@acorex-platform/framework-server 0.0.33 → 0.0.37

package/security/src/lib/session/optional-jwt-session.middleware.js

@@ -11,17 +11,19 @@ const current_session_decorator_1 = require("./current-session.decorator");
 /**
  * Populates {@link CURRENT_SESSION_KEY} when a valid access token is present.
  * Routes stay public when no token is sent (entity storage, optional auth reads).
- * Invalid or expired tokens are ignored here so unauthenticated flows (e.g. token
- * refresh) still work; routes needing enforcement use {@link JwtAuthGuard}.
+ * Invalid, expired, or OD-09-revoked tokens are ignored here so unauthenticated
+ * flows (e.g. token refresh) still work; routes needing enforcement use
+ * {@link JwtAuthGuard}.
  */
 let OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = class OptionalJwtSessionMiddleware {
-    constructor(authService, machineTokenService, tokenResolver) {
+    constructor(requireEntityApiAuth, authService, machineTokenService, tokenResolver) {
+        this.requireEntityApiAuth = requireEntityApiAuth;
         this.authService = authService;
         this.machineTokenService = machineTokenService;
         this.tokenResolver = tokenResolver;
         this.logger = new common_1.Logger(OptionalJwtSessionMiddleware_1.name);
     }
-    use(req, _res, next) {
+    async use(req, _res, next) {
         if (req[current_session_decorator_1.CURRENT_SESSION_KEY]) {
             next();
             return;
@@ -38,16 +40,24 @@ let OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = class Option
             return;
         }
         try {
-            const payload = this.authService.verifyAccessToken(resolved.token);
+            const payload = await this.authService.validateAccessToken(resolved.token);
             req[current_session_decorator_1.CURRENT_SESSION_KEY] = {
                 userId: payload.sub,
                 username: payload.username,
                 tenantId: payload.tid,
                 applicationId: payload.aid,
+                sid: payload.sid,
             };
         }
         catch {
-            this.logger.debug('Ignoring invalid or expired bearer token');
+            this.logger.debug('Ignoring invalid, expired, or revoked bearer token');
+        }
+        // Optional auth middleware: routes remain public when no token is sent.
+        // When enabled, require auth for entity storage REST API.
+        if (this.requireEntityApiAuth &&
+            !req[current_session_decorator_1.CURRENT_SESSION_KEY] &&
+            (String(req.originalUrl ?? '').includes('/v1/entity/') || String(req.path ?? '').includes('/v1/entity/'))) {
+            throw new common_1.UnauthorizedException('Bearer access token is required for entity API.');
         }
         next();
     }
@@ -55,7 +65,8 @@ let OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = class Option
 exports.OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware;
 exports.OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware = OptionalJwtSessionMiddleware_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [auth_service_1.AuthService,
+    tslib_1.__param(0, (0, common_1.Inject)('AUTH_ENTITY_API_REQUIRE_AUTH')),
+    tslib_1.__metadata("design:paramtypes", [Boolean, auth_service_1.AuthService,
         machine_token_service_1.MachineTokenService,
         token_resolver_service_1.TokenResolverService])
 ], OptionalJwtSessionMiddleware);

package/security/src/lib/session/optional-jwt-session.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"optional-jwt-session.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/optional-jwt-session.middleware.ts"],"names":[],"mappings":";;;;;AAAA,2CAAoE;AAEpE,uDAAmD;AACnD,yEAAoE;AACpE,2EAAsE;AACtE,2EAAkE;AASlE;;;;;GAKG;AAEI,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAGvC,YACmB,WAAwB,EACxB,mBAAwC,EACxC,aAAmC;QAFnC,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,kBAAa,GAAb,aAAa,CAAsB;QALrC,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;IAMrE,CAAC;IAEJ,GAAG,CAAC,GAAuB,EAAE,IAAc,EAAE,IAAkB;QAC7D,IAAI,GAAG,CAAC,+CAAmB,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,+CAAmB,CAAC,GAAG,cAAc,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,GAAG,CAAC,OAAwD,EAC5D,GAAG,CAAC,OAAkC,CACvC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnE,GAAG,CAAC,+CAAmB,CAAC,GAAG;gBACzB,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,aAAa,EAAE,OAAO,CAAC,GAAG;aAC3B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AA7CY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;6CAKqB,0BAAW;QACH,2CAAmB;QACzB,6CAAoB;GAN3C,4BAA4B,CA6CxC;AAED,YAAY"}
+{"version":3,"file":"optional-jwt-session.middleware.js","sourceRoot":"","sources":["../../../../../../../../libs/framework/server/security/src/lib/session/optional-jwt-session.middleware.ts"],"names":[],"mappings":";;;;;AAAA,2CAAmG;AAEnG,uDAAmD;AACnD,yEAAoE;AACpE,2EAAsE;AACtE,2EAAkE;AASlE;;;;;;GAMG;AAEI,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAGvC,YAC0C,oBAA8C,EACrE,WAAwB,EACxB,mBAAwC,EACxC,aAAmC;QAHK,yBAAoB,GAApB,oBAAoB,CAAS;QACrE,gBAAW,GAAX,WAAW,CAAa;QACxB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,kBAAa,GAAb,aAAa,CAAsB;QANrC,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;IAOrE,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAuB,EAAE,IAAc,EAAE,IAAkB;QACnE,IAAI,GAAG,CAAC,+CAAmB,CAAC,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,cAAc,EAAE,CAAC;YACnB,GAAG,CAAC,+CAAmB,CAAC,GAAG,cAAc,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CACpD,GAAG,CAAC,OAAwD,EAC5D,GAAG,CAAC,OAAkC,CACvC,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3E,GAAG,CAAC,+CAAmB,CAAC,GAAG;gBACzB,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG;gBACrB,aAAa,EAAE,OAAO,CAAC,GAAG;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1E,CAAC;QAED,wEAAwE;QACxE,0DAA0D;QAC1D,IACE,IAAI,CAAC,oBAAoB;YACzB,CAAC,GAAG,CAAC,+CAAmB,CAAC;YACzB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EACzG,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,iDAAiD,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAzDY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,eAAM,EAAC,8BAA8B,CAAC,CAAA;sDACT,0BAAW;QACH,2CAAmB;QACzB,6CAAoB;GAP3C,4BAA4B,CAyDxC;AAED,YAAY"}