cabloy 5.1.239 → 5.1.241

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/bean.permission.ts

@@ -11,7 +11,7 @@ import type { ContextRoute, IRecordResourceNameToRoutePathItem } from 'vona-modu
 import { appResource, BeanBase, beanFullNameFromOnionName } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import { Caching } from 'vona-module-a-caching';
-import { clearRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
+import { clearRbacDecision, getRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
 import {
   composeGuards,
   getCacheControllerRoutes,
@@ -107,6 +107,23 @@ export class BeanPermission extends BeanBase {
     return typeof permission === 'boolean' ? permission : permission.allowed;
   }
 
+  /**
+   * Checks current guards without permission events, result caches or matcher projection.
+   * A true result does not authorize individual records or prepare data scope/owner values.
+   * The target action's RBAC decision is not retained; scoped operations must authorize separately.
+   */
+  public async checkPermissionActionGuards(
+    resource: keyof IResourceRecord,
+    actionKey: string,
+  ): Promise<boolean> {
+    if (!Object.hasOwn(recordResourceNameToRoutePath, resource)) return false;
+    const routePathInfo = recordResourceNameToRoutePath[resource];
+    if (!routePathInfo || !appResource.getBean(routePathInfo.controller)) return false;
+    const route = this._getControllerActionRoute(resource, actionKey);
+    if (!route?.route?.meta || !this._matchPassportMeta(route.route.meta)) return false;
+    return await this._evaluatePermissionAction(route, true);
+  }
+
   public async retrievePermissionAction(
     resource: keyof IResourceRecord,
     actionKey: string,
@@ -201,12 +218,17 @@ export class BeanPermission extends BeanBase {
     return true;
   }
 
-  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction> {
+  private async _evaluatePermissionAction(route: ContextRoute, guardsOnly: true): Promise<boolean>;
+  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction>;
+  private async _evaluatePermissionAction(
+    route: ContextRoute,
+    guardsOnly = false,
+  ): Promise<IOpenapiPermissionAction> {
     const ctx = this.ctx as any;
-    const routePrevious = ctx.route;
+    const routeDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'route');
+    const innerAccessDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'innerAccess');
     const innerAccessPrevious = ctx.innerAccess;
-    const rbacDecisionHadOwnProperty = Object.hasOwn(ctx, SymbolRbacDecision);
-    const rbacDecisionPrevious = ctx[SymbolRbacDecision];
+    const rbacDecisionDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, SymbolRbacDecision);
     try {
       ctx.route = route;
       ctx.innerAccess = false;
@@ -214,19 +236,43 @@ export class BeanPermission extends BeanBase {
       const result = await composeGuards(this.app, route)(this.ctx);
       if (result === false) return false;
       if (!route.route.meta?.[BeanFullNameGuardRbac]) return true;
+      if (guardsOnly) {
+        const action = this.bean.rbacCatalog.getAction(route);
+        const decision = getRbacDecision(this.ctx);
+        return Boolean(
+          action &&
+          Object.hasOwn(ctx, SymbolRbacDecision) &&
+          decision?.allowed === true &&
+          decision.actionKey === action.actionKey &&
+          decision.action?.actionKey === action.actionKey &&
+          decision.action.actionInheritKey === action.actionInheritKey &&
+          decision.action.controllerBeanFullName === action.controllerBeanFullName &&
+          decision.action.action === action.action,
+        );
+      }
       const rbacScopeCurrent = await this.bean.rbacScope.current();
       return rbacScopeCurrent.permissionProjection();
     } catch (err: any) {
       if ([401, 403].includes(err?.code)) return false;
       throw err;
     } finally {
-      if (rbacDecisionHadOwnProperty) {
-        setRbacDecision(ctx, rbacDecisionPrevious);
+      if (rbacDecisionDescriptorPrevious) {
+        Object.defineProperty(ctx, SymbolRbacDecision, rbacDecisionDescriptorPrevious);
       } else {
         clearRbacDecision(ctx);
       }
-      ctx.route = routePrevious;
+      if (routeDescriptorPrevious) {
+        Object.defineProperty(ctx, 'route', routeDescriptorPrevious);
+      } else {
+        delete ctx.route;
+      }
+      // Vona's inherited innerAccess accessor owns its value in a context symbol.
       ctx.innerAccess = innerAccessPrevious;
+      if (innerAccessDescriptorPrevious) {
+        Object.defineProperty(ctx, 'innerAccess', innerAccessDescriptorPrevious);
+      } else {
+        delete ctx.innerAccess;
+      }
     }
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-permission/test/permission.test.ts

