@axinom/mosaic-id-guard 0.11.1 → 0.12.0-rc.3

package/dist/common/authenticated-subject.interface.d.ts

@@ -7,7 +7,7 @@ export interface EnvironmentInfo {
     environmentId: string;
 }
 /** Authenticated subject information extracted from the JWT token */
-interface GenericAuthenticatedSubject extends EnvironmentInfo {
+export interface GenericAuthenticatedSubject extends EnvironmentInfo {
     /**
      * Issued at (seconds since Unix epoch)
      * @example 1638974572
@@ -96,5 +96,4 @@ export interface AuthenticatedConsumer extends AuthenticatedConsumerApplication
     profileId: string;
     extensions: unknown;
 }
-export {};
 //# sourceMappingURL=authenticated-subject.interface.d.ts.map

package/dist/common/authenticated-subject.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticated-subject.interface.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-subject.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,UAAU,2BAA4B,SAAQ,eAAe;IAC3D;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,8BACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,WAAW,EAAE;QACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,gCACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBACf,SAAQ,gCAAgC;IACxC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,OAAO,CAAC;CACrB"}
+{"version":3,"file":"authenticated-subject.interface.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-subject.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,8BACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,WAAW,EAAE;QACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,gCACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBACf,SAAQ,gCAAgC;IACxC;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,OAAO,CAAC;CACrB"}

package/dist/common/authentication-request-context.interface.d.ts

@@ -25,4 +25,8 @@ export interface AuthenticatedConsumerRequest extends Request {
     /** Authenticated subject and error information */
     authContext: ConsumerAuthenticationContext;
 }
+/** An Authenticated Request that has either a `ManagementAuthenticationContext` or a `ConsumerAuthenticationContext` as the authContext */
+export interface AuthenticatedRequest extends Request {
+    authContext: ManagementAuthenticationContext | ConsumerAuthenticationContext;
+}
 //# sourceMappingURL=authentication-request-context.interface.d.ts.map

package/dist/common/authentication-request-context.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-request-context.interface.d.ts","sourceRoot":"","sources":["../../src/common/authentication-request-context.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,8BAA8B,EAC/B,MAAM,GAAG,CAAC;AACX,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,wEAAwE;AACxE,MAAM,WAAW,+BAA+B;IAC9C,mDAAmD;IACnD,OAAO,CAAC,EAAE,8BAA8B,CAAC;IAEzC,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,OAAO,CAAC,EAAE,qBAAqB,GAAG,gCAAgC,CAAC;IAEnE,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,8DAA8D;AAC9D,MAAM,WAAW,8BAA+B,SAAQ,OAAO;IAC7D,kDAAkD;IAClD,WAAW,EAAE,+BAA+B,CAAC;CAC9C;AAED,4DAA4D;AAC5D,MAAM,WAAW,4BAA6B,SAAQ,OAAO;IAC3D,kDAAkD;IAClD,WAAW,EAAE,6BAA6B,CAAC;CAC5C"}
+{"version":3,"file":"authentication-request-context.interface.d.ts","sourceRoot":"","sources":["../../src/common/authentication-request-context.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,8BAA8B,EAC/B,MAAM,GAAG,CAAC;AACX,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,wEAAwE;AACxE,MAAM,WAAW,+BAA+B;IAC9C,mDAAmD;IACnD,OAAO,CAAC,EAAE,8BAA8B,CAAC;IAEzC,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,6BAA6B;IAC5C,yCAAyC;IACzC,OAAO,CAAC,EAAE,qBAAqB,GAAG,gCAAgC,CAAC;IAEnE,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,8DAA8D;AAC9D,MAAM,WAAW,8BAA+B,SAAQ,OAAO;IAC7D,kDAAkD;IAClD,WAAW,EAAE,+BAA+B,CAAC;CAC9C;AAED,4DAA4D;AAC5D,MAAM,WAAW,4BAA6B,SAAQ,OAAO;IAC3D,kDAAkD;IAClD,WAAW,EAAE,6BAA6B,CAAC;CAC5C;AAED,2IAA2I;AAC3I,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,WAAW,EAAE,+BAA+B,GAAG,6BAA6B,CAAC;CAC9E"}

package/dist/common/guard-error.d.ts

@@ -1,5 +1,5 @@
+import { DefaultError } from '@axinom/mosaic-service-common';
 import { ErrorCode } from './error-code.enum';
-import { DefaultError } from "@axinom/mosaic-service-common";
 export declare class AxGuardErrorInfo {
     code: ErrorCode;
     message: string;
@@ -9,7 +9,12 @@ export declare class AxGuardErrorInfo {
 }
 export declare class AxGuardError extends DefaultError {
     constructor(info: AxGuardErrorInfo);
-    protected code: string;
+    code: string;
     protected details: Record<string, unknown>;
 }
+/**
+ * Asserts if a parsed error is of type AxGuardError
+ * @param error
+ */
+export declare const assertAxGuardError: (error: unknown) => asserts error is AxGuardError;
 //# sourceMappingURL=guard-error.d.ts.map

package/dist/common/guard-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-error.d.ts","sourceRoot":"","sources":["../../src/common/guard-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAC,YAAY,EAAc,MAAM,+BAA+B,CAAC;AAExE,qBAAa,gBAAgB;IAElB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,MAAM;IACf,aAAa,CAAC;IACd,OAAO,CAAC;gBAHR,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,mBAAO,EACrB,OAAO,CAAC,qCAAyB;CAE3C;AAED,qBAAa,YAAa,SAAQ,YAAY;gBAChC,IAAI,EAAE,gBAAgB;IAWlC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"guard-error.d.ts","sourceRoot":"","sources":["../../src/common/guard-error.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAGb,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,qBAAa,gBAAgB;IAElB,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,MAAM;IACf,aAAa,CAAC;IACd,OAAO,CAAC;gBAHR,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,mBAAO,EACrB,OAAO,CAAC,qCAAyB;CAE3C;AAED,qBAAa,YAAa,SAAQ,YAAY;gBAChC,IAAI,EAAE,gBAAgB;IAWlC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAC/B,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,KAAK,IAAI,YASrB,CAAC"}

package/dist/common/guard-error.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AxGuardError = exports.AxGuardErrorInfo = void 0;
+exports.assertAxGuardError = exports.AxGuardError = exports.AxGuardErrorInfo = void 0;
 const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
 class AxGuardErrorInfo {
     constructor(code, message, originalError, details) {
@@ -25,4 +25,14 @@ class AxGuardError extends mosaic_service_common_1.DefaultError {
     }
 }
 exports.AxGuardError = AxGuardError;
+/**
+ * Asserts if a parsed error is of type AxGuardError
+ * @param error
+ */
+const assertAxGuardError = (error) => {
+    if (!(error instanceof AxGuardError)) {
+        throw new mosaic_service_common_1.GeneralError(`A caught error is not an instance of an AxGuardError class.`, { error });
+    }
+};
+exports.assertAxGuardError = assertAxGuardError;
 //# sourceMappingURL=guard-error.js.map

package/dist/common/guard-error.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-error.js","sourceRoot":"","sources":["../../src/common/guard-error.ts"],"names":[],"mappings":";;;AACA,yEAAwE;AAExE,MAAa,gBAAgB;IAC3B,YACS,IAAe,EACf,OAAe,EACf,aAAqB,EACrB,OAAiC;QAHjC,SAAI,GAAJ,IAAI,CAAW;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,kBAAa,GAAb,aAAa,CAAQ;QACrB,YAAO,GAAP,OAAO,CAA0B;IACvC,CAAC;CACL;AAPD,4CAOC;AAED,MAAa,YAAa,SAAQ,oCAAY;IAC5C,YAAY,IAAsB;;QAChC,IAAI,IAAI,CAAC,aAAa,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;SACzC;aAAM;YACL,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SACrB;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,mBAAK,WAAW,EAAX,mCAAW,IAAK,CAAC,MAAA,IAAI,CAAC,OAAO,mCAAI,EAAE,CAAC,CAAE,CAAC;IAC1D,CAAC;CAIF;AAdD,oCAcC"}
+{"version":3,"file":"guard-error.js","sourceRoot":"","sources":["../../src/common/guard-error.ts"],"names":[],"mappings":";;;AAAA,yEAIuC;AAGvC,MAAa,gBAAgB;IAC3B,YACS,IAAe,EACf,OAAe,EACf,aAAqB,EACrB,OAAiC;QAHjC,SAAI,GAAJ,IAAI,CAAW;QACf,YAAO,GAAP,OAAO,CAAQ;QACf,kBAAa,GAAb,aAAa,CAAQ;QACrB,YAAO,GAAP,OAAO,CAA0B;IACvC,CAAC;CACL;AAPD,4CAOC;AAED,MAAa,YAAa,SAAQ,oCAAY;IAC5C,YAAY,IAAsB;;QAChC,IAAI,IAAI,CAAC,aAAa,EAAE;YACtB,KAAK,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;SACzC;aAAM;YACL,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SACrB;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,mBAAK,WAAW,EAAX,mCAAW,IAAK,CAAC,MAAA,IAAI,CAAC,OAAO,mCAAI,EAAE,CAAC,CAAE,CAAC;IAC1D,CAAC;CAIF;AAdD,oCAcC;AAED;;;GAGG;AACI,MAAM,kBAAkB,GAEM,CACnC,KAAc,EACiB,EAAE;IACjC,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE;QACpC,MAAM,IAAI,oCAAY,CACpB,6DAA6D,EAC7D,EAAE,KAAK,EAAE,CACV,CAAC;KACH;AACH,CAAC,CAAC;AAXW,QAAA,kBAAkB,sBAW7B"}

