cabloy 5.1.136 → 5.1.138

package/zova/src/suite/a-home/modules/home-passport/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../model/passport.js';
 import { IModelOptionsPassport } from '../model/passport.js';
 import 'zova-module-a-model';
 declare module 'zova-module-a-model' {
-  
+
     export interface IModelRecord {
       'home-passport:passport': IModelOptionsPassport;
     }
 
-  
+
 }
 declare module 'zova-module-home-passport' {
-  
+
         export interface ModelPassport {
           /** @internal */
           get scope(): ScopeModuleHomePassport;
@@ -22,7 +22,7 @@ declare module 'zova-module-home-passport' {
           get $beanFullName(): 'home-passport.model.passport';
           get $onionName(): 'home-passport:passport';
           get $onionOptions(): IModelOptionsPassport;
-        } 
+        }
 }
 /** model: end */
 /** model: begin */
@@ -58,14 +58,14 @@ declare module 'zova' {
   export interface IBeanScopeRecord {
     'home-passport': ScopeModuleHomePassport;
   }
-  
+
   export interface IBeanScopeConfig {
     'home-passport': ReturnType<typeof config>;
   }
 
-  
 
-  
+
+
 }
-  
+
 /** scope: end */

package/zova/src/suite/a-home/modules/home-passport/src/lib/permissionActionMatcher.ts

@@ -0,0 +1,37 @@
+import type { IOpenapiPermissionActionRbac } from 'zova-module-a-openapi';
+
+export function matchPermissionAction(
+  actionPermission: IOpenapiPermissionActionRbac,
+  currentData?: Record<string, unknown> | readonly Record<string, unknown>[],
+): boolean {
+  if (!actionPermission || actionPermission.allowed !== true) return false;
+  const matcher = actionPermission.matcher;
+  if (!matcher || typeof matcher !== 'object') return false;
+  if (matcher.mode === 'all') return true;
+  if (matcher.mode !== 'any' || !Array.isArray(matcher.rules) || matcher.rules.length === 0) {
+    return false;
+  }
+  if (
+    !matcher.rules.every(
+      rule =>
+        rule &&
+        typeof rule.field === 'string' &&
+        rule.field.length > 0 &&
+        Array.isArray(rule.values) &&
+        rule.values.length > 0 &&
+        rule.values.every(value => typeof value === 'string'),
+    )
+  ) {
+    return false;
+  }
+  if (!currentData) return true;
+  const records = Array.isArray(currentData) ? currentData : [currentData];
+  if (records.length === 0) return false;
+  return records.every(record => {
+    if (!record || typeof record !== 'object') return false;
+    return matcher.rules.some(rule => {
+      const value = record[rule.field];
+      return value !== undefined && rule.values.includes(String(value));
+    });
+  });
+}

package/zova/src/suite/a-home/modules/home-passport/src/model/passport.ts

@@ -18,6 +18,8 @@ import {
 } from 'zova-module-a-openapi';
 import { ApiApiHomeUserPassportloginOauthPath, OpenApiBaseURL } from 'zova-module-home-api';
 
+import { matchPermissionAction } from '../lib/permissionActionMatcher.js';
+
 export interface IModelOptionsPassport extends IDecoratorModelOptions {}
 
 @Model<IModelOptionsPassport>()
@@ -140,6 +142,11 @@ export class ModelPassport extends BeanModelBase {
     this.app.$gotoReturnTo();
   }
 
+  isPassportSiteAdmitted(passport?: ApiApiHomeUserPassportloginResponseBody['passport']) {
+    const siteId = this.sys.env.SITE_ID;
+    return !!siteId && !!passport?.roles.some(role => role.siteIds.includes(siteId));
+  }
+
   logout() {
     return this.$useMutationData<void, void>({
       mutationKey: ['logout'],
@@ -147,11 +154,7 @@ export class ModelPassport extends BeanModelBase {
         await this.$api.homeUserPassport.logout();
       },
       onSuccess: async () => {
-        this._setPassportJwt();
-        // page: login
-        await this.app.$gotoLogin();
-        // clear: should after goto login page, avoid home-layoutadmin use some cache data
-        this.$clear(); // not await
+        await this.requireRelogin();
       },
     });
   }
@@ -194,12 +197,26 @@ export class ModelPassport extends BeanModelBase {
 
   async ensurePassport() {
     if (!this.$ssr.cookieDisabledOnServer && !this.isAuthenticated && this.accessToken) {
-      this.passport = await this.$api.homeUserPassport.current();
-      this._setLocaleTz();
+      await this.refreshCurrent();
     }
     return this.passport;
   }
 
