Skip to main content

IAMService

@webda/iam

Class: IAMService<T>

Defined in: packages/iam/src/iam.service.ts:154

Enforce IAM policies on operations, evaluated with Casbin

Policies come from the configuration and from the IAMPolicy / IAMPolicyAttachment models

Webda Modda​

Extends​

  • Service<T>

Type Parameters​

T​

T extends IAMServiceParameters = IAMServiceParameters

Constructors​

Constructor​

new IAMService<T>(name, params): IAMService<T>

Defined in: packages/core/lib/services/service.d.ts:72

Service

Parameters​

name​

string

The name of the service

params​

T

The parameters block define in the configuration file

Returns​

IAMService<T>

Inherited from​

Service<T>.constructor

Properties​

_compiledCapabilities​

protected _compiledCapabilities: Record<string, any>

Defined in: packages/core/lib/services/iservice.d.ts:38

Capabilities detected at compile-time from @WebdaCapability-tagged interfaces.

Populated during Service.resolve by reading the service's entry in webda.module.json. Each key is a capability name (e.g., "request-filter"), and the value is an empty object {} by default. Override getCapabilities to provide capability-specific configuration or to conditionally disable capabilities.

See​

getCapabilities

Inherited from​

Service._compiledCapabilities

[WEBDA_EVENTS]​

[WEBDA_EVENTS]: object

Defined in: packages/core/lib/services/service.d.ts:50

Set the Webda events here

Inherited from​

Service.[WEBDA_EVENTS]

authorizer?​

protected optional authorizer?: OperationAuthorizer

Defined in: packages/iam/src/iam.service.ts:170

The registered authorizer

configNames​

protected configNames: Set<string>

Defined in: packages/iam/src/iam.service.ts:166

Names of the configuration policies

configRows​

protected configRows: PolicyRow[] = []

Defined in: packages/iam/src/iam.service.ts:162

Compiled configuration policies

engine?​

protected optional engine?: PolicyEngine

Defined in: packages/iam/src/iam.service.ts:158

Current snapshot; undefined until init

generation​

protected generation: number = 0

Defined in: packages/iam/src/iam.service.ts:186

Generation of the latest started rebuild: an older rebuild finishing late never replaces a newer snapshot

intervalTimer?​

protected optional intervalTimer?: Timeout

Defined in: packages/iam/src/iam.service.ts:178

Periodic timer

logger​

protected logger: Logger

Defined in: packages/core/lib/services/service.d.ts:59

Logger with class context

Inherited from​

Service.logger

metrics?​

protected optional metrics?: object

Defined in: packages/core/lib/services/service.d.ts:63

Get metrics

Inherited from​

Service.metrics

name​

readonly name: string

Defined in: packages/core/lib/services/iservice.d.ts:18

Inherited from​

Service.name

parameters​

readonly parameters: T

Defined in: packages/core/lib/services/iservice.d.ts:19

Inherited from​

Service.parameters

reloadTimer?​

protected optional reloadTimer?: Timeout

Defined in: packages/iam/src/iam.service.ts:174

Debounce timer

stopped​

protected stopped: boolean = false

Defined in: packages/iam/src/iam.service.ts:190

True once stopped: the authorizer stays registered and refuses in-scope operations

unsubscribers​

protected unsubscribers: (() => void)[] = []

