter[key]]));
+}
+/** Item matches a forced filter: an array value means membership, anything else equality on the item's field */
+function matchesForcedFilter(item, forced) {
+    if (!item)
+        return false;
+    return Object.entries(forced).every(([key, value]) => Array.isArray(value) ? value.includes(item[key]) : item[key] === value);
+}
+const BODY_METHODS = ["POST", "PUT", "PATCH"];
+/**
+ * Guards a POST/PUT/PATCH body under a forced view: a body value for a forced key must match it (403 otherwise);
+ * on POST a missing scalar forced key is set from the forced value (array-valued keys are not injected).
+ * Returns the (possibly created) body; other methods and non-object bodies are returned unchanged.
+ */
+function guardForcedBody(method, body, forced) {
+    const upper = String(method ?? "").toUpperCase();
+    if (!BODY_METHODS.includes(upper) || !Object.keys(forced).length)
+        return body;
+    if (body !== undefined && body !== null && (typeof body !== "object" || Array.isArray(body)))
+        return body;
+    const target = (body ?? {});
+    for (const [key, value] of Object.entries(forced)) {
+        if (target[key] !== undefined) {
+            if (!matchesForcedFilter({ [key]: target[key] }, { [key]: value })) {
+                throw new errors_1.ErrorHttp(exception_handler_1.HTTP.FORBIDDEN, `Field ${key} is outside the caller's view`);
+            }
+        }
+        else if (upper === "POST" && !Array.isArray(value)) {
+            target[key] = value;
+        }
+    }
+    return body ?? (upper === "POST" && Object.keys(target).length ? target : body);
+}
+//# sourceMappingURL=policy-view.js.map

package/dist/utils/auth/policy-view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-view.js","sourceRoot":"","sources":["../../../src/utils/auth/policy-view.ts"],"names":[],"mappings":";;;;;;;;;AAAA,mDAAmD;AACnD,yEAAyD;AAEzD,wDAAkD;AAIlD,MAAM,UAAU,GAAG,CAAC,CAAkB,EAAiB,EAAE,CACvD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAQ,CAAc,CAAC,KAAK,KAAK,QAAQ,CAAC;AAExG;;;GAGG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,wGAAwG;AACxG,4BAAmC,MAAkC;IACnE,IAAI,MAAM,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,yBACE,MAAsB,EACtB,MAAc,EACd,MAAc;IAEd,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAEvE,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,wGAAwG;YACxG,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,SAAS,EAAE,SAAS,KAAK,CAAC,KAAK,4BAA4B,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,6FAA6F;YAC7F,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,8BAAY,EAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAEpE,qHAAqH;AACrH,SAAS,YAAY,CAAC,GAAW,EAAE,MAAc;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,KAAK,KAAK,OAAO,WAAW,EAAE,IAAI,KAAK,KAAK,OAAO,WAAW,EAAE;QAAE,OAAO,IAAI,CAAC;IAClF,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;AACvE,CAAC;AAQD,2GAA2G;AAC3G,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAEhE,mGAAmG;AACnG,SAAS,YAAY,CAAC,KAAuB;IAC3C,OAAO,CAAC,GAAG,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAC7F,CAAC,IAAI,EAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,8BACE,MAAsB,EACtB,MAAc,EACd,MAAc,EACd,KAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAW,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC,SAAS,CAAC;IACxB,OAAO,MAAM,CAAC,UAAU,CAAC;IACzB,OAAO,MAAM,CAAC,aAAa,CAAC;IAC5B,OAAO,MAAM,CAAC,cAAc,CAAC;IAC7B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC,aAAa,CAAC;QAC5B,OAAO,MAAM,CAAC,cAAc,CAAC;QAC7B,OAAO,MAAM,CAAC,cAAc,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,gCAAuC,MAAc,EAAE,MAA2B;IAChF,MAAM,MAAM,GAAW,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAChF,MAAM,CAAC,GAAG,GAAG,cAAc,CAAC,GAAG,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oHAAoH;AACpH,6BAAoC,MAAsB,EAAE,MAAc;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,gHAAgH;AAChH,6BACE,IAA4C,EAC5C,MAA2B;IAE3B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACnD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAE9C;;;;GAIG;AACH,yBAAgC,MAAc,EAAE,IAAa,EAAE,MAA2B;IACxF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1G,MAAM,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,kBAAS,CAAC,wBAAI,CAAC,SAAS,EAAE,SAAS,GAAG,+BAA+B,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC","sourcesContent":["import { ErrorHttp } from \"../../exception/errors\";\nimport { HTTP } from \"../../exception/exception-handler\";\nimport type { Caller } from \"../../model/caller.model\";\nimport { markForcedIn } from \"../reflection.util\";\nimport type { Filter } from \"../../model/filter.model\";\nimport type { ClaimRef, EndpointPolicy, ResponseFields, ViewFilterValue } from \"../../model/validation.model\";\n\nconst isClaimRef = (v: ViewFilterValue): v is ClaimRef =>\n  typeof v === \"object\" && v !