cabloy 5.1.136 → 5.1.138

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/bean.rbacCatalog.ts

@@ -0,0 +1,95 @@
+import type { ContextRoute } from 'vona-module-a-web';
+
+import { beanFullNameFromOnionName, BeanBase } from 'vona';
+import { Bean } from 'vona-module-a-bean';
+import { getCacheControllerRoutes } from 'vona-module-a-web';
+
+import type { IRbacActionDescriptor } from '../types/rbac.ts';
+import type { IGuardOptionsRbac } from './guard.rbac.ts';
+
+import { rbacActionKey } from '../lib/rbac.ts';
+
+const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+
+@Bean()
+export class BeanRbacCatalog extends BeanBase {
+  private _catalog: Map<string, IRbacActionDescriptor> | undefined;
+
+  getAction(route: ContextRoute): IRbacActionDescriptor | undefined {
+    return this.getCatalog().get(rbacActionKey(route.controllerBeanFullName, route.action));
+  }
+
+  getCatalog(): ReadonlyMap<string, IRbacActionDescriptor> {
+    if (!this._catalog) this._catalog = this.createCatalog();
+    return this._catalog;
+  }
+
+  clear(): void {
+    this._catalog = undefined;
+  }
+
+  private createCatalog(): Map<string, IRbacActionDescriptor> {
+    const catalog = new Map<string, IRbacActionDescriptor>();
+    const routesByController = getCacheControllerRoutes(this.app);
+    for (const routes of Object.values(routesByController)) {
+      for (const route of routes) {
+        const options = route.route.meta?.[BeanFullNameGuardRbac] as IGuardOptionsRbac | undefined;
+        if (!options) continue;
+        const actionKey = rbacActionKey(route.controllerBeanFullName, route.action);
+        catalog.set(actionKey, {
+          actionKey,
+          controllerBeanFullName: route.controllerBeanFullName,
+          action: route.action,
+          route,
+          options: Object.freeze({ ...options }),
+        });
+      }
+    }
+    this.resolveActionInherit(catalog, routesByController);
+    return catalog;
+  }
+
+  private resolveActionInherit(
+    catalog: ReadonlyMap<string, IRbacActionDescriptor>,
+    routesByController: Record<string, ContextRoute[]>,
+  ): void {
+    for (const descriptor of catalog.values()) {
+      if (!descriptor.options.actionInherit) continue;
+      const routes = routesByController[descriptor.controllerBeanFullName] ?? [];
+      const routesByAction = new Map(routes.map(route => [route.action, route]));
+      descriptor.actionInheritKey = this.resolveActionInheritKey(
+        descriptor,
+        catalog,
+        routesByAction,
+      );
+    }
+  }
+
+  private resolveActionInheritKey(
+    descriptor: IRbacActionDescriptor,
+    catalog: ReadonlyMap<string, IRbacActionDescriptor>,
+    routesByAction: ReadonlyMap<string, ContextRoute>,
+  ): string {
+    const seen = new Set<string>([descriptor.actionKey]);
+    let current = descriptor;
+    while (current.options.actionInherit) {
+      const action = current.options.actionInherit;
+      if (action === current.action) {
+        throw new Error(`RBAC actionInherit cannot reference itself: ${current.actionKey}`);
+      }
+      const route = routesByAction.get(action);
+      if (!route) {
+        throw new Error(`RBAC actionInherit target not found: ${current.actionKey} -> ${action}`);
+      }
+      const targetKey = rbacActionKey(current.controllerBeanFullName, action);
+      if (seen.has(targetKey)) {
+        throw new Error(`RBAC actionInherit cycle: ${descriptor.actionKey}`);
+      }
+      seen.add(targetKey);
+      const target = catalog.get(targetKey);
+      if (!target) return targetKey;
+      current = target;
+    }
+    return current.actionKey;
+  }
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/bean.rbacScope.ts

