hazo_auth 1.6.2 → 1.6.5

package/dist/app/api/hazo_auth/user_management/permissions/route.js

@@ -0,0 +1,257 @@
+// file_description: API route for permissions management operations (list, migrate from config, update, delete)
+// section: imports
+import { NextResponse } from "next/server";
+import { get_hazo_connect_instance } from "../../../../../lib/hazo_connect_instance.server";
+import { createCrudService } from "hazo_connect/server";
+import { create_app_logger } from "../../../../../lib/app_logger";
+import { get_filename, get_line_number } from "../../../../../lib/utils/api_route_helpers";
+import { get_user_management_config } from "../../../../../lib/user_management_config.server";
+// section: route_config
+export const dynamic = 'force-dynamic';
+// section: api_handler
+/**
+ * GET - Fetch all permissions from database and config
+ */
+export async function GET(request) {
+    const logger = create_app_logger();
+    try {
+        const hazoConnect = get_hazo_connect_instance();
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        // Fetch all permissions from database (empty object means no filter - get all records)
+        const db_permissions = await permissions_service.findBy({});
+        if (!Array.isArray(db_permissions)) {
+            return NextResponse.json({ error: "Failed to fetch permissions" }, { status: 500 });
+        }
+        // Get config permissions
+        const config = get_user_management_config();
+        const config_permission_names = config.application_permission_list_defaults || [];
+        // Get DB permission names
+        const db_permission_names = db_permissions.map((p) => p.permission_name);
+        // Find config permissions not in DB
+        const config_only_permissions = config_permission_names.filter((name) => !db_permission_names.includes(name));
+        logger.info("user_management_permissions_fetched", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            db_count: db_permissions.length,
+            config_count: config_permission_names.length,
+        });
+        return NextResponse.json({
+            success: true,
+            db_permissions: db_permissions.map((p) => ({
+                id: p.id,
+                permission_name: p.permission_name,
+                description: p.description || "",
+            })),
+            config_permissions: config_only_permissions,
+        }, { status: 200 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_permissions_fetch_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to fetch permissions" }, { status: 500 });
+    }
+}
+/**
+ * POST - Create new permission or migrate config permissions to database
+ */
+export async function POST(request) {
+    const logger = create_app_logger();
+    try {
+        const { searchParams } = new URL(request.url);
+        const action = searchParams.get("action");
+        // Handle migrate action
+        if (action === "migrate") {
+            const hazoConnect = get_hazo_connect_instance();
+            const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+            // Get config permissions
+            const config = get_user_management_config();
+            const config_permission_names = config.application_permission_list_defaults || [];
+            if (config_permission_names.length === 0) {
+                return NextResponse.json({
+                    success: true,
+                    message: "No permissions to migrate",
+                    created: [],
+                    skipped: [],
+                }, { status: 200 });
+            }
+            // Get existing permissions from DB (empty object means no filter - get all records)
+            const db_permissions = await permissions_service.findBy({});
+            const db_permission_names = Array.isArray(db_permissions)
+                ? db_permissions.map((p) => p.permission_name)
+                : [];
+            const now = new Date().toISOString();
+            const created = [];
+            const skipped = [];
+            // Migrate each config permission
+            for (const permission_name of config_permission_names) {
+                if (db_permission_names.includes(permission_name)) {
+                    // Skip if already exists
+                    skipped.push(permission_name);
+                    continue;
+                }
+                // Create new permission
+                await permissions_service.insert({
+                    permission_name: permission_name.trim(),
+                    description: "",
+                    created_at: now,
+                    changed_at: now,
+                });
+                created.push(permission_name);
+            }
+            logger.info("user_management_permissions_migrated", {
+                filename: get_filename(),
+                line_number: get_line_number(),
+                created_count: created.length,
+                skipped_count: skipped.length,
+            });
+            return NextResponse.json({
+                success: true,
+                created,
+                skipped,
+            }, { status: 200 });
+        }
+        // Handle create new permission
+        const body = await request.json();
+        const { permission_name, description } = body;
+        if (!permission_name || typeof permission_name !== "string" || permission_name.trim().length === 0) {
+            return NextResponse.json({ error: "permission_name is required and must be a non-empty string" }, { status: 400 });
+        }
+        const hazoConnect = get_hazo_connect_instance();
