nucleus-core-ts 0.9.728 → 0.9.730

package/dist/src/ElysiaPlugin/routes/auth/admin/createUserAuthz.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Pure, fail-closed authorization decision for the admin "create user" endpoint. Kept out of
+ * the route handler so the privilege-escalation guard can be unit-tested in isolation.
+ *
+ * Two boundaries must hold together:
+ *  1. Only a godmin, OR a caller holding one of `allowRoles`, may call the endpoint at all.
+ *  2. A caller who is NOT a godmin (admitted purely via `allowRoles`) must NOT be able to
+ *     assign the godmin role — otherwise a delegated operator (e.g. "support") could mint a
+ *     full super-admin, bypassing the isRbacTable godmin gate that protects generic
+ *     user_roles writes. Only a godmin may assign the godmin role.
+ */
+export type CreateUserAuthzDecision = {
+    allowed: true;
+    callerIsGodmin: boolean;
+} | {
+    allowed: false;
+    status: 403;
+    reason: 'not_privileged' | 'godmin_assignment_forbidden';
+};
+export declare function decideCreateUserAuthz(params: {
+    /** The caller's DB is_god flag. */
+    callerIsGod: boolean;
+    /** Role NAMES the caller holds (from a user_roles⋈roles lookup). */
+    callerRoleNames: string[];
+    /** Role names permitted to call this endpoint (in addition to godmins). */
+    allowRoles: string[];
+    /** Role NAMES the caller is trying to assign to the new user. */
+    requestedRoleNames: string[];
+    /** The framework's godmin role name (GODMIN_ROLE_NAME). */
+    godminRoleName: string;
+}): CreateUserAuthzDecision;

package/dist/src/ElysiaPlugin/routes/auth/admin/createUserAuthz.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/ElysiaPlugin/routes/entity/relationAuthz.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Pure, fail-closed decision helpers for authorizing `?with=` relation expansions on
+ * entity GET routes. Kept out of the route handler so they can be unit-tested in
+ * isolation (no DB, no Elysia). See index.ts for how they are wired into the handler.
+ */
+/** The subset of an authorization check result the relation-expansion decision needs. */
+export interface RelationAuthResult {
+    authorized: boolean;
+    scopeFilters?: Record<string, unknown>;
+}
+/** Outcome of the decision: whether to expand, and (when authorized + scoped) with which scope. */
+export type RelationExpansionDecision = {
+    expand: false;
+} | {
+    expand: true;
+    scope?: Record<string, unknown>;
+};
+/**
+ * Decide whether a requested `?with=<relation>` may be expanded, and with what ownership
+ * scope. Fail-closed by construction:
+ *
+ *  - `!authEnabled` OR the relation is unmapped (`!targetTable`) → expand fully. There is no
+ *    per-relation gate to apply (auth is off, or we could not resolve the relation's target
+ *    entity), so this preserves the pre-per-relation-authz behavior.
+ *
+ *  - `relAuth === null` → NO user context. This is the PUBLIC-parent-route case: on a public
+ *    GET route the auth middleware never sets `x-user-id`, so the per-relation check has no
+ *    caller to authorize. Expanding a NON-public target here would let a public parent entity
+ *    transitively leak a DIFFERENT, non-public entity's full rows to an anonymous caller
+ *    (e.g. `GET /comments/:id?with=author` exposing every `users` column). So expand ONLY when
+ *    the TARGET entity is itself public-GET; otherwise DENY.
+ *
+ *  - `relAuth.authorized === false` → DENY. The caller has no read claim on the target entity,
+ *    so the relation must not be expanded.
+ *
+ *  - `relAuth.authorized === true` → expand, carrying the target claim's OWN `self:` scope so a
+ *    caller can only pull related rows they own (empty/absent scope → unscoped expand).
+ */
+export declare function decideRelationExpansion(params: {
+    authEnabled: boolean;
+    targetTable: string | undefined;
+    relAuth: RelationAuthResult | null;
+    isTargetPublicGet: boolean;
+}): RelationExpansionDecision;
+/**
+ * Resolve a related table's drizzle column for a scope key, accepting snake_case or camelCase,
+ * using OWN-property lookups ONLY. A raw `fields[key]` reaches through the prototype chain: a
+ * stale/typo'd/malicious scope key that happens to be an `Object.prototype` member name
+ * (`constructor`, `toString`, `hasOwnProperty`, `__proto__`, …) would return a truthy INHERITED
+ * value, making the nested where-clause treat it as a real column and silently DROP the
+ * fail-closed `1 = 0` guard for an unknown scope column. Own-property lookup makes such keys
+ * resolve to `undefined`, so the guard fires. Mirrors `resolveCol` in the route handler.
+ */
+export declare function resolveRelationScopeColumn(fields: Record<string, unknown>, key: string, toCamel: (s: string) => string): unknown | undefined;

package/dist/src/ElysiaPlugin/routes/entity/relationAuthz.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.728",
+	"version": "0.9.730",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",