@@ -0,0 +1,218 @@
+import type { TableIdentity } from 'table-identity';
+import type { TypeModelWhere } from 'vona-module-a-orm';
+
+import { BeanBase, beanFullNameFromOnionName } from 'vona';
+import { Bean } from 'vona-module-a-bean';
+
+import type { IRbacActionDescriptor, IRbacPolicyDecision, IRbacScopeTerm } from '../types/rbac.ts';
+import type { IRbacScopeAccess, IRbacScopeAdapter } from '../types/scope.ts';
+
+import { getRbacDecision, hasRbacAllScope, rbacActionKey } from '../lib/rbac.ts';
+
+@Bean()
+export class BeanRbacScope extends BeanBase {
+  private _scopeAdapter: IRbacScopeAdapter | undefined;
+
+  async isUnrestricted(): Promise<boolean> {
+    return await this.scopeAdapter.isUnrestricted();
+  }
+
+  async current(actionKey?: string): Promise<IRbacScopeAccess> {
+    const action = this.resolveAction(actionKey);
+    if (!action) this.app.throw(403);
+
+    const decision = getRbacDecision(this.ctx);
+    if (!this.isDecisionForAction(decision, action)) this.app.throw(403);
+
+    const unrestricted = hasRbacAllScope(decision);
+    const ownerValues =
+      action.action === 'create'
+        ? await this.prepareOwnerValues(action, decision, unrestricted)
+        : undefined;
+    return this.createAccess(action, decision, unrestricted, ownerValues);
+  }
+
+  private get scopeAdapter(): IRbacScopeAdapter {
+    if (!this._scopeAdapter) {
+      const beanFullName = beanFullNameFromOnionName(
+        this.scope.config.adapter.rbacScope,
+        'service',
+      );
+      this._scopeAdapter = this.bean._getBean(beanFullName) as unknown as IRbacScopeAdapter;
+    }
+    return this._scopeAdapter;
+  }
+
+  private async prepareOwnerValues(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+  ): Promise<Record<string, TableIdentity | null | undefined>> {
+    const values = await this.scopeAdapter.ownerValues(action, decision);
+    const departmentField = action.options.dataScopeField ?? 'departmentId';
+    const ownerField = action.options.dataScopeMineField ?? 'userIdOwner';
+    const ownerValues = {
+      [departmentField]: values.departmentId,
+      [ownerField]: values.userIdOwner,
+    };
+    if (!this.matches(action, decision, unrestricted, ownerValues)) this.app.throw(403);
+    return ownerValues;
+  }
+
+  private createAccess(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    ownerValues: Record<string, TableIdentity | null | undefined> | undefined,
+  ): IRbacScopeAccess {
+    return {
+      action,
+      decision,
+      unrestricted,
+      ownerValues: () => {
+        if (!ownerValues) this.app.throw(500, 'RBAC scope owner values are not initialized');
+        return { ...ownerValues };
+      },
+      where: (callerWhere?: TypeModelWhere<any>) =>
+        this.where(action, decision, unrestricted, callerWhere),
+      checkEntry: (entry: object | undefined) => {
+        if (entry !== undefined && !this.matches(action, decision, unrestricted, entry)) {
+          this.app.throw(403);
+        }
+      },
+      checkEntries: (entries: readonly object[]) => {
+        for (const entry of entries) {
+          if (!this.matches(action, decision, unrestricted, entry)) this.app.throw(403);
+        }
+      },
+      permissionProjection: () => this.permissionProjection(action, decision, unrestricted),
+    };
+  }
+
+  private permissionProjection(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+  ) {
+    const matcher =
+      unrestricted || !action.options.dataScope
+        ? { mode: 'all' as const }
+        : {
+            mode: 'any' as const,
+            rules: (decision.terms ?? []).flatMap(term => {
+              if (term.dataScope === 'all') return [];
+              if (term.dataScope === 'mine') {
+                return [
+                  {
+                    field: action.options.dataScopeMineField ?? 'userIdOwner',
+                    values: [term.ownerId],
+                  },
+                ];
+              }
+              return [
+                {
+                  field: action.options.dataScopeField ?? 'departmentId',
+                  values: [...term.departmentIds],
+                },
+              ];
+            }),
+          };
+    if (matcher.mode === 'any' && matcher.rules.length === 0) this.app.throw(403);
+    return { key: action.actionKey, allowed: decision.allowed, matcher };
+  }
+
+  private where(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    callerWhere?: TypeModelWhere<any>,
+  ): TypeModelWhere<any> | undefined {
+    if (unrestricted) return callerWhere;
+    const scopeWhere = this.scopeWhere(action, decision);
+    if (!scopeWhere) this.app.throw(403);
+    if (!callerWhere) return scopeWhere;
+    return { _and_: { _and_: callerWhere, _and_0: scopeWhere } } as TypeModelWhere<any>;
+  }
+
+  private scopeWhere(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+  ): TypeModelWhere<any> | undefined {
+    const predicates = (decision.terms ?? []).flatMap(term => this.termPredicates(action, term));
+    if (!predicates.length) return undefined;
+    return (predicates.length === 1 ? predicates[0] : { _or_: predicates }) as TypeModelWhere<any>;
+  }
+
+  private matches(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+    unrestricted: boolean,
+    row: object,
+  ): boolean {
+    const values = row as Record<string, unknown>;
+    if (unrestricted) return true;
+    return (decision.terms ?? []).some(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine') {
+        const field = action.options.dataScopeMineField ?? 'userIdOwner';
+        return String(values[field] ?? '') === term.ownerId;
+      }
+      const field = action.options.dataScopeField ?? 'departmentId';
+      return term.departmentIds.includes(String(values[field] ?? ''));
+    });
+  }
+
+  private resolveAction(actionKey?: string): IRbacActionDescriptor | undefined {
+    const catalog = this.bean.rbacCatalog.getCatalog();
+    if (actionKey) return catalog.get(actionKey);
+    const route = this.ctx.route;
+    return route
+      ? catalog.get(rbacActionKey(route.controllerBeanFullName, route.action))
+      : undefined;
+  }
+
+  private isDecisionForAction(
+    decision: IRbacPolicyDecision | undefined,
+    action: IRbacActionDescriptor,
+  ): decision is IRbacPolicyDecision {
+    return Boolean(
+      decision?.allowed &&
+      decision.actionKey === action.actionKey &&
+      decision.action.actionKey === action.actionKey &&
+      decision.action.actionInheritKey === action.actionInheritKey &&
+      decision.action.controllerBeanFullName === action.controllerBeanFullName &&
+      decision.action.action === action.action &&
+      this.isValidTerms(decision.terms),
+    );
+  }
+
+  private isValidTerms(terms: IRbacScopeTerm[] | undefined): boolean {
+    if (!terms?.length) return false;
+    return terms.every(term => {
+      if (term.dataScope === 'all') return true;
+      if (term.dataScope === 'mine')
+        return typeof term.ownerId === 'string' && term.ownerId.length > 0;
+      return (
+        ['customDepartments', 'ownDepartment', 'ownDepartmentAndDescendants'].includes(
+          term.dataScope,
+        ) &&
+        Array.isArray(term.departmentIds) &&
+        term.departmentIds.length > 0 &&
+        term.departmentIds.every(id => typeof id === 'string' && id.length > 0)
+      );
+    });
+  }
+
+  private termPredicates(
+    action: IRbacActionDescriptor,
+    term: IRbacScopeTerm,
+  ): Record<string, unknown>[] {
+    if (term.dataScope === 'all') return [{}];
+    if (term.dataScope === 'mine') {
+      const field = action.options.dataScopeMineField ?? 'userIdOwner';
+      return [{ [field]: term.ownerId }];
+    }
+    const field = action.options.dataScopeField ?? 'departmentId';
+    return [{ [field]: { _in_: term.departmentIds } }];
+  }
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/event.policyInvalidated.ts

