@axinom/mosaic-id-guard 0.14.8 → 0.14.9-rc.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/common/authenticated-subject.interface.d.ts +5 -5
- package/dist/common/authenticated-subject.interface.d.ts.map +1 -1
- package/dist/common/authentication-request-context.interface.d.ts +9 -9
- package/dist/common/authentication-request-context.interface.d.ts.map +1 -1
- package/dist/common/get-authenticated-subject.d.ts +6 -6
- package/dist/common/get-authenticated-subject.d.ts.map +1 -1
- package/dist/common/get-authenticated-subject.js +28 -28
- package/dist/common/get-authenticated-subject.js.map +1 -1
- package/dist/common/guard-utils.d.ts +2 -2
- package/dist/common/guard-utils.d.ts.map +1 -1
- package/dist/common/guard-utils.js +8 -8
- package/dist/common/guard-utils.js.map +1 -1
- package/dist/common/handle-end-user-authorization.js +3 -3
- package/dist/common/handle-end-user-authorization.js.map +1 -1
- package/dist/common/helpers/parse-jwt-token-error-handler.d.ts +2 -2
- package/dist/common/helpers/parse-jwt-token-error-handler.js +5 -5
- package/dist/common/helpers/parse-jwt-token-error-handler.js.map +1 -1
- package/dist/common/index.d.ts +2 -2
- package/dist/common/index.d.ts.map +1 -1
- package/dist/common/parse-jwt-token.d.ts +6 -5
- package/dist/common/parse-jwt-token.d.ts.map +1 -1
- package/dist/common/parse-jwt-token.js +17 -14
- package/dist/common/parse-jwt-token.js.map +1 -1
- package/dist/common/subject-type.enum.d.ts +2 -2
- package/dist/common/subject-type.enum.d.ts.map +1 -1
- package/dist/common/subject-type.enum.js +2 -2
- package/dist/common/subject-type.enum.js.map +1 -1
- package/dist/common/type-assertions.d.ts +8 -9
- package/dist/common/type-assertions.d.ts.map +1 -1
- package/dist/common/type-assertions.js +22 -23
- package/dist/common/type-assertions.js.map +1 -1
- package/dist/graphql/guard.context.d.ts +4 -4
- package/dist/graphql/guard.context.d.ts.map +1 -1
- package/dist/graphql/guard.context.js +9 -9
- package/dist/graphql/guard.context.js.map +1 -1
- package/dist/graphql/guard.middleware.d.ts +8 -8
- package/dist/graphql/guard.middleware.d.ts.map +1 -1
- package/dist/graphql/guard.middleware.js +19 -19
- package/dist/graphql/guard.middleware.js.map +1 -1
- package/dist/graphql/guard.plugin.js +1 -1
- package/dist/graphql/guard.plugin.js.map +1 -1
- package/dist/graphql/index.d.ts +1 -1
- package/dist/graphql/index.d.ts.map +1 -1
- package/dist/graphql/index.js +4 -4
- package/dist/graphql/index.js.map +1 -1
- package/dist/graphql/subscription-authorization-hook-factory.js +2 -2
- package/dist/graphql/subscription-authorization-hook-factory.js.map +1 -1
- package/dist/message-bus/message-handler-authentication.d.ts +3 -3
- package/dist/message-bus/message-handler-authentication.d.ts.map +1 -1
- package/package.json +6 -6
|
@@ -69,21 +69,21 @@ export interface AuthenticatedManagementSubject extends GenericAuthenticatedSubj
|
|
|
69
69
|
[key: string]: unknown;
|
|
70
70
|
}
|
|
71
71
|
/**
|
|
72
|
-
* Represents an authenticated
|
|
72
|
+
* Represents an authenticated End-User Application created to access end-user facing APIs for a specific tenant + environment + application.
|
|
73
73
|
* This will be created using a token issued by the ax-user-service.
|
|
74
74
|
*/
|
|
75
|
-
export interface
|
|
75
|
+
export interface AuthenticatedEndUserApplication extends GenericAuthenticatedSubject {
|
|
76
76
|
/**
|
|
77
|
-
* The
|
|
77
|
+
* The end-user application for this token
|
|
78
78
|
* @example f4d491d8-49fc-4bfc-bb69-3c6abd957821
|
|
79
79
|
*/
|
|
80
80
|
applicationId: string;
|
|
81
81
|
}
|
|
82
82
|
/**
|
|
83
|
-
* Represents an Authenticated
|
|
83
|
+
* Represents an Authenticated End-User, created to be used in End-User Applications.
|
|
84
84
|
* This will be created using a token issued by the ax-user-service.
|
|
85
85
|
*/
|
|
86
|
-
export interface
|
|
86
|
+
export interface AuthenticatedEndUser extends AuthenticatedEndUserApplication {
|
|
87
87
|
/**
|
|
88
88
|
* The session identifier
|
|
89
89
|
* @example f5f2ec54-be1e-4330-9827-13b3e2338551
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authenticated-subject.interface.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-subject.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,8BACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,WAAW,EAAE;QACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,
|
|
1
|
+
{"version":3,"file":"authenticated-subject.interface.d.ts","sourceRoot":"","sources":["../../src/common/authenticated-subject.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,qFAAqF;AACrF,MAAM,WAAW,eAAe;IAC9B,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,WAAW,2BAA4B,SAAQ,eAAe;IAClE;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,8BACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,WAAW,EAAE;QACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,+BACf,SAAQ,2BAA2B;IACnC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,+BAA+B;IAC3E;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,OAAO,CAAC;CACrB"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { Request } from 'express';
|
|
2
|
-
import {
|
|
2
|
+
import { AuthenticatedEndUser, AuthenticatedEndUserApplication, AuthenticatedManagementSubject } from './authenticated-subject.interface';
|
|
3
3
|
import { AxGuardErrorInfo } from './guard-error';
|
|
4
4
|
/** Authenticated Subject and error information for Management Tokens */
|
|
5
5
|
export interface ManagementAuthenticationContext {
|
|
@@ -8,10 +8,10 @@ export interface ManagementAuthenticationContext {
|
|
|
8
8
|
/** Authentication error information */
|
|
9
9
|
authErrorInfo?: AxGuardErrorInfo;
|
|
10
10
|
}
|
|
11
|
-
/** Authenticated
|
|
12
|
-
export interface
|
|
11
|
+
/** Authenticated End-User/Application and error information for End-User Tokens */
|
|
12
|
+
export interface EndUserAuthenticationContext {
|
|
13
13
|
/** Authenticated End User information */
|
|
14
|
-
subject?:
|
|
14
|
+
subject?: AuthenticatedEndUser | AuthenticatedEndUserApplication;
|
|
15
15
|
/** Authentication error information */
|
|
16
16
|
authErrorInfo?: AxGuardErrorInfo;
|
|
17
17
|
}
|
|
@@ -20,13 +20,13 @@ export interface AuthenticatedManagementRequest extends Request {
|
|
|
20
20
|
/** Authenticated subject and error information */
|
|
21
21
|
authContext: ManagementAuthenticationContext;
|
|
22
22
|
}
|
|
23
|
-
/** Extended request with `
|
|
24
|
-
export interface
|
|
23
|
+
/** Extended request with `EndUserAuthenticationContext` */
|
|
24
|
+
export interface AuthenticatedEndUserRequest extends Request {
|
|
25
25
|
/** Authenticated subject and error information */
|
|
26
|
-
authContext:
|
|
26
|
+
authContext: EndUserAuthenticationContext;
|
|
27
27
|
}
|
|
28
|
-
/** An Authenticated Request that has either a `ManagementAuthenticationContext` or a `
|
|
28
|
+
/** An Authenticated Request that has either a `ManagementAuthenticationContext` or a `EndUserAuthenticationContext` as the authContext */
|
|
29
29
|
export interface AuthenticatedRequest extends Request {
|
|
30
|
-
authContext: ManagementAuthenticationContext |
|
|
30
|
+
authContext: ManagementAuthenticationContext | EndUserAuthenticationContext;
|
|
31
31
|
}
|
|
32
32
|
//# sourceMappingURL=authentication-request-context.interface.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authentication-request-context.interface.d.ts","sourceRoot":"","sources":["../../src/common/authentication-request-context.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,
|
|
1
|
+
{"version":3,"file":"authentication-request-context.interface.d.ts","sourceRoot":"","sources":["../../src/common/authentication-request-context.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,wEAAwE;AACxE,MAAM,WAAW,+BAA+B;IAC9C,mDAAmD;IACnD,OAAO,CAAC,EAAE,8BAA8B,CAAC;IAEzC,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,4BAA4B;IAC3C,yCAAyC;IACzC,OAAO,CAAC,EAAE,oBAAoB,GAAG,+BAA+B,CAAC;IAEjE,uCAAuC;IACvC,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,8DAA8D;AAC9D,MAAM,WAAW,8BAA+B,SAAQ,OAAO;IAC7D,kDAAkD;IAClD,WAAW,EAAE,+BAA+B,CAAC;CAC9C;AAED,2DAA2D;AAC3D,MAAM,WAAW,2BAA4B,SAAQ,OAAO;IAC1D,kDAAkD;IAClD,WAAW,EAAE,4BAA4B,CAAC;CAC3C;AAED,0IAA0I;AAC1I,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,WAAW,EAAE,+BAA+B,GAAG,4BAA4B,CAAC;CAC7E"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { AuthenticatedEndUser, AuthenticatedEndUserApplication, AuthenticatedManagementSubject } from './authenticated-subject.interface';
|
|
2
2
|
import { AuthenticationConfig } from './authentication-config.interface';
|
|
3
|
-
export declare const
|
|
3
|
+
export declare const EMBEDDED_END_USER_TOKEN_KEY = "mosaic.end-user.accessToken";
|
|
4
4
|
/**
|
|
5
5
|
* Parses a JWT token to produce an `AuthenticatedManagementSubject`.