== null && !Array.isArray(v) && typeof (v as ClaimRef).claim === \"string\";\n\n/**\n * A claim value that would act as a query operator: DynamoDB treats `*x*`, `x*`, `!x` and `a,b` as\n * contains / begins_with / not-equal / IN, OpenSearch treats `*` and `,` as wildcard and list separators.\n */\nfunction isOperatorValue(value: unknown): boolean {\n  return typeof value === \"string\" && (value.includes(\"*\") || value.includes(\",\") || value.startsWith(\"!\"));\n}\n\n/** Caller-mode config check: a policy `view` only takes effect together with `kinds` (500 otherwise) */\nexport function assertViewHasKinds(policy: EndpointPolicy | undefined): void {\n  if (policy?.view && !policy.kinds) {\n    throw new ErrorHttp(HTTP.INTERNAL_SERVER_ERROR, \"policy view requires kinds\");\n  }\n}\n\n/** Applies the caller kind check and the per-kind view (forced filters, response fields). Pure. */\nexport function applyPolicyView(\n  policy: EndpointPolicy,\n  caller: Caller,\n  filter: Filter,\n): { filter: Filter; response?: ResponseFields } {\n  if (policy.kinds && !policy.kinds.includes(caller.kind)) {\n    throw new ErrorHttp(HTTP.FORBIDDEN, \"Caller kind is not allowed\");\n  }\n  const view = policy.view?.[caller.kind];\n  if (!view) return { filter: { ...filter }, response: policy.response };\n\n  const forced: Record<string, any> = {};\n  for (const [key, value] of Object.entries(view.filter ?? {})) {\n    if (isClaimRef(value)) {\n      const resolved = caller.claims?.[value.claim];\n      if (resolved === undefined || resolved === null || resolved === \"\") {\n        throw new ErrorHttp(HTTP.FORBIDDEN, `Missing claim ${value.claim}`);\n      }\n      // A claim must be a literal: `*`, `,` and a leading `!` would turn the forced equality into an operator\n      if (isOperatorValue(resolved)) {\n        throw new ErrorHttp(HTTP.FORBIDDEN, `Claim ${value.claim} contains a query operator`);\n      }\n      forced[key] = resolved;\n    } else {\n      // Forced arrays are IN lists: marked so DynamoDB index selection never joins them into a key\n      forced[key] = Array.isArray(value) ? markForcedIn([...value]) : value;\n    }\n  }\n  return { filter: { ...filter, ...forced }, response: view.response ?? policy.response };\n}\n\nconst RANGE_SUFFIXES = [\"Min\", \"Max\", \"From\", \"To\", \"Start\", \"End\"];\n\n/** True when a client filter key selects on forced field `forced` other than by plain equality on `forced` itself */\nfunction isSelectorOf(key: string, forced: string): boolean {\n  const lower = key.toLowerCase();\n  const forcedLower = forced.toLowerCase();\n  if (lower === `min_${forcedLower}` || lower === `max_${forcedLower}`) return true;\n  if (key.startsWith(`${forced}__`) || key.startsWith(`${forced}.`)) return true;\n  return RANGE_SUFFIXES.some((suffix) => key === `${forced}${suffix}`);\n}\n\n/** Entity owner field names (subset of EntityConfig) that the service maps the owner aliases onto */\nexport interface OwnerFieldNames {\n  OWNER_ID_FIELD_NAME?: string;\n  OWNER_PARENT_ID_FIELD_NAME?: string;\n}\n\n/** Public owner aliases that the service (`parseOwnerFields`) rewrites onto the configured owner fields */\nconst OWNER_ALIASES = [\"profileId\", \"ownerParentId\", \"ownerId\"];\n\n/** Owner alias and owner field names; the service may copy a client value from one onto another */\nfunction ownerTargets(owner?: OwnerFieldNames): string[] {\n  return [...OWNER_ALIASES, owner?.OWNER_ID_FIELD_NAME, owner?.OWNER_PARENT_ID_FIELD_NAME].filter(\n    (name): name is string => !!name,\n  );\n}\n\n/**\n * When the caller's view forces filter keys, drops client selectors that could bypass or replace them:\n * `indexName`/`indexValue`/`indexSortName`/`indexSortValue` (index choice), range filters on a forced key,\n * `rangeFilterBy/Min/Max` on a forced key, and every key whose base field is a forced key\n * (`min_K`, `max_K`, `K__<op>`, `K.keyword*`, `K` + Min|Max|From|To|Start|End).\n * When a forced key is an owner field (`profileId`, `ownerParentId`, `ownerId`, `owner.OWNER_ID_FIELD_NAME`,\n * `owner.OWNER_PARENT_ID_FIELD_NAME`), all other owner aliases/fields are dropped from the client filter too,\n * because the service maps them onto the owner field after the view and would overwrite the forced value. Pure.