package/dist/common/guard-utils.d.ts

@@ -1,5 +1,6 @@
 import { PermissionDefinition } from '@axinom/mosaic-id-utils';
 import { AuthenticatedManagementSubject } from '.';
+import { GenericAuthenticatedSubject } from './authenticated-subject.interface';
 import { AxGuardErrorInfo } from './guard-error';
 /**
  * Options that are extracted from Postgraphile context and required by IdGuard plugin to check if operation is authorized.
@@ -28,5 +29,47 @@ export interface AxGuardOptions {
      */
     authorizationOptions: GqlAuthorizationOptions;
 }
-export declare const isUserAuthorized: (user: AuthenticatedManagementSubject | undefined, options: GqlAuthorizationOptions, errorInfo: AxGuardErrorInfo | undefined) => boolean;
+/**
+ * This function returns if an operation sent in `GqlAuthorizationOptions` is an Anonymous operation or not.
+ * @param options `GqlAuthorizationOptions` object
+ * @returns `true` if `options.operation` is an Anonymous operation. `false` otherwise.
+ */
+export declare const isAnonymousOperation: (options: GqlAuthorizationOptions) => boolean;
+/**
+ * This function asserts if the subject authentication is valid. It checks if there're any errors in the
+ * `errorInfo` found in the `AuthenticationContext`, if the Authenticated Subject is defined and if the token has not expired.
+ * If any of these conditions fail, it throws an error.
+ *
+ * @param user GenericAuthenticatedSubject
+ * @param options GqlAuthorizationOptions
+ * @param errorInfo AxGuardErrorInfo
+ */
+export declare const assertSubjectAuthenticated: (user: GenericAuthenticatedSubject | undefined, options: GqlAuthorizationOptions, errorInfo: AxGuardErrorInfo | undefined) => void;
+/**
+ * This function asserts if a passed `AuthenticatedManagementSubject` has necessary permission to execute a given operation.
+ * If any checks fail, it raises an `AxGuardError` with the code `UserNotAuthorized`.
+ *
+ * @param subject `AuthenticatedManagementSubject`
+ * @param options `GqlAuthorizationOptions`
+ */
+export declare const assertSubjectAuthorized: (subject: AuthenticatedManagementSubject, options: GqlAuthorizationOptions) => void;
+/**
+ * This function asserts if a passed JWT has not expired.
+ * If it has, it throws an `AxGuardError` with code `AccessTokenExpired`.
+ * @param accessToken
+ * @param serviceId
+ */
+export declare const assertTokenNotExpired: (accessToken: GenericAuthenticatedSubject, serviceId: string) => void;
+/**
+ * Returns if a passed Authenticated Subject is a Management Subject
+ * @param subject GenericAuthenticatedSubject
+ * @returns
+ */
+export declare const isAuthenticatedManagementSubject: (subject: GenericAuthenticatedSubject | undefined) => boolean;
+/**
+ * Returns if a passed Authenticated Subject is a Consumer
+ * @param subject GenericAuthenticatedSubject
+ * @returns
+ */
+export declare const isAuthenticatedConsumer: (subject: GenericAuthenticatedSubject | undefined) => boolean;
 //# sourceMappingURL=guard-utils.d.ts.map

package/dist/common/guard-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-utils.d.ts","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,GAAG,CAAC;AAEnD,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;OAEG;IACH,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED,eAAO,MAAM,gBAAgB,SACrB,8BAA8B,GAAG,SAAS,WACvC,uBAAuB,aACrB,gBAAgB,GAAG,SAAS,KACtC,OAmDF,CAAC"}
+{"version":3,"file":"guard-utils.d.ts","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,8BAA8B,EAAe,MAAM,GAAG,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAEhF,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;OAEG;IACH,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,YACtB,uBAAuB,KAC/B,OAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,SAC/B,2BAA2B,GAAG,SAAS,WACpC,uBAAuB,aACrB,gBAAgB,GAAG,SAAS,KACtC,IAiBF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,YACzB,8BAA8B,WAC9B,uBAAuB,KAC/B,IAoCF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBACnB,2BAA2B,aAC7B,MAAM,KAChB,IAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,YAClC,2BAA2B,GAAG,SAAS,KAC/C,OAsBF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,YACzB,2BAA2B,GAAG,SAAS,KAC/C,OAsBF,CAAC"}

package/dist/common/guard-utils.js

@@ -1,16 +1,35 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isUserAuthorized = void 0;
+exports.isAuthenticatedConsumer = exports.isAuthenticatedManagementSubject = exports.assertTokenNotExpired = exports.assertSubjectAuthorized = exports.assertSubjectAuthenticated = exports.isAnonymousOperation = void 0;
 const mosaic_id_utils_1 = require("@axinom/mosaic-id-utils");
+const _1 = require(".");
 const error_code_enum_1 = require("./error-code.enum");
 const guard_error_1 = require("./guard-error");
-const isUserAuthorized = (user, options, errorInfo) => {
+/**
+ * This function returns if an operation sent in `GqlAuthorizationOptions` is an Anonymous operation or not.
+ * @param options `GqlAuthorizationOptions` object
+ * @returns `true` if `options.operation` is an Anonymous operation. `false` otherwise.
+ */
+const isAnonymousOperation = (options) => {
     var _a, _b;
-    const { serviceId, permissionDefinition, operation } = options;
+    const { permissionDefinition, operation } = options;
     const isAnonymousOperation = (_b = (_a = permissionDefinition.gqlOptions) === null || _a === void 0 ? void 0 : _a.anonymousGqlOperations) === null || _b === void 0 ? void 0 : _b.includes(operation);
     if (isAnonymousOperation) {
         return true;
     }
+    return false;
+};
+exports.isAnonymousOperation = isAnonymousOperation;
+/**
+ * This function asserts if the subject authentication is valid. It checks if there're any errors in the
+ * `errorInfo` found in the `AuthenticationContext`, if the Authenticated Subject is defined and if the token has not expired.
+ * If any of these conditions fail, it throws an error.
+ *
+ * @param user GenericAuthenticatedSubject
+ * @param options GqlAuthorizationOptions
+ * @param errorInfo AxGuardErrorInfo
+ */
+const assertSubjectAuthenticated = (user, options, errorInfo) => {
     // Error occurred and handled while extracting user information from JWT token
     if (errorInfo !== undefined) {
         throw new guard_error_1.AxGuardError(errorInfo);
@@ -25,22 +44,120 @@ const isUserAuthorized = (user, options, errorInfo) => {
             },
         });
     }
-    // Check user token validity.
-    if (user.exp < new Date().getTime() / 1000) {
+    // Check access-token validity.
+    (0, exports.assertTokenNotExpired)(user, options.serviceId);
+};
+exports.assertSubjectAuthenticated = assertSubjectAuthenticated;
+/**
+ * This function asserts if a passed `AuthenticatedManagementSubject` has necessary permission to execute a given operation.
+ * If any checks fail, it raises an `AxGuardError` with the code `UserNotAuthorized`.
+ *
+ * @param subject `AuthenticatedManagementSubject`
+ * @param options `GqlAuthorizationOptions`
+ */
+const assertSubjectAuthorized = (subject, options) => {
+    const { serviceId, permissionDefinition, operation } = options;
+    // Not authorized to use this operation
+    if (subject.permissions !== undefined && serviceId in subject.permissions) {
+        const grantedPermissions = subject.permissions[serviceId];
+        const requiredPermissions = (0, mosaic_id_utils_1.getPermissionsForOperation)(operation, permissionDefinition);
+        if (!grantedPermissions.some((permission) => requiredPermissions.includes(permission))) {
+            throw new guard_error_1.AxGuardError({
+                message: 'User is not authorized to access the operation.',
+                code: error_code_enum_1.ErrorCode.UserNotAuthorized,
+                details: {
+                    user: subject.sub,
+                    serviceId: options.serviceId,
+                },
+            });
+        }
+    }
+    else {
         throw new guard_error_1.AxGuardError({
-            message: 'User Token has expired.',
+            message: 'User is not authorized to access the operation.',
             code: error_code_enum_1.ErrorCode.UserNotAuthorized,
-            details: { serviceId: options.serviceId },
+            details: {
+                user: subject.sub,
+                serviceId: options.serviceId,
+            },
         });
     }
-    // Not authorized to use this operation
-    if (user.permissions !== undefined && serviceId in user.permissions) {
-        const grantedPermissions = user.permissions[serviceId];
-        const requiredPermissions = (0, mosaic_id_utils_1.getPermissionsForOperation)(operation, permissionDefinition);
-        return grantedPermissions.some((permission) => requiredPermissions.includes(permission));
+};
+exports.assertSubjectAuthorized = assertSubjectAuthorized;
+/**
+ * This function asserts if a passed JWT has not expired.
+ * If it has, it throws an `AxGuardError` with code `AccessTokenExpired`.
+ * @param accessToken
+ * @param serviceId
+ */
+const assertTokenNotExpired = (accessToken, serviceId) => {
+    if (accessToken.exp < new Date().getTime() / 1000) {
+        throw new guard_error_1.AxGuardError({
+            message: 'User Token has expired.',
+            code: error_code_enum_1.ErrorCode.AccessTokenExpired,
+            details: { serviceId },
+        });
+    }
+};
+exports.assertTokenNotExpired = assertTokenNotExpired;
+/**
+ * Returns if a passed Authenticated Subject is a Management Subject
+ * @param subject GenericAuthenticatedSubject
+ * @returns
+ */
+const isAuthenticatedManagementSubject = (subject) => {
+    if (subject === undefined) {
+        return false;
+    }
+    else {
+        switch (subject.subjectType) {
+            case _1.SubjectType.UserAccount:
+            case _1.SubjectType.ServiceAccount:
+            case _1.SubjectType.ManagedServiceAccount:
+            case _1.SubjectType.ImpersonatedUserAccount:
+            case _1.SubjectType.SuperUserAccount:
+            case _1.SubjectType.EnvironmentAdminAccount:
+                return true;
+            case _1.SubjectType.ConsumerAccount:
+            case _1.SubjectType.ConsumerApplication:
+                return false;
+            default: {
+                // This block would never execute in runtime, and used as a build-time exhaustive switch-case check for the `SubjectType` ENUM.
+                const exhaustiveCheck = subject.subjectType;
+                throw new Error(`Unhandled SubjectType case: ${exhaustiveCheck}`);
+            }
+        }
+    }
+};
+exports.isAuthenticatedManagementSubject = isAuthenticatedManagementSubject;
+/**
+ * Returns if a passed Authenticated Subject is a Consumer
+ * @param subject GenericAuthenticatedSubject
+ * @returns
+ */
+const isAuthenticatedConsumer = (subject) => {
+    if (subject === undefined) {
+        return false;
+    }
+    else {
+        switch (subject.subjectType) {
+            case _1.SubjectType.ConsumerAccount:
+            case _1.SubjectType.ConsumerApplication:
+                return true;
+            case _1.SubjectType.UserAccount:
+            case _1.SubjectType.ServiceAccount:
+            case _1.SubjectType.ManagedServiceAccount:
+            case _1.SubjectType.ImpersonatedUserAccount:
+            case _1.SubjectType.SuperUserAccount:
+            case _1.SubjectType.EnvironmentAdminAccount:
+                return false;
+            default: {
+                // This block would never execute in runtime, and used as a build-time exhaustive switch-case check for the `SubjectType` ENUM.
+                const exhaustiveCheck = subject.subjectType;
+                throw new Error(`Unhandled SubjectType case: ${exhaustiveCheck}`);
+            }
+        }
     }
-    // Not authorized to use this service
-    return false;
 };
-exports.isUserAuthorized = isUserAuthorized;
+exports.isAuthenticatedConsumer = isAuthenticatedConsumer;
 //# sourceMappingURL=guard-utils.js.map

