@ballistix.digital/identity-connector 0.0.0-local

package/dist/common/domain/model/identity.d.ts

@@ -0,0 +1,9 @@
+export interface Identity {
+    provider: string;
+    id: string;
+    email: string | null;
+    emailVerified: boolean;
+    givenName: string | null;
+    familyName: string | null;
+    roles: string[];
+}

package/dist/common/domain/model/identity.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/common/domain/model/identityProfile.d.ts

@@ -0,0 +1,6 @@
+export interface IdentityProfile {
+    identityId: string | null;
+    email: string;
+    givenName: string;
+    familyName: string;
+}

package/dist/common/domain/model/identityProfile.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { IdentityConnectorExceptionTypeEnum } from './common/domain/enum/identityConnectorExceptionType.enum';
+export { identityConnectorException, IdentityConnectorException, identityConnectorExceptionTypeOf, } from './module/identity/domain/exception/identityConnectorException';
+export { Identity } from './common/domain/model/identity';
+export { IdentityProfile } from './common/domain/model/identityProfile';
+export { IdentityProviderOptions } from './module/identity/domain/model/identityProviderOptions';
+export { IdentityConnectorModuleOptions } from './module/identity/domain/model/identityConnectorModuleOptions';
+export { IdentityProvider, ManagementOptionsOf, ProviderIdentity, } from './module/identity/domain/model/identityProvider';
+export { UserStore } from './module/identity/domain/model/userStore';
+export { DEFAULT_SIGN_IN_CACHE_SECONDS, IdentityConnectorModule } from './module/identity/identityConnector.module';
+export { IdentityAuthGuard } from './module/identity/service/identityAuth.guard';
+export { IdentityManagement } from './module/identity/service/identityManagement';
+export { IdentityRuntime } from './module/identity/service/identityRuntime';

package/dist/index.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityRuntime = exports.IdentityManagement = exports.IdentityAuthGuard = exports.IdentityConnectorModule = exports.DEFAULT_SIGN_IN_CACHE_SECONDS = exports.UserStore = exports.IdentityProvider = exports.IdentityProviderOptions = exports.identityConnectorExceptionTypeOf = exports.identityConnectorException = exports.IdentityConnectorExceptionTypeEnum = void 0;
+var identityConnectorExceptionType_enum_1 = require("./common/domain/enum/identityConnectorExceptionType.enum");
+Object.defineProperty(exports, "IdentityConnectorExceptionTypeEnum", { enumerable: true, get: function () { return identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum; } });
+var identityConnectorException_1 = require("./module/identity/domain/exception/identityConnectorException");
+Object.defineProperty(exports, "identityConnectorException", { enumerable: true, get: function () { return identityConnectorException_1.identityConnectorException; } });
+Object.defineProperty(exports, "identityConnectorExceptionTypeOf", { enumerable: true, get: function () { return identityConnectorException_1.identityConnectorExceptionTypeOf; } });
+var identityProviderOptions_1 = require("./module/identity/domain/model/identityProviderOptions");
+Object.defineProperty(exports, "IdentityProviderOptions", { enumerable: true, get: function () { return identityProviderOptions_1.IdentityProviderOptions; } });
+var identityProvider_1 = require("./module/identity/domain/model/identityProvider");
+Object.defineProperty(exports, "IdentityProvider", { enumerable: true, get: function () { return identityProvider_1.IdentityProvider; } });
+var userStore_1 = require("./module/identity/domain/model/userStore");
+Object.defineProperty(exports, "UserStore", { enumerable: true, get: function () { return userStore_1.UserStore; } });
+var identityConnector_module_1 = require("./module/identity/identityConnector.module");
+Object.defineProperty(exports, "DEFAULT_SIGN_IN_CACHE_SECONDS", { enumerable: true, get: function () { return identityConnector_module_1.DEFAULT_SIGN_IN_CACHE_SECONDS; } });
+Object.defineProperty(exports, "IdentityConnectorModule", { enumerable: true, get: function () { return identityConnector_module_1.IdentityConnectorModule; } });
+var identityAuth_guard_1 = require("./module/identity/service/identityAuth.guard");
+Object.defineProperty(exports, "IdentityAuthGuard", { enumerable: true, get: function () { return identityAuth_guard_1.IdentityAuthGuard; } });
+var identityManagement_1 = require("./module/identity/service/identityManagement");
+Object.defineProperty(exports, "IdentityManagement", { enumerable: true, get: function () { return identityManagement_1.IdentityManagement; } });
+var identityRuntime_1 = require("./module/identity/service/identityRuntime");
+Object.defineProperty(exports, "IdentityRuntime", { enumerable: true, get: function () { return identityRuntime_1.IdentityRuntime; } });

