@anarchitects/auth-nest 0.4.2 → 0.5.0

package/src/infrastructure-persistence/persistence.module.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthPersistenceModule = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
 const typeorm_1 = require("@nestjs/typeorm");
 const invalidated_token_entity_1 = require("./entities/invalidated-token.entity");
 const permission_entity_1 = require("./entities/permission.entity");
@@ -11,12 +12,14 @@ const user_entity_1 = require("./entities/user.entity");
 const persistence_module_definition_1 = require("./persistence.module-definition");
 const auth_user_repository_1 = require("./repositories/auth-user.repository");
 const typeorm_auth_user_repository_1 = require("./repositories/typeorm-auth-user.repository");
+const config_2 = require("../config");
 let AuthPersistenceModule = class AuthPersistenceModule extends persistence_module_definition_1.ConfigurableModuleClass {
-    static forRoot(options) {
-        switch (options.persistence) {
+    static forRoot(options = {}) {
+        const resolvedOptions = (0, config_2.resolveAuthPersistenceModuleOptions)(options);
+        switch (resolvedOptions.persistence) {
             case 'typeorm':
                 return {
-                    ...super.forRoot(options),
+                    ...super.forRoot(resolvedOptions),
                     imports: [
                         typeorm_1.TypeOrmModule.forFeature([
                             user_entity_1.UserEntity,
@@ -35,9 +38,23 @@ let AuthPersistenceModule = class AuthPersistenceModule extends persistence_modu
                     exports: [auth_user_repository_1.AuthUserRepository, typeorm_1.TypeOrmModule],
                 };
             default:
-                throw new Error(`Unsupported persistence type: ${options.persistence}`);
+                throw new Error(`Unsupported persistence type: ${resolvedOptions.persistence}`);
         }
     }
+    static forRootFromConfig(overrides = {}) {
+        const configOptions = (0, config_2.mapAuthConfigToPersistenceModuleOptions)((0, config_2.authConfig)());
+        const moduleDefinition = this.forRoot({
+            ...configOptions,
+            ...overrides,
+        });
+        return {
+            ...moduleDefinition,
+            imports: [
+                config_1.ConfigModule.forFeature(config_2.authConfig),
+                ...(moduleDefinition.imports ?? []),
+            ],
+        };
+    }
 };
 exports.AuthPersistenceModule = AuthPersistenceModule;
 exports.AuthPersistenceModule = AuthPersistenceModule = tslib_1.__decorate([

package/src/infrastructure-persistence/persistence.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"persistence.module.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/infrastructure-persistence/persistence.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAuD;AACvD,6CAAgD;AAChD,kFAA6E;AAC7E,oEAAgE;AAChE,wDAAoD;AACpD,wDAAoD;AACpD,mFAGyC;AACzC,8EAAyE;AACzE,8FAAwF;AAGjF,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,uDAAuB;IAChE,MAAM,CAAC,OAAO,CAAC,OAA4B;QACzC,QAAQ,OAAO,CAAC,WAAW,EAAE,CAAC;YAC5B,KAAK,SAAS;gBACZ,OAAO;oBACL,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;oBACzB,OAAO,EAAE;wBACP,uBAAa,CAAC,UAAU,CAAC;4BACvB,wBAAU;4BACV,wBAAU;4BACV,oCAAgB;4BAChB,iDAAsB;yBACvB,CAAC;qBACH;oBACD,SAAS,EAAE;wBACT,wDAAyB;wBACzB;4BACE,OAAO,EAAE,yCAAkB;4BAC3B,WAAW,EAAE,wDAAyB;yBACvC;qBACF;oBACD,OAAO,EAAE,CAAC,yCAAkB,EAAE,uBAAa,CAAC;iBAC7C,CAAC;YACJ;gBACE,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAA;AA3BY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,qBAAqB,CA2BjC"}
+{"version":3,"file":"persistence.module.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/infrastructure-persistence/persistence.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAuD;AACvD,2CAA8C;AAC9C,6CAAgD;AAChD,kFAA6E;AAC7E,oEAAgE;AAChE,wDAAoD;AACpD,wDAAoD;AACpD,mFAGyC;AACzC,8EAAyE;AACzE,8FAAwF;AACxF,sCAImB;AAIZ,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,uDAAuB;IAChE,MAAM,CAAC,OAAO,CAAC,UAAwC,EAAE;QACvD,MAAM,eAAe,GACnB,IAAA,4CAAmC,EAAC,OAAO,CAAC,CAAC;QAE/C,QAAQ,eAAe,CAAC,WAAW,EAAE,CAAC;YACpC,KAAK,SAAS;gBACZ,OAAO;oBACL,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;oBACjC,OAAO,EAAE;wBACP,uBAAa,CAAC,UAAU,CAAC;4BACvB,wBAAU;4BACV,wBAAU;4BACV,oCAAgB;4BAChB,iDAAsB;yBACvB,CAAC;qBACH;oBACD,SAAS,EAAE;wBACT,wDAAyB;wBACzB;4BACE,OAAO,EAAE,yCAAkB;4BAC3B,WAAW,EAAE,wDAAyB;yBACvC;qBACF;oBACD,OAAO,EAAE,CAAC,yCAAkB,EAAE,uBAAa,CAAC;iBAC7C,CAAC;YACJ;gBACE,MAAM,IAAI,KAAK,CACb,iCAAiC,eAAe,CAAC,WAAW,EAAE,CAC/D,CAAC;QACN,CAAC;IACH,CAAC;IAED,MAAM,CAAC,iBAAiB,CACtB,YAA0C,EAAE;QAE5C,MAAM,aAAa,GAAG,IAAA,gDAAuC,EAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;YACpC,GAAG,aAAa;YAChB,GAAG,SAAS;SACb,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,gBAAgB;YACnB,OAAO,EAAE;gBACP,qBAAY,CAAC,UAAU,CAAC,mBAAU,CAAC;gBACnC,GAAG,CAAC,gBAAgB,CAAC,OAAO,IAAI,EAAE,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAlDY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,qBAAqB,CAkDjC"}