package/dist/common/guard-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-utils.js","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":";;;AAAA,6DAGiC;AAEjC,uDAA8C;AAC9C,+CAA+D;AAiCxD,MAAM,gBAAgB,GAAG,CAC9B,IAAgD,EAChD,OAAgC,EAChC,SAAuC,EAC9B,EAAE;;IACX,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,oBAAoB,GACxB,MAAA,MAAA,oBAAoB,CAAC,UAAU,0CAAE,sBAAsB,0CAAE,QAAQ,CAC/D,SAAS,CACV,CAAC;IAEJ,IAAI,oBAAoB,EAAE;QACxB,OAAO,IAAI,CAAC;KACb;IAED,8EAA8E;IAC9E,IAAI,SAAS,KAAK,SAAS,EAAE;QAC3B,MAAM,IAAI,0BAAY,CAAC,SAAS,CAAC,CAAC;KACnC;SAAM,IAAI,CAAC,IAAI,EAAE;QAChB,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,oJAAoJ;gBAC1J,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B;SACF,CAAC,CAAC;KACJ;IAED,6BAA6B;IAC7B,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE;QAC1C,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SAC1C,CAAC,CAAC;KACJ;IAED,uCAAuC;IACvC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE;QACnE,MAAM,kBAAkB,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEvD,MAAM,mBAAmB,GAAG,IAAA,4CAA0B,EACpD,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5C,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzC,CAAC;KACH;IAED,qCAAqC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAvDW,QAAA,gBAAgB,oBAuD3B"}
+{"version":3,"file":"guard-utils.js","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":";;;AAAA,6DAGiC;AACjC,wBAAgE;AAEhE,uDAA8C;AAC9C,+CAA+D;AAiC/D;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,OAAgC,EACvB,EAAE;;IACX,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEpD,MAAM,oBAAoB,GACxB,MAAA,MAAA,oBAAoB,CAAC,UAAU,0CAAE,sBAAsB,0CAAE,QAAQ,CAC/D,SAAS,CACV,CAAC;IAEJ,IAAI,oBAAoB,EAAE;QACxB,OAAO,IAAI,CAAC;KACb;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAfW,QAAA,oBAAoB,wBAe/B;AAEF;;;;;;;;GAQG;AACI,MAAM,0BAA0B,GAAG,CACxC,IAA6C,EAC7C,OAAgC,EAChC,SAAuC,EACjC,EAAE;IACR,8EAA8E;IAC9E,IAAI,SAAS,KAAK,SAAS,EAAE;QAC3B,MAAM,IAAI,0BAAY,CAAC,SAAS,CAAC,CAAC;KACnC;SAAM,IAAI,CAAC,IAAI,EAAE;QAChB,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,oJAAoJ;gBAC1J,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B;SACF,CAAC,CAAC;KACJ;IAED,+BAA+B;IAC/B,IAAA,6BAAqB,EAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AACjD,CAAC,CAAC;AArBW,QAAA,0BAA0B,8BAqBrC;AAEF;;;;;;GAMG;AACI,MAAM,uBAAuB,GAAG,CACrC,OAAuC,EACvC,OAAgC,EAC1B,EAAE;IACR,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE/D,uCAAuC;IACvC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,IAAI,OAAO,CAAC,WAAW,EAAE;QACzE,MAAM,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE1D,MAAM,mBAAmB,GAAG,IAAA,4CAA0B,EACpD,SAAS,EACT,oBAAoB,CACrB,CAAC;QAEF,IACE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CACtC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CACzC,EACD;YACA,MAAM,IAAI,0BAAY,CAAC;gBACrB,OAAO,EAAE,iDAAiD;gBAC1D,IAAI,EAAE,2BAAS,CAAC,iBAAiB;gBACjC,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO,CAAC,GAAG;oBACjB,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B;aACF,CAAC,CAAC;SACJ;KACF;SAAM;QACL,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,iDAAiD;YAC1D,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B;SACF,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAvCW,QAAA,uBAAuB,2BAuClC;AAEF;;;;;GAKG;AACI,MAAM,qBAAqB,GAAG,CACnC,WAAwC,EACxC,SAAiB,EACX,EAAE;IACR,IAAI,WAAW,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE;QACjD,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,2BAAS,CAAC,kBAAkB;YAClC,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC;AAEF;;;;GAIG;AACI,MAAM,gCAAgC,GAAG,CAC9C,OAAgD,EACvC,EAAE;IACX,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,OAAO,KAAK,CAAC;KACd;SAAM;QACL,QAAQ,OAAO,CAAC,WAAW,EAAE;YAC3B,KAAK,cAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,qBAAqB,CAAC;YACvC,KAAK,cAAW,CAAC,uBAAuB,CAAC;YACzC,KAAK,cAAW,CAAC,gBAAgB,CAAC;YAClC,KAAK,cAAW,CAAC,uBAAuB;gBACtC,OAAO,IAAI,CAAC;YACd,KAAK,cAAW,CAAC,eAAe,CAAC;YACjC,KAAK,cAAW,CAAC,mBAAmB;gBAClC,OAAO,KAAK,CAAC;YACf,OAAO,CAAC,CAAC;gBACP,+HAA+H;gBAC/H,MAAM,eAAe,GAAU,OAAO,CAAC,WAAW,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,eAAe,EAAE,CAAC,CAAC;aACnE;SACF;KACF;AACH,CAAC,CAAC;AAxBW,QAAA,gCAAgC,oCAwB3C;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,CACrC,OAAgD,EACvC,EAAE;IACX,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,OAAO,KAAK,CAAC;KACd;SAAM;QACL,QAAQ,OAAO,CAAC,WAAW,EAAE;YAC3B,KAAK,cAAW,CAAC,eAAe,CAAC;YACjC,KAAK,cAAW,CAAC,mBAAmB;gBAClC,OAAO,IAAI,CAAC;YACd,KAAK,cAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,qBAAqB,CAAC;YACvC,KAAK,cAAW,CAAC,uBAAuB,CAAC;YACzC,KAAK,cAAW,CAAC,gBAAgB,CAAC;YAClC,KAAK,cAAW,CAAC,uBAAuB;gBACtC,OAAO,KAAK,CAAC;YACf,OAAO,CAAC,CAAC;gBACP,+HAA+H;gBAC/H,MAAM,eAAe,GAAU,OAAO,CAAC,WAAW,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,eAAe,EAAE,CAAC,CAAC;aACnE;SACF;KACF;AACH,CAAC,CAAC;AAxBW,QAAA,uBAAuB,2BAwBlC"}

package/dist/common/index.d.ts

@@ -1,11 +1,11 @@
-export * from './assert-consumer-token-type';
-export * from './authenticated-subject.interface';
+export { AuthenticatedConsumer, AuthenticatedConsumerApplication, AuthenticatedManagementSubject, EnvironmentInfo, } from './authenticated-subject.interface';
 export * from './authentication-config.interface';
-export * from './authentication-request-context.interface';
+export { AuthenticatedConsumerRequest, AuthenticatedManagementRequest, ConsumerAuthenticationContext, ManagementAuthenticationContext, } from './authentication-request-context.interface';
 export * from './error-code.enum';
 export * from './get-authenticated-subject';
 export * from './guard-error';
 export * from './jwt-verify-options';
 export * from './parse-jwt-token';
 export * from './subject-type.enum';
+export * from './type-assertions';
 //# sourceMappingURL=index.d.ts.map

package/dist/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,mCAAmC,CAAC;AAClD,cAAc,mCAAmC,CAAC;AAClD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,8BAA8B,EAC9B,eAAe,GAChB,MAAM,mCAAmC,CAAC;AAC3C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}

package/dist/common/index.js

@@ -10,14 +10,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./assert-consumer-token-type"), exports);
-__exportStar(require("./authenticated-subject.interface"), exports);
 __exportStar(require("./authentication-config.interface"), exports);
-__exportStar(require("./authentication-request-context.interface"), exports);
 __exportStar(require("./error-code.enum"), exports);
 __exportStar(require("./get-authenticated-subject"), exports);
 __exportStar(require("./guard-error"), exports);
 __exportStar(require("./jwt-verify-options"), exports);
 __exportStar(require("./parse-jwt-token"), exports);
 __exportStar(require("./subject-type.enum"), exports);
+__exportStar(require("./type-assertions"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,+DAA6C;AAC7C,oEAAkD;AAClD,oEAAkD;AAClD,6EAA2D;AAC3D,oDAAkC;AAClC,8DAA4C;AAC5C,gDAA8B;AAC9B,uDAAqC;AACrC,oDAAkC;AAClC,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;AAMA,oEAAkD;AAOlD,oDAAkC;AAClC,8DAA4C;AAC5C,gDAA8B;AAC9B,uDAAqC;AACrC,oDAAkC;AAClC,sDAAoC;AACpC,oDAAkC"}

