88 lines
4.4 KiB
JavaScript
88 lines
4.4 KiB
JavaScript
"use strict";
|
|
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
};
|
|
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
};
|
|
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
return function (target, key) { decorator(target, key, paramIndex); }
|
|
};
|
|
var RoleSyncService_1;
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
exports.RoleSyncService = void 0;
|
|
const common_1 = require("@nestjs/common");
|
|
const prisma_service_1 = require("../../shared/prisma.service");
|
|
const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
|
|
const group_hash_service_1 = require("./group-hash.service");
|
|
const authorization_service_1 = require("../authorization/authorization.service");
|
|
let RoleSyncService = RoleSyncService_1 = class RoleSyncService {
|
|
prisma;
|
|
groupHash;
|
|
permissionCache;
|
|
events;
|
|
logger = new common_1.Logger(RoleSyncService_1.name);
|
|
constructor(prisma, groupHash, permissionCache, events) {
|
|
this.prisma = prisma;
|
|
this.groupHash = groupHash;
|
|
this.permissionCache = permissionCache;
|
|
this.events = events;
|
|
}
|
|
computeGroupHash(groups) {
|
|
return this.groupHash.compute(groups || []);
|
|
}
|
|
async mapGroupsToRoleIds(groups) {
|
|
if (!groups || groups.length === 0)
|
|
return [];
|
|
const mappings = await this.prisma.authGroupRoleMapping.findMany({ where: { authGroup: { in: groups } } });
|
|
const roleIds = mappings.map((m) => m.roleId);
|
|
return Array.from(new Set(roleIds));
|
|
}
|
|
async syncUserRolesFromAuthentik(userId, groups) {
|
|
const groupHash = this.computeGroupHash(groups || []);
|
|
const user = await this.prisma.user.findUnique({ where: { id: userId } });
|
|
if (!user)
|
|
throw new Error('User not found');
|
|
if (user.lastGroupHash === groupHash) {
|
|
this.logger.debug('Group hash unchanged, skipping sync');
|
|
return { skipped: true };
|
|
}
|
|
const roleIds = await this.mapGroupsToRoleIds(groups || []);
|
|
const previousRoleRows = await this.prisma.userRole.findMany({ where: { userId, source: 'AUTHENTIK' }, select: { roleId: true } });
|
|
const previousRoles = previousRoleRows.map((r) => r.roleId);
|
|
await this.prisma.$transaction(async (tx) => {
|
|
await tx.userRole.deleteMany({ where: { userId: userId, source: 'AUTHENTIK' } });
|
|
if (roleIds.length > 0) {
|
|
const createData = roleIds.map((rid) => ({ userId, roleId: rid, source: 'AUTHENTIK' }));
|
|
await tx.userRole.createMany({ data: createData, skipDuplicates: true });
|
|
}
|
|
await tx.user.update({ where: { id: userId }, data: { lastGroupHash: groupHash } });
|
|
});
|
|
// Invalidate permission cache through abstraction
|
|
try {
|
|
await this.permissionCache.invalidate(userId);
|
|
}
|
|
catch (e) {
|
|
this.logger.error('Failed to invalidate permission cache', e);
|
|
}
|
|
// Publish event for audit and other subscribers
|
|
this.events.publish({
|
|
id: require('crypto').randomUUID(),
|
|
timestamp: new Date().toISOString(),
|
|
type: 'RolesSynchronized',
|
|
payload: { userId, groups, assignedRoleIds: roleIds, previousRoles },
|
|
});
|
|
return { skipped: false, assignedRoleIds: roleIds };
|
|
}
|
|
};
|
|
exports.RoleSyncService = RoleSyncService;
|
|
exports.RoleSyncService = RoleSyncService = RoleSyncService_1 = __decorate([
|
|
(0, common_1.Injectable)(),
|
|
__param(2, (0, common_1.Inject)(authorization_service_1.PERMISSION_CACHE)),
|
|
__metadata("design:paramtypes", [prisma_service_1.PrismaService,
|
|
group_hash_service_1.GroupHashService, Object, event_bus_service_1.EventBus])
|
|
], RoleSyncService);
|
|
//# sourceMappingURL=role-sync.service.js.map
|