package/src/presentation/authorized-resource.request.d.ts

@@ -0,0 +1,7 @@
+import { Subject } from '@anarchitects/auth-ts/models';
+export declare const AUTHORIZED_RESOURCES_REQUEST_KEY = "__authAuthorizedResources";
+type AuthorizedResourceStore = Record<string, unknown>;
+export declare const attachAuthorizedResource: (request: Record<string, unknown>, subject: Subject, resource: unknown) => void;
+export declare const getAuthorizedResourceStore: (request: Record<string, unknown>) => AuthorizedResourceStore;
+export declare const getAuthorizedResource: (request: Record<string, unknown>, subject: Subject) => unknown;
+export {};

package/src/presentation/authorized-resource.request.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuthorizedResource = exports.getAuthorizedResourceStore = exports.attachAuthorizedResource = exports.AUTHORIZED_RESOURCES_REQUEST_KEY = void 0;
+exports.AUTHORIZED_RESOURCES_REQUEST_KEY = '__authAuthorizedResources';
+const attachAuthorizedResource = (request, subject, resource) => {
+    const requestWithResources = request;
+    const store = requestWithResources[exports.AUTHORIZED_RESOURCES_REQUEST_KEY] ??
+        (requestWithResources[exports.AUTHORIZED_RESOURCES_REQUEST_KEY] = {});
+    store[subject] = resource;
+};
+exports.attachAuthorizedResource = attachAuthorizedResource;
+const getAuthorizedResourceStore = (request) => request[exports.AUTHORIZED_RESOURCES_REQUEST_KEY] ?? {};
+exports.getAuthorizedResourceStore = getAuthorizedResourceStore;
+const getAuthorizedResource = (request, subject) => (0, exports.getAuthorizedResourceStore)(request)[subject];
+exports.getAuthorizedResource = getAuthorizedResource;
+//# sourceMappingURL=authorized-resource.request.js.map

package/src/presentation/authorized-resource.request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-resource.request.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/authorized-resource.request.ts"],"names":[],"mappings":";;;AAEa,QAAA,gCAAgC,GAAG,2BAA2B,CAAC;AAQrE,MAAM,wBAAwB,GAAG,CACtC,OAAgC,EAChC,OAAgB,EAChB,QAAiB,EACX,EAAE;IACR,MAAM,oBAAoB,GAAG,OAAyC,CAAC;IACvE,MAAM,KAAK,GACT,oBAAoB,CAAC,wCAAgC,CAAC;QACtD,CAAC,oBAAoB,CAAC,wCAAgC,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;AAC5B,CAAC,CAAC;AAVW,QAAA,wBAAwB,4BAUnC;AAEK,MAAM,0BAA0B,GAAG,CACxC,OAAgC,EACP,EAAE,CAC1B,OAA0C,CACzC,wCAAgC,CACjC,IAAI,EAAE,CAAC;AALG,QAAA,0BAA0B,8BAK7B;AAEH,MAAM,qBAAqB,GAAG,CACnC,OAAgC,EAChC,OAAgB,EACP,EAAE,CAAC,IAAA,kCAA0B,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;AAH9C,QAAA,qBAAqB,yBAGyB"}