@@ -1,10 +1,14 @@
+import type { VonaContext } from 'vona';
 import type { ICachingActionKeyInfo } from 'vona-module-a-caching';
 import type { IRbacPolicyDecision } from 'vona-module-a-rbac';
+import type { ContextRoute } from 'vona-module-a-web';
 
 import assert from 'node:assert';
 import { describe, it } from 'node:test';
-import { beanFullNameFromOnionName } from 'vona';
+import { appResource, beanFullNameFromOnionName } from 'vona';
+import { app } from 'vona-mock';
 import { getRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
+import { getCacheControllerRoutes, recordResourceNameToRoutePath } from 'vona-module-a-web';
 
 import { BeanPermission } from '../src/bean/bean.permission.ts';
 
@@ -51,6 +55,64 @@ function createCachePermission(clearedCacheNames: string[]) {
   return permission;
 }
 
+const BeanFullNameGuardRbac = beanFullNameFromOnionName('a-rbac:rbac', 'guard');
+const GuardResource = 'test-rest:product';
+
+async function withGuardPermission(
+  guard: (ctx: VonaContext) => Promise<boolean | void>,
+  callback: (fixture: {
+    permission: BeanPermission;
+    ctx: VonaContext;
+    passport: { isAuthenticated: boolean; isAccountActive: boolean; isActivated: boolean };
+    action: IRbacPolicyDecision['action'];
+  }) => Promise<void>,
+  rbac = false,
+) {
+  await app.bean.executor.mockCtx(async () => {
+    const controller = recordResourceNameToRoutePath[GuardResource].controller;
+    const controllerBeanFullName = appResource.getBean(controller)!.beanFullName;
+    const route = {
+      controller,
+      controllerBeanFullName,
+      action: 'create',
+      route: { meta: rbac ? { [BeanFullNameGuardRbac]: {} } : {} },
+    } as ContextRoute;
+    const action: IRbacPolicyDecision['action'] = {
+      actionKey: `${controllerBeanFullName}#create`,
+      actionInheritKey: `${controllerBeanFullName}#update`,
+      controllerBeanFullName,
+      action: 'create',
+      route,
+      options: {},
+    };
+    const unexpected = () =>
+      assert.fail('guard-only checks must not use permission retrieval or scope projection');
+    const fixtureApp = {
+      meta: {},
+      bean: { onion: { guard: { compose: () => guard } } },
+    };
+    getCacheControllerRoutes(fixtureApp as never)[controllerBeanFullName] = [route];
+    const passport = { isAuthenticated: true, isAccountActive: true, isActivated: true };
+    const permission = Object.create(BeanPermission.prototype) as BeanPermission;
+    Object.defineProperties(permission, {
+      app: { value: fixtureApp },
+      ctx: { value: app.ctx },
+      bean: {
+        value: {
+          passport,
+          rbacCatalog: { getAction: () => action },
+          rbacScope: { current: unexpected },
+        },
+      },
+      scope: { value: { event: { retrievePermissionAction: { emit: unexpected } } } },
+      retrievePermissionAction: { value: unexpected },
+      retrievePermissionActionByRoles: { value: unexpected },
+      retrievePermissionActionByUser: { value: unexpected },
+    });
+    await callback({ permission, ctx: app.ctx, passport, action });
+  });
+}
+
 describe('permission.test.ts', { concurrency: false }, () => {
   it('normalizes role cache keys by role identity', () => {
     const first = createPermission({
@@ -62,10 +124,10 @@ describe('permission.test.ts', { concurrency: false }, () => {
       roleIds: ['role-a', 'role-b'],
     });
 
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
     assert.equal(
       (first as any).retrievePermissionActionByRolesCacheKey(info),
-      'action:training-student:student:select:roles:role-a,role-b',
+      'action:test:resource:select:roles:role-a,role-b',
     );
     assert.equal(
       (first as any).retrievePermissionActionByRolesCacheKey(info),
@@ -78,7 +140,7 @@ describe('permission.test.ts', { concurrency: false }, () => {
       userId: 'user-1',
       roleIds: ['role-a'],
     });
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
 
     assert.notEqual(
       (permission as any).retrievePermissionActionByRolesCacheKey(info),
@@ -100,10 +162,10 @@ describe('permission.test.ts', { concurrency: false }, () => {
       roleIds: ['role-b'],
     });
 
