cabloy 5.1.136 → 5.1.138

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [
@@ -31,6 +31,9 @@
     "prepack": "clean-package",
     "postpack": "clean-package restore"
   },
+  "dependencies": {
+    "vona-module-a-rbac": "workspace:^"
+  },
   "devDependencies": {
     "clean-package": "^2.2.0",
     "rimraf": "^6.1.3"

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/.metadata/index.ts

@@ -6,15 +6,15 @@ export * from '../bean/bean.permission.ts';
 
 import 'vona';
 declare module 'vona' {
-  
-  
+
+
 }
 declare module 'vona-module-a-permission' {
-  
+
         export interface BeanPermission {
           /** @internal */
           get scope(): ScopeModuleAPermission;
-        } 
+        }
 }
 /** bean: end */
 /** bean: begin */
@@ -32,11 +32,11 @@ export * from '../bean/event.retrievePermissions.ts';
 
 import 'vona';
 declare module 'vona' {
-  
-  
+
+
 }
 declare module 'vona-module-a-permission' {
-  
+
         export interface EventRetrievePermissionAction {
           /** @internal */
           get scope(): ScopeModuleAPermission;
@@ -45,7 +45,6 @@ declare module 'vona-module-a-permission' {
           export interface EventRetrievePermissionAction {
             get $beanFullName(): 'a-permission.event.retrievePermissionAction';
             get $onionName(): 'a-permission:retrievePermissionAction';
-            
           }
 
         export interface EventRetrievePermissions {
@@ -56,8 +55,7 @@ declare module 'vona-module-a-permission' {
           export interface EventRetrievePermissions {
             get $beanFullName(): 'a-permission.event.retrievePermissions';
             get $onionName(): 'a-permission:retrievePermissions';
-            
-          } 
+          }
 }
 /** event: end */
 /** event: begin */
@@ -71,7 +69,7 @@ export interface IModuleEvent {
 /** event: begin */
 import type { TypeEventRetrievePermissionActionData, TypeEventRetrievePermissionActionResult } from '../bean/event.retrievePermissionAction.ts';
 import type { TypeEventRetrievePermissionsData, TypeEventRetrievePermissionsResult } from '../bean/event.retrievePermissions.ts';
-import type { EventOn } from 'vona-module-a-event'; 
+import type { EventOn } from 'vona-module-a-event';
 declare module 'vona-module-a-event' {
   export interface IEventRecord {
     'a-permission:retrievePermissionAction': EventOn<TypeEventRetrievePermissionActionData, TypeEventRetrievePermissionActionResult>;
@@ -81,20 +79,22 @@ declare module 'vona-module-a-event' {
 /** event: end */
 /** summerCache: begin */
 export * from '../bean/summerCache.permissionActionByRoles.ts';
+export * from '../bean/summerCache.permissionActionByUser.ts';
 export * from '../bean/summerCache.permissionUser.ts';
 
 import { type IDecoratorSummerCacheOptions } from 'vona-module-a-summer';
 declare module 'vona-module-a-summer' {
-  
+
     export interface ISummerCacheRecord {
       'a-permission:permissionActionByRoles': IDecoratorSummerCacheOptions;
+'a-permission:permissionActionByUser': IDecoratorSummerCacheOptions;
 'a-permission:permissionUser': IDecoratorSummerCacheOptions;
     }
 
-  
+
 }
 declare module 'vona-module-a-permission' {
-  
+
         export interface SummerCachePermissionActionByRoles {
           /** @internal */
           get scope(): ScopeModuleAPermission;
@@ -106,6 +106,17 @@ declare module 'vona-module-a-permission' {
             get $onionOptions(): IDecoratorSummerCacheOptions;
           }
 
