cabloy 5.1.240 → 5.1.242

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/bean/cacheRedis.captcha.ts

@@ -1,12 +1,209 @@
+import { createHash } from 'node:crypto';
 import { ServiceCacheRedisBase, CacheRedis } from 'vona-module-a-cache';
 
 import type { ICaptchaDataCache } from '../types/captcha.ts';
+import type { ICaptchaAuthorization } from '../types/captchaProvider.ts';
+
+import {
+  captchaCasLua,
+  captchaConsumeLua,
+  captchaFinalizeLua,
+  captchaReserveLua,
+} from '../lib/captchaLua.ts';
 
 export type TCacheRedisCaptchaKey = string;
 export type TCacheRedisCaptchaData = ICaptchaDataCache;
 
-@CacheRedis({ disableTransactionCompensate: true })
+export interface ICaptchaSnapshot {
+  raw: string;
+  data: ICaptchaDataCache;
+}
+
+@CacheRedis({ disableTransactionCompensate: true, updateAgeOnGet: false })
 export class CacheRedisCaptcha extends ServiceCacheRedisBase<
   TCacheRedisCaptchaKey,
   TCacheRedisCaptchaData
-> {}
+> {
+  async snapshot(id: string): Promise<ICaptchaSnapshot | undefined> {
+    const { redis, keys } = this._redisKeys([id]);
+    const raw = await redis.get(keys[0]);
+    return raw ? { raw, data: JSON.parse(raw) } : undefined;
+  }
+
+  async createImage(id: string, data: ICaptchaDataCache, ttl: number) {
+    this._validateTtl(ttl);
+    const { redis, keys } = this._redisKeys([id]);
+    return (await redis.set(keys[0], JSON.stringify(data), 'PX', ttl, 'NX')) === 'OK';
+  }
+
+  async compareAndSet(
+    id: string,
+    snapshot: ICaptchaSnapshot,
+    data?: ICaptchaDataCache,
+    ttl?: number,
+  ) {
+    if (ttl !== undefined) this._validateTtl(ttl);
+    const result = await this._eval(
+      captchaCasLua,
+      [id],
+      [snapshot.raw, data === undefined ? '' : JSON.stringify(data), ttl ?? 0],
+    );
+    return result === 1;
+  }
+
+  boundPrefix() {
+    const instance = createHash('sha256').update(String(this.__getInstanceIdScope())).digest('hex');
+    return `{captcha:${instance}}:`;
+  }
+
+  /** Opaque, instance-local cache keys, also available for precise test cleanup. */
+  boundKeys(
+    authorization: Pick<ICaptchaAuthorization, 'scope' | 'ip' | 'recipientLimits' | 'ipLimits'>,
+  ) {
+    const prefix = this.boundPrefix();
+    return {
+      pointer: `${prefix}current:${authorization.scope}`,
+      cooldown: `${prefix}cooldown:${authorization.scope}`,
+      budgets: [
+        ...authorization.recipientLimits.map(
+          limit => `${prefix}recipient:${authorization.scope}:${limit.windowMs}`,
+        ),
+        ...authorization.ipLimits.map(limit => `${prefix}ip:${authorization.ip}:${limit.windowMs}`),
+      ],
+    };
+  }
+
+  async reserveBound(id: string, data: ICaptchaDataCache, authorization: ICaptchaAuthorization) {
+    this._validateAuthorization(authorization);
+    this._validateBoundId(id);
+    const keys = this.boundKeys(authorization);
+    const policy = {
+      ttl: authorization.ttl,
+      cooldown: authorization.cooldown,
+      budgets: [...authorization.recipientLimits, ...authorization.ipLimits],
+    };
+    const result = (await this._eval(
+      captchaReserveLua,
+      [id, keys.pointer, keys.cooldown, ...keys.budgets],
+      [id, JSON.stringify(policy), JSON.stringify(data)],
+    )) as [number, string, number, number];
+    if (result[0] === -1) throw new Error('captcha identity collision');
+    if (result[0] === 0) {
+      return { reserved: false as const, retryAt: result[2], resendAt: result[3] };
+    }
+    if (result[0] !== 1 || !result[1]) throw new Error('invalid captcha reservation');
+    return {
+      reserved: true as const,
+      snapshot: { raw: result[1], data: JSON.parse(result[1]) as ICaptchaDataCache },
+    };
+  }
+
