diff --git a/apps/api/release/app.js b/apps/api/release/app.js index 21aa79f..a3d0872 100644 --- a/apps/api/release/app.js +++ b/apps/api/release/app.js @@ -82930,6 +82930,49 @@ var require_passport = __commonJS({ } }); +// dist/modules/auth/super-admin.js +var require_super_admin = __commonJS({ + "dist/modules/auth/super-admin.js"(exports2) { + "use strict"; + Object.defineProperty(exports2, "__esModule", { value: true }); + exports2.SUPER_ADMIN_RIDS = exports2.SUPER_ADMIN_MOBILE = void 0; + exports2.isSuperAdmin = isSuperAdmin; + exports2.withSuperAdminRids = withSuperAdminRids; + exports2.SUPER_ADMIN_MOBILE = "09128081392"; + exports2.SUPER_ADMIN_RIDS = [ + "persons.create.single", + "persons.list.client.single", + "persons.list.client.single.view", + "persons.list.client.single.edit", + "branch", + "branch.create", + "branch.list", + "workshop", + "workshop.create", + "workshop.list", + "order.create", + "order.list", + "order.list.view", + "order.list.sts", + "order.list.sts.view", + "order.list.sts.remove", + "order.list.sts.submit", + "order.list.view.edit", + "order.list.pdf", + "offers.create.tak", + "offers.list.tak.edit", + "offers.list.tak.remove", + "config.wallet" + ]; + function isSuperAdmin(mobile) { + return mobile?.trim() === exports2.SUPER_ADMIN_MOBILE; + } + function withSuperAdminRids(mobile, rids) { + return isSuperAdmin(mobile) ? [.../* @__PURE__ */ new Set([...rids, ...exports2.SUPER_ADMIN_RIDS])] : rids; + } + } +}); + // dist/modules/auth/guards.js var require_guards2 = __commonJS({ "dist/modules/auth/guards.js"(exports2) { @@ -82944,16 +82987,20 @@ var require_guards2 = __commonJS({ if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v); }; Object.defineProperty(exports2, "__esModule", { value: true }); - exports2.PermissionsGuard = exports2.JwtAuthGuard = exports2.CurrentAdmin = exports2.RequirePermission = exports2.REQUIRED_RID_KEY = exports2.Public = exports2.IS_PUBLIC_KEY = void 0; + exports2.PermissionsGuard = exports2.JwtAuthGuard = exports2.CurrentAdmin = exports2.SuperAdminOnly = exports2.SUPER_ADMIN_ONLY_KEY = exports2.RequirePermission = exports2.REQUIRED_RID_KEY = exports2.Public = exports2.IS_PUBLIC_KEY = void 0; var common_12 = require_common(); var passport_1 = require_passport(); var core_12 = require_core3(); + var super_admin_1 = require_super_admin(); exports2.IS_PUBLIC_KEY = "isPublic"; var Public = () => (0, common_12.SetMetadata)(exports2.IS_PUBLIC_KEY, true); exports2.Public = Public; exports2.REQUIRED_RID_KEY = "requiredRid"; - var RequirePermission = (rid) => (0, common_12.SetMetadata)(exports2.REQUIRED_RID_KEY, rid); + var RequirePermission = (...rids) => (0, common_12.SetMetadata)(exports2.REQUIRED_RID_KEY, rids); exports2.RequirePermission = RequirePermission; + exports2.SUPER_ADMIN_ONLY_KEY = "superAdminOnly"; + var SuperAdminOnly = (options = {}) => (0, common_12.SetMetadata)(exports2.SUPER_ADMIN_ONLY_KEY, options); + exports2.SuperAdminOnly = SuperAdminOnly; exports2.CurrentAdmin = (0, common_12.createParamDecorator)((_data, ctx) => ctx.switchToHttp().getRequest().user); var JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") { reflector; @@ -82982,17 +83029,23 @@ var require_guards2 = __commonJS({ this.reflector = reflector; } canActivate(context) { - const requiredRid = this.reflector.getAllAndOverride(exports2.REQUIRED_RID_KEY, [ - context.getHandler(), - context.getClass() - ]); - if (!requiredRid) + const targets = [context.getHandler(), context.getClass()]; + const superAdminOnly = this.reflector.getAllAndOverride(exports2.SUPER_ADMIN_ONLY_KEY, targets); + const requiredRids = this.reflector.getAllAndOverride(exports2.REQUIRED_RID_KEY, targets); + if (!superAdminOnly && !requiredRids) return true; const user = context.switchToHttp().getRequest().user; if (!user) throw new common_12.ForbiddenException(); - if (!user.permissions.includes(requiredRid)) { - throw new common_12.ForbiddenException(`Missing permission: ${requiredRid}`); + if (superAdminOnly && !(0, super_admin_1.isSuperAdmin)(user.mobile)) { + if (!