|
|
6
6
|
* This function is intended to be used by any service which works with the Mosaic Management System.
|
|
@@ -11,12 +11,12 @@ export declare const EMBEDDED_CONSUMER_TOKEN_KEY = "mosaic.consumer.accessToken"
|
|
|
11
11
|
*/
|
|
12
12
|
export declare const getAuthenticatedManagementSubject: (token: string, authParams: string | AuthenticationConfig) => Promise<AuthenticatedManagementSubject>;
|
|
13
13
|
/**
|
|
14
|
-
* Parses a JWT token to produce an `
|
|
15
|
-
* This function is intended to be used by any service which works with
|
|
14
|
+
* Parses a JWT token to produce an `AuthenticatedEndUser` or an `AuthenticatedEndUserApplication`.
|
|
15
|
+
* This function is intended to be used by any service which works with End-User Applications.
|
|
16
16
|
*
|
|
17
17
|
* @param {string} token JWT token without `Bearer ` prefix.
|
|
18
18
|
* @param {string | AuthenticationConfig} authParams This could be either a string containing the Auth Endpoint for the User Service or an instance of `AuthenticationConfig`.
|
|
19
|
-
* @returns {Promise<
|
|
19
|
+
* @returns {Promise<AuthenticatedEndUser | AuthenticatedEndUserApplication>} AuthenticatedEndUser/AuthenticatedEndUserApplication
|
|
20
20
|
*/
|
|
21
|
-
export declare const
|
|
21
|
+
export declare const getAuthenticatedEndUser: (token: string, authParams: string | AuthenticationConfig) => Promise<AuthenticatedEndUser | AuthenticatedEndUserApplication>;
|
|
22
22
|
//# sourceMappingURL=get-authenticated-subject.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-authenticated-subject.d.ts","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,
|
|
1
|
+
{"version":3,"file":"get-authenticated-subject.d.ts","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,8BAA8B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAQzE,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,UACrC,MAAM,cACD,MAAM,GAAG,oBAAoB,KACxC,QAAQ,8BAA8B,CAsDxC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,UAC3B,MAAM,cACD,MAAM,GAAG,oBAAoB,KACxC,QAAQ,oBAAoB,GAAG,+BAA+B,CAyEhE,CAAC"}
|
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.getAuthenticatedEndUser = exports.getAuthenticatedManagementSubject = exports.EMBEDDED_END_USER_TOKEN_KEY = void 0;
|
|
4
4
|
const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
|
|
5
5
|
const jwt = require("jsonwebtoken");
|
|
6
6
|
const jwks = require("jwks-rsa");
|
|
7
|
-
const _1 = require(".");
|
|
8
7
|
const jwt_verify_options_1 = require("./jwt-verify-options");
|
|
9
|
-
|
|
8
|
+
const subject_type_enum_1 = require("./subject-type.enum");
|
|
9
|
+
exports.EMBEDDED_END_USER_TOKEN_KEY = 'mosaic.end-user.accessToken';
|
|
10
10
|
/**
|
|
11
11
|
* Parses a JWT token to produce an `AuthenticatedManagementSubject`.
|
|
12
12
|
* This function is intended to be used by any service which works with the Mosaic Management System.
|
|
@@ -26,7 +26,7 @@ const getAuthenticatedManagementSubject = async (token, authParams) => {
|
|
|
26
26
|
tenantId = decoded.tenantId;
|
|
27
27
|
environmentId = decoded.environmentId;
|
|
28
28
|
isManagedServiceAccount =
|
|
29
|
-
decoded.subjectType ===
|
|
29
|
+
decoded.subjectType === subject_type_enum_1.SubjectType.ManagedServiceAccount;
|
|
30
30
|
// If token is not issued by the ID Service, the jwks URI will not be set, and the verification will fail.
|
|
31
31
|
if (issuer === jwt_verify_options_1.TOKEN_ISSUER_ID_SERVICE) {
|
|
32
32
|
if (typeof authParams === 'string') {
|
|
@@ -58,35 +58,35 @@ const getAuthenticatedManagementSubject = async (token, authParams) => {
|
|
|
58
58
|
};
|
|
59
59
|
exports.getAuthenticatedManagementSubject = getAuthenticatedManagementSubject;
|
|
60
60
|
/**
|
|
61
|
-
* Parses a JWT token to produce an `
|
|
62
|
-
* This function is intended to be used by any service which works with
|
|
61
|
+
* Parses a JWT token to produce an `AuthenticatedEndUser` or an `AuthenticatedEndUserApplication`.
|
|
62
|
+
* This function is intended to be used by any service which works with End-User Applications.
|
|
63
63
|
*
|
|
64
64
|
* @param {string} token JWT token without `Bearer ` prefix.
|
|
65
65
|
* @param {string | AuthenticationConfig} authParams This could be either a string containing the Auth Endpoint for the User Service or an instance of `AuthenticationConfig`.
|
|
66
|
-
* @returns {Promise<
|
|
66
|
+
* @returns {Promise<AuthenticatedEndUser | AuthenticatedEndUserApplication>} AuthenticatedEndUser/AuthenticatedEndUserApplication
|
|
67
67
|
*/
|
|
68
|
-
const
|
|
68
|
+
const getAuthenticatedEndUser = async (token, authParams) => {
|
|
69
69
|
let tenantId = '';
|
|
70
70
|
let environmentId = '';
|
|
71
71
|
let jwksUri = '';
|
|
72
|
-
let
|
|
72
|
+
let endUserToken = '';
|
|
73
73
|
const decodedToken = jwt.decode(token);
|
|
74
|
-
// Handle embedded
|
|
75
|
-
if (decodedToken[exports.
|
|
76
|
-
|
|
74
|
+
// Handle embedded end-user token.