+  async finalizeBound(id: string, snapshot: ICaptchaSnapshot, data?: ICaptchaDataCache) {
+    this._validateBoundId(id);
+    const scope = snapshot.data.bound!.scope;
+    const pointer = `${this.boundPrefix()}current:${scope}`;
+    return (
+      (await this._eval(
+        captchaFinalizeLua,
+        [id, pointer],
+        [snapshot.raw, id, data === undefined ? '' : JSON.stringify(data)],
+      )) === 1
+    );
+  }
+
+  /** -1 asks the verifier to reread a competing wrong-attempt update. */
+  async consumeBound(id: string, snapshot: ICaptchaSnapshot, verified: boolean) {
+    this._validateBoundId(id);
+    const bound = snapshot.data.bound!;
+    const pointer = `${this.boundPrefix()}current:${bound.scope}`;
+    const next = {
+      ...snapshot.data,
+      bound: {
+        ...bound,
+        attemptsRemaining: bound.attemptsRemaining - 1,
+        version: bound.version + 1,
+      },
+    };
+    return (await this._eval(
+      captchaConsumeLua,
+      [id, pointer],
+      [snapshot.raw, id, verified ? '1' : '0', JSON.stringify(next)],
+    )) as number;
+  }
+
+  validateAuthorization(authorization: ICaptchaAuthorization) {
+    this._validateAuthorization(authorization);
+  }
+
+  private _validateAuthorization(authorization: ICaptchaAuthorization) {
+    if (!authorization || typeof authorization !== 'object')
+      throw new Error('invalid captcha authorization');
+    const { binding, scope, ip, ttl, cooldown, maxAttempts, recipientLimits, ipLimits } =
+      authorization;
+    const text = (value: unknown) =>
+      typeof value === 'string' && value.length > 0 && value.length <= 512;
+    const hash = (value: unknown) => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+    if (
+      !binding ||
+      !text(binding.recipient) ||
+      !text(binding.purpose) ||
+      (binding.subject !== undefined && !text(binding.subject)) ||
+      !hash(scope) ||
+      !hash(ip)
+    ) {
+      throw new Error('invalid captcha binding');
+    }
+    this._validateTtl(ttl);
+    if (
+      !Number.isSafeInteger(cooldown) ||
+      cooldown < 0 ||
+      cooldown > Number.MAX_SAFE_INTEGER - Date.now() ||
+      maxAttempts !== 5
+    ) {
+      throw new Error('invalid captcha policy');
+    }
+    for (const limits of [recipientLimits, ipLimits]) {
+      if (!Array.isArray(limits) || limits.length === 0 || limits.length > 16)
+        throw new Error('invalid captcha limits');
+      const windows = new Set<number>();
+      for (const limit of limits) {
+        if (
+          !limit ||
+          !Number.isSafeInteger(limit.limit) ||
+          limit.limit <= 0 ||
+          windows.has(limit.windowMs)
+        ) {
+          throw new Error('invalid captcha limit');
+        }
+        this._validateTtl(limit.windowMs);
+        windows.add(limit.windowMs);
+      }
+    }
+  }
+
+  private _validateTtl(ttl: number) {
+    if (!Number.isSafeInteger(ttl) || ttl <= 0 || ttl > Number.MAX_SAFE_INTEGER - Date.now()) {
+      throw new Error('invalid captcha ttl');
+    }
+  }
+
+  private _validateBoundId(id: string) {
+    if (
+      !id.startsWith(this.boundPrefix()) ||
+      !/^[a-f0-9-]{36}$/.test(id.slice(this.boundPrefix().length))
+    ) {
+      throw new Error('invalid bound captcha identity');
+    }
+  }
+
+  private _redisKeys(ids: string[]) {
+    const redis = this.__cacheInstance;
+    if (!redis) throw new Error('captcha cache not enabled');
+    return { redis, keys: ids.map(id => this.getRedisKey(id)!) };
+  }
+
+  private async _eval(lua: string, ids: string[], args: Array<string | number>) {
+    const { redis, keys } = this._redisKeys(ids);
+    return await redis.eval(lua, keys.length, ...keys, ...args);
+  }
+}

