feat: RBAC Rollen & Rechte (Phase 1 - Datenmodell, Roles-Verwaltung, Guard-Infrastruktur)
Replaces the fixed 5-value Role enum with a database-driven Role/Permission model: admins can create custom roles with a precise per-resource/action permission set (83-key code-owned catalog), instead of being locked to ADMIN/BEEKEEPER/STAFF/READONLY/API_CLIENT. - New Role/Permission/RolePermission tables; legacy Role enum renamed to LegacyRole and kept as User.legacyRole so all existing @Roles() call sites keep working unchanged during the migration. - New RolesController/RolesService (CRUD, permission-set editing, deactivate/reactivate) with lockout-prevention invariants: system roles (ADMIN) can't be edited or deactivated, and a role still assigned to users can't be deactivated. - New PermissionResolverService (30s-cached, DB-fresh per user) and PermissionsGuard + @RequirePermission(), registered as an additional APP_GUARD alongside the legacy RolesGuard so both systems run side-by-side until controllers are migrated in Phase 2. - PermissionCatalogSyncService seeds any new catalog entries into the DB on boot, so future features only touch the TS catalog. - New GET /auth/me returns the caller's role and effective permissions. - Migration hand-written (destructive column rename) with grants derived from a fresh grep of every existing @Roles() call site, verified against 5 controllers read in full for STAFF's exact write boundary. - test/roles.e2e-spec.ts covers the new endpoints and invariants end to end; test/authorization-coverage.e2e-spec.ts added but skipped until Phase 2 gives every controller a @RequirePermission. Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Nick SzaunigandClaude Sonnet 5 committed
1 parent
d31aa79f50
commit
139ea6fdd7
84 files changed
+1819
-103
No files matched your search
@@ -0,0 +1,225 @@
|
||||
import {
|
||||
ConflictException,
|
||||
ForbiddenException,
|
||||
Injectable,
|
||||
NotFoundException,
|
||||
} from '@nestjs/common';
|
||||
import { Prisma } from '../../generated/prisma';
|
||||
import { PrismaService } from '../prisma/prisma.service';
|
||||
import { AuditLogService } from '../audit/audit-log.service';
|
||||
import { PermissionResolverService } from '../auth/permissions/permission-resolver.service';
|
||||
import { CreateRoleDto } from './dto/create-role.dto';
|
||||
import { UpdateRoleDto } from './dto/update-role.dto';
|
||||
|
||||
export interface RoleSummary {
|
||||
id: string;
|
||||
key: string;
|
||||
name: string;
|
||||
description: string | null;
|
||||
isSystem: boolean;
|
||||
status: string;
|
||||
userCount: number;
|
||||
permissionKeys: string[];
|
||||
createdAt: Date;
|
||||
updatedAt: Date;
|
||||
deactivatedAt: Date | null;
|
||||
}
|
||||
|
||||
const ROLE_INCLUDE = {
|
||||
permissions: { select: { permission: { select: { key: true } } } },
|
||||
_count: { select: { users: true } },
|
||||
} satisfies Prisma.RoleInclude;
|
||||
|
||||
type RoleWithRelations = Prisma.RoleGetPayload<{
|
||||
include: typeof ROLE_INCLUDE;
|
||||
}>;
|
||||
|
||||
@Injectable()
|
||||
export class RolesService {
|
||||
constructor(
|
||||
private readonly prisma: PrismaService,
|
||||
private readonly auditLog: AuditLogService,
|
||||
private readonly permissionResolver: PermissionResolverService,
|
||||
) {}
|
||||
|
||||
private toSummary(role: RoleWithRelations): RoleSummary {
|
||||
return {
|
||||
id: role.id,
|
||||
key: role.key,
|
||||
name: role.name,
|
||||
description: role.description,
|
||||
isSystem: role.isSystem,
|
||||
status: role.status,
|
||||
userCount: role._count.users,
|
||||
permissionKeys: role.permissions.map((grant) => grant.permission.key),
|
||||
createdAt: role.createdAt,
|
||||
updatedAt: role.updatedAt,
|
||||
deactivatedAt: role.deactivatedAt,
|
||||
};
|
||||
}
|
||||
|
||||
async findAll(): Promise<RoleSummary[]> {
|
||||
const roles = await this.prisma.role.findMany({
|
||||
include: ROLE_INCLUDE,
|
||||
orderBy: [{ isSystem: 'desc' }, { name: 'asc' }],
|
||||
});
|
||||
return roles.map((role) => this.toSummary(role));
|
||||
}
|
||||
|
||||
async findById(id: string): Promise<RoleWithRelations> {
|
||||
const role = await this.prisma.role.findUnique({
|
||||
where: { id },
|
||||
include: ROLE_INCLUDE,
|
||||
});
|
||||
if (!role) {
|
||||
throw new NotFoundException('Role not found');
|
||||
}
|
||||
return role;
|
||||
}
|
||||
|
||||
async findSummaryById(id: string): Promise<RoleSummary> {
|
||||