package/dist/common/type-assertions.d.ts

@@ -0,0 +1,46 @@
+import { ConsumerAuthenticationContext, ManagementAuthenticationContext } from '.';
+import { AuthenticatedConsumer, AuthenticatedConsumerApplication, AuthenticatedManagementSubject, GenericAuthenticatedSubject } from './authenticated-subject.interface';
+import { AuthenticatedRequest } from './authentication-request-context.interface';
+/**
+ * Asserts if the passed subject object is of type AuthenticatedConsumer.
+ *
+ * @param subject subject object of type unknown
+ */
+export declare const assertAuthenticatedConsumer: (subject: unknown) => asserts subject is AuthenticatedConsumer;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedConsumerApplication.
+ *
+ * @param subject subject object of type unknown
+ */
+export declare const assertConsumerApplication: (subject: unknown) => asserts subject is AuthenticatedConsumerApplication;
+/**
+ * Asserts if the passed subject object is of type GenericAuthenticatedSubject.
+ *
+ * @param subject subject object of type unknown
+ */
+export declare const assertGenericAuthenticatedSubject: (subject: unknown) => asserts subject is GenericAuthenticatedSubject;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedManagementSubject.
+ *
+ * @param subject subject object of type unknown
+ */
+export declare const assertAuthenticatedManagementSubject: (subject: unknown) => asserts subject is AuthenticatedManagementSubject;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedRequest.
+ *
+ * @param subject subject object of type unknown
+ */
+export declare const assertAuthenticatedRequest: (request: unknown) => asserts request is AuthenticatedRequest;
+/**
+ * Asserts if the passed context object is of type ManagementAuthenticationContext.
+ *
+ * @param subject context object of type unknown
+ */
+export declare const assertManagementAuthenticationContext: (context: unknown) => asserts context is ManagementAuthenticationContext;
+/**
+ * Asserts if the passed context object is of type ConsumerAuthenticationContext.
+ *
+ * @param subject context object of type unknown
+ */
+export declare const assertConsumerAuthenticationContext: (context: unknown) => asserts context is ConsumerAuthenticationContext;
+//# sourceMappingURL=type-assertions.d.ts.map

package/dist/common/type-assertions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-assertions.d.ts","sourceRoot":"","sources":["../../src/common/type-assertions.ts"],"names":[],"mappings":"AACA,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,EAEhC,MAAM,GAAG,CAAC;AACX,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC5B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAMlF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,CACxC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,qBASvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,CACtC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,gCASvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,CAC9C,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,2BAMvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,EAAE,CACjD,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,8BAUvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,CACvC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,oBAMvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,EAAE,CAClD,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,+BAevB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,EAAE,CAChD,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,6BAavB,CAAC"}

package/dist/common/type-assertions.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertConsumerAuthenticationContext = exports.assertManagementAuthenticationContext = exports.assertAuthenticatedRequest = exports.assertAuthenticatedManagementSubject = exports.assertGenericAuthenticatedSubject = exports.assertConsumerApplication = exports.assertAuthenticatedConsumer = void 0;
+const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
+const _1 = require(".");
+const guard_utils_1 = require("./guard-utils");
+/**
+ * Asserts if the passed subject object is of type AuthenticatedConsumer.
+ *
+ * @param subject subject object of type unknown
+ */
+const assertAuthenticatedConsumer = (subject) => {
+    if (subject.subjectType !==
+        _1.SubjectType.ConsumerAccount) {
+        throw new mosaic_service_common_1.GeneralError(`The token is not an Authenticated Consumer`);
+    }
+};
+exports.assertAuthenticatedConsumer = assertAuthenticatedConsumer;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedConsumerApplication.
+ *
+ * @param subject subject object of type unknown
+ */
+const assertConsumerApplication = (subject) => {
+    if (subject.subjectType !==
+        _1.SubjectType.ConsumerApplication) {
+        throw new mosaic_service_common_1.GeneralError(`The token is not an Consumer Application`);
+    }
+};
+exports.assertConsumerApplication = assertConsumerApplication;
+/**
+ * Asserts if the passed subject object is of type GenericAuthenticatedSubject.
+ *
+ * @param subject subject object of type unknown
+ */
+const assertGenericAuthenticatedSubject = (subject) => {
+    if (subject.subjectType === undefined) {
+        throw new mosaic_service_common_1.GeneralError(`The object is not a GenericAuthenticatedSubject`);
+    }
+};
+exports.assertGenericAuthenticatedSubject = assertGenericAuthenticatedSubject;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedManagementSubject.
+ *
+ * @param subject subject object of type unknown
+ */
+const assertAuthenticatedManagementSubject = (subject) => {
+    if (!(0, guard_utils_1.isAuthenticatedManagementSubject)(subject)) {
+        throw new mosaic_service_common_1.GeneralError(`The object is not a AuthenticatedManagementSubject`);
+    }
+};
+exports.assertAuthenticatedManagementSubject = assertAuthenticatedManagementSubject;
+/**
+ * Asserts if the passed subject object is of type AuthenticatedRequest.
+ *
+ * @param subject subject object of type unknown
+ */
+const assertAuthenticatedRequest = (request) => {
+    if (request.authContext === undefined) {
+        throw new mosaic_service_common_1.GeneralError(`The object is not a AuthenticatedRequest`);
+    }
+};
+exports.assertAuthenticatedRequest = assertAuthenticatedRequest;
+/**
+ * Asserts if the passed context object is of type ManagementAuthenticationContext.
+ *
+ * @param subject context object of type unknown
+ */
+const assertManagementAuthenticationContext = (context) => {
+    const managementAuthContext = context;
+    if ((managementAuthContext.subject === undefined &&
+        managementAuthContext.authErrorInfo === undefined) ||
+        // the call to isAuthenticatedManagementSubject should only happen if a subject is available in the ManagementAuthenticationContext
+        (managementAuthContext.subject !== undefined &&
+            !(0, guard_utils_1.isAuthenticatedManagementSubject)(managementAuthContext.subject))) {
+        throw new mosaic_service_common_1.GeneralError(`The object is not a ManagementAuthenticationContext`);
+    }
+};
+exports.assertManagementAuthenticationContext = assertManagementAuthenticationContext;
+/**
+ * Asserts if the passed context object is of type ConsumerAuthenticationContext.
+ *
+ * @param subject context object of type unknown
+ */
+const assertConsumerAuthenticationContext = (context) => {
+    const consumerAuthContext = context;
+    if ((consumerAuthContext.subject === undefined &&
+        consumerAuthContext.authErrorInfo === undefined) ||
+        // the call to isAuthenticatedConsumer should only happen if a subject is available in the ConsumerAuthenticationContext
+        (consumerAuthContext.subject !== undefined &&
+            !(0, guard_utils_1.isAuthenticatedConsumer)(consumerAuthContext.subject))) {
+        throw new mosaic_service_common_1.GeneralError(`The object is not a ConsumerAuthenticationContext`);
+    }
+};
+exports.assertConsumerAuthenticationContext = assertConsumerAuthenticationContext;
+//# sourceMappingURL=type-assertions.js.map

package/dist/common/type-assertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-assertions.js","sourceRoot":"","sources":["../../src/common/type-assertions.ts"],"names":[],"mappings":";;;AAAA,yEAA6D;AAC7D,wBAIW;AAQX,+CAGuB;AAEvB;;;;GAIG;AACI,MAAM,2BAA2B,GAEQ,CAC9C,OAAgB,EAC0B,EAAE;IAC5C,IACG,OAAiC,CAAC,WAAW;QAC9C,cAAW,CAAC,eAAe,EAC3B;QACA,MAAM,IAAI,oCAAY,CAAC,4CAA4C,CAAC,CAAC;KACtE;AACH,CAAC,CAAC;AAXW,QAAA,2BAA2B,+BAWtC;AAEF;;;;GAIG;AACI,MAAM,yBAAyB,GAEqB,CACzD,OAAgB,EACqC,EAAE;IACvD,IACG,OAA4C,CAAC,WAAW;QACzD,cAAW,CAAC,mBAAmB,EAC/B;QACA,MAAM,IAAI,oCAAY,CAAC,0CAA0C,CAAC,CAAC;KACpE;AACH,CAAC,CAAC;AAXW,QAAA,yBAAyB,6BAWpC;AAEF;;;;GAIG;AACI,MAAM,iCAAiC,GAEQ,CACpD,OAAgB,EACgC,EAAE;IAClD,IAAK,OAAuC,CAAC,WAAW,KAAK,SAAS,EAAE;QACtE,MAAM,IAAI,oCAAY,CAAC,iDAAiD,CAAC,CAAC;KAC3E;AACH,CAAC,CAAC;AARW,QAAA,iCAAiC,qCAQ5C;AAEF;;;;GAIG;AACI,MAAM,oCAAoC,GAEQ,CACvD,OAAgB,EACmC,EAAE;IACrD,IACE,CAAC,IAAA,8CAAgC,EAAC,OAAsC,CAAC,EACzE;QACA,MAAM,IAAI,oCAAY,CACpB,oDAAoD,CACrD,CAAC;KACH;AACH,CAAC,CAAC;AAZW,QAAA,oCAAoC,wCAY/C;AAEF;;;;GAIG;AACI,MAAM,0BAA0B,GAEQ,CAC7C,OAAgB,EACyB,EAAE;IAC3C,IAAK,OAAgC,CAAC,WAAW,KAAK,SAAS,EAAE;QAC/D,MAAM,IAAI,oCAAY,CAAC,0CAA0C,CAAC,CAAC;KACpE;AACH,CAAC,CAAC;AARW,QAAA,0BAA0B,8BAQrC;AAEF;;;;GAIG;AACI,MAAM,qCAAqC,GAEQ,CACxD,OAAgB,EACoC,EAAE;IACtD,MAAM,qBAAqB,GAAG,OAA0C,CAAC;IACzE,IACE,CAAC,qBAAqB,CAAC,OAAO,KAAK,SAAS;QAC1C,qBAAqB,CAAC,aAAa,KAAK,SAAS,CAAC;QACpD,mIAAmI;QACnI,CAAC,qBAAqB,CAAC,OAAO,KAAK,SAAS;YAC1C,CAAC,IAAA,8CAAgC,EAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EACnE;QACA,MAAM,IAAI,oCAAY,CACpB,qDAAqD,CACtD,CAAC;KACH;AACH,CAAC,CAAC;AAjBW,QAAA,qCAAqC,yCAiBhD;AAEF;;;;GAIG;AACI,MAAM,mCAAmC,GAEQ,CACtD,OAAgB,EACkC,EAAE;IACpD,MAAM,mBAAmB,GAAG,OAAwC,CAAC;IACrE,IACE,CAAC,mBAAmB,CAAC,OAAO,KAAK,SAAS;QACxC,mBAAmB,CAAC,aAAa,KAAK,SAAS,CAAC;QAClD,wHAAwH;QACxH,CAAC,mBAAmB,CAAC,OAAO,KAAK,SAAS;YACxC,CAAC,IAAA,qCAAuB,EAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,EACxD;QACA,MAAM,IAAI,oCAAY,CAAC,mDAAmD,CAAC,CAAC;KAC7E;AACH,CAAC,CAAC;AAfW,QAAA,mCAAmC,uCAe9C"}