\n */\nexport function stripForcedSelectors(\n  policy: EndpointPolicy,\n  caller: Caller,\n  filter: Filter,\n  owner?: OwnerFieldNames,\n): Filter {\n  const forcedKeys = Object.keys(policy.view?.[caller.kind]?.filter ?? {});\n  const result: Filter = { ...(filter ?? {}) };\n  if (!forcedKeys.length) return result;\n\n  const owners = ownerTargets(owner);\n  if (forcedKeys.some((key) => owners.includes(key))) {\n    for (const name of owners) if (!forcedKeys.includes(name)) delete result[name];\n  }\n\n  delete result.indexName;\n  delete result.indexValue;\n  delete result.indexSortName;\n  delete result.indexSortValue;\n  if (forcedKeys.includes(result.rangeFilterBy)) {\n    delete result.rangeFilterBy;\n    delete result.rangeFilterMin;\n    delete result.rangeFilterMax;\n  }\n  if (Array.isArray(result.rangeFilters)) {\n    result.rangeFilters = result.rangeFilters.filter((rf) => !forcedKeys.includes(rf.fieldName));\n    if (!result.rangeFilters.length) delete result.rangeFilters;\n  }\n  for (const key of Object.keys(result)) {\n    if (forcedKeys.some((forced) => isSelectorOf(key, forced))) delete result[key];\n  }\n  return result;\n}\n\n/**\n * OpenSearch `search/query*` routes only read `field__op` keys, so a plain forced key would be ignored.\n * Moves every forced key onto `K.keyword__eq` (scalar) or `K.keyword__in` (array, comma-joined) and removes\n * every other client key for that field (`K`, `K__*`, `K.*`). Pure.\n */\nexport function applyForcedSearchQuery(filter: Filter, forced: Record<string, any>): Filter {\n  const result: Filter = { ...(filter ?? {}) };\n  for (const [key, value] of Object.entries(forced)) {\n    for (const name of Object.keys(result)) {\n      if (name === key || name.startsWith(`${key}__`) || name.startsWith(`${key}.`)) delete result[name];\n    }\n    if (Array.isArray(value)) result[`${key}.keyword__in`] = value.map(String).join(\",\");\n    else result[`${key}.keyword__eq`] = value;\n  }\n  return result;\n}\n\n/** Resolved forced filter of the caller's view; empty when the view forces nothing. Throws like applyPolicyView. */\nexport function resolveForcedFilter(policy: EndpointPolicy, caller: Caller): Record<string, any> {\n  const forcedKeys = Object.keys(policy.view?.[caller.kind]?.filter ?? {});\n  if (!forcedKeys.length) return {};\n  const { filter } = applyPolicyView(policy, caller, {});\n  return Object.fromEntries(forcedKeys.map((key) => [key, filter[key]]));\n}\n\n/** Item matches a forced filter: an array value means membership, anything else equality on the item's field */\nexport function matchesForcedFilter(\n  item: Record<string, any> | null | undefined,\n  forced: Record<string, any>,\n): boolean {\n  if (!item) return false;\n  return Object.entries(forced).every(([key, value]) =>\n    Array.isArray(value) ? value.includes(item[key]) : item[key] === value,\n  );\n}\n\nconst BODY_METHODS = [\"POST\", \"PUT\", \"PATCH\"];\n\n/**\n * Guards a POST/PUT/PATCH body under a forced view: a body value for a forced key must match it (403 otherwise);\n * on POST a missing scalar forced key is set from the forced value (array-valued keys are not injected).\n * Returns the (possibly created) body; other methods and non-object bodies are returned unchanged.\n */\nexport function guardForcedBody(method: string, body: unknown, forced: Record<string, any>): unknown {\n  const upper = String(method ?? \"\").toUpperCase();\n  if (!BODY_METHODS.includes(upper) || !Object.keys(forced).length) return body;\n  if (body !== undefined && body !== null && (typeof body !== \"object\" || Array.isArray(body))) return body;\n\n  const target = (body ?? {}) as Record<string, any>;\n  for (const [key, value] of Object.entries(forced)) {\n    if (target[key] !== undefined) {\n      if (!matchesForcedFilter({ [key]: target[key] }, { [key]: value })) {\n        throw new ErrorHttp(HTTP.FORBIDDEN, `Field ${key} is outside the caller's view`);\n      }\n    } else if (upper === \"POST\" && !Array.isArray(value)) {\n      target[key] = value;\n    }\n  }\n  return body ?? (upper === \"POST\" && Object.keys(target).length ? target : body);\n}\n"]}

package/dist/utils/http/api-event.d.ts

@@ -0,0 +1,23 @@
+import type { HttpMethod } from "../../model/index.js";
+import type { APIGatewayProxyEvent, APIGatewayProxyEventV2 } from "aws-lambda";