|
|
75
|
+
if (decodedToken[exports.EMBEDDED_END_USER_TOKEN_KEY] !== undefined) {
|
|
76
|
+
endUserToken = String(decodedToken[exports.EMBEDDED_END_USER_TOKEN_KEY]);
|
|
77
77
|
}
|
|
78
78
|
else {
|
|
79
|
-
|
|
79
|
+
endUserToken = token;
|
|
80
80
|
}
|
|
81
|
-
const
|
|
82
|
-
// There can be a chance the token passed through `mosaic.
|
|
83
|
-
if ((0, mosaic_service_common_1.isNullOrWhitespace)(
|
|
84
|
-
throw new mosaic_service_common_1.GeneralError('Passed JWT is not a Mosaic
|
|
81
|
+
const decodedEndUserToken = jwt.decode(endUserToken);
|
|
82
|
+
// There can be a chance the token passed through `mosaic.end-user.accessToken` is not a valid JWT. (i.e. a simple string)
|
|
83
|
+
if ((0, mosaic_service_common_1.isNullOrWhitespace)(decodedEndUserToken)) {
|
|
84
|
+
throw new mosaic_service_common_1.GeneralError('Passed JWT is not a Mosaic End-User Token. Cannot be verified.');
|
|
85
85
|
}
|
|
86
|
-
const issuer =
|
|
87
|
-
tenantId =
|
|
88
|
-
environmentId =
|
|
89
|
-
const applicationId =
|
|
86
|
+
const issuer = decodedEndUserToken.iss;
|
|
87
|
+
tenantId = decodedEndUserToken.tenantId;
|
|
88
|
+
environmentId = decodedEndUserToken.environmentId;
|
|
89
|
+
const applicationId = decodedEndUserToken.applicationId;
|
|
90
90
|
// If token is not issued by the User Service, the jwks URI will not be set, and the verification will fail.
|
|
91
91
|
if (issuer === jwt_verify_options_1.TOKEN_ISSUER_USER_SERVICE) {
|
|
92
92
|
if (typeof authParams === 'string') {
|
|
@@ -102,19 +102,19 @@ const getAuthenticatedConsumer = async (token, authParams) => {
|
|
|
102
102
|
jwksUri = new URL(`/${tenantId}/${environmentId}/${applicationId}/.well-known/jwks.json`, authParams.authEndpoint).href;
|
|
103
103
|
}
|
|
104
104
|
}
|
|
105
|
-
if (
|
|
105
|
+
if (decodedEndUserToken.subjectType === subject_type_enum_1.SubjectType.EndUserApplication) {
|
|
106
106
|
// Verify access token using JWKS
|
|
107
|
-
return (await verifyTokenAndGetAuthenticatedSubject(
|
|
107
|
+
return (await verifyTokenAndGetAuthenticatedSubject(endUserToken, jwksUri, 'END_USER_APPLICATION'));
|
|
108
108
|
}
|
|
109
|
-
else if (
|
|
109
|
+
else if (decodedEndUserToken.subjectType === subject_type_enum_1.SubjectType.EndUserAccount) {
|
|
110
110
|
// Verify access token using JWKS
|
|
111
|
-
return (await verifyTokenAndGetAuthenticatedSubject(
|
|
111
|
+
return (await verifyTokenAndGetAuthenticatedSubject(endUserToken, jwksUri, 'END_USER'));
|
|
112
112
|
}
|
|
113
113
|
else {
|
|
114
|
-
throw new mosaic_service_common_1.GeneralError('Passed JWT is not a Mosaic
|
|
114
|
+
throw new mosaic_service_common_1.GeneralError('Passed JWT is not a Mosaic End-User Token. Cannot be verified.');
|
|
115
115
|
}
|
|
116
116
|
};
|
|
117
|
-
exports.
|
|
117
|
+
exports.getAuthenticatedEndUser = getAuthenticatedEndUser;
|
|
118
118
|
const verifyTokenAndGetAuthenticatedSubject = async (token, jwksUri, authType) => {
|
|
119
119
|
return new Promise((resolve, reject) => {
|
|
120
120
|
const jwksClient = jwks({
|
|
@@ -141,7 +141,7 @@ const verifyTokenAndGetAuthenticatedSubject = async (token, jwksUri, authType) =
|
|
|
141
141
|
if (authType === 'MANAGEMENT') {
|
|
142
142
|
resolve(decoded);
|
|
143
143
|
}
|
|
144
|
-
else if (authType === '
|
|
144
|
+
else if (authType === 'END_USER') {
|
|
145
145
|
resolve(decoded);
|
|
146
146
|
}
|
|
147
147
|
else {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-authenticated-subject.js","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":";;;AAAA,yEAGuC;AACvC,oCAAoC;AACpC,iCAAiC;
|
|
1
|
+
{"version":3,"file":"get-authenticated-subject.js","sourceRoot":"","sources":["../../src/common/get-authenticated-subject.ts"],"names":[],"mappings":";;;AAAA,yEAGuC;AACvC,oCAAoC;AACpC,iCAAiC;AAOjC,6DAI8B;AAC9B,2DAAkD;AAErC,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;GAOG;AACI,MAAM,iCAAiC,GAAG,KAAK,EACpD,KAAa,EACb,UAAyC,EACA,EAAE;IAC3C,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAmC,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,gEAAgE;IAChE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACtC,uBAAuB;QACrB,OAAO,CAAC,WAAW,KAAK,+BAAW,CAAC,qBAAqB,CAAC;IAE5D,0GAA0G;IAC1G,IAAI,MAAM,KAAK,4CAAuB,EAAE;QACtC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,IAAI,uBAAuB,EAAE;gBAC3B,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;aAC9D;iBAAM;gBACL,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,wBAAwB,EACrD,UAAU,CACX,CAAC,IAAI,CAAC;aACR;SACF;aAAM;YACL,6EAA6E;YAC7E,IACE,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC;gBACxC,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,aAAa,CAAC,EAC7C;gBACA,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC/B,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;aAC1C;YAED,IAAI,uBAAuB,EAAE;gBAC3B,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,UAAU,CAAC,YAAY,CAAC;qBACjE,IAAI,CAAC;aACT;iBAAM;gBACL,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,wBAAwB,EACrD,UAAU,CAAC,YAAY,CACxB,CAAC,IAAI,CAAC;aACR;SACF;KACF;IAED,iCAAiC;IACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,KAAK,EACL,OAAO,EACP,YAAY,CACb,CAAmC,CAAC;AACvC,CAAC,CAAC;AAzDW,QAAA,iCAAiC,qCAyD5C;AAEF;;;;;;;GAOG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,KAAa,EACb,UAAyC,EACwB,EAAE;IACnE,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;IAElE,kCAAkC;IAClC,IAAI,YAAY,CAAC,mCAA2B,CAAC,KAAK,SAAS,EAAE;QAC3D,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,mCAA2B,CAAC,CAAC,CAAC;KAClE;SAAM;QACL,YAAY,GAAG,KAAK,CAAC;KACtB;IAED,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,CACpC,YAAY,CACsB,CAAC;IAErC,0HAA0H;IAC1H,IAAI,IAAA,0CAAkB,EAAC,mBAAmB,CAAC,EAAE;QAC3C,MAAM,IAAI,oCAAY,CACpB,gEAAgE,CACjE,CAAC;KACH;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC;IACvC,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IACxC,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAClD,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC;IAExD,4GAA4G;IAC5G,IAAI,MAAM,KAAK,8CAAyB,EAAE;QACxC,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;YAClC,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