package/dist/graphql/guard.context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.context.d.ts","sourceRoot":"","sources":["../../src/graphql/guard.context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAGL,oBAAoB,EACpB,6BAA6B,EAC7B,+BAA+B,EAEhC,MAAM,WAAW,CAAC;AAEnB;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,QACxC,OAAO,6DAEX,QAAQ,+BAA+B,CA2BzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,QACtC,OAAO,6DAEX,QAAQ,6BAA6B,CA2BvC,CAAC"}
+{"version":3,"file":"guard.context.d.ts","sourceRoot":"","sources":["../../src/graphql/guard.context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAKL,oBAAoB,EACpB,6BAA6B,EAC7B,+BAA+B,EAEhC,MAAM,WAAW,CAAC;AAEnB;;;;;;;;GAQG;AACH,eAAO,MAAM,kCAAkC,QACxC,OAAO,6DAEX,QAAQ,+BAA+B,CA0BzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,QACtC,OAAO,6DAEX,QAAQ,6BAA6B,CAwBvC,CAAC"}

package/dist/graphql/guard.context.js

@@ -14,8 +14,9 @@ const common_1 = require("../common");
 const getManagementAuthenticationContext = async (req, authParams) => {
     var _a;
     let context = req.authContext;
+    // Subscription requests avoid regular express http middleware pipeline.
+    // `context` can be undefined when using websocket protocol for subscriptions.
     if (context === undefined && authParams !== undefined) {
-        //Subscription requests avoid regular express http middleware pipeline
         const token = ((_a = req.headers['authorization']) !== null && _a !== void 0 ? _a : '').replace('Bearer ', '');
         if (typeof authParams === 'string') {
             const authConfig = {
@@ -23,10 +24,16 @@ const getManagementAuthenticationContext = async (req, authParams) => {
                 tenantId: '',
                 environmentId: '',
             };
-            context = (await (0, common_1.parseJwtToken)(token, authConfig, 'MANAGEMENT'));
+            // TODO: refactor parseJwtToken to be Generic
+            const tempContext = await (0, common_1.parseJwtToken)(token, authConfig, 'MANAGEMENT');
+            (0, common_1.assertManagementAuthenticationContext)(tempContext);
+            context = tempContext;
+            // handle http requests
         }
         else {
-            context = (await (0, common_1.parseJwtToken)(token, authParams, 'MANAGEMENT'));
+            const tempContext = await (0, common_1.parseJwtToken)(token, authParams, 'MANAGEMENT');
+            (0, common_1.assertManagementAuthenticationContext)(tempContext);
+            context = tempContext;
         }
     }
     return context !== null && context !== void 0 ? context : {};
@@ -44,8 +51,9 @@ exports.getManagementAuthenticationContext = getManagementAuthenticationContext;
 const getConsumerAuthenticationContext = async (req, authParams) => {
     var _a;
     let context = req.authContext;
+    // Subscription requests avoid regular express http middleware pipeline.
+    // `context` can be undefined when using websocket protocol for subscriptions.
     if (context === undefined && authParams !== undefined) {
-        //Subscription requests avoid regular express http middleware pipeline
         const token = ((_a = req.headers['authorization']) !== null && _a !== void 0 ? _a : '').replace('Bearer ', '');
         if (typeof authParams === 'string') {
             const authConfig = {
@@ -53,10 +61,14 @@ const getConsumerAuthenticationContext = async (req, authParams) => {
                 tenantId: '',
                 environmentId: '',
             };
-            context = (await (0, common_1.parseJwtToken)(token, authConfig, 'CONSUMER'));
+            const tempContext = await (0, common_1.parseJwtToken)(token, authConfig, 'CONSUMER');
+            (0, common_1.assertConsumerAuthenticationContext)(tempContext);
+            context = tempContext;
         }
         else {
-            context = (await (0, common_1.parseJwtToken)(token, authParams, 'CONSUMER'));
+            const tempContext = await (0, common_1.parseJwtToken)(token, authParams, 'CONSUMER');
+            (0, common_1.assertConsumerAuthenticationContext)(tempContext);
+            context = tempContext;
         }
     }
     return context !== null && context !== void 0 ? context : {};

package/dist/graphql/guard.context.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.context.js","sourceRoot":"","sources":["../../src/graphql/guard.context.ts"],"names":[],"mappings":";;;AACA,sCAOmB;AAEnB;;;;;;;;GAQG;AACI,MAAM,kCAAkC,GAAG,KAAK,EACrD,GAAY,EACZ,UAA0C,EACA,EAAE;;IAC5C,IAAI,OAAO,GAAI,GAAsC,CAAC,WAAW,CAAC;IAElE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE;QACrD,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,MAAA,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,MAAM,UAAU,GAAyB;gBACvC,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,EAAE;aAClB,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,IAAA,sBAAa,EAC5B,KAAK,EACL,UAAU,EACV,YAAY,CACb,CAAoC,CAAC;SACvC;aAAM;YACL,OAAO,GAAG,CAAC,MAAM,IAAA,sBAAa,EAC5B,KAAK,EACL,UAAU,EACV,YAAY,CACb,CAAoC,CAAC;SACvC;KACF;IAED,OAAO,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AA9BW,QAAA,kCAAkC,sCA8B7C;AAEF;;;;;;;;GAQG;AACI,MAAM,gCAAgC,GAAG,KAAK,EACnD,GAAY,EACZ,UAA0C,EACF,EAAE;;IAC1C,IAAI,OAAO,GAAI,GAAoC,CAAC,WAAW,CAAC;IAEhE,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE;QACrD,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,MAAA,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,MAAM,UAAU,GAAyB;gBACvC,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,EAAE;aAClB,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,IAAA,sBAAa,EAC5B,KAAK,EACL,UAAU,EACV,UAAU,CACX,CAAkC,CAAC;SACrC;aAAM;YACL,OAAO,GAAG,CAAC,MAAM,IAAA,sBAAa,EAC5B,KAAK,EACL,UAAU,EACV,UAAU,CACX,CAAkC,CAAC;SACrC;KACF;IAED,OAAO,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AA9BW,QAAA,gCAAgC,oCA8B3C"}
+{"version":3,"file":"guard.context.js","sourceRoot":"","sources":["../../src/graphql/guard.context.ts"],"names":[],"mappings":";;;AACA,sCASmB;AAEnB;;;;;;;;GAQG;AACI,MAAM,kCAAkC,GAAG,KAAK,EACrD,GAAY,EACZ,UAA0C,EACA,EAAE;;IAC5C,IAAI,OAAO,GAAI,GAAsC,CAAC,WAAW,CAAC;IAElE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE;QACrD,MAAM,KAAK,GAAG,CAAC,MAAA,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,MAAM,UAAU,GAAyB;gBACvC,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,EAAE;aAClB,CAAC;YACF,6CAA6C;YAC7C,MAAM,WAAW,GAAG,MAAM,IAAA,sBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACzE,IAAA,8CAAqC,EAAC,WAAW,CAAC,CAAC;YACnD,OAAO,GAAG,WAAW,CAAC;YACtB,uBAAuB;SACxB;aAAM;YACL,MAAM,WAAW,GAAG,MAAM,IAAA,sBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACzE,IAAA,8CAAqC,EAAC,WAAW,CAAC,CAAC;YACnD,OAAO,GAAG,WAAW,CAAC;SACvB;KACF;IAED,OAAO,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AA7BW,QAAA,kCAAkC,sCA6B7C;AAEF;;;;;;;;GAQG;AACI,MAAM,gCAAgC,GAAG,KAAK,EACnD,GAAY,EACZ,UAA0C,EACF,EAAE;;IAC1C,IAAI,OAAO,GAAI,GAAoC,CAAC,WAAW,CAAC;IAEhE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE;QACrD,MAAM,KAAK,GAAG,CAAC,MAAA,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,MAAM,UAAU,GAAyB;gBACvC,YAAY,EAAE,UAAU;gBACxB,QAAQ,EAAE,EAAE;gBACZ,aAAa,EAAE,EAAE;aAClB,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAA,sBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACvE,IAAA,4CAAmC,EAAC,WAAW,CAAC,CAAC;YACjD,OAAO,GAAG,WAAW,CAAC;SACvB;aAAM;YACL,MAAM,WAAW,GAAG,MAAM,IAAA,sBAAa,EAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACvE,IAAA,4CAAmC,EAAC,WAAW,CAAC,CAAC;YACjD,OAAO,GAAG,WAAW,CAAC;SACvB;KACF;IAED,OAAO,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AA3BW,QAAA,gCAAgC,oCA2B3C"}

package/dist/graphql/guard.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.plugin.d.ts","sourceRoot":"","sources":["../../src/graphql/guard.plugin.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,iCAmEzB,CAAC"}
+{"version":3,"file":"guard.plugin.d.ts","sourceRoot":"","sources":["../../src/graphql/guard.plugin.ts"],"names":[],"mappings":"AAaA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,iCAmEzB,CAAC"}