return this.toSummary(await this.findById(id));
|
||||
}
|
||||
|
||||
async create(
|
||||
dto: CreateRoleDto,
|
||||
actingUserId?: string,
|
||||
): Promise<RoleSummary> {
|
||||
const existing = await this.prisma.role.findUnique({
|
||||
where: { key: dto.key },
|
||||
});
|
||||
if (existing) {
|
||||
throw new ConflictException('Role key already in use');
|
||||
}
|
||||
const role = await this.prisma.$transaction(async (tx) => {
|
||||
const created = await tx.role.create({
|
||||
data: {
|
||||
key: dto.key,
|
||||
name: dto.name,
|
||||
description: dto.description,
|
||||
},
|
||||
});
|
||||
await this.replacePermissions(tx, created.id, dto.permissionKeys);
|
||||
return tx.role.findUniqueOrThrow({
|
||||
where: { id: created.id },
|
||||
include: ROLE_INCLUDE,
|
||||
});
|
||||
});
|
||||
this.permissionResolver.invalidateAll();
|
||||
const summary = this.toSummary(role);
|
||||
await this.auditLog.record({
|
||||
entityType: 'Role',
|
||||
entityId: role.id,
|
||||
action: 'CREATE',
|
||||
userId: actingUserId,
|
||||
afterData: summary,
|
||||
});
|
||||
return summary;
|
||||
}
|
||||
|
||||
async update(
|
||||
id: string,
|
||||
dto: UpdateRoleDto,
|
||||
actingUserId?: string,
|
||||
): Promise<RoleSummary> {
|
||||
const before = await this.findById(id);
|
||||
if (before.isSystem) {
|
||||
throw new ForbiddenException('System roles cannot be edited');
|
||||
}
|
||||
const role = await this.prisma.$transaction(async (tx) => {
|
||||
await tx.role.update({
|
||||
where: { id },
|
||||
data: { name: dto.name, description: dto.description },
|
||||
});
|
||||
if (dto.permissionKeys) {
|
||||
await this.replacePermissions(tx, id, dto.permissionKeys);
|
||||
}
|
||||
return tx.role.findUniqueOrThrow({
|
||||
where: { id },
|
||||
include: ROLE_INCLUDE,
|
||||
});
|
||||
});
|
||||
this.permissionResolver.invalidateAll();
|
||||
const summary = this.toSummary(role);
|
||||
await this.auditLog.record({
|
||||
entityType: 'Role',
|
||||
entityId: id,
|
||||
action: 'UPDATE',
|
||||
userId: actingUserId,
|
||||
beforeData: this.toSummary(before),
|
||||
afterData: summary,
|
||||
});
|
||||
return summary;
|
||||
}
|
||||
|
||||
async deactivate(id: string, actingUserId?: string): Promise<RoleSummary> {
|
||||
const before = await this.findById(id);
|
||||
if (before.isSystem) {
|
||||
throw new ForbiddenException('System roles cannot be deactivated');
|
||||
}
|
||||
if (before._count.users > 0) {
|
||||
throw new ConflictException(
|
||||
'Role still has users assigned; reassign them before deactivating',
|
||||
);
|
||||
}
|
||||
const role = await this.prisma.role.update({
|
||||
where: { id },
|
||||
data: { status: 'INACTIVE', deactivatedAt: new Date() },
|
||||
include: ROLE_INCLUDE,
|
||||
});
|
||||
this.permissionResolver.invalidateAll();
|
||||
const summary = this.toSummary(role);
|
||||
await this.auditLog.record({
|
||||
entityType: 'Role',
|
||||
entityId: id,
|
||||
action: 'DEACTIVATE',
|
||||
userId: actingUserId,
|
||||
beforeData: this.toSummary(before),
|
||||
afterData: summary,
|
||||
});
|
||||
return summary;
|
||||
}
|
||||
|
||||
async reactivate(id: string, actingUserId?: string): Promise<RoleSummary> {
|
||||
const before = await this.findById(id);
|
||||
if (before.status === 'ACTIVE') {
|
||||
throw new ConflictException('Role is already active');
|
||||
}
|
||||
const role = await this.prisma.role.update({
|
||||
where: { id },
|
||||
data: { status: 'ACTIVE', deactivatedAt: null },
|
||||
include: ROLE_INCLUDE,
|
||||
});
|
||||
this.permissionResolver.invalidateAll();
|
||||
const summary = this.toSummary(role);
|
||||
await this.auditLog.record({
|
||||
entityType: 'Role',
|
||||
entityId: id,
|
||||
action: 'UPDATE',
|
||||
userId: actingUserId,
|
||||
beforeData: this.toSummary(before),
|
||||
afterData: summary,
|
||||
});
|
||||
return summary;
|
||||
}
|
||||
|
||||
private async replacePermissions(
|
||||
tx: Prisma.TransactionClient,
|
||||
roleId: string,
|
||||
permissionKeys: string[],
|
||||
): Promise<void> {
|
||||
const permissions = await tx.permission.findMany({
|
||||
where: { key: { in: permissionKeys } },
|
||||
select: { id: true },
|
||||
});
|
||||
await tx.rolePermission.deleteMany({ where: { roleId } });
|
||||
if (permissions.length > 0) {
|
||||
await tx.rolePermission.createMany({
|
||||
data: permissions.map((permission) => ({
|
||||
roleId,
|
||||
permissionId: permission.id,
|
||||
})),
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user