+        export interface SummerCachePermissionActionByUser {
+          /** @internal */
+          get scope(): ScopeModuleAPermission;
+        }
+
+          export interface SummerCachePermissionActionByUser {
+            get $beanFullName(): 'a-permission.summerCache.permissionActionByUser';
+            get $onionName(): 'a-permission:permissionActionByUser';
+            get $onionOptions(): IDecoratorSummerCacheOptions;
+          }
+
         export interface SummerCachePermissionUser {
           /** @internal */
           get scope(): ScopeModuleAPermission;
@@ -115,14 +126,16 @@ declare module 'vona-module-a-permission' {
             get $beanFullName(): 'a-permission.summerCache.permissionUser';
             get $onionName(): 'a-permission:permissionUser';
             get $onionOptions(): IDecoratorSummerCacheOptions;
-          } 
+          }
 }
 /** summerCache: end */
 /** summerCache: begin */
 import type { SummerCachePermissionActionByRoles } from '../bean/summerCache.permissionActionByRoles.ts';
+import type { SummerCachePermissionActionByUser } from '../bean/summerCache.permissionActionByUser.ts';
 import type { SummerCachePermissionUser } from '../bean/summerCache.permissionUser.ts';
 export interface IModuleSummerCache {
   'permissionActionByRoles': SummerCachePermissionActionByRoles;
+'permissionActionByUser': SummerCachePermissionActionByUser;
 'permissionUser': SummerCachePermissionUser;
 }
 /** summerCache: end */
@@ -131,21 +144,21 @@ export * from '../dto/permissions.tsx';
 import type { IDtoOptionsPermissions } from '../dto/permissions.tsx';
 import 'vona-module-a-web';
 declare module 'vona-module-a-web' {
-  
+
     export interface IDtoRecord {
       'a-permission:permissions': IDtoOptionsPermissions;
     }
 
-  
+
 }
 declare module 'vona-module-a-permission' {
-   
+
 }
 /** dto: end */
 /** dto: begin */
 import type { DtoPermissions } from '../dto/permissions.tsx';
 declare module 'vona-module-a-permission' {
-  
+
     export interface IDtoOptionsPermissions {
       fields?: TypeEntityOptionsFields<DtoPermissions, IDtoOptionsPermissions[TypeSymbolKeyFieldsMore]>;
     }
@@ -178,13 +191,13 @@ declare module 'vona' {
   export interface IBeanScopeContainer {
     permission: ScopeModuleAPermission;
   }
-  
+
   export interface IBeanScopeConfig {
     'a-permission': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
 /** scope: end */

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/bean.permission.ts

@@ -1,5 +1,6 @@
 import type { ICachingActionKeyInfo } from 'vona-module-a-caching';
 import type {
+  IOpenapiPermissionAction,
   IOpenapiPermissionModeActionActions,
   IOpenapiPermissions,
   IResourceRecord,
@@ -10,6 +11,7 @@ import type { ContextRoute, IRecordResourceNameToRoutePathItem } from 'vona-modu
 import { appResource, BeanBase, beanFullNameFromOnionName } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import { Caching } from 'vona-module-a-caching';
+import { clearRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
 import {
   composeGuards,
   getCacheControllerRoutes,
@@ -17,6 +19,7 @@ import {
 } from 'vona-module-a-web';
 
 const BeanFullNameGuardPassport = beanFullNameFromOnionName('a-user:passport', 'guard');
+const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
 const GuardOptionsPassportDefault: IGuardOptionsPassport = {
   public: false,
   activated: true,
@@ -34,22 +37,33 @@ export class BeanPermission extends BeanBase {
     const cachePermissionActionByRoles = this.bean.summer.cache(
       beanFullNameFromOnionName('a-permission:permissionActionByRoles', 'summerCache'),
     );
+    const cachePermissionActionByUser = this.bean.summer.cache(
+      beanFullNameFromOnionName('a-permission:permissionActionByUser', 'summerCache'),
+    );
     await cachePermissionUser.clear();
     await cachePermissionActionByRoles.clear();
+    await cachePermissionActionByUser.clear();
   }
 
   protected retrievePermissionsCacheKey(info: ICachingActionKeyInfo): string {
     const resource = info.args[0];
     const userId = this.ctx.passport.user?.id;
-    return `user:${resource}_${userId}`;
+    return `user:${resource}:user:${userId ?? 'anonymous'}`;
   }
 