Defined in: packages/iam/src/iam.service.ts:182

Repository listener removers

Returns​

void

createConfiguration?​

static optional createConfiguration?: (params) => any

Defined in: packages/core/lib/services/iservice.d.ts:23

Create configuration set by the application on load

Parameters​

params​

any

Returns​

any

Inherited from​

Service.createConfiguration

filterConfiguration?​

static optional filterConfiguration?: (params) => any

Defined in: packages/core/lib/services/iservice.d.ts:27

Create configuration set by the application on load

Parameters​

params​

any

Returns​

any

Inherited from​

Service.filterConfiguration

Parameters​

static Parameters: typeof ServiceParameters

Defined in: packages/core/lib/services/service.d.ts:46

Service parameters

Inherited from​

Service.Parameters

Methods​

__clean()​

abstract __clean(): Promise<void>

Defined in: packages/core/lib/services/service.d.ts:215

Clean the service data, can only be used in test mode

Returns​

Promise<void>

Inherited from​

Service.__clean

addListener()​

addListener<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:80

Type Parameters​

Key​

Key extends never

Parameters​

eventName​

Key

the event name

listener​

(event) => void | Promise<void>

the event listener

Returns​

this

this for chaining

See​

EventEmitter.addListener

Inherited from​

Service.addListener

addRoute()​

protected addRoute(url, methods, executer, openapi?, override?): void

Defined in: packages/core/lib/services/service.d.ts:177

Add a route dynamicaly

Parameters​

url​

string

of the route can contains dynamic part like {uuid}

methods​

HttpMethodType[]

the HTTP methods

executer​

Function

Method to execute for this route

openapi?​

OpenAPIWebdaDefinition

the OpenAPI specification

override?​

boolean

whether to override existing

Returns​

void

Inherited from​

Service.addRoute

authorize()​

authorize(context, operationId, options): Promise<string | true>

Defined in: packages/iam/src/iam.service.ts:303

Authorize an operation call; an allowed (non-probe) IAM model operation is recorded on the context (IAM_ALLOWED_OPERATION) for the IAM models' canAct

Parameters​

context​

OperationContext

the caller context

operationId​

string

the operation id

options​

input and probe mode

input?​

any

the resolved operation input

probe​

boolean

true for a listing probe (no input)

Returns​

Promise<string | true>

true or the refusal reason

Throws​

WebdaError.BadRequest for an invalid IAMPolicy input

authorizeClientEvent()​

authorizeClientEvent(_event, _context): boolean

Defined in: packages/core/lib/services/service.d.ts:153

Authorize a public event subscription

Parameters​

_event​

string

the event name

_context​

OperationContext

the execution context

Returns​

boolean

true if the condition is met

Inherited from​

Service.authorizeClientEvent

build()​

protected build(): Promise<PolicyEngine>

Defined in: packages/iam/src/iam.service.ts:484

Compile configuration and stored policies into a new engine

Returns​

Promise<PolicyEngine>

the engine

Throws​

PolicyCompileError for an invalid stored policy or one shadowing a configuration policy

buildRequest()​

protected buildRequest(context, operationId, options): Promise<string | { ctx: IAMRequestContext; principals: string[]; }>

Defined in: packages/iam/src/iam.service.ts:395

Build the principals and the r.ctx of a request

Parameters​

context​

OperationContext

the caller context

operationId​

string

the operation id

options​

input and probe mode

input?​

any

the resolved operation input

probe​

boolean

true for a listing probe (no input)

Returns​

Promise<string | { ctx: IAMRequestContext; principals: string[]; }>

principals and request context, or the refusal reason when the current user cannot be loaded

checkPolicyInput()​

protected checkPolicyInput(operationId, input): void

Defined in: packages/iam/src/iam.service.ts:364

Validate the input of an IAMPolicy write: models have no validate hook

Parameters​

operationId​

string

the operation id

input​

any

the operation input

Returns​

void

Throws​

WebdaError.BadRequest when invalid

computeParameters()​

computeParameters(): void

Defined in: packages/core/lib/services/service.d.ts:77

Used to compute or derivate input parameter to attribute

Returns​

void

Deprecated​

Inherited from​

Service.computeParameters

decide()​

protected decide(context, operationId, options): Promise<string | true>

Defined in: packages/iam/src/iam.service.ts:330

Decide on an operation call

Parameters​

context​

OperationContext

the caller context

operationId​

string

the operation id

options​

input and probe mode

input?​

any

the resolved operation input

probe​

boolean

true for a listing probe (no input)

Returns​

Promise<string | true>

true or the refusal reason

Throws​

WebdaError.BadRequest for an invalid IAMPolicy input

emit()​

emit<Key>(event, data): Promise<void>

Defined in: packages/core/lib/services/service.d.ts:204

Emit the event with data and wait for Promise to finish if listener returned a Promise

Type Parameters​

Key​

Key extends never

Parameters​

event​

Key

the event name

data​

object[Key]

the data to process

Returns​

Promise<void>

Inherited from​

Service.emit

getCapabilities()​

getCapabilities(): Record<string, any>

Defined in: packages/core/lib/services/iservice.d.ts:60

Return the capabilities of this service.