package/src/presentation/decorators/authorize-resource.decorator.d.ts

@@ -0,0 +1,3 @@
+import { ResourceAuthorizationRoute } from '../../application/resource-authorization.types';
+export declare const AUTHORIZE_RESOURCE_KEY = "authorize-resource";
+export declare const AuthorizeResource: (...resources: ResourceAuthorizationRoute[]) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;

package/src/presentation/decorators/authorize-resource.decorator.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizeResource = exports.AUTHORIZE_RESOURCE_KEY = void 0;
+const common_1 = require("@nestjs/common");
+const resource_authorization_guard_1 = require("../guards/resource-authorization.guard");
+exports.AUTHORIZE_RESOURCE_KEY = 'authorize-resource';
+const AuthorizeResource = (...resources) => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.AUTHORIZE_RESOURCE_KEY, resources), (0, common_1.UseGuards)(resource_authorization_guard_1.ResourceAuthorizationGuard));
+exports.AuthorizeResource = AuthorizeResource;
+//# sourceMappingURL=authorize-resource.decorator.js.map

package/src/presentation/decorators/authorize-resource.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-resource.decorator.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/decorators/authorize-resource.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAyE;AAEzE,yFAAoF;AAEvE,QAAA,sBAAsB,GAAG,oBAAoB,CAAC;AAEpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,SAAuC,EAAE,EAAE,CAC9E,IAAA,wBAAe,EACb,IAAA,oBAAW,EAAC,8BAAsB,EAAE,SAAS,CAAC,EAC9C,IAAA,kBAAS,EAAC,yDAA0B,CAAC,CACtC,CAAC;AAJS,QAAA,iBAAiB,qBAI1B"}

package/src/presentation/decorators/authorized-resource.decorator.d.ts

@@ -0,0 +1,2 @@
+import { Subject } from '@anarchitects/auth-ts/models';
+export declare const AuthorizedResource: (...dataOrPipes: (Subject | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;

package/src/presentation/decorators/authorized-resource.decorator.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizedResource = void 0;
+const common_1 = require("@nestjs/common");
+const authorize_resource_decorator_1 = require("./authorize-resource.decorator");
+const authorized_resource_request_1 = require("../authorized-resource.request");
+const resolveAuthorizedResourceSubject = (context, subjectOverride) => {
+    if (subjectOverride) {
+        return subjectOverride;
+    }
+    const resources = Reflect.getMetadata(authorize_resource_decorator_1.AUTHORIZE_RESOURCE_KEY, context.getHandler()) ??
+        Reflect.getMetadata(authorize_resource_decorator_1.AUTHORIZE_RESOURCE_KEY, context.getClass()) ??
+        [];
+    const subjects = resources.map((resource) => resource.subject);
+    if (subjects.length === 1) {
+        return subjects[0];
+    }
+    throw new common_1.InternalServerErrorException('Authorized resource subject could not be resolved from route metadata');
+};
+exports.AuthorizedResource = (0, common_1.createParamDecorator)((subjectOverride, context) => {
+    const request = context
+        .switchToHttp()
+        .getRequest();
+    const subject = resolveAuthorizedResourceSubject(context, subjectOverride);
+    const resource = (0, authorized_resource_request_1.getAuthorizedResource)(request, subject);
+    if (resource === undefined) {
+        const store = (0, authorized_resource_request_1.getAuthorizedResourceStore)(request);
+        throw new common_1.InternalServerErrorException(`Authorized resource for subject "${subject}" is not attached to the request. Available subjects: ${Object.keys(store).join(', ')}`);
+    }
+    return resource;
+});
+//# sourceMappingURL=authorized-resource.decorator.js.map