,IAAI,aAAa,wBAAwB,EACtE,UAAU,CACX,CAAC,IAAI,CAAC;SACR;aAAM;YACL,6EAA6E;YAC7E,IACE,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,QAAQ,CAAC;gBACxC,CAAC,IAAA,0CAAkB,EAAC,UAAU,CAAC,aAAa,CAAC,EAC7C;gBACA,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAC/B,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC;aAC1C;YAED,OAAO,GAAG,IAAI,GAAG,CACf,IAAI,QAAQ,IAAI,aAAa,IAAI,aAAa,wBAAwB,EACtE,UAAU,CAAC,YAAY,CACxB,CAAC,IAAI,CAAC;SACR;KACF;IAED,IAAI,mBAAmB,CAAC,WAAW,KAAK,+BAAW,CAAC,kBAAkB,EAAE;QACtE,iCAAiC;QACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,YAAY,EACZ,OAAO,EACP,sBAAsB,CACvB,CAAoC,CAAC;KACvC;SAAM,IAAI,mBAAmB,CAAC,WAAW,KAAK,+BAAW,CAAC,cAAc,EAAE;QACzE,iCAAiC;QACjC,OAAO,CAAC,MAAM,qCAAqC,CACjD,YAAY,EACZ,OAAO,EACP,UAAU,CACX,CAAyB,CAAC;KAC5B;SAAM;QACL,MAAM,IAAI,oCAAY,CACpB,gEAAgE,CACjE,CAAC;KACH;AACH,CAAC,CAAC;AA5EW,QAAA,uBAAuB,2BA4ElC;AAEF,MAAM,qCAAqC,GAAG,KAAK,EACjD,KAAa,EACb,OAAe,EACf,QAA4D,EAK5D,EAAE;IACF,OAAO,IAAI,OAAO,CAIhB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC;YACtB,OAAO;YACP,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,IAAI,GAAG,EAAE,GAAG,EAAE;YAC3B,eAAe,EAAE,GAAG;SACrB,CAAC,CAAC;QAEH,MAAM,YAAY,GAA6B,CAC7C,MAAqB,EACrB,QAAgC,EAC1B,EAAE;;YACR,UAAU,CAAC,aAAa,CACtB,MAAA,MAAM,CAAC,GAAG,mCAAI,8BAA8B,EAC5C,CAAC,KAAmB,EAAE,GAAoB,EAAE,EAAE;gBAC5C,IAAI,KAAK,EAAE;oBACT,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;iBACR;gBACD,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YACrC,CAAC,CACF,CAAC;QACJ,CAAC,CAAC;QAEF,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,IAAA,wCAAmB,GAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxE,IAAI,KAAK,EAAE;gBACT,MAAM,CAAC,KAAK,CAAC,CAAC;gBACd,OAAO;aACR;YAED,IAAI,QAAQ,KAAK,YAAY,EAAE;gBAC7B,OAAO,CAAC,OAAyC,CAAC,CAAC;aACpD;iBAAM,IAAI,QAAQ,KAAK,UAAU,EAAE;gBAClC,OAAO,CAAC,OAA+B,CAAC,CAAC;aAC1C;iBAAM;gBACL,OAAO,CAAC,OAA0C,CAAC,CAAC;aACrD;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}
|
|
@@ -64,11 +64,11 @@ export declare const assertTokenNotExpired: (accessToken: GenericAuthenticatedSu
|
|
|
64
64
|
*/
|
|
65
65
|
export declare const isAuthenticatedManagementSubject: (subject: GenericAuthenticatedSubject | undefined) => boolean;
|
|
66
66
|
/**
|
|
67
|
-
* Returns if a passed Authenticated Subject is
|
|
67
|
+
* Returns if a passed Authenticated Subject is an End-User
|
|
68
68
|
* @param subject GenericAuthenticatedSubject
|
|
69
69
|
* @returns
|
|
70
70
|
*/
|
|
71
|
-
export declare const
|
|
71
|
+
export declare const isAuthenticatedEndUser: (subject: GenericAuthenticatedSubject | undefined) => boolean;
|
|
72
72
|
/**
|
|
73
73
|
* Validates if Postgraphile build options related to authorization are correctly set.
|
|
74
74
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-utils.d.ts","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAEhF,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C;;OAEG;IACH,0BAA0B,EAAE,0BAA0B,CAAC;CACxD;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;OAEG;IACH,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,cACpB,MAAM,uBACI,MAAM,EAAE,GAAG,SAAS,KACxC,OAQF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,SAC/B,2BAA2B,GAAG,SAAS,aAClC,MAAM,aACN,gBAAgB,GAAG,SAAS,KACtC,IAiBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBACnB,2BAA2B,aAC7B,MAAM,KAChB,IAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,YAClC,2BAA2B,GAAG,SAAS,KAC/C,OAsBF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,
|
|
1
|
+
{"version":3,"file":"guard-utils.d.ts","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAEhF,OAAO,EAAgB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,oBAAoB,EAAE,oBAAoB,CAAC;IAE3C;;OAEG;IACH,0BAA0B,EAAE,0BAA0B,CAAC;CACxD;AAED,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAElC;;OAEG;IACH,oBAAoB,EAAE,uBAAuB,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,cACpB,MAAM,uBACI,MAAM,EAAE,GAAG,SAAS,KACxC,OAQF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,SAC/B,2BAA2B,GAAG,SAAS,aAClC,MAAM,aACN,gBAAgB,GAAG,SAAS,KACtC,IAiBF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,gBACnB,2BAA2B,aAC7B,MAAM,KAChB,IAQF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,YAClC,2BAA2B,GAAG,SAAS,KAC/C,OAsBF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,YACxB,2BAA2B,GAAG,SAAS,KAC/C,OAsBF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,YAClC,cAAc,KACtB,IAsBF,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.validatePostgraphileBuildOptions = exports.
|
|
3
|
+
exports.validatePostgraphileBuildOptions = exports.isAuthenticatedEndUser = exports.isAuthenticatedManagementSubject = exports.assertTokenNotExpired = exports.assertSubjectAuthenticated = exports.isAnonymousOperation = void 0;
|
|
4
4
|
const _1 = require(".");
|
|
5
5
|
const error_code_enum_1 = require("./error-code.enum");
|
|
6
6
|
const guard_error_1 = require("./guard-error");
|
|
@@ -80,8 +80,8 @@ const isAuthenticatedManagementSubject = (subject) => {
|
|
|
80
80
|
case _1.SubjectType.SuperUserAccount:
|
|
81
81
|
case _1.SubjectType.EnvironmentAdminAccount:
|
|
82
82
|
return true;
|
|
83
|
-
case _1.SubjectType.
|
|
84
|
-
case _1.SubjectType.
|
|
83
|
+
case _1.SubjectType.EndUserAccount:
|
|
84
|
+
case _1.SubjectType.EndUserApplication:
|
|
85
85
|
return false;
|
|
86
86
|
default: {
|
|
87
87
|
// This block would never execute in runtime, and used as a build-time exhaustive switch-case check for the `SubjectType` ENUM.
|
|
@@ -93,18 +93,18 @@ const isAuthenticatedManagementSubject = (subject) => {
|
|
|
93
93
|
};
|
|
94
94
|
exports.isAuthenticatedManagementSubject = isAuthenticatedManagementSubject;
|
|
95
95
|
/**
|
|
96
|
-
* Returns if a passed Authenticated Subject is
|
|
96
|
+
* Returns if a passed Authenticated Subject is an End-User
|
|
97
97
|
* @param subject GenericAuthenticatedSubject
|
|
98
98
|
* @returns
|
|
99
99
|
*/
|
|
100
|
-
const
|
|
100
|
+
const isAuthenticatedEndUser = (subject) => {
|
|
101
101
|
if (subject === undefined) {
|
|
102
102
|
return false;
|
|
103
103
|
}
|
|
104
104
|
else {
|
|
105
105
|
switch (subject.subjectType) {
|
|
106
|
-
case _1.SubjectType.
|
|
107
|
-
case _1.SubjectType.