By default returns capabilities detected at compile-time from

Returns​

Record<string, any>

the result

Webda Capability-tagged​

interfaces in webda.module.json.

Override to disable capabilities based on configuration:

getCapabilities() {
  const caps = super.getCapabilities();
  if (!this.parameters.enabled) delete caps["request-filter"];
  return caps;
}

Inherited from​

Service.getCapabilities

getClientEvents()​

getClientEvents(): string[]

Defined in: packages/core/lib/services/service.d.ts:144

Return the events that an external system can subscribe to

Returns​

string[]

the list of results

Inherited from​

Service.getClientEvents

getMaxListeners()​

getMaxListeners(): number

Defined in: packages/core/lib/events/asynceventemitter.d.ts:84

Returns​

number

Inherited from​

Service.getMaxListeners

getMetric()​

getMetric<T>(type, configuration): T

Defined in: packages/core/lib/services/service.d.ts:138

Add service name label

Type Parameters​

T​

T = Gauge<string> | Counter<string> | Histogram<string>

Parameters​

type​

CustomConstructor<T, [MetricConfiguration<T>]>

the type to look up

configuration​

MetricConfiguration<T>

the configuration

Returns​

T

the result

Inherited from​

Service.getMetric

getName()​

getName(): string

Defined in: packages/core/lib/services/service.d.ts:209

Get service name

Returns​

string

the result string

Inherited from​

Service.getName

getOpenApiReplacements()​

getOpenApiReplacements(): any

Defined in: packages/core/lib/services/service.d.ts:182

Return variables for replacement in openapi

Returns​

any

the result

Inherited from​

Service.getOpenApiReplacements

getOperationId()​

getOperationId(id): string | undefined

Defined in: packages/core/lib/services/service.d.ts:167

If undefined is returned it cancel the operation registration

Parameters​

id​

string

the identifier

Returns​

string | undefined

the result

Inherited from​

Service.getOperationId

getParameters()​

getParameters(): T

Defined in: packages/core/lib/services/service.d.ts:82

Get the service parameters

Returns​

T

the result

Inherited from​

Service.getParameters

getService()​

getService<T>(name): ServicesMap[T]

Defined in: packages/core/lib/services/service.d.ts:131

Get a service by name

Type Parameters​

T​

T extends keyof ServicesMap

Parameters​

name​

T

the name to use

Returns​

ServicesMap[T]

the result map

Deprecated​

Use useService, might reconsider

Inherited from​

Service.getService

getState()​

getState(): ServiceStates

Defined in: packages/core/lib/services/service.d.ts:55

Get the current state

Returns​

ServiceStates

the result

Inherited from​

Service.getState

getUrl()​

getUrl(url, _methods): string

Defined in: packages/core/lib/services/service.d.ts:161

Return the full path url based on parameters

Parameters​

url​

string

relative url to service

_methods​

HttpMethodType[]

in case we need filtering (like Store)

Returns​

string

absolute url or undefined if need to skip the Route

Inherited from​

Service.getUrl

init()​

init(): Promise<IAMService<T>>

Defined in: packages/iam/src/iam.service.ts:226

Watch for changes, then load the stored policies and build the engine

Listeners and the periodic rebuild start first: when the first build fails, init() throws but a later successful rebuild (after the stored policy is fixed) still recovers; until then in-scope calls are refused

Returns​

Promise<IAMService<T>>

this

Throws​

PolicyCompileError when the first build fails

Overrides​

Service.init

initMetrics()​

initMetrics(): void

Defined in: packages/core/lib/services/service.d.ts:124

Init the metrics

Returns​

void

Inherited from​

Service.initMetrics

initOperations()​

initOperations(): void

Defined in: packages/core/lib/services/service.d.ts:186

Init the operations from

Returns​

void

Operation​

decorators on this service

Inherited from​

Service.initOperations

isInScope()​

isInScope(operationId): boolean

Defined in: packages/iam/src/iam.service.ts:288

Parameters​

operationId​

string

the operation id

Returns​

boolean

true when IAM governs the operation

listeners()​

listeners(eventName): Function[]

Defined in: packages/core/lib/events/asynceventemitter.d.ts:139

Get all listeners for an event

Parameters​

eventName​

never

the event name

Returns​

Function[]

the list of results

Inherited from​

Service.listeners

loadCapabilities()​

protected loadCapabilities(): void

Defined in: packages/core/lib/services/service.d.ts:120

Load capabilities from webda.module.json metadata into _compiledCapabilities.