package/dist/module/entra/domain/model/entraProviderOptions.d.ts

@@ -0,0 +1,6 @@
+import { IdentityProviderOptions } from '../../../identity/domain/model/identityProviderOptions';
+export declare class EntraProviderOptions extends IdentityProviderOptions {
+    tenantId: string;
+    audience: string | string[];
+    acceptIdTokens?: boolean;
+}

package/dist/module/entra/domain/model/entraProviderOptions.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraProviderOptions = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const identityProviderOptions_1 = require("../../../identity/domain/model/identityProviderOptions");
+const default_decorator_1 = require("../../../identity/domain/validation/default.decorator");
+const trimmed_decorator_1 = require("../../../identity/domain/validation/trimmed.decorator");
+class EntraProviderOptions extends identityProviderOptions_1.IdentityProviderOptions {
+}
+exports.EntraProviderOptions = EntraProviderOptions;
+__decorate([
+    (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim().toLowerCase() : value)),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.Matches)(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, {
+        message: '$property must be the GUID of one tenant, not "$value"; a multi-tenant value names no single issuer',
+    }),
+    __metadata("design:type", String)
+], EntraProviderOptions.prototype, "tenantId", void 0);
+__decorate([
+    (0, trimmed_decorator_1.TrimmedList)(true),
+    (0, class_validator_1.IsArray)({ message: '$property must be a non-empty string, or a list of them' }),
+    (0, class_validator_1.ArrayNotEmpty)({ message: '$property must name at least one audience' }),
+    (0, class_validator_1.IsString)({ each: true }),
+    (0, class_validator_1.IsNotEmpty)({ each: true }),
+    __metadata("design:type", Object)
+], EntraProviderOptions.prototype, "audience", void 0);
+__decorate([
+    (0, default_decorator_1.Default)(false),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], EntraProviderOptions.prototype, "acceptIdTokens", void 0);

package/dist/module/entra/index.d.ts

@@ -0,0 +1,2 @@
+export { EntraProviderOptions } from './domain/model/entraProviderOptions';
+export { EntraProvider } from './service/entra.provider';

package/dist/module/entra/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraProvider = exports.EntraProviderOptions = void 0;
+var entraProviderOptions_1 = require("./domain/model/entraProviderOptions");
+Object.defineProperty(exports, "EntraProviderOptions", { enumerable: true, get: function () { return entraProviderOptions_1.EntraProviderOptions; } });
+var entra_provider_1 = require("./service/entra.provider");
+Object.defineProperty(exports, "EntraProvider", { enumerable: true, get: function () { return entra_provider_1.EntraProvider; } });

package/dist/module/entra/service/entra.provider.d.ts

@@ -0,0 +1,23 @@
+import { IdentityProfile } from '../../../common/domain/model/identityProfile';
+import { IdentityProvider, ProviderIdentity } from '../../identity/domain/model/identityProvider';
+import { EntraProviderOptions } from '../domain/model/entraProviderOptions';
+export declare class EntraProvider extends IdentityProvider {
+    readonly issuers: [string, ...string[]];
+    private readonly tenantId;
+    private readonly audience;
+    private readonly acceptIdTokens;
+    private readonly verifier;
+    constructor(options: EntraProviderOptions);
+    private get loginUrl();
+    private get v1IssuerUrl();
+    authenticate(accessToken: string): Promise<ProviderIdentity>;
+    readProfile(accessToken: string, identity: ProviderIdentity): Promise<ProviderIdentity>;
+    findByEmail(email: string, managementOptions: unknown): Promise<string | null>;
+    create(profile: IdentityProfile, managementOptions: unknown): Promise<string>;
+    createAccountSetupLink(identityId: string, managementOptions: unknown, options?: {
+        returnUrl?: string;
+    }): Promise<string>;
+    isFederated(email: string, managementOptions: unknown): Promise<boolean>;
+    private static isIdToken;
+    private static rolesOf;
+}