(superAdminOnly.allowBranch && user.branchId)) { + throw new common_12.ForbiddenException("\u0627\u06CC\u0646 \u0628\u062E\u0634 \u0641\u0642\u0637 \u062F\u0631 \u062F\u0633\u062A\u0631\u0633 \u0645\u062F\u06CC\u0631 \u0627\u0631\u0634\u062F \u0633\u0627\u0645\u0627\u0646\u0647 \u0627\u0633\u062A"); + } + } + if (!requiredRids) + return true; + if (!requiredRids.some((rid) => user.permissions.includes(rid))) { + throw new common_12.ForbiddenException(`Missing permission: ${requiredRids.join(" | ")}`); } return true; } @@ -93596,6 +93649,7 @@ var require_auth_service = __commonJS({ var admin_session_service_1 = require_admin_session_service(); var env_12 = require_env(); var password_hash_1 = require_password_hash(); + var super_admin_1 = require_super_admin(); var password_hash_2 = require_password_hash(); Object.defineProperty(exports2, "compareLocalHash", { enumerable: true, get: function() { return password_hash_2.compareLocalHash; @@ -93603,7 +93657,7 @@ var require_auth_service = __commonJS({ Object.defineProperty(exports2, "OTP_ONLY_PASSWORD_HASH", { enumerable: true, get: function() { return password_hash_2.OTP_ONLY_PASSWORD_HASH; } }); - var STATIC_ADMIN_MOBILE = "09128081392"; + var STATIC_ADMIN_MOBILE = super_admin_1.SUPER_ADMIN_MOBILE; var AuthService = AuthService_1 = class AuthService { prisma; jwt; @@ -93671,8 +93725,9 @@ var require_auth_service = __commonJS({ role: user.role, ut: user.userTypeId, branch_id: user.branchId, + is_super_admin: (0, super_admin_1.isSuperAdmin)(user.mobile), api_token: apiToken, - roles: (user.userType?.permissions ?? []).map((p) => ({ rid: p.rid })), + roles: (0, super_admin_1.withSuperAdminRids)(user.mobile, (user.userType?.permissions ?? []).map((p) => p.rid)).map((rid) => ({ rid })), ...bootstrap2 ? { iamBootstrapUrl: bootstrap2 } : {} }; } @@ -93774,8 +93829,9 @@ var require_auth_service = __commonJS({ role: user.role, ut: user.userTypeId, branch_id: user.branchId, + is_super_admin: (0, super_admin_1.isSuperAdmin)(user.mobile), api_token: apiToken, - roles: (user.userType?.permissions ?? []).map((p) => ({ rid: p.rid })) + roles: (0, super_admin_1.withSuperAdminRids)(user.mobile, (user.userType?.permissions ?? []).map((p) => p.rid)).map((rid) => ({ rid })) }; } async ensureStaticAdmin() { @@ -93876,7 +93932,8 @@ var require_auth_service = __commonJS({ ut: user.userTypeId, branch_id: user.branchId, user_type: user.userType ? { id: user.userType.id, title: user.userType.title } : null, - permission: (user.userType?.permissions ?? []).map((p) => p.rid) + is_super_admin: (0, super_admin_1.isSuperAdmin)(user.mobile), + permission: (0, super_admin_1.withSuperAdminRids)(user.mobile, (user.userType?.permissions ?? []).map((p) => p.rid)) }; } }; @@ -94252,6 +94309,7 @@ var require_jwt_strategy = __commonJS({ var env_12 = require_env(); var admin_session_service_1 = require_admin_session_service(); var acl_constants_1 = require_acl_constants(); + var super_admin_1 = require_super_admin(); var APP_TOKEN_TYPES = /* @__PURE__ */ new Set(["customer", "sales-expert"]); var JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, "jwt") { prisma; @@ -94279,7 +94337,7 @@ var require_jwt_strategy = __commonJS({ if (!user || !user.isActive) { throw new common_12.UnauthorizedException(); } - const rids = user.userType?.permissions.map((p) => p.rid) ?? []; + const rids = (0, super_admin_1.withSuperAdminRids)(user.mobile, user.userType?.permissions.map((p) => p.rid) ?? []); return { id: user.id, fullName: user.fullName, @@ -95428,6 +95486,9 @@ var require_admin_orders_controller = __commonJS({ typeOptions() { return this.orders.typeOptions(); } + // The three routes below also serve the wholesale and sourcing lists, whose + // staff hold order.omde / order.tamin rather than the super-admin-only + // order.list. statusOptions() { return this.orders.statusOptions(); } @@ -95443,6 +95504,7 @@ var require_admin_orders_controller = __commonJS({ __decorate4([ (0, common_12.Post)("list"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)({ allowBranch: true }), (0, guards_1.RequirePermission)("order.list"), __param3(0, (0, common_12.Body)()), __param3(1, (0, guards_1.CurrentAdmin)()), @@ -95482,6 +95544,7 @@ var require_admin_orders_controller = __commonJS({ __decorate4([ (0, common_12.Post)("create"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)({ allowBranch: true }), (0, guards_1.RequirePermission)("order.create"), __param3(0, (0, common_12.Body)()), __param3(1, (0, guards_1.CurrentAdmin)()), @@ -95491,6 +95554,7 @@ var require_admin_orders_controller = __commonJS({ ], AdminOrdersController.prototype, "createFromAdmin", null); __decorate4([ (0, common_12.Get)("type-options"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("order.create"), __metadata3("design:type", Function), __metadata3("design:paramtypes", []), @@ -95498,7 +95562,7 @@ var require_admin_orders_controller = __commonJS({ ], AdminOrdersController.prototype, "typeOptions", null); __decorate4([ (0, common_12.Get)("status-options"), - (0, guards_1.RequirePermission)("order.list"), + (0, guards_1.RequirePermission)("order.list", "order.omde", "order.tamin"), __metadata3("design:type", Function), __metadata3("design:paramtypes", []), __metadata3("design:returntype", void 0) @@ -95506,7 +95570,7 @@ var require_admin_orders_controller = __commonJS({ __decorate4([ (0, common_12.Post)("status"), (0, common_12.HttpCode)(200), - (0, guards_1.RequirePermission)("order.list"), + (0, guards_1.RequirePermission)("order.list", "order.omde", "order.tamin"), __param3(0, (0, common_12.Body)()), __param3(1, (0, guards_1.CurrentAdmin)()), __metadata3("design:type", Function), @@ -95515,7 +95579,7 @@ var require_admin_orders_controller = __commonJS({ ], AdminOrdersController.prototype, "setStatus", null); __decorate4([ (0, common_12.Get)(":id"), - (0, guards_1.RequirePermission)("order.list"), + (0, guards_1.RequirePermission)("order.list", "order.omde", "order.tamin"), __param3(0, (0, common_12.Param)("id")), __metadata3("design:type", Function), __metadata3("design:paramtypes", [String]), @@ -96353,6 +96417,7 @@ var require_admin_branches_controller = __commonJS({ ], AdminBranchesController.prototype, "updateBranch", null); exports2.AdminBranchesController = AdminBranchesController = __decorate4([ (0, common_12.Controller)("admin/branches"), + (0, guards_1.SuperAdminOnly)(), __metadata3("design:paramtypes", [admin_branches_service_1.AdminBranchesService]) ], AdminBranchesController); } @@ -96447,6 +96512,7 @@ var require_admin_workshops_controller = __commonJS({ __decorate4([ (0, common_12.Post)(), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("workshop.create"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -96455,6 +96521,7 @@ var require_admin_workshops_controller = __commonJS({ ], AdminWorkshopsController.prototype, "create", null); __decorate4([ (0, common_12.Get)("active/:id"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("workshop.list"), __param3(0, (0, common_12.Param)("id")), __metadata3("design:type", Function), @@ -96463,6 +96530,7 @@ var require_admin_workshops_controller = __commonJS({ ], AdminWorkshopsController.prototype, "toggleActive", null); __decorate4([ (0, common_12.Get)(":id"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("workshop.list"), __param3(0, (0, common_12.Param)("id")), __metadata3("design:type", Function), @@ -96471,6 +96539,7 @@ var require_admin_workshops_controller = __commonJS({ ], AdminWorkshopsController.prototype, "findOne", null); __decorate4([ (0, common_12.Put)(":id"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("workshop.list"), __param3(0, (0, common_12.Param)("id")), __param3(1, (0, common_12.Body)()), @@ -97637,6 +97706,7 @@ var require_admin_customers_controller = __commonJS({ __decorate4([ (0, common_12.Post)("banker/list"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("persons.list.client.omde"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -97646,6 +97716,7 @@ var require_admin_customers_controller = __commonJS({ __decorate4([ (0, common_12.Post)("shopkeeper/list"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("persons.list.client.omde"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -97673,6 +97744,7 @@ var require_admin_customers_controller = __commonJS({ __decorate4([ (0, common_12.Post)("single/list"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)({ allowBranch: true }), (0, guards_1.RequirePermission)("persons.list.client.single"), __param3(0, (0, common_12.Body)()), __param3(1, (0, guards_1.CurrentAdmin)()), @@ -97683,6 +97755,7 @@ var require_admin_customers_controller = __commonJS({ __decorate4([ (0, common_12.Post)("single"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)({ allowBranch: true }), (0, guards_1.RequirePermission)("persons.create"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -98845,6 +98918,7 @@ var require_admin_products_controller = __commonJS({ var admin_products_service_1 = require_admin_products_service(); var table_query_dto_1 = require_table_query_dto(); var guards_1 = require_guards2(); + var super_admin_1 = require_super_admin(); var AdminProductsController = class AdminProductsController { products; constructor(products) { @@ -98890,7 +98964,9 @@ var require_admin_products_controller = __commonJS({ changePercent(body) { return this.products.changePercent(body); } - create(data) { + create(data, admin) { + if (!