@axinom/mosaic-id-guard 0.24.0-rc.4 → 0.24.0-rc.5

package/dist/message-bus/guarded-transactional-inbox-message-handler.d.ts

@@ -0,0 +1,38 @@
+import { MessagingSettings } from '@axinom/mosaic-message-bus-abstractions';
+import { Logger } from '@axinom/mosaic-service-common';
+import { DbConfig, TransactionalInboxMessageHandler } from '@axinom/mosaic-transactional-inbox-outbox';
+import { ClientBase } from 'pg';
+import { AuthenticatedManagementSubject } from '../common';
+export interface GuardedContext {
+    subject: AuthenticatedManagementSubject;
+    [key: string]: unknown;
+}
+export type GuardedConfig = DbConfig & {
+    idServiceAuthBaseUrl: string;
+};
+export declare abstract class GuardedTransactionalInboxMessageHandler<TMessage, TConfig extends GuardedConfig> extends TransactionalInboxMessageHandler<TMessage, GuardedContext, TConfig> {
+    protected permissions: string[];
+    /**
+     * Create a new Message handler that provides both the functionality to store
+     * an incoming RabbitMQ message in the inbox and provides the actual logic to
+     * execute the business logic that is based on that message.
+     * @param messagingSettings The definitions of the message that is handled.
+     * @param permissions The set of permissions that allow to execute the handler code
+     * @param config The configuration object
+     */
+    constructor(messagingSettings: MessagingSettings, permissions: string[], logger: Logger, config: TConfig);
+    private authenticateAndAuthorize;
+    /**
+     * Add the PostgreSQL settings for the environment owner connection and subject
+     * @param envOwnerClient The env owner based DB client
+     * @param subject The user or service account to use for setting the connection context
+     * @example
+     * ```ts
+     * const pgSettings = buildAuthPgSettings(subject, this.config.serviceId);
+     * await setPgSettingsConfig(pgSettings, envOwnerClient);
+     * ```
+     */
+    protected abstract setPgSettings(envOwnerClient: ClientBase, subject: AuthenticatedManagementSubject): Promise<void>;
+    mapError(error: Error): Error;
+}
+//# sourceMappingURL=guarded-transactional-inbox-message-handler.d.ts.map

package/dist/message-bus/guarded-transactional-inbox-message-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-transactional-inbox-message-handler.d.ts","sourceRoot":"","sources":["../../src/message-bus/guarded-transactional-inbox-message-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAC5E,OAAO,EACL,MAAM,EAGP,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,QAAQ,EAER,gCAAgC,EACjC,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EACL,8BAA8B,EAG/B,MAAM,WAAW,CAAC;AAGnB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,8BAA8B,CAAC;IACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG;IAAE,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,8BAAsB,uCAAuC,CAC3D,QAAQ,EACR,OAAO,SAAS,aAAa,CAC7B,SAAQ,gCAAgC,CAAC,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC;IAWzE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE;IAVjC;;;;;;;OAOG;gBAED,iBAAiB,EAAE,iBAAiB,EAC1B,WAAW,EAAE,MAAM,EAAE,EAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO;IAWjB,OAAO,CAAC,wBAAwB,CAe9B;IAEF;;;;;;;;;OASG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,CAC9B,cAAc,EAAE,UAAU,EAC1B,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,IAAI,CAAC;IAEP,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK;CAGvC"}