+  async refreshCurrent() {
+    if (this.$ssr.cookieDisabledOnServer || !this.accessToken) return;
+    this.passport = await this.$api.homeUserPassport.current();
+    this._setLocaleTz();
+    return this.passport;
+  }
+
+  async requireRelogin(returnTo?: string | boolean, cause?: string) {
+    this._setPassportJwt();
+    // page: login
+    await this.app.$gotoLogin(returnTo, cause);
+    // clear: should after goto login page, avoid home-layoutadmin use some cache data
+    this.$clear(); // not await
+  }
+
   private _isTempAuthTokenExpired(
     token: string | undefined,
     dataUpdatedAt: number,
@@ -257,6 +274,7 @@ export class ModelPassport extends BeanModelBase {
     permissions: TypeOpenapiPermissions | undefined,
     actionName?: keyof (IResourceTableActionNameRecord & IResourceFormActionRowNameRecord),
     permissionHint?: IPermissionHintGeneral,
+    currentData?: Record<string, unknown> | readonly Record<string, unknown>[],
   ): boolean {
     if (permissionHint?.public) return true;
     const permissionAction = permissionHint?.actionInherit ?? actionName;
@@ -264,23 +282,25 @@ export class ModelPassport extends BeanModelBase {
     if (isNil(permissions)) return false;
     if (permissions === false) return false;
     if (permissions === true) return true;
-    // roleIds
+
+    const actionPermission = permissions.actions?.[permissionAction];
+    if (actionPermission !== undefined) {
+      if (typeof actionPermission === 'boolean') return actionPermission;
+      return matchPermissionAction(actionPermission, currentData);
+    }
+
     if (
       permissions.roleIds &&
       permissions.roleIds.some(roleId => this.roles?.some(role => role.id === roleId))
     ) {
       return true;
     }
-    // roleNames
     if (
       permissions.roleNames &&
       permissions.roleNames.some(roleName => this.roles?.some(role => role.name === roleName))
     ) {
       return true;
     }
-    // actions
-    if (permissions.actions && !!permissions.actions[permissionAction]) return true;
-    // others
     return false;
   }
 }

package/zova/src/suite/a-home/modules/home-passport/test/lib/permissionActionMatcher.test.ts

@@ -0,0 +1,80 @@
+import type { IOpenapiPermissionActionRbac } from 'zova-module-a-openapi';
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { matchPermissionAction } from '../../src/lib/permissionActionMatcher.js';
+
+const action = (
+  matcher: IOpenapiPermissionActionRbac['matcher'],
+  allowed = true,
+): IOpenapiPermissionActionRbac => ({
+  key: 'training-student:student#update',
+  allowed,
+  matcher,
+});
+
+test('matches unrestricted actions without row data', () => {
+  assert.equal(matchPermissionAction(action({ mode: 'all' })), true);
+  assert.equal(matchPermissionAction(action({ mode: 'all' }), undefined), true);
+  assert.equal(matchPermissionAction(action({ mode: 'all' }), [{ id: 1 }, { id: 2 }]), true);
+});
+
+test('matches mine and department projections against one row', () => {
+  const mine = action({
+    mode: 'any',
+    rules: [{ field: 'userIdOwner', values: ['42'] }],
+  });
+  const department = action({
+    mode: 'any',
+    rules: [{ field: 'departmentId', values: ['7', '8'] }],
+  });
+
+  assert.equal(matchPermissionAction(mine, { userIdOwner: 42 }), true);
+  assert.equal(matchPermissionAction(mine, { userIdOwner: 43 }), false);
+  assert.equal(matchPermissionAction(department, { departmentId: '8' }), true);
+  assert.equal(matchPermissionAction(department, { departmentId: '9' }), false);
+  assert.equal(matchPermissionAction(department, {}), false);
+});
+
+test('requires every selected row to match', () => {
+  const permission = action({
+    mode: 'any',
+    rules: [{ field: 'departmentId', values: ['7', '8'] }],
+  });
+
+  assert.equal(
+    matchPermissionAction(permission, [{ departmentId: 7 }, { departmentId: '8' }]),
+    true,
+  );
+  assert.equal(
+    matchPermissionAction(permission, [{ departmentId: 7 }, { departmentId: 9 }]),
+    false,
+  );
+  assert.equal(matchPermissionAction(permission, []), false);
+});
+
+test('denies explicit decisions and malformed matchers', () => {
+  assert.equal(matchPermissionAction(action({ mode: 'all' }, false)), false);
+  assert.equal(
+    matchPermissionAction({ key: 'test', allowed: true, matcher: { mode: 'any', rules: [] } }),
+    false,
+  );
+  assert.equal(
+    matchPermissionAction({ key: 'test', allowed: true, matcher: { mode: 'any' } } as any, {
+      id: 1,
+    }),
+    false,
+  );
+  assert.equal(
+    matchPermissionAction(
+      {
+        key: 'test',
+        allowed: true,
+        matcher: { mode: 'any', rules: [{ field: 'id', values: [7] }] },
+      } as any,
+      { id: 7 },
+    ),
+    false,
+  );
+});