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        // Check if permission already exists
+        const existing_permissions = await permissions_service.findBy({
+            permission_name: permission_name.trim(),
+        });
+        if (Array.isArray(existing_permissions) && existing_permissions.length > 0) {
+            return NextResponse.json({ error: "Permission with this name already exists" }, { status: 409 });
+        }
+        // Create new permission
+        const now = new Date().toISOString();
+        const new_permission_result = await permissions_service.insert({
+            permission_name: permission_name.trim(),
+            description: (description || "").trim(),
+            created_at: now,
+            changed_at: now,
+        });
+        // insert() returns an array, get the first element
+        if (!Array.isArray(new_permission_result) || new_permission_result.length === 0) {
+            return NextResponse.json({ error: "Failed to create permission - no record returned" }, { status: 500 });
+        }
+        const new_permission = new_permission_result[0];
+        logger.info("user_management_permission_created", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            permission_id: new_permission.id,
+            permission_name: permission_name.trim(),
+        });
+        return NextResponse.json({
+            success: true,
+            permission: {
+                id: new_permission.id,
+                permission_name: permission_name.trim(),
+                description: (description || "").trim(),
+            },
+        }, { status: 201 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_permissions_post_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to create permission" }, { status: 500 });
+    }
+}
+/**
+ * PUT - Update permission description
+ */
+export async function PUT(request) {
+    const logger = create_app_logger();
+    try {
+        const body = await request.json();
+        const { permission_id, description } = body;
+        if (!permission_id || typeof description !== "string") {
+            return NextResponse.json({ error: "permission_id and description are required" }, { status: 400 });
+        }
+        const hazoConnect = get_hazo_connect_instance();
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        // Update permission with changed_at timestamp
+        const now = new Date().toISOString();
+        await permissions_service.updateById(permission_id, {
+            description: description.trim(),
+            changed_at: now,
+        });
+        logger.info("user_management_permission_updated", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            permission_id,
+        });
+        return NextResponse.json({ success: true }, { status: 200 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_permission_update_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to update permission" }, { status: 500 });
+    }
+}
+/**
+ * DELETE - Delete permission from database
+ */
+export async function DELETE(request) {
+    const logger = create_app_logger();
+    try {
+        const { searchParams } = new URL(request.url);
+        const permission_id = searchParams.get("permission_id");
+        if (!permission_id) {
+            return NextResponse.json({ error: "permission_id is required" }, { status: 400 });
+        }
+        const permission_id_num = parseInt(permission_id, 10);
+        if (isNaN(permission_id_num)) {
+            return NextResponse.json({ error: "permission_id must be a number" }, { status: 400 });
+        }
+        const hazoConnect = get_hazo_connect_instance();
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        const role_permissions_service = createCrudService(hazoConnect, "hazo_role_permissions");
+        // Check if permission is used in any role
+        const role_permissions = await role_permissions_service.findBy({
+            permission_id: permission_id_num,
+        });
+        if (Array.isArray(role_permissions) && role_permissions.length > 0) {
+            return NextResponse.json({ error: "Cannot delete permission that is assigned to roles" }, { status: 409 });
+        }
+        // Delete permission
+        await permissions_service.deleteById(permission_id_num);
+        logger.info("user_management_permission_deleted", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            permission_id: permission_id_num,
+        });
+        return NextResponse.json({ success: true }, { status: 200 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_permission_delete_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to delete permission" }, { status: 500 });
+    }
+}

package/dist/app/api/hazo_auth/user_management/roles/route.d.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server";
+export declare const dynamic = "force-dynamic";
+/**
+ * GET - Fetch all roles with their permissions
+ */
+export declare function GET(request: NextRequest): Promise<NextResponse<{
+    error: string;
+}> | NextResponse<{
+    success: boolean;
+    roles: {
+        role_id: unknown;
+        role_name: unknown;
+        permissions: string[];
+    }[];
+    permissions: {
+        id: unknown;
+        permission_name: unknown;
+    }[];
+}>>;
+/**
+ * POST - Create new role
+ */
+export declare function POST(request: NextRequest): Promise<NextResponse<{
+    error: string;
+}> | NextResponse<{
+    success: boolean;
+    role: {
+        role_id: number;
+        role_name: string;
+    };
+}>>;
+/**
+ * PUT - Update role permissions (save role-permission matrix)
+ */
+export declare function PUT(request: NextRequest): Promise<NextResponse<{