package/dist/message-bus/guarded-transactional-inbox-message-handler.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardedTransactionalInboxMessageHandler = void 0;
+const mosaic_service_common_1 = require("@axinom/mosaic-service-common");
+const mosaic_transactional_inbox_outbox_1 = require("@axinom/mosaic-transactional-inbox-outbox");
+const common_1 = require("../common");
+const message_handler_permissions_1 = require("./message-handler-permissions");
+class GuardedTransactionalInboxMessageHandler extends mosaic_transactional_inbox_outbox_1.TransactionalInboxMessageHandler {
+    /**
+     * Create a new Message handler that provides both the functionality to store
+     * an incoming RabbitMQ message in the inbox and provides the actual logic to
+     * execute the business logic that is based on that message.
+     * @param messagingSettings The definitions of the message that is handled.
+     * @param permissions The set of permissions that allow to execute the handler code
+     * @param config The configuration object
+     */
+    constructor(messagingSettings, permissions, logger, config) {
+        const wrapper = async (message, envOwnerClient) => {
+            return this.authenticateAndAuthorize(message, envOwnerClient);
+        };
+        super(messagingSettings, logger, config, wrapper);
+        this.permissions = permissions;
+        this.authenticateAndAuthorize = async (message, envOwnerClient) => {
+            const token = message.metadata.authToken;
+            if (token === undefined) {
+                throw new mosaic_service_common_1.MosaicError(common_1.IdGuardErrors.AccessTokenRequired);
+            }
+            const subject = await (0, common_1.getAuthenticatedManagementSubject)(token, this.config.idServiceAuthBaseUrl);
+            await (0, message_handler_permissions_1.permissionsCheck)(subject, this.permissions, this.config.serviceId);
+            this.setPgSettings(envOwnerClient, subject);
+            return { subject };
+        };
+    }
+    mapError(error) {
+        return (0, mosaic_service_common_1.getMappedError)(error);
+    }
+}
+exports.GuardedTransactionalInboxMessageHandler = GuardedTransactionalInboxMessageHandler;
+//# sourceMappingURL=guarded-transactional-inbox-message-handler.js.map

package/dist/message-bus/guarded-transactional-inbox-message-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guarded-transactional-inbox-message-handler.js","sourceRoot":"","sources":["../../src/message-bus/guarded-transactional-inbox-message-handler.ts"],"names":[],"mappings":";;;AACA,yEAIuC;AACvC,iGAImD;AAEnD,sCAImB;AACnB,+EAAiE;AASjE,MAAsB,uCAGpB,SAAQ,oEAAmE;IAC3E;;;;;;;OAOG;IACH,YACE,iBAAoC,EAC1B,WAAqB,EAC/B,MAAc,EACd,MAAe;QAEf,MAAM,OAAO,GAAG,KAAK,EACnB,OAA4C,EAC5C,cAA0B,EACD,EAAE;YAC3B,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAVxC,gBAAW,GAAX,WAAW,CAAU;QAazB,6BAAwB,GAAG,KAAK,EACtC,OAA4C,EAC5C,cAA0B,EACD,EAAE;YAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;YACzC,IAAI,KAAK,KAAK,SAAS,EAAE;gBACvB,MAAM,IAAI,mCAAW,CAAC,sBAAa,CAAC,mBAAmB,CAAC,CAAC;aAC1D;YACD,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAiC,EACrD,KAAK,EACL,IAAI,CAAC,MAAM,CAAC,oBAAoB,CACjC,CAAC;YACF,MAAM,IAAA,8CAAgB,EAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC;IAjBF,CAAC;IAkCQ,QAAQ,CAAC,KAAY;QAC5B,OAAO,IAAA,sCAAc,EAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF;AA9DD,0FA8DC"}

package/dist/message-bus/index.d.ts

@@ -1,4 +1,5 @@
 export * from './guard-message-handler';
+export * from './guarded-transactional-inbox-message-handler';
 export * from './message-handler-authentication';
 export * from './message-handler-permissions';
 //# sourceMappingURL=index.d.ts.map

package/dist/message-bus/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/message-bus/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/message-bus/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,+CAA+C,CAAC;AAC9D,cAAc,kCAAkC,CAAC;AACjD,cAAc,+BAA+B,CAAC"}

package/dist/message-bus/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./guard-message-handler"), exports);
+__exportStar(require("./guarded-transactional-inbox-message-handler"), exports);
 __exportStar(require("./message-handler-authentication"), exports);
 __exportStar(require("./message-handler-permissions"), exports);
 //# sourceMappingURL=index.js.map

package/dist/message-bus/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/message-bus/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,mEAAiD;AACjD,gEAA8C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/message-bus/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,gFAA8D;AAC9D,mEAAiD;AACjD,gEAA8C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axinom/mosaic-id-guard",
-  "version": "0.24.0-rc.4",
+  "version": "0.24.0-rc.5",
   "description": "Authentication and authorization helpers for Axinom Mosaic services",
   "author": "Axinom",
   "license": "PROPRIETARY",
@@ -28,9 +28,10 @@
     "lint": "eslint . --ext .ts,.tsx,.js --color --cache"
   },
   "dependencies": {
-    "@axinom/mosaic-id-utils": "^0.15.9-rc.4",
-    "@axinom/mosaic-message-bus": "^0.19.0-rc.4",
-    "@axinom/mosaic-service-common": "^0.41.0-rc.4",
+    "@axinom/mosaic-id-utils": "^0.15.9-rc.5",
+    "@axinom/mosaic-message-bus": "^0.19.0-rc.5",
+    "@axinom/mosaic-service-common": "^0.41.0-rc.5",
+    "@axinom/mosaic-transactional-inbox-outbox": "^0.1.0-rc.4",
     "amqplib": "^0.10.3",
     "express": "^4.17.1",
     "express-bearer-token": "^2.4.0",
@@ -62,5 +63,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "44934f78046b0d7f65bd36b65cbda4fef52fe65d"
+  "gitHead": "c111e4f8ef6144efb5aed6de8a7e6c628158307d"
 }