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/lib/captchaLua.ts

@@ -0,0 +1,90 @@
+// All keys are supplied through the existing captcha cache owner. Bound keys share
+// one instance hash tag; image transitions use their original single key.
+export const captchaCasLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] then return 0 end
+if ARGV[2] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  local ttl = tonumber(ARGV[3])
+  if ttl > 0 then
+    redis.call('SET', KEYS[1], ARGV[2], 'PX', ttl)
+  else
+    redis.call('SET', KEYS[1], ARGV[2], 'KEEPTTL')
+  end
+end
+return 1
+`;
+
+export const captchaReserveLua = `
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+local policy = cjson.decode(ARGV[2])
+local cooldown = tonumber(redis.call('GET', KEYS[3]) or '0')
+local retryAt = cooldown
+local counters = {}
+for i, budget in ipairs(policy.budgets) do
+  local value = tonumber(redis.call('GET', KEYS[i + 3]) or '0')
+  local deadline = (math.floor(now / budget.windowMs) + 1) * budget.windowMs
+  local remaining = redis.call('PTTL', KEYS[i + 3])
+  if remaining <= 0 then value = 0 end
+  counters[i] = { value = value, deadline = deadline }
+  if value >= budget.limit and deadline > retryAt then retryAt = deadline end
+end
+if retryAt > now then return { 0, '', retryAt, cooldown } end
+if redis.call('EXISTS', KEYS[1]) == 1 then return { -1 } end
+local data = cjson.decode(ARGV[3])
+data.bound.expiresAt = now + policy.ttl
+data.bound.resendAt = now + policy.cooldown
+local raw = cjson.encode(data)
+for i, counter in ipairs(counters) do
+  redis.call('SET', KEYS[i + 3], tostring(counter.value + 1))
+  redis.call('PEXPIREAT', KEYS[i + 3], counter.deadline)
+end
+redis.call('SET', KEYS[1], raw)
+redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+redis.call('SET', KEYS[2], ARGV[1])
+redis.call('PEXPIREAT', KEYS[2], math.max(data.bound.expiresAt, data.bound.resendAt))
+if policy.cooldown > 0 then
+  redis.call('SET', KEYS[3], tostring(data.bound.resendAt))
+  redis.call('PEXPIREAT', KEYS[3], data.bound.resendAt)
+end
+return { 1, raw, data.bound.expiresAt, data.bound.resendAt }
+`;
+
+export const captchaFinalizeLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] or redis.call('GET', KEYS[2]) ~= ARGV[2] then return 0 end
+local data = cjson.decode(current)
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if data.bound.state ~= 'pending' or data.bound.expiresAt <= now then return 0 end
+if ARGV[3] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[3])
+  redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+end
+return 1
+`;
+
+// Verification happens in the provider. Only the caller holding this exact active
+// snapshot can commit its verdict, so success cannot race refresh or another use.
+export const captchaConsumeLua = `
+local current = redis.call('GET', KEYS[1])
+if current ~= ARGV[1] then return -1 end
+if redis.call('GET', KEYS[2]) ~= ARGV[2] then return 0 end
+local data = cjson.decode(current)
+local time = redis.call('TIME')
+local now = tonumber(time[1]) * 1000 + math.floor(tonumber(time[2]) / 1000)
+if data.bound.state ~= 'active' or data.bound.expiresAt <= now or data.bound.attemptsRemaining <= 0 then
+  return 0
+end
+if ARGV[3] == '1' or data.bound.attemptsRemaining == 1 then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[4])
+  redis.call('PEXPIREAT', KEYS[1], data.bound.expiresAt)
+end
+return 1
+`;