package/src/presentation/decorators/authorized-resource.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-resource.decorator.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/decorators/authorized-resource.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAIwB;AAGxB,iFAAwE;AACxE,gFAGwC;AAExC,MAAM,gCAAgC,GAAG,CACvC,OAAyB,EACzB,eAAyB,EAChB,EAAE;IACX,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,SAAS,GACb,OAAO,CAAC,WAAW,CAAC,qDAAsB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QACjE,OAAO,CAAC,WAAW,CAAC,qDAAsB,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/D,EAAE,CAAC;IAEL,MAAM,QAAQ,GAAI,SAA0C,CAAC,GAAG,CAC9D,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAC/B,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,qCAA4B,CACpC,uEAAuE,CACxE,CAAC;AACJ,CAAC,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,eAAoC,EAAE,OAAyB,EAAE,EAAE;IAClE,MAAM,OAAO,GAAG,OAAO;SACpB,YAAY,EAAE;SACd,UAAU,EAA2B,CAAC;IACzC,MAAM,OAAO,GAAG,gCAAgC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAA,mDAAqB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAA,wDAA0B,EAAC,OAAO,CAAC,CAAC;QAClD,MAAM,IAAI,qCAA4B,CACpC,oCAAoC,OAAO,yDAAyD,MAAM,CAAC,IAAI,CAC7G,KAAK,CACN,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACf,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CACF,CAAC"}

package/src/presentation/decorators/policies.decorator.d.ts

@@ -1,3 +1,3 @@
-import { PolicyRule } from '@anarchitects/auth-ts/models';
+import { RoutePolicy } from '../route-policy';
 export declare const POLICIES_KEY = "policies";
-export declare const Policies: (...rules: PolicyRule[]) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+export declare const Policies: (...rules: RoutePolicy[]) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;

package/src/presentation/decorators/policies.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.decorator.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/decorators/policies.decorator.ts"],"names":[],"mappings":";;;AACA,2CAA8D;AAEjD,QAAA,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAmB,EAAE,EAAE,CACjD,IAAA,wBAAe,EAAC,IAAA,oBAAW,EAAC,oBAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AADvC,QAAA,QAAQ,YAC+B"}
+{"version":3,"file":"policies.decorator.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/decorators/policies.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA8D;AAGjD,QAAA,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAoB,EAAE,EAAE,CAClD,IAAA,wBAAe,EAAC,IAAA,oBAAW,EAAC,oBAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AADvC,QAAA,QAAQ,YAC+B"}

package/src/presentation/guards/policies.guard.js

@@ -6,6 +6,7 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const policies_service_1 = require("../../application/services/policies.service");
 const policies_decorator_1 = require("../decorators/policies.decorator");
+const route_policy_matcher_1 = require("./route-policy-matcher");
 let PoliciesGuard = class PoliciesGuard {
     constructor(reflector, policiesService) {
         this.reflector = reflector;
@@ -14,17 +15,17 @@ let PoliciesGuard = class PoliciesGuard {
     async canActivate(context) {
         const req = context.switchToHttp().getRequest();
         const policies = this.reflector.getAllAndOverride(policies_decorator_1.POLICIES_KEY, [context.getHandler(), context.getClass()]);
-        if (policies) {
+        if (policies?.length) {
             const user = req.user;
             if (!user) {
                 throw new common_1.UnauthorizedException('User not authenticated');
             }
-            const ability = await this.policiesService.buildAbilityForUser(user);
-            policies.forEach((policy) => {
-                if (!ability.can(policy.action, policy.subject)) {
+            const policyRules = await this.policiesService.rulesForUser(user);
+            for (const policy of policies) {
+                if (!(0, route_policy_matcher_1.canAttemptRoutePolicy)(policy, policyRules)) {
                     throw new common_1.ForbiddenException();
                 }
-            });
+            }
         }
         return true;
     }

package/src/presentation/guards/policies.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.guard.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/guards/policies.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AACxB,uCAAyC;AAEzC,kFAA8E;AAC9E,yEAAgE;AAGzD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAAoB,EACpB,eAAgC;QADhC,cAAS,GAAT,SAAS,CAAW;QACpB,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IACJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC/C,iCAAY,EACZ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACrE,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;gBACjC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1BY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;6CAGmB,gBAAS;QACH,kCAAe;GAHxC,aAAa,CA0BzB"}
+{"version":3,"file":"policies.guard.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/guards/policies.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,kFAA8E;AAC9E,yEAAgE;AAEhE,iEAA+D;AAGxD,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YACmB,SAAoB,EACpB,eAAgC;QADhC,cAAS,GAAT,SAAS,CAAW;QACpB,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC/C,iCAAY,EACZ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAElE,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAA,4CAAqB,EAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;oBAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;gBACjC,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/BY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;6CAGmB,gBAAS;QACH,kCAAe;GAHxC,aAAa,CA+BzB"}