-  protected retrievePermissionActionCacheKey(info: ICachingActionKeyInfo): string {
+  protected retrievePermissionActionByRolesCacheKey(info: ICachingActionKeyInfo): string {
     const [resource, actionKey] = info.args as [keyof IResourceRecord, string];
     const roleIdsKey = this._extractCurrentRoleIdsSorted().join(',') || 'none';
     return `action:${resource}:${actionKey}:roles:${roleIdsKey}`;
   }
 
+  protected retrievePermissionActionByUserCacheKey(info: ICachingActionKeyInfo): string {
+    const [resource, actionKey] = info.args as [keyof IResourceRecord, string];
+    const userId = this.ctx.passport.user?.id;
+    const roleIdsKey = this._extractCurrentRoleIdsSorted().join(',') || 'none';
+    return `action:${resource}:${actionKey}:user:${userId ?? 'anonymous'}:roles:${roleIdsKey}`;
+  }
+
   @Caching.get({
     cacheName: 'a-permission:permissionUser',
     cacheKeyFn: 'retrievePermissionsCacheKey',
@@ -81,29 +95,57 @@ export class BeanPermission extends BeanBase {
     return { actions: permissionsActions };
   }
 
-  public async retrievePermissionAction(
+  /**
+   * Returns only the final boolean permission result for server-side callers that
+   * do not need the browser-safe RBAC matcher projection.
+   */
+  public async checkPermissionAction(
     resource: keyof IResourceRecord,
     actionKey: string,
   ): Promise<boolean> {
+    const permission = await this.retrievePermissionAction(resource, actionKey);
+    return typeof permission === 'boolean' ? permission : permission.allowed;
+  }
+
+  public async retrievePermissionAction(
+    resource: keyof IResourceRecord,
+    actionKey: string,
+  ): Promise<IOpenapiPermissionAction> {
     const route = this._getControllerActionRoute(resource, actionKey);
     if (!route?.route?.meta) return false;
     if (!this._matchPassportMeta(route.route.meta)) return false;
     return await this.scope.event.retrievePermissionAction.emit(
       { resource, actionKey },
       async () => {
-        return await this.retrievePermissionActionByRoles(resource, actionKey);
+        const isRbac = Boolean(route.route.meta?.[BeanFullNameGuardRbac]);
+        return isRbac
+          ? await this.retrievePermissionActionByUser(resource, actionKey)
+          : await this.retrievePermissionActionByRoles(resource, actionKey);
       },
     );
   }
 
   @Caching.get({
     cacheName: 'a-permission:permissionActionByRoles',
-    cacheKeyFn: 'retrievePermissionActionCacheKey',
+    cacheKeyFn: 'retrievePermissionActionByRolesCacheKey',
   })
   protected async retrievePermissionActionByRoles(
     resource: keyof IResourceRecord,
     actionKey: string,
-  ): Promise<boolean> {
+  ): Promise<IOpenapiPermissionAction> {
+    const route = this._getControllerActionRoute(resource, actionKey);
+    if (!route?.route?.meta) return false;
+    return await this._evaluatePermissionAction(route);
+  }
+
+  @Caching.get({
+    cacheName: 'a-permission:permissionActionByUser',
+    cacheKeyFn: 'retrievePermissionActionByUserCacheKey',
+  })
+  protected async retrievePermissionActionByUser(
+    resource: keyof IResourceRecord,
+    actionKey: string,
+  ): Promise<IOpenapiPermissionAction> {
     const route = this._getControllerActionRoute(resource, actionKey);
     if (!route?.route?.meta) return false;
     return await this._evaluatePermissionAction(route);
@@ -159,19 +201,30 @@ export class BeanPermission extends BeanBase {
     return true;
   }
 