@@ -0,0 +1,17 @@
+import { BeanEventBase, Event } from 'vona-module-a-event';
+
+export type TypeRbacPolicyInvalidationKind = 'policy' | 'role' | 'scopeTopology';
+
+export interface TypeEventPolicyInvalidatedData {
+  kind: TypeRbacPolicyInvalidationKind;
+  removedRoleIds?: string[];
+  removedScopeIds?: string[];
+}
+
+export type TypeEventPolicyInvalidatedResult = void;
+
+@Event()
+export class EventPolicyInvalidated extends BeanEventBase<
+  TypeEventPolicyInvalidatedData,
+  TypeEventPolicyInvalidatedResult
+> {}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/event.resolvePolicy.ts

@@ -0,0 +1,13 @@
+import { BeanEventBase, Event } from 'vona-module-a-event';
+
+import type { IRbacPolicyDecision, IRbacPolicyRequest } from '../types/rbac.ts';
+
+export type TypeEventResolvePolicyData = IRbacPolicyRequest;
+
+export type TypeEventResolvePolicyResult = IRbacPolicyDecision | undefined;
+
+@Event()
+export class EventResolvePolicy extends BeanEventBase<
+  TypeEventResolvePolicyData,
+  TypeEventResolvePolicyResult
+> {}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/guard.rbac.ts