|
|
106
|
+
case _1.SubjectType.EndUserAccount:
|
|
107
|
+
case _1.SubjectType.EndUserApplication:
|
|
108
108
|
return true;
|
|
109
109
|
case _1.SubjectType.UserAccount:
|
|
110
110
|
case _1.SubjectType.ServiceAccount:
|
|
@@ -121,7 +121,7 @@ const isAuthenticatedConsumer = (subject) => {
|
|
|
121
121
|
}
|
|
122
122
|
}
|
|
123
123
|
};
|
|
124
|
-
exports.
|
|
124
|
+
exports.isAuthenticatedEndUser = isAuthenticatedEndUser;
|
|
125
125
|
/**
|
|
126
126
|
* Validates if Postgraphile build options related to authorization are correctly set.
|
|
127
127
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"guard-utils.js","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":";;;AAIA,wBAAgC;AAEhC,uDAA8C;AAC9C,+CAA+D;AAuC/D;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,SAAiB,EACjB,mBAAyC,EAChC,EAAE;IACX,MAAM,oBAAoB,GAAG,mBAAmB,aAAnB,mBAAmB,uBAAnB,mBAAmB,CAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,oBAAoB,EAAE;QACxB,OAAO,IAAI,CAAC;KACb;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAXW,QAAA,oBAAoB,wBAW/B;AAEF;;;;;;;;GAQG;AACI,MAAM,0BAA0B,GAAG,CACxC,IAA6C,EAC7C,SAAiB,EACjB,SAAuC,EACjC,EAAE;IACR,8EAA8E;IAC9E,IAAI,SAAS,KAAK,SAAS,EAAE;QAC3B,MAAM,IAAI,0BAAY,CAAC,SAAS,CAAC,CAAC;KACnC;SAAM,IAAI,CAAC,IAAI,EAAE;QAChB,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,oJAAoJ;gBAC1J,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CAAC;KACJ;IAED,+BAA+B;IAC/B,IAAA,6BAAqB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC,CAAC;AArBW,QAAA,0BAA0B,8BAqBrC;AAEF;;;;;GAKG;AACI,MAAM,qBAAqB,GAAG,CACnC,WAAwC,EACxC,SAAiB,EACX,EAAE;IACR,IAAI,WAAW,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE;QACjD,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,2BAAS,CAAC,kBAAkB;YAClC,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC;AAEF;;;;GAIG;AACI,MAAM,gCAAgC,GAAG,CAC9C,OAAgD,EACvC,EAAE;IACX,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,OAAO,KAAK,CAAC;KACd;SAAM;QACL,QAAQ,OAAO,CAAC,WAAW,EAAE;YAC3B,KAAK,cAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,qBAAqB,CAAC;YACvC,KAAK,cAAW,CAAC,uBAAuB,CAAC;YACzC,KAAK,cAAW,CAAC,gBAAgB,CAAC;YAClC,KAAK,cAAW,CAAC,uBAAuB;gBACtC,OAAO,IAAI,CAAC;YACd,KAAK,cAAW,CAAC,
|
|
1
|
+
{"version":3,"file":"guard-utils.js","sourceRoot":"","sources":["../../src/common/guard-utils.ts"],"names":[],"mappings":";;;AAIA,wBAAgC;AAEhC,uDAA8C;AAC9C,+CAA+D;AAuC/D;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,SAAiB,EACjB,mBAAyC,EAChC,EAAE;IACX,MAAM,oBAAoB,GAAG,mBAAmB,aAAnB,mBAAmB,uBAAnB,mBAAmB,CAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEtE,IAAI,oBAAoB,EAAE;QACxB,OAAO,IAAI,CAAC;KACb;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAXW,QAAA,oBAAoB,wBAW/B;AAEF;;;;;;;;GAQG;AACI,MAAM,0BAA0B,GAAG,CACxC,IAA6C,EAC7C,SAAiB,EACjB,SAAuC,EACjC,EAAE;IACR,8EAA8E;IAC9E,IAAI,SAAS,KAAK,SAAS,EAAE;QAC3B,MAAM,IAAI,0BAAY,CAAC,SAAS,CAAC,CAAC;KACnC;SAAM,IAAI,CAAC,IAAI,EAAE;QAChB,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,oJAAoJ;gBAC1J,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CAAC;KACJ;IAED,+BAA+B;IAC/B,IAAA,6BAAqB,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACzC,CAAC,CAAC;AArBW,QAAA,0BAA0B,8BAqBrC;AAEF;;;;;GAKG;AACI,MAAM,qBAAqB,GAAG,CACnC,WAAwC,EACxC,SAAiB,EACX,EAAE;IACR,IAAI,WAAW,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE;QACjD,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,2BAAS,CAAC,kBAAkB;YAClC,OAAO,EAAE,EAAE,SAAS,EAAE;SACvB,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC;AAEF;;;;GAIG;AACI,MAAM,gCAAgC,GAAG,CAC9C,OAAgD,EACvC,EAAE;IACX,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,OAAO,KAAK,CAAC;KACd;SAAM;QACL,QAAQ,OAAO,CAAC,WAAW,EAAE;YAC3B,KAAK,cAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,qBAAqB,CAAC;YACvC,KAAK,cAAW,CAAC,uBAAuB,CAAC;YACzC,KAAK,cAAW,CAAC,gBAAgB,CAAC;YAClC,KAAK,cAAW,CAAC,uBAAuB;gBACtC,OAAO,IAAI,CAAC;YACd,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,kBAAkB;gBACjC,OAAO,KAAK,CAAC;YACf,OAAO,CAAC,CAAC;gBACP,+HAA+H;gBAC/H,MAAM,eAAe,GAAU,OAAO,CAAC,WAAW,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,eAAe,EAAE,CAAC,CAAC;aACnE;SACF;KACF;AACH,CAAC,CAAC;AAxBW,QAAA,gCAAgC,oCAwB3C;AAEF;;;;GAIG;AACI,MAAM,sBAAsB,GAAG,CACpC,OAAgD,EACvC,EAAE;IACX,IAAI,OAAO,KAAK,SAAS,EAAE;QACzB,OAAO,KAAK,CAAC;KACd;SAAM;QACL,QAAQ,OAAO,CAAC,WAAW,EAAE;YAC3B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,kBAAkB;gBACjC,OAAO,IAAI,CAAC;YACd,KAAK,cAAW,CAAC,WAAW,CAAC;YAC7B,KAAK,cAAW,CAAC,cAAc,CAAC;YAChC,KAAK,cAAW,CAAC,qBAAqB,CAAC;YACvC,KAAK,cAAW,CAAC,uBAAuB,CAAC;YACzC,KAAK,cAAW,CAAC,gBAAgB,CAAC;YAClC,KAAK,cAAW,CAAC,uBAAuB;gBACtC,OAAO,KAAK,CAAC;YACf,OAAO,CAAC,CAAC;gBACP,+HAA+H;gBAC/H,MAAM,eAAe,GAAU,OAAO,CAAC,WAAW,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,+BAA+B,eAAe,EAAE,CAAC,CAAC;aACnE;SACF;KACF;AACH,CAAC,CAAC;AAxBW,QAAA,sBAAsB,0BAwBjC;AAEF;;;;GAIG;AACI,MAAM,gCAAgC,GAAG,CAC9C,OAAuB,EACjB,EAAE;IACR,IACE,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,KAAK,SAAS;QACrE,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,KAAK,SAAS,EAC/D;QACA,MAAM,IAAI,0BAAY,CAAC;YACrB,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EACL,8LAA8L;SACjM,CAAC,CAAC;KACJ;IAED,IACE,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,KAAK,SAAS;QACrE,OAAO,CAAC,oBAAoB,CAAC,oBAAoB,KAAK,SAAS,EAC/D;QACA,MAAM,IAAI,0BAAY,CAAC;YACrB,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EACL,sLAAsL;SACzL,CAAC,CAAC;KACJ;AACH,CAAC,CAAC;AAxBW,QAAA,gCAAgC,oCAwB3C"}
|
|
@@ -23,8 +23,8 @@ const handleEndUserAuthorization = (options, ensureOnlyAuthentication, subject,
|
|
|
23
23
|
// If authorization checks are required, proceed to do that. If not, return the resolver.
