@elsikora/nestjs-crud-automator/dist/cjs/class/api/authorization/engine.class.js

A library for automating the creation of CRUD operations in NestJS.

'use strict';

var tslib_es6 = require('../../../external/tslib/tslib.es6.js');
require('../../../enum/class/authorization/cache-mode.enum.js');
var decisionType_enum = require('../../../enum/class/authorization/decision-type.enum.js');
var effect_enum = require('../../../enum/class/authorization/effect.enum.js');
require('../../../enum/class/authorization/mode.enum.js');
require('../../../enum/class/authorization/permission-match.enum.js');
require('../../../enum/class/authorization/policy/attachment-type.enum.js');
require('../../../enum/class/authorization/policy/on-type.enum.js');
require('../../../enum/class/authorization/policy/source-type.enum.js');
require('../../../enum/class/authorization/policy/status.enum.js');
require('../../../enum/class/authorization/principal-type.enum.js');
var common = require('@nestjs/common');
var scopeMergeWhere_utility = require('../../../utility/authorization/scope-merge-where.utility.js');

exports.ApiAuthorizationEngine = class ApiAuthorizationEngine {
    async evaluate(options) {
        const context = {
            permissions: options.permissions,
            principal: options.principal,
            resource: options.resource,
        };
        const matchedRules = [];
        let scope;
        const transforms = [];
        for (const rule of options.policy.rules) {
            const isConditionPassed = await this.evaluateCondition(rule, context);
            if (!isConditionPassed) {
                continue;
            }
            if (rule.effect === effect_enum.EApiPolicyEffect.DENY) {
                return this.buildDecision(options, {
                    appliedRules: [rule],
                    decisionType: decisionType_enum.EApiAuthorizationDecisionType.EXPLICIT_DENY,
                    effect: effect_enum.EApiPolicyEffect.DENY,
                    scope: undefined,
                    transforms: [],
                });
            }
            matchedRules.push(rule);
            scope = await this.mergeScope(scope, rule, context);
            if (rule.resultTransform) {
                transforms.push(rule.resultTransform);
            }
        }
        if (matchedRules.length === 0) {
            return this.buildDecision(options, {
                appliedRules: [],
                decisionType: decisionType_enum.EApiAuthorizationDecisionType.IMPLICIT_DENY,
                effect: effect_enum.EApiPolicyEffect.DENY,
                scope: undefined,
                transforms: [],
            });
        }
        return this.buildDecision(options, {
            appliedRules: matchedRules,
            decisionType: decisionType_enum.EApiAuthorizationDecisionType.EXPLICIT_ALLOW,
            effect: effect_enum.EApiPolicyEffect.ALLOW,
            scope,
            transforms,
        });
    }
    buildDecision(options, payload) {
        return {
            action: options.action,
            appliedRules: payload.appliedRules,
            effect: payload.effect,
            mode: options.mode,
            permissions: options.permissions,
            policyId: options.policy.policyId,
            policyIds: options.policy.policyIds,
            principal: options.principal,
            resource: options.resource,
            resourceType: options.resourceType,
            scope: payload.scope,
            trace: {
                decisionType: payload.decisionType,
                mode: options.mode,
                permissions: options.permissions,
                rules: options.policy.rules.map((rule) => ({
                    description: rule.description,
                    effect: rule.effect,
                    isMatched: payload.appliedRules.includes(rule),
                    policyId: rule.policyId,
                    priority: rule.priority,
                })),
            },
            transforms: payload.transforms,
        };
    }
    async evaluateCondition(rule, context) {
        if (!rule.condition) {
            return true;
        }
        const result = await rule.condition(context);
        return result === true;
    }
    async mergeScope(currentScope, rule, context) {
        if (!rule.scope) {
            return currentScope;
        }
        const scopePatch = await rule.scope(context);
        if (!scopePatch) {
            return currentScope;
        }
        if (!currentScope) {
            return scopePatch;
        }
        return {
            ...currentScope,
            ...scopePatch,
            where: scopeMergeWhere_utility.AuthorizationScopeMergeWhere(currentScope.where, scopePatch.where),
        };
    }
};
exports.ApiAuthorizationEngine = tslib_es6.__decorate([
    common.Injectable()
], exports.ApiAuthorizationEngine);
//# sourceMappingURL=engine.class.js.map