(0, super_admin_1.isSuperAdmin)(admin.mobile)) + delete data.ciny_ids; return this.products.create(data); } remove(id) { @@ -98937,6 +99013,7 @@ var require_admin_products_controller = __commonJS({ __decorate4([ (0, common_12.Post)("variants/create"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("order.create"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -98968,6 +99045,7 @@ var require_admin_products_controller = __commonJS({ ], AdminProductsController.prototype, "brandsTable", null); __decorate4([ (0, common_12.Get)("collections"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("product.list"), __metadata3("design:type", Function), __metadata3("design:paramtypes", []), @@ -98996,8 +99074,9 @@ var require_admin_products_controller = __commonJS({ (0, common_12.HttpCode)(200), (0, guards_1.RequirePermission)("product.create"), __param3(0, (0, common_12.Body)()), + __param3(1, (0, guards_1.CurrentAdmin)()), __metadata3("design:type", Function), - __metadata3("design:paramtypes", [Object]), + __metadata3("design:paramtypes", [Object, Object]), __metadata3("design:returntype", void 0) ], AdminProductsController.prototype, "create", null); __decorate4([ @@ -99428,6 +99507,7 @@ var require_admin_categories_controller = __commonJS({ __decorate4([ (0, common_12.Post)("collections/list"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("collection.list"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -99437,6 +99517,7 @@ var require_admin_categories_controller = __commonJS({ __decorate4([ (0, common_12.Post)("collections"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("collection.create"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -99445,6 +99526,7 @@ var require_admin_categories_controller = __commonJS({ ], AdminCategoriesController.prototype, "createCollection", null); __decorate4([ (0, common_12.Put)("collections/:id"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("collection.list.edit"), __param3(0, (0, common_12.Param)("id")), __param3(1, (0, common_12.Body)()), @@ -99454,6 +99536,7 @@ var require_admin_categories_controller = __commonJS({ ], AdminCategoriesController.prototype, "updateCollection", null); __decorate4([ (0, common_12.Delete)("collections/:id"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("collection.list.edit"), __param3(0, (0, common_12.Param)("id")), __metadata3("design:type", Function), @@ -100046,6 +100129,7 @@ var require_admin_documents_controller = __commonJS({ ], AdminDocumentsController.prototype, "listWallet", null); __decorate4([ (0, common_12.Get)("wallet/config"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("config.wallet"), __metadata3("design:type", Function), __metadata3("design:paramtypes", []), @@ -100054,6 +100138,7 @@ var require_admin_documents_controller = __commonJS({ __decorate4([ (0, common_12.Post)("wallet/config"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("config.wallet"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -100062,6 +100147,7 @@ var require_admin_documents_controller = __commonJS({ ], AdminDocumentsController.prototype, "setWalletConfig", null); __decorate4([ (0, common_12.Get)("wallet/birthday/config"), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("config.wallet"), __metadata3("design:type", Function), __metadata3("design:paramtypes", []), @@ -100070,6 +100156,7 @@ var require_admin_documents_controller = __commonJS({ __decorate4([ (0, common_12.Post)("wallet/birthday/config"), (0, common_12.HttpCode)(200), + (0, guards_1.SuperAdminOnly)(), (0, guards_1.RequirePermission)("config.wallet"), __param3(0, (0, common_12.Body)()), __metadata3("design:type", Function), @@ -163245,6 +163332,7 @@ var require_migrate = __commonJS({ "use strict"; Object.defineProperty(exports2, "__esModule", { value: true }); exports2.splitSqlStatements = splitSqlStatements; + exports2.sortMigrations = sortMigrations; exports2.runMigrations = runMigrations; exports2.runOnce = runOnce; var fs_1 = require("fs"); @@ -163343,7 +163431,17 @@ var require_migrate = __commonJS({ } } } - return files.sort((a, b) => a.name.localeCompare(b.name)); + return sortMigrations(files); + } + var BASELINE_MIGRATION = "20260910113720_first"; + function sortMigrations(files) { + return [...files].sort((a, b) => { + if (a.name === BASELINE_MIGRATION) + return -1; + if (b.name === BASELINE_MIGRATION) + return 1; + return a.name.localeCompare(b.name); + }); } async function runMigrations(prisma) { const dir = resolveMigrationsDir();