package/zova/src/suite/a-home/modules/home-theme/src/.metadata/index.ts

@@ -4,15 +4,15 @@ export * from '../bean/css.base.js';
 import { ICssOptionsBase } from '../bean/css.base.js';
 import 'zova-module-a-style';
 declare module 'zova-module-a-style' {
-  
+
     export interface ICssRecord {
       'home-theme:base': ICssOptionsBase;
     }
 
-  
+
 }
 declare module 'zova-module-home-theme' {
-  
+
         export interface CssBase {
           /** @internal */
           get scope(): ScopeModuleHomeTheme;
@@ -22,7 +22,7 @@ declare module 'zova-module-home-theme' {
           get $beanFullName(): 'home-theme.css.base';
           get $onionName(): 'home-theme:base';
           get $onionOptions(): ICssOptionsBase;
-        } 
+        }
 }
 /** css: end */
 /** css: begin */
@@ -41,16 +41,16 @@ import { IThemeOptionsDefault } from '../bean/theme.default.js';
 import { IThemeOptionsOrange } from '../bean/theme.orange.js';
 import 'zova-module-a-style';
 declare module 'zova-module-a-style' {
-  
+
     export interface IThemeRecord {
       'home-theme:default': IThemeOptionsDefault;
 'home-theme:orange': IThemeOptionsOrange;
     }
 
-  
+
 }
 declare module 'zova-module-home-theme' {
-  
+
         export interface ThemeDefault {
           /** @internal */
           get scope(): ScopeModuleHomeTheme;
@@ -71,7 +71,7 @@ declare module 'zova-module-home-theme' {
           get $beanFullName(): 'home-theme.theme.orange';
           get $onionName(): 'home-theme:orange';
           get $onionOptions(): IThemeOptionsOrange;
-        } 
+        }
 }
 /** theme: end */
 /** theme: begin */
@@ -101,12 +101,12 @@ declare module 'zova' {
   export interface IBeanScopeRecord {
     'home-theme': ScopeModuleHomeTheme;
   }
-  
-  
 
-  
 
-  
+
+
+
+
 }
-  
+
 /** scope: end */

package/zova/src/suite/a-home/modules/home-user/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "zova-module-home-user",
+  "version": "5.0.0",
+  "description": "",
+  "keywords": [
+    "Zova Module"
+  ],
+  "author": "",
+  "files": [
+    "mock",
+    "dist",
+    "src",
+    "icons",
+    "assets"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": [
+        "./src/index.ts",
+        "./dist/index.d.ts"
+      ],
+      "import": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./*": "./*"
+  },
+  "scripts": {
+    "clean": "rimraf dist tsconfig.build.tsbuildinfo",
+    "tsc:publish": "npm run clean && node ../../../../../packages-cli/cli/src/bin/zova.ts :bin:buildModule --sourcemap && tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run tsc:publish",
+    "prepack": "clean-package",
+    "postpack": "clean-package restore"
+  },
+  "dependencies": {
+    "zova-module-a-bean": "^5.0.0",
+    "zova-module-a-model": "^5.0.0",
+    "zova-module-a-router": "^5.0.0",
+    "zova-module-basic-file": "^5.0.0",
+    "zova-module-basic-image": "^5.0.0",
+    "zova-module-home-api": "^5.0.0",
+    "zova-module-home-base": "^5.0.0"
+  },
+  "devDependencies": {
+    "clean-package": "^2.2.0",
+    "rimraf": "^6.1.3"
+  },
+  "clean-package": {
+    "indent": 2,
+    "replace": {
+      "exports.\\..types": "./dist/index.d.ts"
+    },
+    "remove": [
+      "clean-package",
+      "devDependencies",
+      "exports.\\..import"
+    ]
+  },
+  "title": "home-user"
+}