+export type ApiEvent = APIGatewayProxyEvent | APIGatewayProxyEventV2;
+export interface NormalizedApiEvent {
+    version: "1.0" | "2.0";
+    method: HttpMethod;
+    /** Route template with leading slash, e.g. "/entities/{id}" */
+    routePath: string;
+    rawPath: string;
+    /** Header names are lower-cased */
+    headers: Record<string, string>;
+    query: Record<string, string>;
+    multiQuery: Record<string, string[]>;
+    pathParameters: Record<string, string>;
+    /** base64 already decoded */
+    body?: string;
+    /** REST API (v1) requestContext.authorizer.claims only */
+    restClaims?: Record<string, any>;
+    raw: ApiEvent;
+}
+export declare function isHttpApiEvent(event: ApiEvent): event is APIGatewayProxyEventV2;
+export declare function normalizeApiEvent(event: ApiEvent): NormalizedApiEvent;
+//# sourceMappingURL=api-event.d.ts.map

package/dist/utils/http/api-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-event.d.ts","sourceRoot":"","sources":["../../../src/utils/http/api-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,KAAK,GAAG,KAAK,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAE1D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,GAAG,EAAE,QAAQ,CAAC;CACf;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,KAAK,IAAI,sBAAsB,CAE/E;AAuBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,GAAG,kBAAkB,CAsDrE"}

package/dist/utils/http/api-event.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isHttpApiEvent = isHttpApiEvent;
+exports.normalizeApiEvent = normalizeApiEvent;
+function isHttpApiEvent(event) {
+    return event.version === "2.0";
+}
+function lowerCaseKeys(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (value !== undefined)
+            result[key.toLowerCase()] = value;
+    }
+    return result;
+}
+function definedEntries(record) {
+    const result = {};
+    for (const [key, value] of Object.entries(record ?? {})) {
+        if (value !== undefined)
+            result[key] = value;
+    }
+    return result;
+}
+function decodeBody(body, isBase64Encoded) {
+    if (body === null || body === undefined)
+        return undefined;
+    return isBase64Encoded ? Buffer.from(body, "base64").toString("utf-8") : body;
+}
+function normalizeApiEvent(event) {
+    if (isHttpApiEvent(event)) {
+        const query = definedEntries(event.queryStringParameters);
+        const multiQuery = {};
+        if (event.rawQueryString) {
+            const params = new URLSearchParams(event.rawQueryString);
+            for (const key of new Set(params.keys()))
+                multiQuery[key] = params.getAll(key);
+        }
+        else {
+            for (const [key, value] of Object.entries(query))
+                multiQuery[key] = value.split(",");
+        }
+        const routeKey = event.routeKey ?? "";
+        const spaceIdx = routeKey.indexOf(" ");
+        const routePath = routeKey === "$default" || spaceIdx < 0 ? event.rawPath : routeKey.slice(spaceIdx + 1);
+        return {
+            version: "2.0",
+            method: event.requestContext.http.method,
+            routePath,
+            rawPath: event.rawPath,
+            headers: lowerCaseKeys(event.headers),
+            query,
+            multiQuery,
+            pathParameters: definedEntries(event.pathParameters),
+            body: decodeBody(event.body, event.isBase64Encoded),
+            raw: event,
+        };
+    }
+    const multiQuery = {};
+    for (const [key, values] of Object.entries(event.multiValueQueryStringParameters ?? {})) {
+        if (values)
+            multiQuery[key] = values;
+    }
+    const query = definedEntries(event.queryStringParameters);
+    for (const [key, value] of Object.entries(query)) {
+        if (!(key in multiQuery))
+            multiQuery[key] = [value];
+    }
+    const resourcePath = event.requestContext?.resourcePath ?? event.resource ?? "";
+    const claims = event.requestContext?.authorizer?.claims;
+    return {
+        version: "1.0",
+        method: event.httpMethod,
+        routePath: resourcePath.startsWith("/") ? resourcePath : `/${resourcePath}`,
+        rawPath: event.path,
+        headers: lowerCaseKeys(event.headers),
+        query,
+        multiQuery,
+        pathParameters: definedEntries(event.pathParameters),
+        body: decodeBody(event.body, event.isBase64Encoded),
+        restClaims: claims ?? undefined,
+        raw: event,
+    };
+}
+//# sourceMappingURL=api-event.js.map