|
|
24
24
|
if (!ensureOnlyAuthentication) {
|
|
25
25
|
(0, type_assertions_1.assertGenericAuthenticatedSubject)(subject);
|
|
26
|
-
if (subject.subjectType === subject_type_enum_1.SubjectType.
|
|
27
|
-
(0, type_assertions_1.
|
|
26
|
+
if (subject.subjectType === subject_type_enum_1.SubjectType.EndUserApplication) {
|
|
27
|
+
(0, type_assertions_1.assertEndUserApplication)(subject);
|
|
28
28
|
assertEndUserApplicationAuthorization(subject, options.operation, options.endUserAuthorizationConfig
|
|
29
29
|
.applicationTokenAllowedGqlOperations);
|
|
30
30
|
}
|
|
@@ -33,7 +33,7 @@ const handleEndUserAuthorization = (options, ensureOnlyAuthentication, subject,
|
|
|
33
33
|
};
|
|
34
34
|
exports.handleEndUserAuthorization = handleEndUserAuthorization;
|
|
35
35
|
/**
|
|
36
|
-
* This function asserts if an
|
|
36
|
+
* This function asserts if an AuthenticatedEndUserApplication is authorized to make a request to a GQL operation.
|
|
37
37
|
*
|
|
38
38
|
* @param subject
|
|
39
39
|
* @param operation
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"handle-end-user-authorization.js","sourceRoot":"","sources":["../../src/common/handle-end-user-authorization.ts"],"names":[],"mappings":";;;AAIA,uDAA8C;AAC9C,+CAA+D;AAC/D,+CAIuB;AACvB,2DAAkD;AAClD,uDAG2B;AAE3B;;;;;;;;;GASG;AACI,MAAM,0BAA0B,GAAG,CACxC,OAAgC,EAChC,wBAAiC,EACjC,OAAgD,EAChD,aAA2C,EACrC,EAAE;IACR,IACE,CAAC,IAAA,kCAAoB,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,0BAA0B,CAAC,sBAAsB,CAC1D,EACD;QACA,uCAAuC;QACvC,IAAA,wCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtE,yFAAyF;QACzF,IAAI,CAAC,wBAAwB,EAAE;YAC7B,IAAA,mDAAiC,EAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,WAAW,KAAK,+BAAW,CAAC,
|
|
1
|
+
{"version":3,"file":"handle-end-user-authorization.js","sourceRoot":"","sources":["../../src/common/handle-end-user-authorization.ts"],"names":[],"mappings":";;;AAIA,uDAA8C;AAC9C,+CAA+D;AAC/D,+CAIuB;AACvB,2DAAkD;AAClD,uDAG2B;AAE3B;;;;;;;;;GASG;AACI,MAAM,0BAA0B,GAAG,CACxC,OAAgC,EAChC,wBAAiC,EACjC,OAAgD,EAChD,aAA2C,EACrC,EAAE;IACR,IACE,CAAC,IAAA,kCAAoB,EACnB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,0BAA0B,CAAC,sBAAsB,CAC1D,EACD;QACA,uCAAuC;QACvC,IAAA,wCAA0B,EAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtE,yFAAyF;QACzF,IAAI,CAAC,wBAAwB,EAAE;YAC7B,IAAA,mDAAiC,EAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,WAAW,KAAK,+BAAW,CAAC,kBAAkB,EAAE;gBAC1D,IAAA,0CAAwB,EAAC,OAAO,CAAC,CAAC;gBAClC,qCAAqC,CACnC,OAAO,EACP,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,0BAA0B;qBAC/B,oCAAoC,CACxC,CAAC;aACH;SACF;KACF;AACH,CAAC,CAAC;AA5BW,QAAA,0BAA0B,8BA4BrC;AAEF;;;;;;GAMG;AACH,MAAM,qCAAqC,GAAG,CAC5C,OAAwC,EACxC,SAAiB,EACjB,iCAA2C,EACrC,EAAE;IACR,IAAI,CAAC,iCAAiC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE;QAC1D,MAAM,IAAI,0BAAY,CAAC;YACrB,OAAO,EAAE,8DAA8D;YACvE,IAAI,EAAE,2BAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,GAAG;gBACjB,SAAS,EAAE,SAAS;aACrB;SACF,CAAC,CAAC;KACJ;AACH,CAAC,CAAC"}
|
|
@@ -4,9 +4,9 @@ import { ErrorCode } from '../error-code.enum';
|
|
|
4
4
|
* Returns error code of type ErrorCode, a message and original error.
|
|
5
5
|
*
|
|
6
6
|
* @param err Error of type unknown
|
|
7
|
-
* @param authType Auth Type - 'MANAGEMENT' | '
|
|
7
|
+
* @param authType Auth Type - 'MANAGEMENT' | 'END_USER'
|
|
8
8
|
* @param token JWT token
|
|
9
9
|
* @returns [code, message, originalError]
|
|
10
10
|
*/
|
|
11
|
-
export declare const handleJwtParseError: (err: unknown, authType: 'MANAGEMENT' | '
|
|
11
|
+
export declare const handleJwtParseError: (err: unknown, authType: 'MANAGEMENT' | 'END_USER' | undefined, token: string) => [code: ErrorCode, message: string, originalError: Error];
|
|
12
12
|
//# sourceMappingURL=parse-jwt-token-error-handler.d.ts.map
|
|
@@ -10,7 +10,7 @@ const error_code_enum_1 = require("../error-code.enum");
|
|
|
10
10
|
* This method takes an error code and builds the respective error message for that depending on the authType.
|
|
11
11
|
*
|
|
12
12
|
* @param errorCode a value from the enum ErrorCode
|
|
13
|
-
* @param authType Auth Type - 'MANAGEMENT' | '
|
|
13
|
+
* @param authType Auth Type - 'MANAGEMENT' | 'END_USER'
|
|
14
14
|
* @param authConfig AuthenticationConfig instance
|
|
15
15
|
* @param token JWT Token
|
|
16
16
|
* @returns
|
|
@@ -20,12 +20,12 @@ const buildErrorMessage = (errorCode, authType, token) => {
|
|
|
20
20
|
const decodedToken = jwt.decode(token);
|
|
21
21
|
switch (errorCode) {
|
|
22
22
|
case error_code_enum_1.ErrorCode.SigningKeyNotFound:
|
|
23
|
-
message = `Could not find a matching signing key to verify the access token. The signing key used to create the token may have been revoked or the Tenant(${decodedToken.tenantId})/Environment(${decodedToken.environmentId})${authType === '
|
|
23
|
+
message = `Could not find a matching signing key to verify the access token. The signing key used to create the token may have been revoked or the Tenant(${decodedToken.tenantId})/Environment(${decodedToken.environmentId})${authType === 'END_USER'
|
|
24
24
|
? `/Application(${decodedToken.applicationId})`
|
|
25
25
|
: ''} configuration is erroneous.`;
|
|
26
26
|
break;
|
|
27
27
|
case error_code_enum_1.ErrorCode.JwksError:
|
|
28
|
-
message = `Error occurred while trying to fetch signing keys from the JWKS endpoint for the Tenant(${decodedToken.tenantId})/Environment(${decodedToken.environmentId})${authType === '
|
|
28
|
+
message = `Error occurred while trying to fetch signing keys from the JWKS endpoint for the Tenant(${decodedToken.tenantId})/Environment(${decodedToken.environmentId})${authType === 'END_USER'
|
|
29
29
|
? `/Application(${decodedToken.applicationId}).`
|
|
30
30
|
: '.'}`;
|
|
31
31
|
break;
|
|
@@ -53,7 +53,7 @@ const buildErrorMessage = (errorCode, authType, token) => {
|
|
|
53
53
|
* Returns error code of type ErrorCode, a message and original error.