@@ -0,0 +1,102 @@
+import type { IDecoratorGuardOptions } from 'vona-module-a-aspect';
+
+import { Guard, GuardBase } from 'vona-module-a-aspect';
+
+import type {
+  IRbacActionDescriptor,
+  IRbacPolicyDecision,
+  IRbacScopeTerm,
+  TypeRbacDataScope,
+} from '../types/rbac.ts';
+
+import { clearRbacDecision, createRbacAllScopeDecision, setRbacDecision } from '../lib/rbac.ts';
+
+export interface IGuardOptionsRbac extends IDecoratorGuardOptions {
+  dataScope?: boolean;
+  dataScopeField?: string;
+  dataScopeMineField?: string;
+  actionInherit?: string;
+}
+
+@Guard<IGuardOptionsRbac>({
+  dataScopeField: 'departmentId',
+  dataScopeMineField: 'userIdOwner',
+})
+export class GuardRbac extends GuardBase {
+  async check(options: IGuardOptionsRbac): Promise<boolean> {
+    clearRbacDecision(this.ctx);
+    const action = this.bean.rbacCatalog.getAction(this.ctx.route);
+    if (!action) return false;
+    const effectiveAction = { ...action, options: { ...action.options, ...options } };
+    if (await this.bean.rbacScope.isUnrestricted()) {
+      setRbacDecision(this.ctx, createRbacAllScopeDecision(effectiveAction));
+      return true;
+    }
+
+    const decision = await this.scope.event.resolvePolicy.emit(
+      {
+        action: effectiveAction,
+        policyActionKey: action.actionInheritKey ?? action.actionKey,
+      },
+      async () => undefined,
+    );
+    if (!this.isValidDecision(decision, effectiveAction) || !decision.allowed) return false;
+    setRbacDecision(this.ctx, { ...decision, action: effectiveAction });
+    return true;
+  }
+
+  private isValidDecision(
+    decision: unknown,
+    action: IRbacActionDescriptor,
+  ): decision is IRbacPolicyDecision {
+    if (!decision || typeof decision !== 'object') return false;
+    const value = decision as Partial<IRbacPolicyDecision>;
+    if (typeof value.allowed !== 'boolean' || value.actionKey !== action.actionKey) return false;
+    if (!this.isValidAction(value.action, action)) return false;
+    if (value.revision !== undefined && typeof value.revision !== 'string') return false;
+    if (value.terms !== undefined && !this.isValidTerms(value.terms)) return false;
+    return !value.allowed || !action.options.dataScope || this.isValidTerms(value.terms);
+  }
+
+  private isValidAction(value: unknown, action: IRbacActionDescriptor): boolean {
+    if (!value || typeof value !== 'object') return false;
+    const descriptor = value as Partial<IRbacActionDescriptor>;
+    return (
+      descriptor.actionKey === action.actionKey &&
+      descriptor.actionInheritKey === action.actionInheritKey &&
+      descriptor.controllerBeanFullName === action.controllerBeanFullName &&
+      descriptor.action === action.action
+    );
+  }
+
+  private isValidTerms(value: unknown): value is IRbacScopeTerm[] {
+    return Array.isArray(value) && value.length > 0 && value.every(term => this.isValidTerm(term));
+  }
+
+  private isValidTerm(value: unknown): value is IRbacScopeTerm {
+    if (!value || typeof value !== 'object') return false;
+    const term = value as {
+      dataScope?: unknown;
+      departmentIds?: unknown;
+      ownerId?: unknown;
+    };
+    if (term.dataScope === 'all') return true;
+    if (term.dataScope === 'mine') {
+      return typeof term.ownerId === 'string' && term.ownerId.length > 0;
+    }
+    if (!this.isDepartmentDataScope(term.dataScope)) return false;
+    return (
+      Array.isArray(term.departmentIds) &&
+      term.departmentIds.length > 0 &&
+      term.departmentIds.every(id => typeof id === 'string' && id.length > 0)
+    );
+  }
+
+  private isDepartmentDataScope(
+    value: unknown,
+  ): value is Exclude<TypeRbacDataScope, 'all' | 'mine'> {
+    return ['customDepartments', 'ownDepartment', 'ownDepartmentAndDescendants'].includes(
+      value as Exclude<TypeRbacDataScope, 'all' | 'mine'>,
+    );
+  }
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/bean/index.ts

@@ -0,0 +1,5 @@
+export * from './bean.rbacCatalog.ts';
+export * from './bean.rbacScope.ts';
+export * from './event.policyInvalidated.ts';
+export * from './event.resolvePolicy.ts';
+export * from './guard.rbac.ts';

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/config/config.ts

@@ -0,0 +1,10 @@
+import type { VonaApplication } from 'vona';
+import type { IServiceRecord } from 'vona-module-a-bean';
+
+export function config(_app: VonaApplication) {
+  return {
+    adapter: {
+      rbacScope: 'admin-rbac:rbacScopeAdapter' as keyof IServiceRecord,
+    },
+  };
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/index.ts

@@ -0,0 +1,3 @@
+export * from './lib/index.ts';
+export * from './types/index.ts';
+export * from './.metadata/index.ts';

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/lib/index.ts

@@ -0,0 +1 @@
+export * from './rbac.ts';