package/dist/graphql/guard.plugin.js

@@ -35,18 +35,18 @@ exports.AxGuardPlugin = (0, graphile_utils_1.makeWrapResolversPlugin)(({ scope }
     const { authErrorInfo, subject } = context; // The context could be either a Management or an Consumer context.
     if (!options.ensureOnlyAuthentication) {
         // If the ensureOnlyAuthentication flag is set, it is assumed that the subject is a AuthenticatedManagementSubject
-        if ((0, guard_utils_1.isUserAuthorized)(subject, options.authorizationOptions, authErrorInfo)) {
+        // If the requested operation is an Anonymous operation, return the resolver without further validation.
+        if ((0, guard_utils_1.isAnonymousOperation)(options.authorizationOptions)) {
             return resolver(source, args, context, resolveInfo);
         }
         else {
-            throw new common_1.AxGuardError({
-                message: 'User is not authorized to access the endpoint.',
-                code: common_1.ErrorCode.UserNotAuthorized,
-                details: {
-                    user: subject === null || subject === void 0 ? void 0 : subject.sub,
-                    serviceId: options.authorizationOptions.serviceId,
-                },
-            });
+            // Check if the authentication is valid
+            (0, guard_utils_1.assertSubjectAuthenticated)(subject, options.authorizationOptions, authErrorInfo);
+            // Check if the subject type is a Management Subject
+            (0, common_1.assertAuthenticatedManagementSubject)(subject);
+            // Check if the user is authorized to execute the GQL operation.
+            (0, guard_utils_1.assertSubjectAuthorized)(subject, options.authorizationOptions);
+            return resolver(source, args, context, resolveInfo);
         }
     }
     else {
@@ -56,12 +56,8 @@ exports.AxGuardPlugin = (0, graphile_utils_1.makeWrapResolversPlugin)(({ scope }
          * the token carrier will have access to all operations for the given GQL endpoint.
          * Entities in this endpoint must have RLS for user_id enabled.
          */
-        if (authErrorInfo !== undefined) {
-            throw new common_1.AxGuardError(authErrorInfo);
-        }
-        else {
-            return resolver(source, args, context, resolveInfo);
-        }
+        (0, guard_utils_1.assertSubjectAuthenticated)(subject, options.authorizationOptions, authErrorInfo);
+        return resolver(source, args, context, resolveInfo);
     }
 });
 //# sourceMappingURL=guard.plugin.js.map

package/dist/graphql/guard.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.plugin.js","sourceRoot":"","sources":["../../src/graphql/guard.plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAyD;AACzD,sCAMmB;AACnB,uDAAyE;AAEzE;;;;;;;;GAQG;AACU,QAAA,aAAa,GAAG,IAAA,wCAAuB,EAClD,CACE,EAAE,KAAK,EAAE,EACT,KAAK,EACL,MAAM,EACN,EAAE,wBAAwB,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAC7D,EAAE;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,KAAK,OAAO;QAC3B,CAAC,KAAK,CAAC,WAAW;YAChB,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,wBAAwB;YAC9B,KAAK,CAAC,yBAAyB;YAC/B,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE9B,IAAI,uBAAuB,EAAE;QAC3B,OAAO;YACL,wBAAwB,EAAE,wBAAwB,aAAxB,wBAAwB,cAAxB,wBAAwB,GAAI,KAAK;YAC3D,oBAAoB,EAAE;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS;gBACT,oBAAoB;aACrB;SACF,CAAC;KACH;IAED,OAAO,IAAI,CAAC;AACd,CAAC,EACD,CAAC,OAAuB,EAAE,EAAE,CAC1B,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;IACrD,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,OAEF,CAAC,CAAC,mEAAmE;IACtG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACrC,kHAAkH;QAClH,IACE,IAAA,8BAAgB,EACd,OAAyC,EACzC,OAAO,CAAC,oBAAoB,EAC5B,aAAa,CACd,EACD;YACA,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;SACrD;aAAM;YACL,MAAM,IAAI,qBAAY,CAAC;gBACrB,OAAO,EAAE,gDAAgD;gBACzD,IAAI,EAAE,kBAAS,CAAC,iBAAiB;gBACjC,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;oBAClB,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,SAAS;iBAClD;aACF,CAAC,CAAC;SACJ;KACF;SAAM;QACL;;;;;WAKG;QACH,IAAI,aAAa,KAAK,SAAS,EAAE;YAC/B,MAAM,IAAI,qBAAY,CAAC,aAAa,CAAC,CAAC;SACvC;aAAM;YACL,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;SACrD;KACF;AACH,CAAC,CACJ,CAAC"}
+{"version":3,"file":"guard.plugin.js","sourceRoot":"","sources":["../../src/graphql/guard.plugin.ts"],"names":[],"mappings":";;;AAAA,mDAAyD;AACzD,sCAImB;AACnB,uDAK+B;AAE/B;;;;;;;;GAQG;AACU,QAAA,aAAa,GAAG,IAAA,wCAAuB,EAClD,CACE,EAAE,KAAK,EAAE,EACT,KAAK,EACL,MAAM,EACN,EAAE,wBAAwB,EAAE,SAAS,EAAE,oBAAoB,EAAE,EAC7D,EAAE;IACF,MAAM,uBAAuB,GAC3B,KAAK,CAAC,SAAS,KAAK,OAAO;QAC3B,CAAC,KAAK,CAAC,WAAW;YAChB,KAAK,CAAC,cAAc;YACpB,KAAK,CAAC,wBAAwB;YAC9B,KAAK,CAAC,yBAAyB;YAC/B,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAE9B,IAAI,uBAAuB,EAAE;QAC3B,OAAO;YACL,wBAAwB,EAAE,wBAAwB,aAAxB,wBAAwB,cAAxB,wBAAwB,GAAI,KAAK;YAC3D,oBAAoB,EAAE;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS;gBACT,oBAAoB;aACrB;SACF,CAAC;KACH;IAED,OAAO,IAAI,CAAC;AACd,CAAC,EACD,CAAC,OAAuB,EAAE,EAAE,CAC1B,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE;IACrD,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,OAEF,CAAC,CAAC,mEAAmE;IACtG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE;QACrC,kHAAkH;QAElH,wGAAwG;QACxG,IAAI,IAAA,kCAAoB,EAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;YACtD,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;SACrD;aAAM;YACL,uCAAuC;YACvC,IAAA,wCAA0B,EACxB,OAAO,EACP,OAAO,CAAC,oBAAoB,EAC5B,aAAa,CACd,CAAC;YACF,oDAAoD;YACpD,IAAA,6CAAoC,EAAC,OAAO,CAAC,CAAC;YAC9C,gEAAgE;YAChE,IAAA,qCAAuB,EAAC,OAAO,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAC/D,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;SACrD;KACF;SAAM;QACL;;;;;WAKG;QACH,IAAA,wCAA0B,EACxB,OAAO,EACP,OAAO,CAAC,oBAAoB,EAC5B,aAAa,CACd,CAAC;QACF,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;KACrD;AACH,CAAC,CACJ,CAAC"}

package/dist/graphql/subscription-authorization-hook-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-authorization-hook-factory.d.ts","sourceRoot":"","sources":["../../src/graphql/subscription-authorization-hook-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAU5C,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AActB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,iBACjC,oBAAoB,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,KAC/D,kBAuIF,CAAC"}
+{"version":3,"file":"subscription-authorization-hook-factory.d.ts","sourceRoot":"","sources":["../../src/graphql/subscription-authorization-hook-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAU5C,OAAO,EAEL,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,cAAc,CAAC;AAqBtB;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,iBACjC,oBAAoB,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,KAC/D,kBAyLF,CAAC"}