+    error: string;
+}> | NextResponse<{
+    success: boolean;
+}>>;
+//# sourceMappingURL=route.d.ts.map

package/dist/app/api/hazo_auth/user_management/roles/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../src/app/api/hazo_auth/user_management/roles/route.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AASxD,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAGvC;;GAEG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW;;;;;;;;;;;;;IAqF7C;AAED;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW;;;;;;;;IAgF9C;AAED;;GAEG;AACH,wBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW;;;;IAwP7C"}

package/dist/app/api/hazo_auth/user_management/roles/route.js

@@ -0,0 +1,352 @@
+// file_description: API route for roles management operations (list roles with permissions, create role, update role permissions)
+// section: imports
+import { NextResponse } from "next/server";
+import { get_hazo_connect_instance } from "../../../../../lib/hazo_connect_instance.server";
+import { createCrudService, getSqliteAdminService } from "hazo_connect/server";
+import { create_app_logger } from "../../../../../lib/app_logger";
+import { get_filename, get_line_number } from "../../../../../lib/utils/api_route_helpers";
+import { get_auth_cache } from "../../../../../lib/auth/auth_cache";
+import { get_auth_utility_config } from "../../../../../lib/auth_utility_config.server";
+// section: route_config
+export const dynamic = 'force-dynamic';
+// section: api_handler
+/**
+ * GET - Fetch all roles with their permissions
+ */
+export async function GET(request) {
+    const logger = create_app_logger();
+    try {
+        const hazoConnect = get_hazo_connect_instance();
+        const roles_service = createCrudService(hazoConnect, "hazo_roles");
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        const role_permissions_service = createCrudService(hazoConnect, "hazo_role_permissions");
+        // Fetch all roles (empty object means no filter - get all records)
+        const roles = await roles_service.findBy({});
+        const permissions = await permissions_service.findBy({});
+        const role_permissions = await role_permissions_service.findBy({});
+        if (!Array.isArray(roles) || !Array.isArray(permissions) || !Array.isArray(role_permissions)) {
+            return NextResponse.json({ error: "Failed to fetch roles data" }, { status: 500 });
+        }
+        // Build role-permission mapping
+        const role_permission_map = {};
+        role_permissions.forEach((rp) => {
+            const role_id = rp.role_id;
+            const permission_id = rp.permission_id;
+            if (!role_permission_map[role_id]) {
+                role_permission_map[role_id] = [];
+            }
+            role_permission_map[role_id].push(permission_id);
+        });
+        // Build permission name map
+        const permission_name_map = {};
+        permissions.forEach((perm) => {
+            permission_name_map[perm.id] = perm.permission_name;
+        });
+        // Format response
+        const roles_with_permissions = roles.map((role) => {
+            const role_id = role.id;
+            const permission_ids = role_permission_map[role_id] || [];
+            const permission_names = permission_ids.map((pid) => permission_name_map[pid]).filter(Boolean);
+            return {
+                role_id: role.id,
+                role_name: role.role_name,
+                permissions: permission_names,
+            };
+        });
+        logger.info("user_management_roles_fetched", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            role_count: roles.length,
+            permission_count: permissions.length,
+        });
+        return NextResponse.json({
+            success: true,
+            roles: roles_with_permissions,
+            permissions: permissions.map((p) => ({
+                id: p.id,
+                permission_name: p.permission_name,
+            })),
+        }, { status: 200 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_roles_fetch_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to fetch roles" }, { status: 500 });
+    }
+}
+/**
+ * POST - Create new role
+ */
+export async function POST(request) {
+    const logger = create_app_logger();
+    try {
+        const body = await request.json();
+        const { role_name } = body;
+        if (!role_name || typeof role_name !== "string" || role_name.trim().length === 0) {
+            return NextResponse.json({ error: "role_name is required and must be a non-empty string" }, { status: 400 });
+        }
+        const hazoConnect = get_hazo_connect_instance();
+        const roles_service = createCrudService(hazoConnect, "hazo_roles");
+        // Check if role already exists
+        const existing_roles = await roles_service.findBy({
+            role_name: role_name.trim(),
+        });
+        if (Array.isArray(existing_roles) && existing_roles.length > 0) {
+            return NextResponse.json({ error: "Role with this name already exists" }, { status: 409 });
+        }
+        // Create new role
+        const now = new Date().toISOString();
+        const new_role_result = await roles_service.insert({
+            role_name: role_name.trim(),
+            created_at: now,
+            changed_at: now,
+        });
+        // insert() returns an array, get the first element
+        if (!Array.isArray(new_role_result) || new_role_result.length === 0) {
+            return NextResponse.json({ error: "Failed to create role - no record returned" }, { status: 500 });
+        }
+        const new_role = new_role_result[0];