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/lib/rbac.ts

@@ -0,0 +1,46 @@
+import type { VonaContext } from 'vona';
+
+import type { IRbacCapability, IRbacPolicyDecision } from '../types/rbac.ts';
+
+export const SymbolRbacDecision = Symbol('SymbolRbacDecision');
+
+export function createRbacAllScopeDecision(
+  action: IRbacPolicyDecision['action'],
+): IRbacPolicyDecision {
+  return { allowed: true, actionKey: action.actionKey, action, terms: [{ dataScope: 'all' }] };
+}
+
+export function createRbacCapability(key: string, allowed: boolean): IRbacCapability {
+  return { key, allowed };
+}
+
+export function isRbacCapability(value: unknown): value is IRbacCapability {
+  if (!value || typeof value !== 'object') return false;
+  const capability = value as Partial<IRbacCapability>;
+  return (
+    Object.keys(capability).every(key => key === 'key' || key === 'allowed') &&
+    typeof capability.key === 'string' &&
+    capability.key.length > 0 &&
+    typeof capability.allowed === 'boolean'
+  );
+}
+
+export function hasRbacAllScope(decision: IRbacPolicyDecision): boolean {
+  return decision.terms?.some(term => term.dataScope === 'all') === true;
+}
+
+export function rbacActionKey(controllerBeanFullName: string, action: string): string {
+  return `${controllerBeanFullName}#${action}`;
+}
+
+export function getRbacDecision(ctx: VonaContext): IRbacPolicyDecision | undefined {
+  return ctx[SymbolRbacDecision];
+}
+
+export function setRbacDecision(ctx: VonaContext, decision: IRbacPolicyDecision): void {
+  ctx[SymbolRbacDecision] = decision;
+}
+
+export function clearRbacDecision(ctx: VonaContext): void {
+  delete ctx[SymbolRbacDecision];
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/types/index.ts

@@ -0,0 +1,2 @@
+export * from './rbac.ts';
+export * from './scope.ts';

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/types/rbac.ts

@@ -0,0 +1,46 @@
+import type { ContextRoute } from 'vona-module-a-web';
+
+import type { IGuardOptionsRbac } from '../bean/guard.rbac.ts';
+
+export type TypeRbacDataScope =
+  | 'all'
+  | 'customDepartments'
+  | 'ownDepartment'
+  | 'ownDepartmentAndDescendants'
+  | 'mine';
+
+export interface IRbacActionDescriptor {
+  actionKey: string;
+  controllerBeanFullName: string;
+  action: string;
+  actionInheritKey?: string;
+  route: ContextRoute;
+  options: IGuardOptionsRbac;
+}
+
+export interface IRbacPolicyRequest {
+  action: IRbacActionDescriptor;
+  policyActionKey: string;
+}
+
+export type IRbacScopeTerm =
+  | { dataScope: 'all' }
+  | {
+      dataScope: 'customDepartments' | 'ownDepartment' | 'ownDepartmentAndDescendants';
+      departmentIds: string[];
+    }
+  | { dataScope: 'mine'; ownerId: string };
+
+export interface IRbacPolicyDecision {
+  allowed: boolean;
+  actionKey: string;
+  action: IRbacActionDescriptor;
+  terms?: IRbacScopeTerm[];
+  revision?: string;
+}
+
+/** A server-derived UX hint; it never grants backend authority. */
+export interface IRbacCapability {
+  key: string;
+  allowed: boolean;
+}

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/src/types/scope.ts

@@ -0,0 +1,27 @@
+import type { TableIdentity } from 'table-identity';
+import type { IOpenapiPermissionActionRbac } from 'vona-module-a-openapi';
+import type { TypeModelWhere } from 'vona-module-a-orm';
+
+import type { IRbacActionDescriptor, IRbacPolicyDecision } from './rbac.ts';
+
+export type IRbacScopeOwnerValues = Record<string, TableIdentity | null | undefined>;
+
+export interface IRbacScopeAdapter {
+  isUnrestricted(): Promise<boolean>;
+  ownerValues(
+    action: IRbacActionDescriptor,
+    decision: IRbacPolicyDecision,
+  ): Promise<IRbacScopeOwnerValues>;
+}
+
+export interface IRbacScopeAccess {
+  action: IRbacActionDescriptor;
+  decision: IRbacPolicyDecision;
+  unrestricted: boolean;
+  ownerValues(): Record<string, TableIdentity | null | undefined>;
+  where(callerWhere?: TypeModelWhere<any>): TypeModelWhere<any> | undefined;
+  checkEntry(entry: object | undefined): void;
+  checkEntries(entries: readonly object[]): void;
+  /** A safe permission projection for Resource permission consumers. */
+  permissionProjection(): IOpenapiPermissionActionRbac;
+}