package/src/presentation/guards/resource-authorization.guard.d.ts

@@ -0,0 +1,11 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PoliciesService } from '../../application/services/policies.service';
+import { ResourceAuthorizationLoaders } from '../../application/resource-authorization.types';
+export declare class ResourceAuthorizationGuard implements CanActivate {
+    private readonly reflector;
+    private readonly policiesService;
+    private readonly loaders;
+    constructor(reflector: Reflector, policiesService: PoliciesService, loaders: ResourceAuthorizationLoaders);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/src/presentation/guards/resource-authorization.guard.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceAuthorizationGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const policies_service_1 = require("../../application/services/policies.service");
+const resource_authorization_1 = require("../../application/services/resource-authorization");
+const resource_authorization_tokens_1 = require("../../application/resource-authorization.tokens");
+const authorize_resource_decorator_1 = require("../decorators/authorize-resource.decorator");
+const authorized_resource_request_1 = require("../authorized-resource.request");
+let ResourceAuthorizationGuard = class ResourceAuthorizationGuard {
+    constructor(reflector, policiesService, loaders) {
+        this.reflector = reflector;
+        this.policiesService = policiesService;
+        this.loaders = loaders;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const resources = this.reflector.getAllAndOverride(authorize_resource_decorator_1.AUTHORIZE_RESOURCE_KEY, [context.getHandler(), context.getClass()]) ?? [];
+        if (!resources.length) {
+            return true;
+        }
+        const user = request.user;
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not authenticated');
+        }
+        const ability = await this.policiesService.buildAbilityForUser(user);
+        for (const resource of resources) {
+            const loader = this.loaders[resource.subject];
+            if (!loader) {
+                throw new common_1.InternalServerErrorException(`No resource authorization loader registered for subject "${resource.subject}"`);
+            }
+            const resourceId = request.params?.[resource.idParam];
+            if (!resourceId) {
+                throw new common_1.BadRequestException(`Missing route parameter "${resource.idParam}" for resource authorization`);
+            }
+            const loadedResource = await loader({ user, resourceId });
+            if (!loadedResource) {
+                throw new common_1.NotFoundException();
+            }
+            (0, resource_authorization_1.assertCanAccessResource)(ability, resource.action, resource.subject, loadedResource);
+            (0, authorized_resource_request_1.attachAuthorizedResource)(request, resource.subject, loadedResource);
+        }
+        return true;
+    }
+};
+exports.ResourceAuthorizationGuard = ResourceAuthorizationGuard;
+exports.ResourceAuthorizationGuard = ResourceAuthorizationGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(2, (0, common_1.Inject)(resource_authorization_tokens_1.AUTH_RESOURCE_AUTHORIZATION_LOADERS)),
+    tslib_1.__metadata("design:paramtypes", [core_1.Reflector,
+        policies_service_1.PoliciesService, Object])
+], ResourceAuthorizationGuard);
+//# sourceMappingURL=resource-authorization.guard.js.map

package/src/presentation/guards/resource-authorization.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-authorization.guard.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/guards/resource-authorization.guard.ts"],"names":[],"mappings":";;;;AACA,2CASwB;AACxB,uCAAyC;AACzC,kFAA8E;AAC9E,8FAA4F;AAC5F,mGAAsG;AAKtG,6FAAoF;AACpF,gFAA0E;AAGnE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,SAAoB,EACpB,eAAgC,EAEhC,OAAqC;QAHrC,cAAS,GAAT,SAAS,CAAW;QACpB,oBAAe,GAAf,eAAe,CAAiB;QAEhC,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAG7C,CAAC;QACL,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,qDAAsB,EACtB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,IAAI,EAAE,CAAC;QAEV,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAErE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,qCAA4B,CACpC,4DAA4D,QAAQ,CAAC,OAAO,GAAG,CAChF,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,4BAAmB,CAC3B,4BAA4B,QAAQ,CAAC,OAAO,8BAA8B,CAC3E,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,EAAE,CAAC;YAChC,CAAC;YAED,IAAA,gDAAuB,EACrB,OAAO,EACP,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,OAAO,EAChB,cAAc,CACf,CAAC;YACF,IAAA,sDAAwB,EACtB,OAAkC,EAClC,QAAQ,CAAC,OAAO,EAChB,cAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAjEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,eAAM,EAAC,mEAAmC,CAAC,CAAA;6CAFhB,gBAAS;QACH,kCAAe;GAHxC,0BAA0B,CAiEtC"}

