From 20201c9a45828ec9c9c1248b8ac1bc36fa297e8e Mon Sep 17 00:00:00 2001 From: Aleksi Vuorjoki Date: Tue, 21 Jul 2026 19:11:16 +0300 Subject: [PATCH 1/5] Allow user checks to get userForAuthentication as parameter --- packages/user-management/src/user-checks.ts | 25 +++++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/packages/user-management/src/user-checks.ts b/packages/user-management/src/user-checks.ts index 6b7a315..a5a567e 100644 --- a/packages/user-management/src/user-checks.ts +++ b/packages/user-management/src/user-checks.ts @@ -1,22 +1,33 @@ -import { applicationPermissions, AppPerm, Perm, PermissionGrant, PermissionOptions, User, UserSchool } from './index' +import { + applicationPermissions, + AppPerm, + Perm, + PermissionGrant, + PermissionOptions, + User, + UserForAuthentication, + UserSchool +} from './index' -function userSchools(user: User, options?: PermissionOptions): UserSchool[] { +type UserToCheck = UserForAuthentication | User + +function userSchools(user: UserToCheck, options?: PermissionOptions): UserSchool[] { return options?.schoolId ? user.schools.filter(school => school.schoolId === options.schoolId) : user.schools } -export function userPermissionGrants(user: User, options?: PermissionOptions): PermissionGrant[] { +export function userPermissionGrants(user: UserToCheck, options?: PermissionOptions): PermissionGrant[] { return userSchools(user, options).flatMap(school => school.permissions) } -export function userPermissions(user: User, options?: PermissionOptions): Perm[] { +export function userPermissions(user: UserToCheck, options?: PermissionOptions): Perm[] { return userPermissionGrants(user, options).map(grant => grant.permission) } -export function isPrincipal(user: User, options?: PermissionOptions): boolean { +export function isPrincipal(user: UserToCheck, options?: PermissionOptions): boolean { return userSchools(user, options).find(school => school.principal) !== undefined } -export function hasPermission(user: User, requiredPermission: Perm | '*', options?: PermissionOptions): boolean { +export function hasPermission(user: UserToCheck, requiredPermission: Perm | '*', options?: PermissionOptions): boolean { const principal = isPrincipal(user, options) if (principal && !options?.ignorePrincipalRight) { return true @@ -32,7 +43,7 @@ function isApplicationPermission(permission: Perm): permission is AppPerm { return applicationPermissions.includes(permission as AppPerm) } -export function hasApplicationPermission(user: User, options?: PermissionOptions): boolean { +export function hasApplicationPermission(user: UserToCheck, options?: PermissionOptions): boolean { return ( isPrincipal(user, options) || userPermissions(user, options).find(permission => isApplicationPermission(permission)) !== undefined From 5bfe58e5a85534c1248413b111f25dd3fce0508e Mon Sep 17 00:00:00 2001 From: Aleksi Vuorjoki Date: Tue, 21 Jul 2026 19:12:26 +0300 Subject: [PATCH 2/5] Add accepted eulas to user type --- packages/user-management/__tests__/permissions.test.ts | 3 ++- packages/user-management/src/user-types.ts | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/packages/user-management/__tests__/permissions.test.ts b/packages/user-management/__tests__/permissions.test.ts index 7e00394..d53f230 100644 --- a/packages/user-management/__tests__/permissions.test.ts +++ b/packages/user-management/__tests__/permissions.test.ts @@ -10,7 +10,8 @@ const user: User = { ssn: '', firstnames: '', lastname: '', - schools: schoolIds.map(schoolId => ({ schoolId, permissions: [], principal: false, roles: [] })) + schools: schoolIds.map(schoolId => ({ schoolId, permissions: [], principal: false, roles: [] })), + acceptedEulas: [] } describe('Permissions', () => { diff --git a/packages/user-management/src/user-types.ts b/packages/user-management/src/user-types.ts index 7c64ad5..66974ee 100644 --- a/packages/user-management/src/user-types.ts +++ b/packages/user-management/src/user-types.ts @@ -147,7 +147,8 @@ export const UserSchema = StoredUserDetailsSchema.extend({ userAccountId: z.string(), schools: z.array(UserSchoolSchema), censoring: CensoringSchema.optional(), - impersonation: z.never().optional() + impersonation: z.never().optional(), + acceptedEulas: z.array(z.enum(['teacher', 'principal', 'censor'])) }).strict() export type UserToUpsert = z.infer @@ -165,12 +166,13 @@ export const SchoolImpersonationSchema = z .object({ impersonation: ImpersonationSchema, ssn: z.literal('IMPERSONATED'), + acceptedEulas: z.tuple([z.literal('principal')]), schools: z .array( z.object({ schoolId: z.string(), principal: z.literal(true), - permissions: z.array(z.unknown()).max(0, "Impersonated principal doesn't have other permissions") + permissions: z.array(PermissionGrantSchema).max(0, "Impersonated principal doesn't have other permissions") }) ) .max(1, 'Impersonated principal has one school') From 81eb7f5bc49ea0107c7e8e434f15907f43e69e66 Mon Sep 17 00:00:00 2001 From: Github CI Date: Tue, 21 Jul 2026 16:19:06 +0000 Subject: [PATCH 3/5] CI: Release @digabi/user-management@0.7.1-user-management-refactorings.0 with tag user-management-refactorings --- package-lock.json | 2 +- packages/user-management/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 663609a..ddd968f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18737,7 +18737,7 @@ }, "packages/user-management": { "name": "@digabi/user-management", - "version": "0.7.0", + "version": "0.7.1-user-management-refactorings.0", "license": "EUPL-1.2", "dependencies": { "@digabi/validation": "^3.1.0", diff --git a/packages/user-management/package.json b/packages/user-management/package.json index 8ad508a..990ce55 100644 --- a/packages/user-management/package.json +++ b/packages/user-management/package.json @@ -1,6 +1,6 @@ { "name": "@digabi/user-management", - "version": "0.7.0", + "version": "0.7.1-user-management-refactorings.0", "author": "Matriculation Examination Board, Finland", "license": "EUPL-1.2", "repository": { From b90900806a4b7366e41659886015ecbee6aa5cdd Mon Sep 17 00:00:00 2001 From: Aleksi Vuorjoki Date: Tue, 21 Jul 2026 19:58:00 +0300 Subject: [PATCH 4/5] Make acceptedEulas in school impersonation a string array --- packages/user-management/src/user-types.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/user-management/src/user-types.ts b/packages/user-management/src/user-types.ts index 66974ee..5eba1d4 100644 --- a/packages/user-management/src/user-types.ts +++ b/packages/user-management/src/user-types.ts @@ -166,7 +166,13 @@ export const SchoolImpersonationSchema = z .object({ impersonation: ImpersonationSchema, ssn: z.literal('IMPERSONATED'), - acceptedEulas: z.tuple([z.literal('principal')]), + acceptedEulas: z + .array(z.string()) + .max(1, 'only principal eula accepted') + .refine(arr => arr.includes('principal'), { + message: 'only principal eula accepted' + }), + censoring: z.undefined(), schools: z .array( z.object({ From 6114175b834157164334aef11751ed20e0ec9f93 Mon Sep 17 00:00:00 2001 From: Github CI Date: Tue, 21 Jul 2026 16:59:29 +0000 Subject: [PATCH 5/5] CI: Release @digabi/user-management@0.7.1-user-management-refactorings.1 with tag user-management-refactorings --- package-lock.json | 2 +- packages/user-management/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index ddd968f..bd236c9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18737,7 +18737,7 @@ }, "packages/user-management": { "name": "@digabi/user-management", - "version": "0.7.1-user-management-refactorings.0", + "version": "0.7.1-user-management-refactorings.1", "license": "EUPL-1.2", "dependencies": { "@digabi/validation": "^3.1.0", diff --git a/packages/user-management/package.json b/packages/user-management/package.json index 990ce55..ab1ce2e 100644 --- a/packages/user-management/package.json +++ b/packages/user-management/package.json @@ -1,6 +1,6 @@ { "name": "@digabi/user-management", - "version": "0.7.1-user-management-refactorings.0", + "version": "0.7.1-user-management-refactorings.1", "author": "Matriculation Examination Board, Finland", "license": "EUPL-1.2", "repository": {