+        logger.info("user_management_role_created", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            role_id: new_role.id,
+            role_name: role_name.trim(),
+        });
+        return NextResponse.json({
+            success: true,
+            role: {
+                role_id: new_role.id,
+                role_name: role_name.trim(),
+            },
+        }, { status: 201 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_role_create_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to create role" }, { status: 500 });
+    }
+}
+/**
+ * PUT - Update role permissions (save role-permission matrix)
+ */
+export async function PUT(request) {
+    const logger = create_app_logger();
+    try {
+        const body = await request.json();
+        const { roles } = body;
+        if (!Array.isArray(roles)) {
+            return NextResponse.json({ error: "roles array is required" }, { status: 400 });
+        }
+        const hazoConnect = get_hazo_connect_instance();
+        const roles_service = createCrudService(hazoConnect, "hazo_roles");
+        const permissions_service = createCrudService(hazoConnect, "hazo_permissions");
+        const role_permissions_service = createCrudService(hazoConnect, "hazo_role_permissions");
+        // Get all permissions to build name-to-id map (empty object means no filter - get all records)
+        const all_permissions = await permissions_service.findBy({});
+        if (!Array.isArray(all_permissions)) {
+            return NextResponse.json({ error: "Failed to fetch permissions" }, { status: 500 });
+        }
+        const permission_name_to_id = {};
+        all_permissions.forEach((perm) => {
+            permission_name_to_id[perm.permission_name] = perm.id;
+        });
+        const now = new Date().toISOString();
+        const modified_role_ids = []; // Track all role IDs that were modified
+        // Process each role
+        for (const role_data of roles) {
+            const { role_id, role_name, permissions } = role_data;
+            if (!role_name || !Array.isArray(permissions)) {
+                continue; // Skip invalid entries
+            }
+            let current_role_id;
+            if (role_id) {
+                // Update existing role
+                current_role_id = role_id;
+                await roles_service.updateById(role_id, {
+                    role_name: role_name.trim(),
+                    changed_at: now,
+                });
+            }
+            else {
+                // Create new role
+                const existing_roles = await roles_service.findBy({
+                    role_name: role_name.trim(),
+                });
+                if (Array.isArray(existing_roles) && existing_roles.length > 0) {
+                    current_role_id = existing_roles[0].id;
+                }
+                else {
+                    const new_role = await roles_service.insert({
+                        role_name: role_name.trim(),
+                        created_at: now,
+                        changed_at: now,
+                    });
+                    // Handle both single object and array responses from insert
+                    if (Array.isArray(new_role) && new_role.length > 0) {
+                        current_role_id = new_role[0].id;
+                    }
+                    else if (!Array.isArray(new_role) && new_role.id !== undefined) {
+                        current_role_id = new_role.id;
+                    }
+                    else {
+                        // If insert didn't return an id, try to find the role by name
+                        const inserted_roles = await roles_service.findBy({
+                            role_name: role_name.trim(),
+                        });
+                        if (Array.isArray(inserted_roles) && inserted_roles.length > 0) {
+                            current_role_id = inserted_roles[0].id;
+                        }
+                    }
+                }
+            }
+            // Skip if we couldn't determine the role ID
+            if (!current_role_id) {
+                logger.warn("user_management_role_id_not_found", {
+                    filename: get_filename(),
+                    line_number: get_line_number(),
+                    role_name: role_name.trim(),
+                    role_id,
+                });
+                continue;
+            }
+            // Track this role ID for cache invalidation
+            modified_role_ids.push(current_role_id);
+            // Get current role-permission mappings
+            const current_mappings = await role_permissions_service.findBy({
+                role_id: current_role_id,
+            });
+            const current_permission_ids = Array.isArray(current_mappings)
+                ? current_mappings.map((m) => m.permission_id)
+                : [];
+            // Get target permission IDs
+            const target_permission_ids = permissions
+                .map((perm_name) => permission_name_to_id[perm_name])
+                .filter((id) => id !== undefined);
+            // Delete removed permissions
+            // Note: hazo_role_permissions is a junction table without an id column
+            // We need to use SQLite admin service to delete by composite key (role_id, permission_id)
+            const to_delete = current_permission_ids.filter((id) => !target_permission_ids.includes(id));
+            if (to_delete.length > 0) {
+                try {
+                    const admin_service = getSqliteAdminService();
+                    for (const perm_id of to_delete) {