|
|
54
54
|
*
|
|
55
55
|
* @param err Error of type unknown
|
|
56
|
-
* @param authType Auth Type - 'MANAGEMENT' | '
|
|
56
|
+
* @param authType Auth Type - 'MANAGEMENT' | 'END_USER'
|
|
57
57
|
* @param token JWT token
|
|
58
58
|
* @returns [code, message, originalError]
|
|
59
59
|
*/
|
|
@@ -75,7 +75,7 @@ const handleJwtParseError = (err, authType, token) => {
|
|
|
75
75
|
}
|
|
76
76
|
else if (err.code === 'ECONNREFUSED') {
|
|
77
77
|
code =
|
|
78
|
-
authType === '
|
|
78
|
+
authType === 'END_USER'
|
|
79
79
|
? error_code_enum_1.ErrorCode.UserServiceNotAccessible
|
|
80
80
|
: error_code_enum_1.ErrorCode.IdentityServiceNotAccessible;
|
|
81
81
|
message = buildErrorMessage(code, authType, token);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parse-jwt-token-error-handler.js","sourceRoot":"","sources":["../../../src/common/helpers/parse-jwt-token-error-handler.ts"],"names":[],"mappings":";;;AAAA,yEAA6D;AAC7D,oCAAoC;AACpC,iCAAiC;AAEjC,wDAA+C;AAE/C;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CACxB,SAAoB,EACpB,QAA+C,EAC/C,KAAa,EACL,EAAE;IACV,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,QAAQ,SAAS,EAAE;QACjB,KAAK,2BAAS,CAAC,kBAAkB;YAC/B,OAAO,GAAG,kJACP,YAA+C,CAAC,QACnD,iBACG,YAA+C,CAAC,aACnD,IACE,QAAQ,KAAK,UAAU;gBACrB,CAAC,CAAC,gBACG,
|
|
1
|
+
{"version":3,"file":"parse-jwt-token-error-handler.js","sourceRoot":"","sources":["../../../src/common/helpers/parse-jwt-token-error-handler.ts"],"names":[],"mappings":";;;AAAA,yEAA6D;AAC7D,oCAAoC;AACpC,iCAAiC;AAEjC,wDAA+C;AAE/C;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,CACxB,SAAoB,EACpB,QAA+C,EAC/C,KAAa,EACL,EAAE;IACV,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,QAAQ,SAAS,EAAE;QACjB,KAAK,2BAAS,CAAC,kBAAkB;YAC/B,OAAO,GAAG,kJACP,YAA+C,CAAC,QACnD,iBACG,YAA+C,CAAC,aACnD,IACE,QAAQ,KAAK,UAAU;gBACrB,CAAC,CAAC,gBACG,YAAqC,CAAC,aACzC,GAAG;gBACL,CAAC,CAAC,EACN,8BAA8B,CAAC;YAC/B,MAAM;QACR,KAAK,2BAAS,CAAC,SAAS;YACtB,OAAO,GAAG,2FACP,YAA+C,CAAC,QACnD,iBACG,YAA+C,CAAC,aACnD,IACE,QAAQ,KAAK,UAAU;gBACrB,CAAC,CAAC,gBACG,YAAqC,CAAC,aACzC,IAAI;gBACN,CAAC,CAAC,GACN,EAAE,CAAC;YACH,MAAM;QACR,KAAK,2BAAS,CAAC,wBAAwB;YACrC,OAAO;gBACL,oEAAoE,CAAC;YACvE,MAAM;QACR,KAAK,2BAAS,CAAC,4BAA4B;YACzC,OAAO;gBACL,wEAAwE,CAAC;YAC3E,MAAM;QACR,KAAK,2BAAS,CAAC,kBAAkB;YAC/B,OAAO,GAAG,yBAAyB,CAAC;YACpC,MAAM;QACR,KAAK,2BAAS,CAAC,6BAA6B;YAC1C,OAAO,GAAG,kCAAkC,CAAC;YAC7C,MAAM;QACR;YACE,OAAO,GAAG,eAAe,CAAC;KAC7B;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACI,MAAM,mBAAmB,GAAG,CACjC,GAAY,EACZ,QAA+C,EAC/C,KAAa,EAC6C,EAAE;IAC5D,IAAI,IAA2B,CAAC;IAChC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAgC,CAAC;IAErC,IAAI,GAAG,YAAY,GAAG,CAAC,iBAAiB,EAAE;QACxC,IAAI,GAAG,2BAAS,CAAC,kBAAkB,CAAC;QACpC,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACpD;SAAM,IAAI,GAAG,YAAY,IAAI,CAAC,uBAAuB,EAAE;QACtD,IAAI,GAAG,2BAAS,CAAC,kBAAkB,CAAC;QACpC,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACpD;SAAM,IAAI,GAAG,YAAY,IAAI,CAAC,SAAS,EAAE;QACxC,IAAI,GAAG,2BAAS,CAAC,SAAS,CAAC;QAC3B,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACpD;SAAM,IAAK,GAAyB,CAAC,IAAI,KAAK,cAAc,EAAE;QAC7D,IAAI;YACF,QAAQ,KAAK,UAAU;gBACrB,CAAC,CAAC,2BAAS,CAAC,wBAAwB;gBACpC,CAAC,CAAC,2BAAS,CAAC,4BAA4B,CAAC;QAC7C,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACpD;SAAM;QACL,IAAI,GAAG,2BAAS,CAAC,6BAA6B,CAAC;QAC/C,OAAO,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;KACpD;IAED,+JAA+J;IAC/J,IAAI,GAAG,YAAY,KAAK,EAAE;QACxB,aAAa,GAAG,GAAG,CAAC;KACrB;SAAM;QACL,aAAa,GAAG,IAAI,oCAAY,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;KAC5D;IACD,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AACxC,CAAC,CAAC;AApCW,QAAA,mBAAmB,uBAoC9B"}
|
package/dist/common/index.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
export {
|
|
1
|
+
export { AuthenticatedEndUser, AuthenticatedEndUserApplication, AuthenticatedManagementSubject, EnvironmentInfo, } from './authenticated-subject.interface';
|
|
2
2
|
export * from './authentication-config.interface';
|
|
3
|
-
export {
|
|
3
|
+
export { AuthenticatedEndUserRequest, AuthenticatedManagementRequest, EndUserAuthenticationContext, ManagementAuthenticationContext, } from './authentication-request-context.interface';
|
|
4
4
|
export * from './error-code.enum';
|
|
5
5
|
export * from './get-authenticated-subject';
|
|
6
6
|
export * from './guard-error';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,8BAA8B,EAC9B,eAAe,GAChB,MAAM,mCAAmC,CAAC;AAC3C,cAAc,mCAAmC,CAAC;AAClD,OAAO,EACL,2BAA2B,EAC3B,8BAA8B,EAC9B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,4CAA4C,CAAC;AACpD,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,eAAe,CAAC;AAC9B,cAAc,iCAAiC,CAAC;AAChD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC"}
|
|
@@ -1,12 +1,13 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { AuthenticatedEndUser, AuthenticatedManagementSubject } from './authenticated-subject.interface';
|
|
2
2
|
import { AuthenticationConfig } from './authentication-config.interface';
|
|
3
|
+
import { EndUserAuthenticationContext, ManagementAuthenticationContext } from './authentication-request-context.interface';
|
|
3
4
|
/**
|
|
4
5
|
* Parses a JWT token to produce an ManagementAuthenticationContext or a ConsumeAuthenticationContext with subject information and error information, if some error occurred during token processing.
|
|
5
6
|
* @param token JWT token without `Bearer ` prefix
|
|
6
7
|
* @param authConfig an object with ID/User service connection information or a path to a public key file.
|
|
7
|
-
* @param authType The type of Token that's being passed. Should be either `MANAGEMENT` or `
|
|
8
|
+
* @param authType The type of Token that's being passed. Should be either `MANAGEMENT` or `END_USER`.