package/dist/graphql/subscription-authorization-hook-factory.js

@@ -16,7 +16,8 @@ const guard_utils_1 = require("../common/guard-utils");
  */
 const subscriptionAuthorizationHookFactory = (buildOptions) => {
     return {
-        // handles subscription requests coming through protocol `graphql-ws`
+        // Handles subscription requests coming through protocol `graphql-ws`
+        // This is maintained for backwards compatibility. Managed services use `graphql-transport-ws` protocol (implemented below)
         'postgraphile:ws:onOperation': (params) => {
             var _a;
             // Extract GQL query and build an AST
@@ -35,8 +36,23 @@ const subscriptionAuthorizationHookFactory = (buildOptions) => {
                     serviceId: params.context.config.serviceId,
                 };
                 const error = undefined;
+                const subject = params.context.subject;
+                (0, common_1.assertGenericAuthenticatedSubject)(subject);
                 // If the authorization fails, throw error
-                if ((0, guard_utils_1.isUserAuthorized)(params.context.subject, options, error)) {
+                if ((0, guard_utils_1.isAuthenticatedManagementSubject)(subject)) {
+                    if ((0, guard_utils_1.isAnonymousOperation)(options)) {
+                        return params;
+                    }
+                    else {
+                        // Check if the authentication is valid
+                        (0, guard_utils_1.assertSubjectAuthenticated)(subject, options, error);
+                        // Check if the user is authorized to execute the GQL operation.
+                        (0, guard_utils_1.assertSubjectAuthorized)(subject, options);
+                        return params;
+                    }
+                }
+                else if ((0, guard_utils_1.isAuthenticatedConsumer)(subject)) {
+                    (0, guard_utils_1.assertTokenNotExpired)(subject, params.context.config.serviceId);
                     return params;
                 }
                 else {
@@ -52,12 +68,13 @@ const subscriptionAuthorizationHookFactory = (buildOptions) => {
             }
             throw new Error('Error in subscription setup. This is likely caused by a development time issue.');
         },
-        // handles subscription requests coming through protocol `graphql-transport-ws`
+        // Handles subscription requests coming through protocol `graphql-transport-ws`
+        // Managed services use this protocol for subscriptions.
         'postgraphile:ws:onSubscribe': (args, params) => {
             var _a;
             // If there were any Authentication Errors, close the web socket.
-            if (params.context.extra.request
-                .authContext.authErrorInfo !== undefined) {
+            if (params.context.extra.request.authContext
+                .authErrorInfo !== undefined) {
                 params.context.extra.socket.close(graphql_ws_1.CloseCode.Forbidden, common_1.ErrorCode.AccessTokenInvalid);
                 return args;
             }
@@ -75,16 +92,48 @@ const subscriptionAuthorizationHookFactory = (buildOptions) => {
                     serviceId: args.contextValue.config.serviceId,
                 };
                 const error = undefined;
+                const subject = args.contextValue.subject;
+                (0, common_1.assertGenericAuthenticatedSubject)(subject);
                 // If the authorization fails, throw error
-                if ((0, guard_utils_1.isUserAuthorized)(args.contextValue.subject, options, error)) {
-                    return args;
+                // Authorization is only checked for Management tokens
+                if ((0, guard_utils_1.isAuthenticatedManagementSubject)(subject)) {
+                    if ((0, guard_utils_1.isAnonymousOperation)(options)) {
+                        return args;
+                    }
+                    else {
+                        try {
+                            // Check if the authentication is valid
+                            (0, guard_utils_1.assertSubjectAuthenticated)(subject, options, error);
+                        }
+                        catch (error) {
+                            (0, common_1.assertAxGuardError)(error);
+                            /**
+                             * If the token has expired, we close the connection with CloseCode.Forbidden, and allow the client to automatically re-establish
+                             * the connection with a new token.
+                             */
+                            if (error.code === common_1.ErrorCode.AccessTokenExpired) {
+                                /**
+                                 * `CloseCode.Forbidden` is used so that the client will automatically start retry process with a newer token.
+                                 * Any other CloseCode will result in a client exception and the client will not automatically retry.
+                                 */
+                                params.context.extra.socket.close(graphql_ws_1.CloseCode.Forbidden, common_1.ErrorCode.AccessTokenExpired);
+                            }
+                            else {
+                                throw error;
+                            }
+                        }
+                        // Check if the user is authorized to execute the GQL operation.
+                        (0, guard_utils_1.assertSubjectAuthorized)(subject, options);
+                        return args;
+                    }
                 }
-                else {
-                    /**
-                     * `CloseCode.Forbidden` is used so that the client will automatically start retry process with a newer token.
-                     * Any other CloseCode will result in a client exception and the client will not automatically retry.
-                     */
-                    params.context.extra.socket.close(graphql_ws_1.CloseCode.Forbidden, common_1.ErrorCode.UserNotAuthorized);
+                else if ((0, guard_utils_1.isAuthenticatedConsumer)(subject)) {
+                    try {
+                        (0, guard_utils_1.assertTokenNotExpired)(subject, args.contextValue.config.serviceId);
+                    }
+                    catch (error) {
+                        params.context.extra.socket.close(graphql_ws_1.CloseCode.Forbidden, common_1.ErrorCode.AccessTokenExpired);
+                    }
                     return args;
                 }
             }

package/dist/graphql/subscription-authorization-hook-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"subscription-authorization-hook-factory.js","sourceRoot":"","sources":["../../src/graphql/subscription-authorization-hook-factory.ts"],"names":[],"mappings":";;;AAQA,6CAA8B;AAC9B,2CAAkE;AAQlE,sCAMmB;AACnB,uDAG+B;AAE/B;;;;;;;;GAQG;AACI,MAAM,oCAAoC,GAAG,CAClD,YAAgE,EAC5C,EAAE;IACtB,OAAO;QACL,qEAAqE;QACrE,6BAA6B,EAAE,CAAC,MAAuB,EAAE,EAAE;;YACzD,qCAAqC;YACrC,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,IAAA,qBAAG,EAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAwC,CAAC;YAEpD,MAAM,YAAY,GAAG,eAAe,CAClC,oBAAoB,EACpB,MAAM,CAAC,aAAa,CACrB,CAAC;YAEF,IACE,YAAY,KAAK,SAAS;gBAC1B,YAAY,CAAC,oBAAoB,KAAK,SAAS;gBAC/C,YAAY,KAAK,SAAS,EAC1B;gBACA,qDAAqD;gBACrD,MAAM,oBAAoB,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,oBAAoB,CAC5D,oBAA4C,CAAC;gBAEhD,MAAM,OAAO,GAA4B;oBACvC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK;oBAClC,oBAAoB;oBACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;iBAC3C,CAAC;gBACF,MAAM,KAAK,GAAiC,SAAS,CAAC;gBAEtD,0CAA0C;gBAC1C,IACE,IAAA,8BAAgB,EACd,MAAM,CAAC,OAAO,CAAC,OAAyC,EACxD,OAAO,EACP,KAAK,CACN,EACD;oBACA,OAAO,MAAM,CAAC;iBACf;qBAAM;oBACL,MAAM,IAAI,qBAAY,CAAC;wBACrB,OAAO,EAAE,+CAA+C;wBACxD,IAAI,EAAE,kBAAS,CAAC,iBAAiB;wBACjC,OAAO,EAAE;4BACP,IAAI,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,OAAO,0CAAE,GAAG;4BACjC,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC7B;qBACF,CAAC,CAAC;iBACJ;aACF;YACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,6BAA6B,EAAE,CAC7B,IAEC,EACD,MAIC,EACD,EAAE;;YACF,iEAAiE;YACjE,IACG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAA0C;iBAC7D,WAAW,CAAC,aAAa,KAAK,SAAS,EAC1C;gBACA,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,SAAS,EACnB,kBAAS,CAAC,kBAAkB,CAC7B,CAAC;gBACF,OAAO,IAAI,CAAC;aACb;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ;iBAClC,WAAwC,CAAC;YAE5C,MAAM,YAAY,GAAG,eAAe,CAClC,eAAe,EACf,MAAA,IAAI,CAAC,aAAa,mCAAI,SAAS,CAChC,CAAC;YACF,IACE,YAAY,KAAK,SAAS;gBAC1B,YAAY,CAAC,oBAAoB,KAAK,SAAS;gBAC/C,YAAY,KAAK,SAAS,EAC1B;gBACA,qDAAqD;gBACrD,MAAM,oBAAoB,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,oBAAoB,CAC5D,oBAA4C,CAAC;gBAEhD,MAAM,OAAO,GAA4B;oBACvC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK;oBAClC,oBAAoB;oBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS;iBAC9C,CAAC;gBACF,MAAM,KAAK,GAAiC,SAAS,CAAC;gBAEtD,0CAA0C;gBAC1C,IACE,IAAA,8BAAgB,EACd,IAAI,CAAC,YAAY,CAAC,OAAyC,EAC3D,OAAO,EACP,KAAK,CACN,EACD;oBACA,OAAO,IAAI,CAAC;iBACb;qBAAM;oBACL;;;uBAGG;oBACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,SAAS,EACnB,kBAAS,CAAC,iBAAiB,CAC5B,CAAC;oBACF,OAAO,IAAI,CAAC;iBACb;aACF;YACD;;;;eAIG;YACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,UAAU,EACpB,iFAAiF,CAClF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAzIW,QAAA,oCAAoC,wCAyI/C;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG,CACtB,oBAA+C,EAC/C,aAAiC,EACV,EAAE;IACzB,uEAAuE;IACvE,6CAA6C;IAC7C,iFAAiF;IACjF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CACxD,CAAC,MAAM,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,KAAK,MAAK,aAAa,CAAA,EAAA,CACjD,CAAC,CAAC,CAAC,CAAC;IAEL,IAAI,sBAAsB,KAAK,SAAS,EAAE;QACxC,iDAAiD;QACjD,yEAAyE;QACzE,mGAAmG;QACnG,MAAM,YAAY,GAChB,sBAAsB,CAAC,YAAY,CAAC,UACrC,CAAC,CAAC,CAAC,CAAC;QACL,OAAO,YAAY,CAAC;KACrB;AACH,CAAC,CAAC"}
+{"version":3,"file":"subscription-authorization-hook-factory.js","sourceRoot":"","sources":["../../src/graphql/subscription-authorization-hook-factory.ts"],"names":[],"mappings":";;;AAQA,6CAA8B;AAC9B,2CAAkE;AAQlE,sCAOmB;AAEnB,uDAQ+B;AAE/B;;;;;;;;GAQG;AACI,MAAM,oCAAoC,GAAG,CAClD,YAAgE,EAC5C,EAAE;IACtB,OAAO;QACL,qEAAqE;QACrE,2HAA2H;QAC3H,6BAA6B,EAAE,CAAC,MAAuB,EAAE,EAAE;;YACzD,qCAAqC;YACrC,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,IAAA,qBAAG,EAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9C,MAAM,oBAAoB,GACxB,QAAQ,CAAC,WAAwC,CAAC;YAEpD,MAAM,YAAY,GAAG,eAAe,CAClC,oBAAoB,EACpB,MAAM,CAAC,aAAa,CACrB,CAAC;YAEF,IACE,YAAY,KAAK,SAAS;gBAC1B,YAAY,CAAC,oBAAoB,KAAK,SAAS;gBAC/C,YAAY,KAAK,SAAS,EAC1B;gBACA,qDAAqD;gBACrD,MAAM,oBAAoB,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,oBAAoB,CAC5D,oBAA4C,CAAC;gBAEhD,MAAM,OAAO,GAA4B;oBACvC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK;oBAClC,oBAAoB;oBACpB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;iBAC3C,CAAC;gBACF,MAAM,KAAK,GAAiC,SAAS,CAAC;gBAEtD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;gBACvC,IAAA,0CAAiC,EAAC,OAAO,CAAC,CAAC;gBAE3C,0CAA0C;gBAC1C,IAAI,IAAA,8CAAgC,EAAC,OAAO,CAAC,EAAE;oBAC7C,IAAI,IAAA,kCAAoB,EAAC,OAAO,CAAC,EAAE;wBACjC,OAAO,MAAM,CAAC;qBACf;yBAAM;wBACL,uCAAuC;wBACvC,IAAA,wCAA0B,EACxB,OAAyC,EACzC,OAAO,EACP,KAAK,CACN,CAAC;wBACF,gEAAgE;wBAChE,IAAA,qCAAuB,EACrB,OAAyC,EACzC,OAAO,CACR,CAAC;wBACF,OAAO,MAAM,CAAC;qBACf;iBACF;qBAAM,IAAI,IAAA,qCAAuB,EAAC,OAAO,CAAC,EAAE;oBAC3C,IAAA,mCAAqB,EAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAChE,OAAO,MAAM,CAAC;iBACf;qBAAM;oBACL,MAAM,IAAI,qBAAY,CAAC;wBACrB,OAAO,EAAE,+CAA+C;wBACxD,IAAI,EAAE,kBAAS,CAAC,iBAAiB;wBACjC,OAAO,EAAE;4BACP,IAAI,EAAE,MAAA,MAAM,CAAC,OAAO,CAAC,OAAO,0CAAE,GAAG;4BACjC,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC7B;qBACF,CAAC,CAAC;iBACJ;aACF;YACD,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,wDAAwD;QACxD,6BAA6B,EAAE,CAC7B,IAEC,EACD,MAIC,EACD,EAAE;;YACF,iEAAiE;YACjE,IACG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAgC,CAAC,WAAW;iBAC/D,aAAa,KAAK,SAAS,EAC9B;gBACA,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,SAAS,EACnB,kBAAS,CAAC,kBAAkB,CAC7B,CAAC;gBACF,OAAO,IAAI,CAAC;aACb;YAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ;iBAClC,WAAwC,CAAC;YAE5C,MAAM,YAAY,GAAG,eAAe,CAClC,eAAe,EACf,MAAA,IAAI,CAAC,aAAa,mCAAI,SAAS,CAChC,CAAC;YACF,IACE,YAAY,KAAK,SAAS;gBAC1B,YAAY,CAAC,oBAAoB,KAAK,SAAS;gBAC/C,YAAY,KAAK,SAAS,EAC1B;gBACA,qDAAqD;gBACrD,MAAM,oBAAoB,GAAG,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,oBAAoB,CAC5D,oBAA4C,CAAC;gBAEhD,MAAM,OAAO,GAA4B;oBACvC,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK;oBAClC,oBAAoB;oBACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS;iBAC9C,CAAC;gBACF,MAAM,KAAK,GAAiC,SAAS,CAAC;gBAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;gBAC1C,IAAA,0CAAiC,EAAC,OAAO,CAAC,CAAC;gBAE3C,0CAA0C;gBAC1C,sDAAsD;gBACtD,IAAI,IAAA,8CAAgC,EAAC,OAAO,CAAC,EAAE;oBAC7C,IAAI,IAAA,kCAAoB,EAAC,OAAO,CAAC,EAAE;wBACjC,OAAO,IAAI,CAAC;qBACb;yBAAM;wBACL,IAAI;4BACF,uCAAuC;4BACvC,IAAA,wCAA0B,EACxB,OAAyC,EACzC,OAAO,EACP,KAAK,CACN,CAAC;yBACH;wBAAC,OAAO,KAAK,EAAE;4BACd,IAAA,2BAAkB,EAAC,KAAK,CAAC,CAAC;4BAC1B;;;+BAGG;4BACH,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAS,CAAC,kBAAkB,EAAE;gCAC/C;;;mCAGG;gCACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,SAAS,EACnB,kBAAS,CAAC,kBAAkB,CAC7B,CAAC;6BACH;iCAAM;gCACL,MAAM,KAAK,CAAC;6BACb;yBACF;wBACD,gEAAgE;wBAChE,IAAA,qCAAuB,EACrB,OAAyC,EACzC,OAAO,CACR,CAAC;wBACF,OAAO,IAAI,CAAC;qBACb;iBACF;qBAAM,IAAI,IAAA,qCAAuB,EAAC,OAAO,CAAC,EAAE;oBAC3C,IAAI;wBACF,IAAA,mCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;qBACpE;oBAAC,OAAO,KAAK,EAAE;wBACd,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,SAAS,EACnB,kBAAS,CAAC,kBAAkB,CAC7B,CAAC;qBACH;oBACD,OAAO,IAAI,CAAC;iBACb;aACF;YACD;;;;eAIG;YACH,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAC/B,sBAAS,CAAC,UAAU,EACpB,iFAAiF,CAClF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AA3LW,QAAA,oCAAoC,wCA2L/C;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG,CACtB,oBAA+C,EAC/C,aAAiC,EACV,EAAE;IACzB,uEAAuE;IACvE,6CAA6C;IAC7C,iFAAiF;IACjF,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,MAAM,CACxD,CAAC,MAAM,EAAE,EAAE,WAAC,OAAA,CAAA,MAAA,MAAM,CAAC,IAAI,0CAAE,KAAK,MAAK,aAAa,CAAA,EAAA,CACjD,CAAC,CAAC,CAAC,CAAC;IAEL,IAAI,sBAAsB,KAAK,SAAS,EAAE;QACxC,iDAAiD;QACjD,yEAAyE;QACzE,mGAAmG;QACnG,MAAM,YAAY,GAChB,sBAAsB,CAAC,YAAY,CAAC,UACrC,CAAC,CAAC,CAAC,CAAC;QACL,OAAO,YAAY,CAAC;KACrB;AACH,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axinom/mosaic-id-guard",
-  "version": "0.11.1",
+  "version": "0.12.0-rc.3",
   "description": "Authentication and authorization helpers for Axinom Mosaic services",
   "author": "Axinom",
   "license": "PROPRIETARY",
@@ -26,10 +26,10 @@
     "test:ci": "jest --reporters=default --reporters=jest-junit --coverage --coverageReporters=cobertura --coverageReporters=html"
   },
   "dependencies": {
-    "@axinom/mosaic-id-link-be": "^0.5.1",
-    "@axinom/mosaic-id-utils": "^0.6.1",
-    "@axinom/mosaic-message-bus": "^0.7.0",
-    "@axinom/mosaic-service-common": "^0.13.0",
+    "@axinom/mosaic-id-link-be": "^0.5.2-rc.3",
+    "@axinom/mosaic-id-utils": "^0.6.2-rc.3",
+    "@axinom/mosaic-message-bus": "^0.7.1-rc.3",
+    "@axinom/mosaic-service-common": "^0.13.1-rc.3",
     "amqplib": "^0.6.0",
     "express": "^4.17.1",
     "express-bearer-token": "^2.4.0",
@@ -60,5 +60,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "c2a761edbf67a6b09600f16bc94465cc0c05a9b7"
+  "gitHead": "e08ea414273c428a14d90e0809906c2bce2660ae"
 }

