FM / lib

/home/techb158/balavpn.abdallabala.com/src/lib/

/home/techb158/balavpn.abdallabala.com/src/lib

Name	Size	Mode	Actions
api-client.js	1012	0644	edit dl rm
crypto.js	1676	0644	edit dl rm
email.js	2175	0644	edit dl rm
http.js	563	0644	edit dl rm
idempotency.js	570	0644	edit dl rm
metrics.js	1061	0644	edit dl rm
oidc.js	1730	0644	edit dl rm
prisma.js	280	0644	edit dl rm
rate-limit.js	2662	0644	edit dl rm
redis.js	3517	0644	edit dl rm
request-context.js	3725	0644	edit dl rm
tenant-guard.js	1427	0644	edit dl rm

Edit: /home/techb158/balavpn.abdallabala.com/src/lib/tenant-guard.js (1427B)

const { prisma } = require("./prisma");
const { hasPermission, canAccessWorkspace } = require("../domain/permissions");

async function getProjectScope(projectId) {
  const project = await prisma.project.findUnique({
    where: { id: projectId },
    include: {
      workspace: {
        include: {
          organization: true
        }
      }
    }
  });
  if (!project) {
    const error = new Error(`Project not found: ${projectId}`);
    error.status = 404;
    throw error;
  }
  return project;
}

async function requireProjectAccess(actor, projectId, permission = "project:read") {
  const project = await getProjectScope(projectId);
  const membership = actor.memberships.find(item => item.organizationId === project.workspace.organizationId && item.status === "ACTIVE");
  if (!membership) {
    const error = new Error("Actor cannot access this project's organization.");
    error.status = 403;
    throw error;
  }
  if (!hasPermission(membership.role.permissions, permission)) {
    const error = new Error(`Permission denied: ${permission}`);
    error.status = 403;
    throw error;
  }
  if (!canAccessWorkspace(membership, project.workspaceId)) {
    const error = new Error("Actor cannot access this workspace.");
    error.status = 403;
    throw error;
  }
  return { project, membership, organization: project.workspace.organization };
}

module.exports = {
  getProjectScope,
  requireProjectAccess
};

const { prisma } = require("./prisma"); const { hasPermission, canAccessWorkspace } = require("../domain/permissions"); async function getProjectScope(projectId) { const project = await prisma.project.findUnique({ where: { id: projectId }, include: { workspace: { include: { organization: true } } } }); if (!project) { const error = new Error(`Project not found: ${projectId}`); error.status = 404; throw error; } return project; } async function requireProjectAccess(actor, projectId, permission = "project:read") { const project = await getProjectScope(projectId); const membership = actor.memberships.find(item => item.organizationId === project.workspace.organizationId && item.status === "ACTIVE"); if (!membership) { const error = new Error("Actor cannot access this project's organization."); error.status = 403; throw error; } if (!hasPermission(membership.role.permissions, permission)) { const error = new Error(`Permission denied: ${permission}`); error.status = 403; throw error; } if (!canAccessWorkspace(membership, project.workspaceId)) { const error = new Error("Actor cannot access this workspace."); error.status = 403; throw error; } return { project, membership, organization: project.workspace.organization }; } module.exports = { getProjectScope, requireProjectAccess };