package/zova/src/suite/a-home/modules/home-user/src/.metadata/index.ts

@@ -0,0 +1,168 @@
+// eslint-disable
+/** model: begin */
+export * from '../model/account.js';
+import { IModelOptionsAccount } from '../model/account.js';
+import 'zova-module-a-model';
+declare module 'zova-module-a-model' {
+
+    export interface IModelRecord {
+      'home-user:account': IModelOptionsAccount;
+    }
+
+
+}
+declare module 'zova-module-home-user' {
+
+        export interface ModelAccount {
+          /** @internal */
+          get scope(): ScopeModuleHomeUser;
+        }
+
+        export interface ModelAccount {
+          get $beanFullName(): 'home-user.model.account';
+          get $onionName(): 'home-user:account';
+          get $onionOptions(): IModelOptionsAccount;
+        }
+}
+/** model: end */
+/** model: begin */
+import { ModelAccount } from '../model/account.js';
+import 'zova';
+declare module 'zova' {
+  export interface IBeanRecordGeneral {
+    'home-user.model.account': ModelAccount;
+  }
+}
+/** model: end */
+/** controller: begin */
+export * from '../page/account/controller.jsx';
+export * from '../page/activation/controller.jsx';
+export * from '../page/passwordReset/controller.jsx';
+export * from '../page/passwordSet/controller.jsx';
+
+import 'zova';
+declare module 'zova' {
+
+
+}
+declare module 'zova-module-home-user' {
+
+        export interface ControllerPageAccount {
+          /** @internal */
+          get scope(): ScopeModuleHomeUser;
+        }
+
+        export interface ControllerPageActivation {
+          /** @internal */
+          get scope(): ScopeModuleHomeUser;
+        }
+
+        export interface ControllerPagePasswordReset {
+          /** @internal */
+          get scope(): ScopeModuleHomeUser;
+        }
+
+        export interface ControllerPagePasswordSet {
+          /** @internal */
+          get scope(): ScopeModuleHomeUser;
+        }
+}
+/** controller: end */
+/** controller: begin */
+import { ControllerPageAccount } from '../page/account/controller.jsx';
+import { ControllerPageActivation } from '../page/activation/controller.jsx';
+import { ControllerPagePasswordReset } from '../page/passwordReset/controller.jsx';
+import { ControllerPagePasswordSet } from '../page/passwordSet/controller.jsx';
+import 'zova';
+declare module 'zova' {
+  export interface IBeanRecordLocal {
+    'home-user.controller.pageAccount': ControllerPageAccount;
+'home-user.controller.pageActivation': ControllerPageActivation;
+'home-user.controller.pagePasswordReset': ControllerPagePasswordReset;
+'home-user.controller.pagePasswordSet': ControllerPagePasswordSet;
+  }
+}
+/** controller: end */
+/** pages: begin */
+export * from './page/account.js';
+export * from './page/activation.js';
+import { NSControllerPageActivation } from './page/activation.js';
+export * from './page/passwordReset.js';
+import { NSControllerPagePasswordReset } from './page/passwordReset.js';
+export * from './page/passwordSet.js';
+import { NSControllerPagePasswordSet } from './page/passwordSet.js';
+export * from '../routes.js';
+import { TypePagePathSchema } from 'zova-module-a-router';
+import 'zova';
+declare module 'zova-module-a-router' {
+export interface IPagePathRecord {
+  '/home/user/account': TypePagePathSchema<undefined,undefined>;
+'/home/user/activation': TypePagePathSchema<undefined,NSControllerPageActivation.QueryInput>;
+'/home/user/password-reset': TypePagePathSchema<undefined,NSControllerPagePasswordReset.QueryInput>;
+'/home/user/password-set': TypePagePathSchema<undefined,NSControllerPagePasswordSet.QueryInput>;
+}
+export interface IPageNameRecord {
+
+}
+}
+export const pagePathSchemas = {
+'/home/user/activation': {
+          query: NSControllerPageActivation.querySchema,
+        },
+'/home/user/password-reset': {
+          query: NSControllerPagePasswordReset.querySchema,
+        },
+'/home/user/password-set': {
+          query: NSControllerPagePasswordSet.querySchema,
+        },
+};
+export const pageNameSchemas = {
+
+};
+declare module 'zova-module-home-user' {
+  export interface ControllerPageActivation {
+        $query: NSControllerPageActivation.QueryOutput;
+      }
+export interface ControllerPagePasswordReset {
+        $query: NSControllerPagePasswordReset.QueryOutput;
+      }
+export interface ControllerPagePasswordSet {
+        $query: NSControllerPagePasswordSet.QueryOutput;
+      }
+}
+/** pages: end */
+
+/** locale: begin */
+import { locales } from './locales.js';
+/** locale: end */
+/** scope: begin */
+import { BeanScopeBase, type BeanScopeUtil, TypeModuleLocales, TypeLocaleBase } from 'zova';
+import { Scope } from 'zova-module-a-bean';
+
+@Scope()
+export class ScopeModuleHomeUser extends BeanScopeBase {}
+
+export interface ScopeModuleHomeUser {
+  util: BeanScopeUtil;
+locale: TypeModuleLocales<(typeof locales)[TypeLocaleBase]>;
+}
+
+import 'zova';
+declare module 'zova' {
+  export interface IBeanScopeRecord {
+    'home-user': ScopeModuleHomeUser;
+  }
+
+
+
+  export interface IBeanScopeLocale {
+    'home-user': (typeof locales)[TypeLocaleBase];
+  }
+
+
+}
+
+export function locale<K extends keyof (typeof locales)[TypeLocaleBase]>(key: K): `home-user::${K}` {
+  return `home-user::${key}`;
+}
+/** scope: end */