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/types/captcha.ts

@@ -1,4 +1,4 @@
-import type { ICaptchaProviderRecord } from './captchaProvider.ts';
+import type { ICaptchaBinding, ICaptchaProviderRecord } from './captchaProvider.ts';
 import type { ICaptchaSceneRecord } from './captchaScene.ts';
 import 'vona';
 
@@ -7,6 +7,16 @@ export interface ICaptchaDataCache {
   provider: keyof ICaptchaProviderRecord;
   token?: unknown;
   token2?: string;
+  revision?: string;
+  bound?: {
+    binding: ICaptchaBinding;
+    scope: string;
+    state: 'pending' | 'active';
+    expiresAt: number;
+    resendAt: number;
+    attemptsRemaining: number;
+    version: number;
+  };
 }
 
 export interface ICaptchaData {
@@ -14,6 +24,10 @@ export interface ICaptchaData {
   provider: keyof ICaptchaProviderRecord;
   token?: unknown;
   payload: unknown;
+  status?: 'accepted' | 'rejected' | 'unknown' | 'limited';
+  expiresAt?: number;
+  resendAt?: number;
+  retryAt?: number;
 }
 
 declare module 'vona' {

package/vona/src/suite-vendor/a-captcha/modules/a-captcha/src/types/captchaProvider.ts

@@ -1,10 +1,44 @@
 import type { OmitNever } from 'vona';
 import type { ServiceOnion, TypeOnionOptionsEnableSimple } from 'vona-module-a-onion';
 
+import type { ICaptchaSceneRecord } from './captchaScene.ts';
+
 export interface ICaptchaProviderRecord {}
 
+export interface ICaptchaBinding {
+  recipient: string;
+  purpose: string;
+  subject?: string;
+}
+
+export interface ICaptchaLimit {
+  limit: number;
+  windowMs: number;
+}
+
+/** Server-authorized policy, never populated from generic captcha request JSON. */
+export interface ICaptchaAuthorization {
+  binding: ICaptchaBinding;
+  scope: string;
+  ip: string;
+  ttl: number;
+  cooldown: number;
+  maxAttempts: number;
+  recipientLimits: ICaptchaLimit[];
+  ipLimits: ICaptchaLimit[];
+}
+
 export interface ICaptchaProviderExecute<TOKEN = unknown, PAYLOAD = unknown> {
-  create(options: IDecoratorCaptchaProviderOptions): Promise<ICaptchaProviderData<TOKEN, PAYLOAD>>;
+  readonly bound?: boolean;
+  authorize?(
+    context: unknown,
+    operation: 'issue' | 'consume',
+    sceneName: keyof ICaptchaSceneRecord,
+  ): ICaptchaAuthorization | undefined | Promise<ICaptchaAuthorization | undefined>;
+  create(
+    options: IDecoratorCaptchaProviderOptions,
+    context?: unknown,
+  ): Promise<ICaptchaProviderData<TOKEN, PAYLOAD>>;
   verify(
     token: TOKEN,
     tokenInput: TOKEN,
@@ -15,6 +49,9 @@ export interface ICaptchaProviderExecute<TOKEN = unknown, PAYLOAD = unknown> {
 export interface ICaptchaProviderData<TOKEN = unknown, PAYLOAD = unknown> {
   token: TOKEN;
   payload: PAYLOAD;
+  outcome?: 'accepted' | 'rejected' | 'unknown';
+  /** Bound providers alone decide whether their actual transport may expose the token. */
+  exposeToken?: boolean;
 }
 
 export interface IDecoratorCaptchaProviderOptions extends TypeOnionOptionsEnableSimple {

package/vona/src/suite-vendor/a-captcha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-captcha",
-  "version": "5.1.19",
+  "version": "5.1.20",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.33",
+  "version": "5.1.35",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/bean.permission.ts