|
|
8
9
|
*/
|
|
9
|
-
export declare const parseJwtToken: (token: string | undefined, authConfig: string | AuthenticationConfig, authType?: "MANAGEMENT" | "
|
|
10
|
+
export declare const parseJwtToken: (token: string | undefined, authConfig: string | AuthenticationConfig, authType?: "MANAGEMENT" | "END_USER" | undefined) => Promise<ManagementAuthenticationContext | EndUserAuthenticationContext>;
|
|
10
11
|
/**
|
|
11
12
|
*
|
|
12
13
|
* @param token The raw JWT which should be decoded
|
|
@@ -16,7 +17,7 @@ export declare const decodeManagementAccessToken: (token: string) => Authenticat
|
|
|
16
17
|
/**
|
|
17
18
|
*
|
|
18
19
|
* @param token The raw JWT which should be decoded
|
|
19
|
-
* @returns An object of type `
|
|
20
|
+
* @returns An object of type `AuthenticatedEndUser`
|
|
20
21
|
*/
|
|
21
|
-
export declare const
|
|
22
|
+
export declare const decodeEndUserAccessToken: (token: string) => AuthenticatedEndUser;
|
|
22
23
|
//# sourceMappingURL=parse-jwt-token.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"parse-jwt-token.d.ts","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,
|
|
1
|
+
{"version":3,"file":"parse-jwt-token.d.ts","sourceRoot":"","sources":["../../src/common/parse-jwt-token.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,oBAAoB,EAEpB,8BAA8B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAChC,MAAM,4CAA4C,CAAC;AAWpD;;;;;GAKG;AACH,eAAO,MAAM,aAAa,UACjB,MAAM,GAAG,SAAS,cACb,MAAM,GAAG,oBAAoB,uDAExC,QAAQ,+BAA+B,GAAG,4BAA4B,CA6ExE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,UAC/B,MAAM,KACZ,8BAEF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,UAC5B,MAAM,KACZ,oBAEF,CAAC"}
|
|
@@ -1,17 +1,20 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.decodeEndUserAccessToken = exports.decodeManagementAccessToken = exports.parseJwtToken = void 0;
|
|
4
4
|
const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
|
|
5
5
|
const fs = require("fs");
|
|
6
6
|
const jwt = require("jsonwebtoken");
|
|
7
|
-
const
|
|
7
|
+
const error_code_enum_1 = require("./error-code.enum");
|
|
8
|
+
const get_authenticated_subject_1 = require("./get-authenticated-subject");
|
|
8
9
|
const guard_error_1 = require("./guard-error");
|
|
9
10
|
const parse_jwt_token_error_handler_1 = require("./helpers/parse-jwt-token-error-handler");
|
|
11
|
+
const jwt_verify_options_1 = require("./jwt-verify-options");
|
|
12
|
+
const subject_type_enum_1 = require("./subject-type.enum");
|
|
10
13
|
/**
|
|
11
14
|
* Parses a JWT token to produce an ManagementAuthenticationContext or a ConsumeAuthenticationContext with subject information and error information, if some error occurred during token processing.
|
|
12
15
|
* @param token JWT token without `Bearer ` prefix
|
|
13
16
|
* @param authConfig an object with ID/User service connection information or a path to a public key file.
|
|
14
|
-
* @param authType The type of Token that's being passed. Should be either `MANAGEMENT` or `
|
|
17
|
+
* @param authType The type of Token that's being passed. Should be either `MANAGEMENT` or `END_USER`.
|
|
15
18
|
*/
|
|
16
19
|
const parseJwtToken = async (token, authConfig, authType) => {
|
|
17
20
|
let code;
|
|
@@ -24,7 +27,7 @@ const parseJwtToken = async (token, authConfig, authType) => {
|
|
|
24
27
|
// If authConfig is a string value, it means the authentication is happening for either the Tenant Admin or the Environment Admin scopes.
|
|
25
28
|
if (typeof authConfig === 'string') {
|
|
26
29
|
if (authType !== undefined) {
|
|
27
|
-
code =
|
|
30
|
+
code = error_code_enum_1.ErrorCode.AuthConfigInvalid;
|
|
28
31
|
message =
|
|
29
32
|
'authType should not be provided when authenticationConfig is a string.';
|
|
30
33
|
originalError = new Error(message);
|
|
@@ -32,21 +35,21 @@ const parseJwtToken = async (token, authConfig, authType) => {
|
|
|
32
35
|
else {
|
|
33
36
|
const publicKeyPath = authConfig;
|
|
34
37
|
const publicKey = fs.readFileSync(publicKeyPath, 'utf8');
|
|
35
|
-
const decoded = jwt.verify(token, publicKey, (0,
|
|
38
|
+
const decoded = jwt.verify(token, publicKey, (0, jwt_verify_options_1.getJwtVerifyOptions)());
|
|
36
39
|
subject = decoded;
|
|
37
40
|
}
|
|
38
41
|
}
|
|
39
42
|
else {
|
|
40
43
|
if (authType === undefined) {
|
|
41
|
-
code =
|
|
44
|
+
code = error_code_enum_1.ErrorCode.AuthConfigInvalid;
|
|
42
45
|
message = 'authType is not provided for Authentication Config';
|
|
43
46
|
originalError = new Error(message);
|
|
44
47
|
}
|
|
45
48
|
else if (authType === 'MANAGEMENT') {
|
|
46
|
-
subject = await (0,
|
|
49
|
+
subject = await (0, get_authenticated_subject_1.getAuthenticatedManagementSubject)(token, authConfig);
|
|
47
50
|
}
|
|
48
|
-
else if (authType === '
|
|
49
|
-
subject = await (0,
|
|
51
|
+
else if (authType === 'END_USER') {
|
|
52
|
+
subject = await (0, get_authenticated_subject_1.getAuthenticatedEndUser)(token, authConfig);
|
|
50
53
|
}
|
|
51
54
|
}
|
|
52
55
|
}
|
|
@@ -55,7 +58,7 @@ const parseJwtToken = async (token, authConfig, authType) => {
|
|
|
55
58
|
}
|
|
56
59
|
}
|
|
57
60
|
else {
|
|
58
|
-
code =
|
|
61
|
+
code = error_code_enum_1.ErrorCode.AccessTokenRequired;
|
|
59
62
|
message = 'Access Token is not provided';
|
|
60
63
|
originalError = new Error(message);
|
|
61
64
|
}
|
|
@@ -72,7 +75,7 @@ const parseJwtToken = async (token, authConfig, authType) => {
|
|
|
72
75
|
};
|
|
73
76
|
}
|
|
74
77
|
else {
|
|
75
|
-
if ((subject === null || subject === void 0 ? void 0 : subject.subjectType) ===
|
|
78
|
+
if ((subject === null || subject === void 0 ? void 0 : subject.subjectType) === subject_type_enum_1.SubjectType.EndUserAccount) {
|
|
76
79
|
return {
|
|
77
80
|
subject: subject,
|
|
78
81
|
authErrorInfo,
|
|
@@ -99,10 +102,10 @@ exports.decodeManagementAccessToken = decodeManagementAccessToken;
|
|
|
99
102
|
/**
|
|
100
103
|
*
|
|
101
104
|
* @param token The raw JWT which should be decoded
|
|
102
|
-
* @returns An object of type `
|
|
105
|
+
* @returns An object of type `AuthenticatedEndUser`
|
|
103
106
|
*/
|
|
104
|
-
const
|
|
107
|
+
const decodeEndUserAccessToken = (token) => {
|
|
105
108
|
return jwt.decode(token);
|
|
106
109
|
};
|
|
107
|
-
exports.
|
|
110
|
+
exports.decodeEndUserAccessToken = decodeEndUserAccessToken;
|
|
108
111
|
//# sourceMappingURL=parse-jwt-token.js.map
|