openxiangda-contracts 2.0.0-alpha.92 → 2.0.0-alpha.95

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1176,7 +1176,7 @@ function compileOperations(config) {
1176
1176
  }
1177
1177
  const code = stableCode(operation.code, `${pointer}/code`);
1178
1178
  validateBackendOperationAi(operation.ai, pointer, code, method, declaredResourceCodes);
1179
- const platformAccess = validateOperationPlatformAccess(operation.platformAccess, `${pointer}/platformAccess`, declaredResources, declaredWorkflowCodes);
1179
+ const platformAccess = validateOperationPlatformAccess(operation.platformAccess, `${pointer}/platformAccess`, declaredResources, declaredWorkflowCodes, new Set(config.authz.roles.map((role) => String(role.code))));
1180
1180
  return {
1181
1181
  code,
1182
1182
  method,
@@ -1193,15 +1193,27 @@ function compileOperations(config) {
1193
1193
  };
1194
1194
  }), (item) => item.code);
1195
1195
  }
1196
- function validateOperationPlatformAccess(value, pointer, declaredResources, declaredWorkflowCodes) {
1196
+ function validateOperationPlatformAccess(value, pointer, declaredResources, declaredWorkflowCodes, declaredRoleCodes) {
1197
1197
  if (value === undefined)
1198
1198
  return null;
1199
1199
  const access = object(value, pointer);
1200
- exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow'], pointer, true);
1200
+ exactKeys(access, ['directory', 'managedFiles', 'managedFileCopies', 'notification', 'workflow', 'roleAssertions'], pointer, true);
1201
1201
  if (Object.keys(access).length === 0) {
1202
1202
  fail('NATIVE_OPERATION_PLATFORM_ACCESS_EMPTY', pointer);
1203
1203
  }
1204
1204
  const result = {};
1205
+ if (access.roleAssertions !== undefined) {
1206
+ const assertions = object(access.roleAssertions, `${pointer}/roleAssertions`);
1207
+ exactKeys(assertions, ['roleCodes'], `${pointer}/roleAssertions`);
1208
+ const codes = uniqueStrings(assertions.roleCodes, `${pointer}/roleAssertions/roleCodes`, 20);
1209
+ if (!codes.length)
1210
+ fail('NATIVE_OPERATION_ROLE_ASSERTIONS_REQUIRED', `${pointer}/roleAssertions/roleCodes`);
1211
+ codes.forEach((code, index) => {
1212
+ if (!declaredRoleCodes.has(code))
1213
+ fail('NATIVE_ROLE_REFERENCE_MISSING', `${pointer}/roleAssertions/roleCodes/${index}`);
1214
+ });
1215
+ result.roleAssertions = { roleCodes: uniqueSorted(codes) };
1216
+ }
1205
1217
  if (access.directory !== undefined) {
1206
1218
  const directory = object(access.directory, `${pointer}/directory`);
1207
1219
  exactKeys(directory, ['mode', 'fields'], `${pointer}/directory`);