@@ -11,7 +11,7 @@ import type { ContextRoute, IRecordResourceNameToRoutePathItem } from 'vona-modu
 import { appResource, BeanBase, beanFullNameFromOnionName } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import { Caching } from 'vona-module-a-caching';
-import { clearRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
+import { clearRbacDecision, getRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
 import {
   composeGuards,
   getCacheControllerRoutes,
@@ -107,6 +107,23 @@ export class BeanPermission extends BeanBase {
     return typeof permission === 'boolean' ? permission : permission.allowed;
   }
 
+  /**
+   * Checks current guards without permission events, result caches or matcher projection.
+   * A true result does not authorize individual records or prepare data scope/owner values.
+   * The target action's RBAC decision is not retained; scoped operations must authorize separately.
+   */
+  public async checkPermissionActionGuards(
+    resource: keyof IResourceRecord,
+    actionKey: string,
+  ): Promise<boolean> {
+    if (!Object.hasOwn(recordResourceNameToRoutePath, resource)) return false;
+    const routePathInfo = recordResourceNameToRoutePath[resource];
+    if (!routePathInfo || !appResource.getBean(routePathInfo.controller)) return false;
+    const route = this._getControllerActionRoute(resource, actionKey);
+    if (!route?.route?.meta || !this._matchPassportMeta(route.route.meta)) return false;
+    return await this._evaluatePermissionAction(route, true);
+  }
+
   public async retrievePermissionAction(
     resource: keyof IResourceRecord,
     actionKey: string,
@@ -201,12 +218,17 @@ export class BeanPermission extends BeanBase {
     return true;
   }
 
-  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction> {
+  private async _evaluatePermissionAction(route: ContextRoute, guardsOnly: true): Promise<boolean>;
+  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction>;
+  private async _evaluatePermissionAction(
+    route: ContextRoute,
+    guardsOnly = false,
+  ): Promise<IOpenapiPermissionAction> {
     const ctx = this.ctx as any;
-    const routePrevious = ctx.route;
+    const routeDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'route');
+    const innerAccessDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'innerAccess');
     const innerAccessPrevious = ctx.innerAccess;
-    const rbacDecisionHadOwnProperty = Object.hasOwn(ctx, SymbolRbacDecision);
-    const rbacDecisionPrevious = ctx[SymbolRbacDecision];
+    const rbacDecisionDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, SymbolRbacDecision);
     try {
       ctx.route = route;
       ctx.innerAccess = false;
@@ -214,19 +236,43 @@ export class BeanPermission extends BeanBase {
       const result = await composeGuards(this.app, route)(this.ctx);
       if (result === false) return false;
       if (!route.route.meta?.[BeanFullNameGuardRbac]) return true;
+      if (guardsOnly) {
+        const action = this.bean.rbacCatalog.getAction(route);
+        const decision = getRbacDecision(this.ctx);
+        return Boolean(
+          action &&
+          Object.hasOwn(ctx, SymbolRbacDecision) &&
+          decision?.allowed === true &&
+          decision.actionKey === action.actionKey &&
+          decision.action?.actionKey === action.actionKey &&
+          decision.action.actionInheritKey === action.actionInheritKey &&
+          decision.action.controllerBeanFullName === action.controllerBeanFullName &&
+          decision.action.action === action.action,
+        );
+      }
       const rbacScopeCurrent = await this.bean.rbacScope.current();
       return rbacScopeCurrent.permissionProjection();
     } catch (err: any) {
       if ([401, 403].includes(err?.code)) return false;
       throw err;
     } finally {
-      if (rbacDecisionHadOwnProperty) {
-        setRbacDecision(ctx, rbacDecisionPrevious);
+      if (rbacDecisionDescriptorPrevious) {
+        Object.defineProperty(ctx, SymbolRbacDecision, rbacDecisionDescriptorPrevious);
       } else {
         clearRbacDecision(ctx);
       }
-      ctx.route = routePrevious;
+      if (routeDescriptorPrevious) {
+        Object.defineProperty(ctx, 'route', routeDescriptorPrevious);
+      } else {
+        delete ctx.route;
+      }
+      // Vona's inherited innerAccess accessor owns its value in a context symbol.
       ctx.innerAccess = innerAccessPrevious;
+      if (innerAccessDescriptorPrevious) {
+        Object.defineProperty(ctx, 'innerAccess', innerAccessDescriptorPrevious);
+      } else {
+        delete ctx.innerAccess;
+      }
     }
   }
 }

package/vona/src/suite-vendor/a-vona/modules/a-permission/test/permission.test.ts

