@adatechnology/auth-keycloak 0.0.1 → 0.0.3

package/dist/roles.guard.d.ts

@@ -0,0 +1,10 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import type { KeycloakConfig } from "./keycloak.interface";
+export declare class RolesGuard implements CanActivate {
+    private readonly reflector;
+    private readonly config?;
+    constructor(reflector: Reflector, config?: KeycloakConfig);
+    canActivate(context: ExecutionContext): boolean | Promise<boolean>;
+    private decodeJwtPayload;
+}

package/dist/roles.guard.js

@@ -0,0 +1,103 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const roles_decorator_1 = require("./roles.decorator");
+const keycloak_token_1 = require("./keycloak.token");
+const shared_1 = require("@adatechnology/shared");
+let RolesGuard = class RolesGuard {
+    reflector;
+    config;
+    constructor(reflector, config) {
+        this.reflector = reflector;
+        this.config = config;
+    }
+    canActivate(context) {
+        const meta = this.reflector.get(roles_decorator_1.ROLES_META_KEY, context.getHandler()) ||
+            this.reflector.get(roles_decorator_1.ROLES_META_KEY, context.getClass());
+        if (!meta || !meta.roles || meta.roles.length === 0)
+            return true;
+        const req = context.switchToHttp().getRequest();
+        const authHeader = req.headers?.authorization || req.headers?.Authorization;
+        const token = authHeader
+            ? String(authHeader).split(" ")[1]
+            : req.query?.token;
+        if (!token)
+            throw new shared_1.BaseAppError({
+                message: "Authorization token not provided",
+                status: 403,
+                code: "FORBIDDEN_MISSING_TOKEN",
+                context: {},
+            });
+        const payload = this.decodeJwtPayload(token);
+        const availableRoles = new Set();
+        // realm roles
+        if (payload?.realm_access?.roles &&
+            Array.isArray(payload.realm_access.roles)) {
+            payload.realm_access.roles.forEach((r) => availableRoles.add(r));
+        }
+        // client roles (resource_access)
+        const clientId = this.config?.credentials?.clientId;
+        if (clientId && payload?.resource_access?.[clientId]?.roles) {
+            payload.resource_access[clientId].roles.forEach((r) => availableRoles.add(r));
+        }
+        // also consider all client roles if type is 'both' and resource_access exists
+        if (meta.type === "both" && payload?.resource_access) {
+            Object.values(payload.resource_access).forEach((entry) => {
+                if (entry?.roles && Array.isArray(entry.roles)) {
+                    entry.roles.forEach((r) => availableRoles.add(r));
+                }
+            });
+        }
+        // matching
+        const required = meta.roles || [];
+        const hasMatch = required.map((r) => availableRoles.has(r));
+        const result = meta.mode === "all" ? hasMatch.every(Boolean) : hasMatch.some(Boolean);
+        if (!result)
+            throw new shared_1.BaseAppError({
+                message: "Insufficient roles",
+                status: 403,
+                code: "FORBIDDEN_INSUFFICIENT_ROLES",
+                context: { required: required },
+            });
+        return true;
+    }
+    decodeJwtPayload(token) {
+        try {
+            const parts = token.split(".");
+            if (parts.length < 2)
+                return {};
+            const payload = parts[1];
+            const BufferCtor = globalThis.Buffer;
+            if (!BufferCtor)
+                return {};
+            const decoded = BufferCtor.from(payload, "base64").toString("utf8");
+            return JSON.parse(decoded);
+        }
+        catch (e) {
+            return {};
+        }
+    }
+};
+exports.RolesGuard = RolesGuard;
+exports.RolesGuard = RolesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(core_1.Reflector)),
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(keycloak_token_1.KEYCLOAK_CONFIG)),
+    __metadata("design:paramtypes", [core_1.Reflector, Object])
+], RolesGuard);
+//# sourceMappingURL=roles.guard.js.map

package/dist/roles.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../src/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,uDAAiE;AACjE,qDAAmD;AAGnD,kDAAqD;AAG9C,IAAM,UAAU,GAAhB,MAAM,UAAU;IAGF;IAGA;IALnB,YAEmB,SAAoB,EAGpB,MAAuB;QAHvB,cAAS,GAAT,SAAS,CAAW;QAGpB,WAAM,GAAN,MAAM,CAAiB;IACvC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,IAAI,GACR,IAAI,CAAC,SAAS,CAAC,GAAG,CAAe,gCAAc,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YACtE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAe,gCAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEvE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC;QAErB,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,qBAAY,CAAC;gBACrB,OAAO,EAAE,kCAAkC;gBAC3C,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QAEL,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAE7C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,cAAc;QACd,IACE,OAAO,EAAE,YAAY,EAAE,KAAK;YAC5B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EACzC,CAAC;YACD,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;QACpD,IAAI,QAAQ,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC;YAC5D,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAC5D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACtB,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvD,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9C,KAAK,CAAC,KAAkB,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAC9C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,WAAW;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,GACV,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEzE,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,qBAAY,CAAC;gBACrB,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAChC,CAAC,CAAC;QAEL,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GACd,UAQD,CAAC,MAAM,CAAC;YACT,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAuB,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF,CAAA;AArGY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,gBAAS,CAAC,CAAA;IAEjB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,gCAAe,CAAC,CAAA;qCAFI,gBAAS;GAH5B,UAAU,CAqGtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adatechnology/auth-keycloak",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "publishConfig": {
     "access": "public"
   },
@@ -11,16 +11,23 @@
     "dist"
   ],
   "dependencies": {
-    "@adatechnology/http-client": "0.0.1"
+    "@adatechnology/http-client": "0.0.3",
+    "@adatechnology/logger": "0.0.2",
+    "@adatechnology/shared": "0.0.1"
   },
   "peerDependencies": {
-    "@nestjs/common": "^11",
+    "@nestjs/common": "^11.0.16",
     "@nestjs/core": "^11"
   },
-  "devDependencies": {},
+  "devDependencies": {
+    "@esbuild-plugins/tsconfig-paths": "^0.1.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.2.0"
+  },
   "scripts": {
-    "build": "tsc -b",
-    "build:watch": "tsc -b --watch",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "build:watch": "tsup --watch",
+    "check": "tsc -p tsconfig.json --noEmit",
     "test": "echo \"no tests\""
   }
 }