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
     assert.equal(
       (first as any).retrievePermissionActionByUserCacheKey(info),
-      'action:training-student:student:select:user:user-1:roles:role-a',
+      'action:test:resource:select:user:user-1:roles:role-a',
     );
     assert.notEqual(
       (first as any).retrievePermissionActionByUserCacheKey(info),
@@ -152,24 +214,21 @@ describe('permission.test.ts', { concurrency: false }, () => {
     });
 
     assert.equal(
-      await permission.retrievePermissionAction('training-student:student', 'ordinary'),
+      await permission.retrievePermissionAction('test:resource' as never, 'ordinary'),
       false,
     );
-    assert.equal(
-      await permission.retrievePermissionAction('training-student:student', 'rbac'),
-      true,
-    );
+    assert.equal(await permission.retrievePermissionAction('test:resource' as never, 'rbac'), true);
     assert.deepEqual(calls, ['roles', 'user']);
   });
 
   it('isolates resource permission snapshots by user', () => {
     const first = createPermission({ userId: 'user-1' });
     const otherUser = createPermission({ userId: 'user-2' });
-    const info = cacheInfo('training-student:student');
+    const info = cacheInfo('test:resource');
 
     assert.equal(
       (first as any).retrievePermissionsCacheKey(info),
-      'user:training-student:student:user:user-1',
+      'user:test:resource:user:user-1',
     );
     assert.notEqual(
       (first as any).retrievePermissionsCacheKey(info),
@@ -307,6 +366,159 @@ describe('permission.test.ts', { concurrency: false }, () => {
     assert.equal(ctx.innerAccess, true);
   });
 
+  it('checks current guards without permission events, result caches, or projection', async () => {
+    let allowed = true;
+    let calls = 0;
+    await withGuardPermission(
+      async () => {
+        calls++;
+        return allowed;
+      },
+      async ({ permission }) => {
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
+        allowed = false;
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
+        assert.equal(calls, 2);
+      },
+    );
+  });
+
+  it('fails closed before guards for unknown routes and Passport admission failures', async () => {
+    await withGuardPermission(
+      async () => assert.fail('guards must not run before admission'),
+      async ({ permission, passport }) => {
+        assert.equal(
+          await permission.checkPermissionActionGuards('test:missing' as never, 'create'),
+          false,
+        );
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'missing'), false);
+        passport.isAuthenticated = false;
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
+      },
+    );
+  });
+
+  it('converts guard authorization errors to false and propagates unexpected errors', async () => {
+    let failure: Error;
+    await withGuardPermission(
+      async () => {
+        throw failure;
+      },
+      async ({ permission }) => {
+        for (const code of [401, 403]) {
+          failure = Object.assign(new Error('authorization failure'), { code });
+          assert.equal(
+            await permission.checkPermissionActionGuards(GuardResource, 'create'),
+            false,
+          );
+        }
+        failure = new Error('unexpected guard failure');
+        await assert.rejects(
+          () => permission.checkPermissionActionGuards(GuardResource, 'create'),
+          failure,
+        );
+      },
+    );
+  });
+
+  it('requires a fresh allowed RBAC decision matching the full catalog action identity', async () => {
+    let decision: IRbacPolicyDecision | undefined;
+    await withGuardPermission(
+      async ctx => {
+        assert.equal(getRbacDecision(ctx), undefined);
+        if (decision) setRbacDecision(ctx, decision);
+        return true;
+      },
+      async ({ permission, ctx, action }) => {
+        const valid: IRbacPolicyDecision = {
+          allowed: true,
+          actionKey: action.actionKey,
+          action: { ...action },
+          terms: [{ dataScope: 'all' }],
+        };
+        setRbacDecision(ctx, valid);
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), false);
+        assert.equal(getRbacDecision(ctx), valid);
+        for (const invalid of [
+          { ...valid, allowed: false },
+          { ...valid, actionKey: 'other#action' },
+          ...[
+            { actionKey: 'other#action' },
+            { actionInheritKey: undefined },
+            { controllerBeanFullName: 'other.controller' },
+            { action: 'other' },
+          ].map(mismatch => ({ ...valid, action: { ...action, ...mismatch } })),
+        ]) {
+          decision = invalid;
+          assert.equal(
+            await permission.checkPermissionActionGuards(GuardResource, 'create'),
+            false,
+          );
+          assert.equal(getRbacDecision(ctx), valid);
+        }
+        decision = valid;
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
+        assert.equal(getRbacDecision(ctx), valid);
+        delete ctx[SymbolRbacDecision];
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
+        assert.equal(Object.hasOwn(ctx, SymbolRbacDecision), false);
+      },
+      true,
+    );
+  });
+
+  it('restores property descriptors and inherited innerAccess after success and failure', async () => {
+    let failure: Error | undefined;
+    await withGuardPermission(
+      async ctx => {
+        assert.equal(ctx.route.action, 'create');
+        assert.equal(ctx.innerAccess, false);
+        assert.equal(getRbacDecision(ctx), undefined);
+        if (failure) throw failure;
+        return true;
+      },
+      async ({ permission, ctx, action }) => {
+        assert.equal(Object.hasOwn(ctx, 'innerAccess'), false);
+        ctx.innerAccess = true;
+        Object.defineProperty(ctx, 'route', {
+          value: { action: 'previous' },
+          writable: true,
+          configurable: true,
+          enumerable: false,
+        });
+        Object.defineProperty(ctx, SymbolRbacDecision, {
+          value: {
+            allowed: true,
+            actionKey: action.actionKey,
+            action,
+            terms: [{ dataScope: 'all' }],
+          },
+          writable: true,
+          configurable: true,
+          enumerable: false,
+        });
+        const descriptors = Object.getOwnPropertyDescriptors(ctx);
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
+        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), descriptors);
+        assert.equal(ctx.innerAccess, true);
+        failure = new Error('guard failure');
+        await assert.rejects(
+          () => permission.checkPermissionActionGuards(GuardResource, 'create'),
+          failure,
+        );
+        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), descriptors);
+        assert.equal(ctx.innerAccess, true);
+
+        delete (ctx as any).route;
+        delete ctx[SymbolRbacDecision];
+        const absentDescriptors = Object.getOwnPropertyDescriptors(ctx);
+        failure = undefined;
+        assert.equal(await permission.checkPermissionActionGuards(GuardResource, 'create'), true);
+        assert.deepEqual(Object.getOwnPropertyDescriptors(ctx), absentDescriptors);
+      },
+    );
+  });
+
   it('reduces an RBAC action projection to its final boolean result', async () => {
     const allowed = createPermission({});
     const denied = createPermission({});
@@ -333,8 +545,8 @@ describe('permission.test.ts', { concurrency: false }, () => {
       retrievePermissionAction: { value: async () => true },
     });
 