@@ -62,10 +62,10 @@ describe('permission.test.ts', { concurrency: false }, () => {
       roleIds: ['role-a', 'role-b'],
     });
 
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
     assert.equal(
       (first as any).retrievePermissionActionByRolesCacheKey(info),
-      'action:training-student:student:select:roles:role-a,role-b',
+      'action:test:resource:select:roles:role-a,role-b',
     );
     assert.equal(
       (first as any).retrievePermissionActionByRolesCacheKey(info),
@@ -78,7 +78,7 @@ describe('permission.test.ts', { concurrency: false }, () => {
       userId: 'user-1',
       roleIds: ['role-a'],
     });
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
 
     assert.notEqual(
       (permission as any).retrievePermissionActionByRolesCacheKey(info),
@@ -100,10 +100,10 @@ describe('permission.test.ts', { concurrency: false }, () => {
       roleIds: ['role-b'],
     });
 
-    const info = cacheInfo('training-student:student', 'select');
+    const info = cacheInfo('test:resource', 'select');
     assert.equal(
       (first as any).retrievePermissionActionByUserCacheKey(info),
-      'action:training-student:student:select:user:user-1:roles:role-a',
+      'action:test:resource:select:user:user-1:roles:role-a',
     );
     assert.notEqual(
       (first as any).retrievePermissionActionByUserCacheKey(info),
@@ -152,24 +152,21 @@ describe('permission.test.ts', { concurrency: false }, () => {
     });
 
     assert.equal(
-      await permission.retrievePermissionAction('training-student:student', 'ordinary'),
+      await permission.retrievePermissionAction('test:resource' as never, 'ordinary'),
       false,
     );
-    assert.equal(
-      await permission.retrievePermissionAction('training-student:student', 'rbac'),
-      true,
-    );
+    assert.equal(await permission.retrievePermissionAction('test:resource' as never, 'rbac'), true);
     assert.deepEqual(calls, ['roles', 'user']);
   });
 
   it('isolates resource permission snapshots by user', () => {
     const first = createPermission({ userId: 'user-1' });
     const otherUser = createPermission({ userId: 'user-2' });
-    const info = cacheInfo('training-student:student');
+    const info = cacheInfo('test:resource');
 
     assert.equal(
       (first as any).retrievePermissionsCacheKey(info),
-      'user:training-student:student:user:user-1',
+      'user:test:resource:user:user-1',
     );
     assert.notEqual(
       (first as any).retrievePermissionsCacheKey(info),
@@ -333,8 +330,8 @@ describe('permission.test.ts', { concurrency: false }, () => {
       retrievePermissionAction: { value: async () => true },
     });
 
-    assert.equal(await allowed.checkPermissionAction('training-student:student', 'select'), true);
-    assert.equal(await denied.checkPermissionAction('training-student:student', 'select'), false);
-    assert.equal(await legacy.checkPermissionAction('training-student:student', 'select'), true);
+    assert.equal(await allowed.checkPermissionAction('test:resource' as never, 'select'), true);
+    assert.equal(await denied.checkPermissionAction('test:resource' as never, 'select'), false);
+    assert.equal(await legacy.checkPermissionAction('test:resource' as never, 'select'), true);
   });
 });

package/vona/src/suite-vendor/a-vona/modules/a-ratelimit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-ratelimit",
-  "version": "5.1.4",
+  "version": "5.1.5",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-vona/modules/a-user/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-user",
-  "version": "5.1.25",
+  "version": "5.1.26",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-user/src/types/user.ts

@@ -16,6 +16,7 @@ export interface IUserIdRecord {
 export interface IUser {
   id: TableIdentity;
   name: string;
+  displayName?: string;
   avatar?: string;
   email?: string;
   mobile?: string;

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.110",
+  "version": "5.1.112",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",