Called during resolve after dependency injection. Reads the service's type name from parameters, looks it up in the application's module metadata (moddas or beans section), and populates _compiledCapabilities with an empty object for each declared capability name.

Fails silently if the application is not available (e.g., in unit tests where services are instantiated without a full application context).

Returns​

void

Example​

// If webda.module.json contains:
// { "moddas": { "MyApp/HawkService": { "capabilities": ["request-filter", "cors-filter"] } } }
// Then after resolve(), this.getCapabilities() returns:
// { "request-filter": {}, "cors-filter": {} }

See​

getCapabilities

Inherited from​

Service.loadCapabilities

loadUser()​

protected loadUser(context, userId): Promise<{ groups: string[]; roles: string[]; uuid: string; } | undefined>

Defined in: packages/iam/src/iam.service.ts:466

Load the current user's groups and roles

Parameters​

context​

OperationContext

the caller context

userId​

string

the current user id

Returns​

Promise<{ groups: string[]; roles: string[]; uuid: string; } | undefined>

the user, or undefined when it cannot be loaded

log()​

log(level, ...args): void

Defined in: packages/core/lib/services/service.d.ts:226

Parameters​

level​

WorkerLogLevel

to log

args​

...any[]

additional arguments

Returns​

void

Inherited from​

Service.log

off()​

off<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:116

Type Parameters​

Key​

Key extends never

Parameters​

eventName​

Key

the event name

listener​

(event) => void

the event listener

Returns​

this

this for chaining

See​

EventEmitter.off

Inherited from​

Service.off

on()​

on<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:102

Type Parameters​

Key​

Key extends never

Parameters​

eventName​

Key

the event name

listener​

(event) => void

the event listener

Returns​

this

this for chaining

See​

EventEmitter.once

Inherited from​

Service.on

once()​

once<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:95

Type Parameters​

Key​

Key extends never

Parameters​

eventName​

Key

the event name

listener​

(event) => void

the event listener

Returns​

this

this for chaining

See​

EventEmitter.once

Inherited from​

Service.once

reload()​

reload(): Promise<void>

Defined in: packages/iam/src/iam.service.ts:514

Rebuild the engine; keep the previous one when the rebuild fails (fail closed)

Returns​

Promise<void>

removeAllListeners()​

removeAllListeners<Key>(eventName?): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:122

Type Parameters​

Key​

Key extends never

Parameters​

eventName?​

Key

the event name

Returns​

this

this for chaining

See​

EventEmitter.removeAllListeners

Inherited from​

Service.removeAllListeners

removeListener()​

removeListener<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:109

Type Parameters​

Key​

Key extends never

Parameters​

eventName​

Key

the event name

listener​

(event) => void

the event listener

Returns​

this

this for chaining

See​

EventEmitter.removeListener

Inherited from​

Service.removeListener

resolve()​

resolve(): this

Defined in: packages/iam/src/iam.service.ts:196

Validate and compile the configuration, register the authorizer

Returns​

this

this

Overrides​

Service.resolve

scheduleReload()​

protected scheduleReload(): void

Defined in: packages/iam/src/iam.service.ts:529

Schedule a debounced rebuild

Returns​

void

setMaxListeners()​

setMaxListeners(n): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:88

Parameters​

n​

number

Returns​

this

Inherited from​

Service.setMaxListeners

stop()​

stop(): Promise<void>

Defined in: packages/iam/src/iam.service.ts:272

Stop watching and drop the policies

The authorizer stays registered: in-scope operations are refused during and after a graceful shutdown

Returns​

Promise<void>

Overrides​

Service.stop

toJSON()​

toJSON(): string

Defined in: packages/core/lib/services/service.d.ts:191

Prevent service to be serialized

Returns​

string

the result

Inherited from​

Service.toJSON

toString()​

toString(): string

Defined in: packages/core/lib/services/service.d.ts:91

Return service representation

Returns​

string

the result

Inherited from​

Service.toString