-    assert.equal(await allowed.checkPermissionAction('training-student:student', 'select'), true);
-    assert.equal(await denied.checkPermissionAction('training-student:student', 'select'), false);
-    assert.equal(await legacy.checkPermissionAction('training-student:student', 'select'), true);
+    assert.equal(await allowed.checkPermissionAction('test:resource' as never, 'select'), true);
+    assert.equal(await denied.checkPermissionAction('test:resource' as never, 'select'), false);
+    assert.equal(await legacy.checkPermissionAction('test:resource' as never, 'select'), true);
   });
 });

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ratelimit",
-  "version": "5.1.3",
+  "version": "5.1.4",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/src/.metadata/index.ts

@@ -25,6 +25,32 @@ declare module 'vona-module-a-ratelimit' {
           }
 }
 /** interceptor: end */
+/** middlewareSystem: begin */
+export * from '../bean/middlewareSystem.aggregate.ts';
+import type { IMiddlewareSystemOptionsAggregate } from '../bean/middlewareSystem.aggregate.ts';
+import 'vona-module-a-aspect';
+declare module 'vona-module-a-aspect' {
+
+    export interface IMiddlewareSystemRecord {
+      'a-ratelimit:aggregate': IMiddlewareSystemOptionsAggregate;
+    }
+
+
+}
+declare module 'vona-module-a-ratelimit' {
+
+        export interface MiddlewareSystemAggregate {
+          /** @internal */
+          get scope(): ScopeModuleARatelimit;
+        }
+
+          export interface MiddlewareSystemAggregate {
+            get $beanFullName(): 'a-ratelimit.middlewareSystem.aggregate';
+            get $onionName(): 'a-ratelimit:aggregate';
+            get $onionOptions(): IMiddlewareSystemOptionsAggregate;
+          }
+}
+/** middlewareSystem: end */
 /** service: begin */
 export * from '../service/rateLimit.ts';
 

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/src/bean/middlewareSystem.aggregate.ts