package/zova/src/suite/a-home/modules/home-user/src/.metadata/locales.ts

@@ -0,0 +1,7 @@
+import locale_en_us from '../config/locale/en-us.js';
+import locale_zh_cn from '../config/locale/zh-cn.js';
+
+export const locales = {
+  'en-us': locale_en_us,
+  'zh-cn': locale_zh_cn,
+};

package/zova/src/suite/a-home/modules/home-user/src/.metadata/page/account.ts

@@ -0,0 +1,5 @@
+import { createZovaComponentPage } from 'zova';
+
+import { ControllerPageAccount } from '../../page/account/controller.jsx';
+
+export const ZPageAccount = createZovaComponentPage(ControllerPageAccount, undefined, undefined);

package/zova/src/suite/a-home/modules/home-user/src/.metadata/page/activation.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { createZovaComponentPage } from 'zova';
+
+import { ControllerPageActivation } from '../../page/activation/controller.jsx';
+import { ControllerPageActivationSchemaQuery } from '../../page/activation/controller.jsx';
+export namespace NSControllerPageActivation {
+  export const querySchema = ControllerPageActivationSchemaQuery;
+  export type QueryInput = z.input<typeof ControllerPageActivationSchemaQuery>;
+  export type QueryOutput = z.output<typeof ControllerPageActivationSchemaQuery>;
+}
+
+export const ZPageActivation = createZovaComponentPage(
+  ControllerPageActivation,
+  undefined,
+  undefined,
+);

package/zova/src/suite/a-home/modules/home-user/src/.metadata/page/passwordReset.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { createZovaComponentPage } from 'zova';
+
+import { ControllerPagePasswordReset } from '../../page/passwordReset/controller.jsx';
+import { ControllerPagePasswordResetSchemaQuery } from '../../page/passwordReset/controller.jsx';
+export namespace NSControllerPagePasswordReset {
+  export const querySchema = ControllerPagePasswordResetSchemaQuery;
+  export type QueryInput = z.input<typeof ControllerPagePasswordResetSchemaQuery>;
+  export type QueryOutput = z.output<typeof ControllerPagePasswordResetSchemaQuery>;
+}
+
+export const ZPagePasswordReset = createZovaComponentPage(
+  ControllerPagePasswordReset,
+  undefined,
+  undefined,
+);

package/zova/src/suite/a-home/modules/home-user/src/.metadata/page/passwordSet.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { createZovaComponentPage } from 'zova';
+
+import { ControllerPagePasswordSet } from '../../page/passwordSet/controller.jsx';
+import { ControllerPagePasswordSetSchemaQuery } from '../../page/passwordSet/controller.jsx';
+export namespace NSControllerPagePasswordSet {
+  export const querySchema = ControllerPagePasswordSetSchemaQuery;
+  export type QueryInput = z.input<typeof ControllerPagePasswordSetSchemaQuery>;
+  export type QueryOutput = z.output<typeof ControllerPagePasswordSetSchemaQuery>;
+}
+
+export const ZPagePasswordSet = createZovaComponentPage(
+  ControllerPagePasswordSet,
+  undefined,
+  undefined,
+);

package/zova/src/suite/a-home/modules/home-user/src/.metadata/this.ts

@@ -0,0 +1,2 @@
+export const __ThisModule__ = 'home-user';
+export { ScopeModuleHomeUser as ScopeModule } from './index.js';