nucleus-core-ts 0.9.717 → 0.9.718
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -20,6 +20,22 @@ export interface AdminGuardDeps {
|
|
|
20
20
|
* fallback) — e.g. the payment plugin.
|
|
21
21
|
*/
|
|
22
22
|
export declare function hasGodminRole(request: Request): boolean;
|
|
23
|
+
/**
|
|
24
|
+
* Authoritative godmin check via the DB `user_roles`→`roles` join.
|
|
25
|
+
*
|
|
26
|
+
* Unlike the header-only {@link hasGodminRole}, this does not depend on the
|
|
27
|
+
* `x-user-roles` header being fresh. The header is populated from the JWT
|
|
28
|
+
* `roles` claim, which can lag the DB after a token refresh — a header-only
|
|
29
|
+
* gate would then lock a REAL godmin out of RBAC management (assigning,
|
|
30
|
+
* patching, or removing role_claims) with a spurious 403, even though the DB
|
|
31
|
+
* still records the godmin role. Use as a fallback when the header check fails.
|
|
32
|
+
*
|
|
33
|
+
* Best-effort: returns false (never throws) when the DB/tables are missing or
|
|
34
|
+
* the query fails, so it can only ever GRANT access to a genuine godmin — never
|
|
35
|
+
* deny a real request on infrastructure hiccups beyond the header path already
|
|
36
|
+
* having failed.
|
|
37
|
+
*/
|
|
38
|
+
export declare function userHasGodminRoleInDb(db: NodePgDatabase | null | undefined, schemaTables: Record<string, unknown>, userId: string | null | undefined, logger: Logger): Promise<boolean>;
|
|
23
39
|
/**
|
|
24
40
|
* Returns true when the request is made by a godmin user.
|
|
25
41
|
*
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nucleus-core-ts",
|
|
3
|
-
"version": "0.9.
|
|
3
|
+
"version": "0.9.718",
|
|
4
4
|
"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
|
|
5
5
|
"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
|
|
6
6
|
"license": "SEE LICENSE IN LICENSE",
|