package/dist/common/assert-consumer-token-type.d.ts

@@ -1,14 +0,0 @@
-import { AuthenticatedConsumer, AuthenticatedConsumerApplication } from './authenticated-subject.interface';
-/**
- * Asserts if the passed subject object is of type AuthenticatedConsumer.
- *
- * @param subject subject object of type unknown
- */
-export declare const assertAuthenticatedConsumer: (subject: unknown) => asserts subject is AuthenticatedConsumer;
-/**
- * Asserts if the passed subject object is of type AuthenticatedConsumerApplication.
- *
- * @param subject subject object of type unknown
- */
-export declare const assertConsumerApplication: (subject: unknown) => asserts subject is AuthenticatedConsumerApplication;
-//# sourceMappingURL=assert-consumer-token-type.d.ts.map

package/dist/common/assert-consumer-token-type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"assert-consumer-token-type.d.ts","sourceRoot":"","sources":["../../src/common/assert-consumer-token-type.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EACjC,MAAM,mCAAmC,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,EAAE,CACxC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,qBASvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,CACtC,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,OAAO,IAAI,gCASvB,CAAC"}

package/dist/common/assert-consumer-token-type.js

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.assertConsumerApplication = exports.assertAuthenticatedConsumer = void 0;
-const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
-const _1 = require(".");
-/**
- * Asserts if the passed subject object is of type AuthenticatedConsumer.
- *
- * @param subject subject object of type unknown
- */
-const assertAuthenticatedConsumer = (subject) => {
-    if (subject.subjectType !==
-        _1.SubjectType.ConsumerAccount) {
-        throw new mosaic_service_common_1.GeneralError(`The token is not an Authenticated Consumer`);
-    }
-};
-exports.assertAuthenticatedConsumer = assertAuthenticatedConsumer;
-/**
- * Asserts if the passed subject object is of type AuthenticatedConsumerApplication.
- *
- * @param subject subject object of type unknown
- */
-const assertConsumerApplication = (subject) => {
-    if (subject.subjectType !==
-        _1.SubjectType.ConsumerApplication) {
-        throw new mosaic_service_common_1.GeneralError(`The token is not an Consumer Application`);
-    }
-};
-exports.assertConsumerApplication = assertConsumerApplication;
-//# sourceMappingURL=assert-consumer-token-type.js.map

package/dist/common/assert-consumer-token-type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assert-consumer-token-type.js","sourceRoot":"","sources":["../../src/common/assert-consumer-token-type.ts"],"names":[],"mappings":";;;AAAA,yEAA6D;AAC7D,wBAAgC;AAMhC;;;;GAIG;AACI,MAAM,2BAA2B,GAEQ,CAC9C,OAAgB,EAC0B,EAAE;IAC5C,IACG,OAAiC,CAAC,WAAW;QAC9C,cAAW,CAAC,eAAe,EAC3B;QACA,MAAM,IAAI,oCAAY,CAAC,4CAA4C,CAAC,CAAC;KACtE;AACH,CAAC,CAAC;AAXW,QAAA,2BAA2B,+BAWtC;AAEF;;;;GAIG;AACI,MAAM,yBAAyB,GAEqB,CACzD,OAAgB,EACqC,EAAE;IACvD,IACG,OAA4C,CAAC,WAAW;QACzD,cAAW,CAAC,mBAAmB,EAC/B;QACA,MAAM,IAAI,oCAAY,CAAC,0CAA0C,CAAC,CAAC;KACpE;AACH,CAAC,CAAC;AAXW,QAAA,yBAAyB,6BAWpC"}