@httpc/kit/dist/esm/auth/PermissionsAuthorizationService.js

httpc toolbox for building function-based API with minimal code and end-to-end type safety

var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __param = (this && this.__param) || function (paramIndex, decorator) {
    return function (target, key) { decorator(target, key, paramIndex); }
};
import { injectable } from "tsyringe";
import { options } from "../di";
import { logger } from "../logging";
import { Assertion, InvalidClaim, PermissionsChecker, PermissionSerializer } from "../permissions";
import { BaseService } from "../services";
let PermissionsAuthorizationService = class PermissionsAuthorizationService extends BaseService() {
    constructor(logger, options) {
        //@ts-expect-error
        super(...arguments);
        this.options = options;
        this.permissions = new PermissionsChecker({ model: options.model });
    }
    async authorize(user) {
        let authorization = await this.options.authorize(user);
        if (typeof authorization === "string") {
            authorization = this.createAuthorization(authorization);
        }
        this.logger.verbose("Authorized(%s) %o", authorization, user);
        return authorization;
    }
    createAuthorization(authorization) {
        try {
            if (typeof authorization === "string") {
                return this.permissions.parse("authorization", authorization);
            }
            else {
                return this.permissions.validate(authorization);
            }
        }
        catch (err) {
            if (err instanceof InvalidClaim) {
                this._raiseError("not_supported", err.message, { claim: err.claim });
            }
            throw err;
        }
    }
    check(authorization, assertion) {
        assertion = this._getAssertion(assertion);
        const result = this.permissions.test(authorization, assertion);
        this.logger.verbose("Check(%s): %s", result.success ? "OK" : "KO", assertion);
        return result.success;
    }
    assert(authorization, assertion) {
        assertion = this._getAssertion(assertion);
        const result = this.permissions.test(authorization, assertion);
        if (!result.success) {
            this._raiseError("forbidden", { claim: PermissionSerializer.serializeAssertionClaim(result.failed) });
        }
        this.logger.verbose("Assertion success: %s", assertion);
    }
    _getAssertion(assertion) {
        if (typeof assertion === "string") {
            assertion = Assertion.parse(assertion);
        }
        if (!(assertion instanceof Assertion)) {
            this._raiseError("invalid_param", "Invalid assertion");
        }
        try {
            return this.permissions.validate(assertion);
        }
        catch (err) {
            if (err instanceof InvalidClaim) {
                this._raiseError("not_supported", err.message, { claim: err.claim });
            }
            throw err;
        }
    }
};
PermissionsAuthorizationService = __decorate([
    injectable(),
    __param(0, logger()),
    __param(1, options()),
    __metadata("design:paramtypes", [Object, Object])
], PermissionsAuthorizationService);
export { PermissionsAuthorizationService };