package/src/presentation/guards/route-policy-matcher.d.ts

@@ -0,0 +1 @@
+export { canAttemptRoutePolicy } from '@anarchitects/auth-ts/models';

package/src/presentation/guards/route-policy-matcher.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAttemptRoutePolicy = void 0;
+var models_1 = require("@anarchitects/auth-ts/models");
+Object.defineProperty(exports, "canAttemptRoutePolicy", { enumerable: true, get: function () { return models_1.canAttemptRoutePolicy; } });
+//# sourceMappingURL=route-policy-matcher.js.map

package/src/presentation/guards/route-policy-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy-matcher.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/presentation/guards/route-policy-matcher.ts"],"names":[],"mappings":";;;AAAA,uDAAqE;AAA5D,+GAAA,qBAAqB,OAAA"}

package/src/presentation/index.d.ts

@@ -1,4 +1,9 @@
 export * from './presentation.module';
 export * from './controllers/auth.controller';
 export * from './guards/policies.guard';
+export * from './guards/resource-authorization.guard';
 export * from './decorators/policies.decorator';
+export * from './decorators/authorize-resource.decorator';
+export * from './decorators/authorized-resource.decorator';
+export * from './route-policy';
+export type { AuthPresentationModuleOptions } from '../config';

package/src/presentation/index.js

@@ -4,5 +4,9 @@ const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./presentation.module"), exports);
 tslib_1.__exportStar(require("./controllers/auth.controller"), exports);
 tslib_1.__exportStar(require("./guards/policies.guard"), exports);
+tslib_1.__exportStar(require("./guards/resource-authorization.guard"), exports);
 tslib_1.__exportStar(require("./decorators/policies.decorator"), exports);
+tslib_1.__exportStar(require("./decorators/authorize-resource.decorator"), exports);
+tslib_1.__exportStar(require("./decorators/authorized-resource.decorator"), exports);
+tslib_1.__exportStar(require("./route-policy"), exports);
 //# sourceMappingURL=index.js.map

package/src/presentation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,wEAA8C;AAC9C,kEAAwC;AACxC,0EAAgD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/index.ts"],"names":[],"mappings":";;;AAAA,gEAAsC;AACtC,wEAA8C;AAC9C,kEAAwC;AACxC,gFAAsD;AACtD,0EAAgD;AAChD,oFAA0D;AAC1D,qFAA2D;AAC3D,yDAA+B"}

package/src/presentation/presentation.module.d.ts

@@ -1,2 +1,6 @@
+import { DynamicModule } from '@nestjs/common';
+import type { AuthPresentationModuleOptions } from '../config';
 export declare class AuthPresentationModule {
+    static forRoot(options?: AuthPresentationModuleOptions): DynamicModule;
+    static forRootFromConfig(overrides?: AuthPresentationModuleOptions): DynamicModule;
 }