package/src/message-bus/guarded-transactional-inbox-message-handler.ts

@@ -0,0 +1,89 @@
+import { MessagingSettings } from '@axinom/mosaic-message-bus-abstractions';
+import {
+  Logger,
+  MosaicError,
+  getMappedError,
+} from '@axinom/mosaic-service-common';
+import {
+  DbConfig,
+  TransactionalInboxMessage,
+  TransactionalInboxMessageHandler,
+} from '@axinom/mosaic-transactional-inbox-outbox';
+import { ClientBase } from 'pg';
+import {
+  AuthenticatedManagementSubject,
+  IdGuardErrors,
+  getAuthenticatedManagementSubject,
+} from '../common';
+import { permissionsCheck } from './message-handler-permissions';
+
+export interface GuardedContext {
+  subject: AuthenticatedManagementSubject;
+  [key: string]: unknown;
+}
+
+export type GuardedConfig = DbConfig & { idServiceAuthBaseUrl: string };
+
+export abstract class GuardedTransactionalInboxMessageHandler<
+  TMessage,
+  TConfig extends GuardedConfig,
+> extends TransactionalInboxMessageHandler<TMessage, GuardedContext, TConfig> {
+  /**
+   * Create a new Message handler that provides both the functionality to store
+   * an incoming RabbitMQ message in the inbox and provides the actual logic to
+   * execute the business logic that is based on that message.
+   * @param messagingSettings The definitions of the message that is handled.
+   * @param permissions The set of permissions that allow to execute the handler code
+   * @param config The configuration object
+   */
+  constructor(
+    messagingSettings: MessagingSettings,
+    protected permissions: string[],
+    logger: Logger,
+    config: TConfig,
+  ) {
+    const wrapper = async <TMessage>(
+      message: TransactionalInboxMessage<TMessage>,
+      envOwnerClient: ClientBase,
+    ): Promise<GuardedContext> => {
+      return this.authenticateAndAuthorize(message, envOwnerClient);
+    };
+    super(messagingSettings, logger, config, wrapper);
+  }
+
+  private authenticateAndAuthorize = async <TMessage>(
+    message: TransactionalInboxMessage<TMessage>,
+    envOwnerClient: ClientBase,
+  ): Promise<GuardedContext> => {
+    const token = message.metadata.authToken;
+    if (token === undefined) {
+      throw new MosaicError(IdGuardErrors.AccessTokenRequired);
+    }
+    const subject = await getAuthenticatedManagementSubject(
+      token,
+      this.config.idServiceAuthBaseUrl,
+    );
+    await permissionsCheck(subject, this.permissions, this.config.serviceId);
+    this.setPgSettings(envOwnerClient, subject);
+    return { subject };
+  };
+
+  /**
+   * Add the PostgreSQL settings for the environment owner connection and subject
+   * @param envOwnerClient The env owner based DB client
+   * @param subject The user or service account to use for setting the connection context
+   * @example
+   * ```ts
+   * const pgSettings = buildAuthPgSettings(subject, this.config.serviceId);
+   * await setPgSettingsConfig(pgSettings, envOwnerClient);
+   * ```
+   */
+  protected abstract setPgSettings(
+    envOwnerClient: ClientBase,
+    subject: AuthenticatedManagementSubject,
+  ): Promise<void>;
+
+  override mapError(error: Error): Error {
+    return getMappedError(error);
+  }
+}

package/src/message-bus/index.ts

@@ -1,3 +1,4 @@
 export * from './guard-message-handler';
+export * from './guarded-transactional-inbox-message-handler';
 export * from './message-handler-authentication';
 export * from './message-handler-permissions';