+                        // Delete using SQLite admin service with criteria (role_id and permission_id)
+                        await admin_service.deleteRows("hazo_role_permissions", {
+                            role_id: current_role_id,
+                            permission_id: perm_id,
+                        });
+                    }
+                }
+                catch (adminError) {
+                    // Fallback: try using createCrudService deleteById if rowid exists
+                    // SQLite tables have a hidden rowid column that can be used
+                    const error_message = adminError instanceof Error ? adminError.message : "Unknown error";
+                    logger.warn("user_management_role_permission_delete_admin_failed", {
+                        filename: get_filename(),
+                        line_number: get_line_number(),
+                        error: error_message,
+                        note: "Trying fallback method",
+                    });
+                    // Fallback: try to find and delete using rowid if available
+                    for (const perm_id of to_delete) {
+                        const mappings_to_delete = await role_permissions_service.findBy({
+                            role_id: current_role_id,
+                            permission_id: perm_id,
+                        });
+                        if (Array.isArray(mappings_to_delete) && mappings_to_delete.length > 0) {
+                            for (const mapping of mappings_to_delete) {
+                                // Try deleteById with rowid (SQLite has hidden rowid)
+                                try {
+                                    // Check if mapping has an id field (could be rowid)
+                                    if (mapping.id !== undefined) {
+                                        await role_permissions_service.deleteById(mapping.id);
+                                    }
+                                    else if (mapping.rowid !== undefined) {
+                                        await role_permissions_service.deleteById(mapping.rowid);
+                                    }
+                                    else {
+                                        // Last resort: log error
+                                        logger.error("user_management_role_permission_delete_no_id", {
+                                            filename: get_filename(),
+                                            line_number: get_line_number(),
+                                            role_id: current_role_id,
+                                            permission_id: perm_id,
+                                            mapping,
+                                        });
+                                    }
+                                }
+                                catch (deleteError) {
+                                    const delete_error_message = deleteError instanceof Error ? deleteError.message : "Unknown error";
+                                    logger.error("user_management_role_permission_delete_failed", {
+                                        filename: get_filename(),
+                                        line_number: get_line_number(),
+                                        role_id: current_role_id,
+                                        permission_id: perm_id,
+                                        error: delete_error_message,
+                                    });
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Add new permissions
+            const to_add = target_permission_ids.filter((id) => !current_permission_ids.includes(id));
+            for (const perm_id of to_add) {
+                await role_permissions_service.insert({
+                    role_id: current_role_id,
+                    permission_id: perm_id,
+                    created_at: now,
+                    changed_at: now,
+                });
+            }
+        }
+        // Invalidate cache for all affected roles
+        try {
+            const config = get_auth_utility_config();
+            const cache = get_auth_cache(config.cache_max_users, config.cache_ttl_minutes, config.cache_max_age_minutes);
+            // Invalidate by all role IDs that were modified (including newly created ones)
+            if (modified_role_ids.length > 0) {
+                cache.invalidate_by_roles(modified_role_ids);
+            }
+        }
+        catch (cache_error) {
+            // Log but don't fail role update if cache invalidation fails
+            const cache_error_message = cache_error instanceof Error ? cache_error.message : "Unknown error";
+            logger.warn("user_management_roles_cache_invalidation_failed", {
+                filename: get_filename(),
+                line_number: get_line_number(),
+                error: cache_error_message,
+            });
+        }
+        logger.info("user_management_roles_updated", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            role_count: roles.length,
+        });
+        return NextResponse.json({ success: true }, { status: 200 });
+    }
+    catch (error) {
+        const error_message = error instanceof Error ? error.message : "Unknown error";
+        const error_stack = error instanceof Error ? error.stack : undefined;
+        logger.error("user_management_roles_update_error", {
+            filename: get_filename(),
+            line_number: get_line_number(),
+            error_message,
+            error_stack,
+        });
+        return NextResponse.json({ error: "Failed to update roles" }, { status: 500 });
+    }
+}