package/src/presentation/presentation.module.js

@@ -1,15 +1,56 @@
 "use strict";
+var AuthPresentationModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthPresentationModule = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
 const auth_controller_1 = require("./controllers/auth.controller");
-let AuthPresentationModule = class AuthPresentationModule {
+const application_1 = require("../application");
+const policies_guard_1 = require("./guards/policies.guard");
+const resource_authorization_guard_1 = require("./guards/resource-authorization.guard");
+const config_2 = require("../config");
+let AuthPresentationModule = AuthPresentationModule_1 = class AuthPresentationModule {
+    static forRoot(options = {}) {
+        return {
+            module: AuthPresentationModule_1,
+            imports: [application_1.AuthApplicationModule.forRoot(options.application)],
+            exports: [application_1.AuthApplicationModule],
+        };
+    }
+    static forRootFromConfig(overrides = {}) {
+        const configOptions = (0, config_2.mapAuthConfigToPresentationModuleOptions)((0, config_2.authConfig)());
+        const moduleDefinition = this.forRoot({
+            ...configOptions,
+            ...overrides,
+            application: {
+                ...configOptions.application,
+                ...overrides.application,
+                encryption: {
+                    ...configOptions.application?.encryption,
+                    ...overrides.application?.encryption,
+                },
+                persistence: {
+                    ...configOptions.application?.persistence,
+                    ...overrides.application?.persistence,
+                },
+            },
+        });
+        return {
+            ...moduleDefinition,
+            imports: [
+                config_1.ConfigModule.forFeature(config_2.authConfig),
+                ...(moduleDefinition.imports ?? []),
+            ],
+        };
+    }
 };
 exports.AuthPresentationModule = AuthPresentationModule;
-exports.AuthPresentationModule = AuthPresentationModule = tslib_1.__decorate([
+exports.AuthPresentationModule = AuthPresentationModule = AuthPresentationModule_1 = tslib_1.__decorate([
     (0, common_1.Module)({
         controllers: [auth_controller_1.AuthController],
+        providers: [policies_guard_1.PoliciesGuard, resource_authorization_guard_1.ResourceAuthorizationGuard],
+        exports: [policies_guard_1.PoliciesGuard, resource_authorization_guard_1.ResourceAuthorizationGuard],
     })
 ], AuthPresentationModule);
 //# sourceMappingURL=presentation.module.js.map

package/src/presentation/presentation.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"presentation.module.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/presentation.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,mEAA+D;AAKxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CAAG,CAAA;AAAzB,wDAAsB;iCAAtB,sBAAsB;IAHlC,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,gCAAc,CAAC;KAC9B,CAAC;GACW,sBAAsB,CAAG"}
+{"version":3,"file":"presentation.module.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/presentation.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAAuD;AACvD,2CAA8C;AAC9C,mEAA+D;AAC/D,gDAAuD;AACvD,4DAAwD;AACxD,wFAAmF;AACnF,sCAGmB;AAQZ,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,MAAM,CAAC,OAAO,CAAC,UAAyC,EAAE;QACxD,OAAO;YACL,MAAM,EAAE,wBAAsB;YAC9B,OAAO,EAAE,CAAC,mCAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC7D,OAAO,EAAE,CAAC,mCAAqB,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,iBAAiB,CACtB,YAA2C,EAAE;QAE7C,MAAM,aAAa,GACjB,IAAA,iDAAwC,EAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACzD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;YACpC,GAAG,aAAa;YAChB,GAAG,SAAS;YACZ,WAAW,EAAE;gBACX,GAAG,aAAa,CAAC,WAAW;gBAC5B,GAAG,SAAS,CAAC,WAAW;gBACxB,UAAU,EAAE;oBACV,GAAG,aAAa,CAAC,WAAW,EAAE,UAAU;oBACxC,GAAG,SAAS,CAAC,WAAW,EAAE,UAAU;iBACrC;gBACD,WAAW,EAAE;oBACX,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW;oBACzC,GAAG,SAAS,CAAC,WAAW,EAAE,WAAW;iBACtC;aACF;SACF,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,gBAAgB;YACnB,OAAO,EAAE;gBACP,qBAAY,CAAC,UAAU,CAAC,mBAAU,CAAC;gBACnC,GAAG,CAAC,gBAAgB,CAAC,OAAO,IAAI,EAAE,CAAC;aACpC;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvCY,wDAAsB;iCAAtB,sBAAsB;IALlC,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,gCAAc,CAAC;QAC7B,SAAS,EAAE,CAAC,8BAAa,EAAE,yDAA0B,CAAC;QACtD,OAAO,EAAE,CAAC,8BAAa,EAAE,yDAA0B,CAAC;KACrD,CAAC;GACW,sBAAsB,CAuClC"}

package/src/presentation/route-policy.d.ts

@@ -0,0 +1 @@
+export type { RoutePolicy } from '@anarchitects/auth-ts/models';

package/src/presentation/route-policy.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=route-policy.js.map

package/src/presentation/route-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-policy.js","sourceRoot":"","sources":["../../../../../../libs/auth/nest/src/presentation/route-policy.ts"],"names":[],"mappings":""}

package/src/application/strategies/jwt/strategy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../../libs/auth/nest/src/application/strategies/jwt/strategy.ts"],"names":[],"mappings":";;;;AACA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAoD;AAG7C,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IACzD;QACE,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,eAAe;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAuC;QACpD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAZY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;;GACA,WAAW,CAYvB"}