@@ -0,0 +1,58 @@
+import type { Next } from 'vona';
+import type {
+  IDecoratorMiddlewareSystemOptions,
+  IMiddlewareSystemExecute,
+} from 'vona-module-a-aspect';
+
+import { BeanBase } from 'vona';
+import { MiddlewareSystem } from 'vona-module-a-aspect';
+
+import type { IRateLimitAggregatePolicy, IRateLimitResult } from '../types/rateLimit.ts';
+
+export interface IMiddlewareSystemOptionsAggregate extends IDecoratorMiddlewareSystemOptions {
+  rateLimit?: IRateLimitAggregatePolicy;
+}
+
+@MiddlewareSystem<IMiddlewareSystemOptionsAggregate>({
+  enable: false,
+  dependencies: 'a-logger:httpLog',
+  dependents: ['a-metrics:health', 'a-instance:app'],
+})
+export class MiddlewareSystemAggregate extends BeanBase implements IMiddlewareSystemExecute {
+  async execute(options: IMiddlewareSystemOptionsAggregate, next: Next) {
+    const policy = options.rateLimit;
+    if (!policy) throw new Error('rate-limit aggregate policy is required when enabled');
+    // Validation is synchronous; only Redis admission failures enter the catch below.
+    const admission = this.scope.service.rateLimit.admitAggregate(policy);
+    let result: IRateLimitResult;
+    try {
+      result = await admission;
+    } catch (error) {
+      this.$logger.warn({
+        event: 'rate_limit.redis_error',
+        scope: 'aggregate',
+        mode: policy.mode,
+        error: error instanceof Error ? error.name : 'Error',
+      });
+      if (policy.mode === 'observe') return next();
+      this._reject(503, 'Service Unavailable');
+      return;
+    }
+    if (result.allowed) return next();
+    this.$logger.warn({
+      event: policy.mode === 'observe' ? 'rate_limit.would_reject' : 'rate_limit.rejected',
+      scope: 'aggregate',
+      mode: policy.mode,
+      limit: policy.limit,
+    });
+    if (policy.mode === 'observe') return next();
+    this.ctx.set('Retry-After', String(result.retryAfterSeconds));
+    this._reject(429, 'Too Many Requests');
+  }
+
+  private _reject(status: number, message: string) {
+    this.ctx.status = status;
+    this.ctx.type = 'application/json';
+    this.ctx.body = { code: status, message };
+  }
+}

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/src/service/rateLimit.ts

@@ -2,7 +2,11 @@ import { createHash } from 'node:crypto';
 import { BeanBase, cast } from 'vona';
 import { Service } from 'vona-module-a-bean';
 
-import type { IRateLimitPolicy, IRateLimitResult } from '../types/rateLimit.ts';
+import type {
+  IRateLimitAggregatePolicy,
+  IRateLimitPolicy,
+  IRateLimitResult,
+} from '../types/rateLimit.ts';
 
 @Service()
 export class ServiceRateLimit extends BeanBase {
@@ -14,16 +18,32 @@ export class ServiceRateLimit extends BeanBase {
     this._validatePolicy(policy);
     const now = Date.now();
     const key = this._createKey(policy, now);
-    const result = (await cast(this.clientRedis).rateLimitAdmit(key, String(policy.windowMs))) as [
+    return this._admit(key, policy.limit, policy.windowMs);
+  }
+
+  admitAggregate(policy: IRateLimitAggregatePolicy): Promise<IRateLimitResult> {
+    if (!['observe', 'enforce'].includes(policy.mode)) {
+      throw new Error('rate-limit aggregate mode must be observe or enforce');
+    }
+    if (!Number.isSafeInteger(policy.limit) || policy.limit < 1) {
+      throw new Error('rate-limit aggregate limit must be a positive safe integer');
+    }
+    const windowMs = 1_000;
+    const windowStart = Math.floor(Date.now() / windowMs) * windowMs;
+    return this._admit(`rate-limit:aggregate:v1:${windowStart}`, policy.limit, windowMs);
+  }
+
+  private async _admit(key: string, limit: number, windowMs: number): Promise<IRateLimitResult> {
+    const result = (await cast(this.clientRedis).rateLimitAdmit(key, String(windowMs))) as [
       number | string,
       number | string,
     ];
     const current = Number(result[0]);
     const resetAfterMs = Math.max(0, Number(result[1]));
     return {
-      allowed: current <= policy.limit,
-      limit: policy.limit,
-      remaining: Math.max(0, policy.limit - current),
+      allowed: current <= limit,
+      limit,
+      remaining: Math.max(0, limit - current),
       resetAfterMs,
       retryAfterSeconds: Math.max(1, Math.ceil(resetAfterMs / 1000)),
     };

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/src/types/rateLimit.ts

@@ -14,6 +14,11 @@ export interface IRateLimitPolicy {
   headers: boolean;
 }
 
+export interface IRateLimitAggregatePolicy {
+  mode: RateLimitMode;
+  limit: number;
+}
+
 export interface IRateLimitResult {
   allowed: boolean;
   limit: number;