-  private async _evaluatePermissionAction(route: ContextRoute): Promise<boolean> {
+  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction> {
     const ctx = this.ctx as any;
     const routePrevious = ctx.route;
     const innerAccessPrevious = ctx.innerAccess;
+    const rbacDecisionHadOwnProperty = Object.hasOwn(ctx, SymbolRbacDecision);
+    const rbacDecisionPrevious = ctx[SymbolRbacDecision];
     try {
       ctx.route = route;
       ctx.innerAccess = false;
+      clearRbacDecision(ctx);
       const result = await composeGuards(this.app, route)(this.ctx);
-      return result !== false;
+      if (result === false) return false;
+      if (!route.route.meta?.[BeanFullNameGuardRbac]) return true;
+      const rbacScopeCurrent = await this.bean.rbacScope.current();
+      return rbacScopeCurrent.permissionProjection();
     } catch (err: any) {
       if ([401, 403].includes(err?.code)) return false;
       throw err;
     } finally {
+      if (rbacDecisionHadOwnProperty) {
+        setRbacDecision(ctx, rbacDecisionPrevious);
+      } else {
+        clearRbacDecision(ctx);
+      }
       ctx.route = routePrevious;
       ctx.innerAccess = innerAccessPrevious;
     }

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/event.retrievePermissionAction.ts

@@ -1,4 +1,4 @@
-import type { IResourceRecord } from 'vona-module-a-openapi';
+import type { IOpenapiPermissionAction, IResourceRecord } from 'vona-module-a-openapi';
 
 import { BeanEventBase, Event } from 'vona-module-a-event';
 
@@ -7,7 +7,7 @@ export interface TypeEventRetrievePermissionActionData {
   actionKey: string;
 }
 
-export type TypeEventRetrievePermissionActionResult = boolean;
+export type TypeEventRetrievePermissionActionResult = IOpenapiPermissionAction;
 
 @Event()
 export class EventRetrievePermissionAction extends BeanEventBase<

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/summerCache.permissionActionByUser.ts

@@ -0,0 +1,24 @@
+import type { ISummerCacheGet, TSummerCacheActionOptions } from 'vona-module-a-summer';
+
+import { ServiceSummerCacheBase, SummerCache } from 'vona-module-a-summer';
+
+export type TSummerCachePermissionActionByUserKey = any;
+export type TSummerCachePermissionActionByUserData = any;
+
+@SummerCache()
+export class SummerCachePermissionActionByUser
+  extends ServiceSummerCacheBase<
+    TSummerCachePermissionActionByUserKey,
+    TSummerCachePermissionActionByUserData
+  >
+  implements
+    ISummerCacheGet<TSummerCachePermissionActionByUserKey, TSummerCachePermissionActionByUserData>
+{
+  async getNative(
+    _key?: TSummerCachePermissionActionByUserKey,
+    _options?: TSummerCacheActionOptions<
+      TSummerCachePermissionActionByUserKey,
+      TSummerCachePermissionActionByUserData
+    >,
+  ): Promise<TSummerCachePermissionActionByUserData | undefined> {}
+}

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/dto/permissions.tsx

@@ -9,6 +9,23 @@ import { Api, v } from 'vona-module-a-openapiutils';
 import { Dto } from 'vona-module-a-web';
 import z from 'zod';
 
+const SchemaPermissionActionMatcher = z.discriminatedUnion('mode', [
+  z.object({ mode: z.literal('all') }),
+  z.object({
+    mode: z.literal('any'),
+    rules: z.array(z.object({ field: z.string(), values: z.array(z.string()) })),
+  }),
+]);
+
+const SchemaPermissionAction = z.union([
+  z.boolean(),
+  z.object({
+    key: z.string(),
+    allowed: z.boolean(),
+    matcher: SchemaPermissionActionMatcher,
+  }),
+]);
+
 export interface IDtoOptionsPermissions extends IDecoratorDtoOptions {}
 
 @Dto<IDtoOptionsPermissions>()
@@ -19,6 +36,6 @@ export class DtoPermissions implements IOpenapiPermissions {
   @Api.field(v.optional(), v.array(z.string()))
   roleNames?: (keyof IRoleNameRecord)[];
 
-  @Api.field(v.optional())
+  @Api.field(v.optional(), z.record(z.string(), SchemaPermissionAction))
   actions?: IOpenapiPermissionModeActionActions;
 }