@elsikora/nestjs-crud-automator/dist/esm/class/api/authorization/engine.class.js

A library for automating the creation of CRUD operations in NestJS.

import { __decorate } from '../../../external/tslib/tslib.es6.js';
import { EAuthorizationEffect } from '../../../enum/class/authorization/effect.enum.js';
import { Injectable } from '@nestjs/common';
import { AuthorizationScopeMergeWhere } from '../../../utility/authorization/scope/merge/where.utility.js';

let ApiAuthorizationEngine = class ApiAuthorizationEngine {
    async evaluate(options) {
        const context = {
            resource: options.resource,
            subject: options.subject,
        };
        const matchedRules = [];
        let scope;
        const transforms = [];
        for (const rule of options.policy.rules) {
            const isConditionPassed = await this.evaluateCondition(rule, context);
            if (!isConditionPassed) {
                continue;
            }
            if (rule.effect === EAuthorizationEffect.DENY) {
                return this.buildDecision(options, {
                    appliedRules: [rule],
                    effect: EAuthorizationEffect.DENY,
                    scope: undefined,
                    transforms: [],
                });
            }
            matchedRules.push(rule);
            scope = await this.mergeScope(scope, rule, context);
            if (rule.resultTransform) {
                transforms.push(rule.resultTransform);
            }
        }
        if (matchedRules.length === 0) {
            return this.buildDecision(options, {
                appliedRules: [],
                effect: EAuthorizationEffect.DENY,
                scope: undefined,
                transforms: [],
            });
        }
        return this.buildDecision(options, {
            appliedRules: matchedRules,
            effect: EAuthorizationEffect.ALLOW,
            scope,
            transforms,
        });
    }
    buildDecision(options, payload) {
        return {
            action: options.action,
            appliedRules: payload.appliedRules,
            effect: payload.effect,
            policyId: options.policy.policyId,
            resource: options.resource,
            resourceType: options.policy.entity.name ?? "UnknownResource",
            scope: payload.scope,
            subject: options.subject,
            transforms: payload.transforms,
        };
    }
    async evaluateCondition(rule, context) {
        if (!rule.condition) {
            return true;
        }
        const result = await rule.condition(context);
        return result === true;
    }
    async mergeScope(currentScope, rule, context) {
        if (!rule.scope) {
            return currentScope;
        }
        const scopePatch = await rule.scope(context);
        if (!scopePatch) {
            return currentScope;
        }
        if (!currentScope) {
            return scopePatch;
        }
        return {
            ...currentScope,
            ...scopePatch,
            where: AuthorizationScopeMergeWhere(currentScope.where, scopePatch.where),
        };
    }
};
ApiAuthorizationEngine = __decorate([
    Injectable()
], ApiAuthorizationEngine);

export { ApiAuthorizationEngine };
//# sourceMappingURL=engine.class.js.map