package/dist/module/entra/service/entra.provider.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraProvider = void 0;
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../../identity/domain/exception/identityConnectorException");
+const identityProvider_1 = require("../../identity/domain/model/identityProvider");
+const validateOptions_1 = require("../../identity/domain/validation/validateOptions");
+const signedToken_verifier_1 = require("../../jwt/service/signedToken.verifier");
+const entraProviderOptions_1 = require("../domain/model/entraProviderOptions");
+class EntraProvider extends identityProvider_1.IdentityProvider {
+    constructor(options) {
+        const checked = (0, validateOptions_1.validateOptions)(entraProviderOptions_1.EntraProviderOptions, options, `Entra provider "${options?.name}"`);
+        super(checked);
+        this.tenantId = checked.tenantId;
+        this.audience = checked.audience;
+        this.acceptIdTokens = checked.acceptIdTokens;
+        this.issuers = [`${this.loginUrl}/${this.tenantId}/v2.0`, `${this.v1IssuerUrl}/${this.tenantId}/`];
+        this.verifier = new signedToken_verifier_1.SignedTokenVerifier({
+            keysUrl: `${this.loginUrl}/${this.tenantId}/discovery/v2.0/keys`,
+            issuers: this.issuers,
+            audience: this.audience,
+        });
+    }
+    get loginUrl() {
+        return 'https://login.microsoftonline.com';
+    }
+    get v1IssuerUrl() {
+        return 'https://sts.windows.net';
+    }
+    async authenticate(accessToken) {
+        const claims = await this.verifier.verify(accessToken);
+        if (typeof claims.oid !== 'string' || claims.oid === '') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        const hasScopes = typeof claims.scp === 'string' && claims.scp.trim() !== '';
+        if (!hasScopes && !(this.acceptIdTokens && EntraProvider.isIdToken(claims))) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        return {
+            id: claims.oid,
+            email: typeof claims.email === 'string' ? claims.email : null,
+            emailVerified: false,
+            givenName: typeof claims.given_name === 'string' ? claims.given_name : null,
+            familyName: typeof claims.family_name === 'string' ? claims.family_name : null,
+            roles: EntraProvider.rolesOf(claims),
+        };
+    }
+    async readProfile(accessToken, identity) {
+        return identity;
+    }
+    async findByEmail(email, managementOptions) {
+        throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_CONFIGURED);
+    }
+    async create(profile, managementOptions) {
+        throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_CONFIGURED);
+    }
+    async createAccountSetupLink(identityId, managementOptions, options) {
+        throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_SUPPORTED);
+    }
+    async isFederated(email, managementOptions) {
+        throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_SUPPORTED);
+    }
+    static isIdToken(claims) {
+        const namesClient = ['azp', 'appid'].some((claim) => claims[claim] !== undefined) || claims.idtyp === 'app';
+        const namesPerson = ['name', 'preferred_username', 'unique_name'].some((claim) => typeof claims[claim] === 'string' && claims[claim].trim() !== '');
+        return !namesClient && namesPerson;
+    }
+    static rolesOf(claims) {
+        return Array.isArray(claims.roles) ? claims.roles.filter((role) => typeof role === 'string') : [];
+    }
+}
+exports.EntraProvider = EntraProvider;

package/dist/module/identity/domain/exception/identityConnectorException.d.ts

@@ -0,0 +1,5 @@
+import { BaseException, GenericErrorDetailDto, PreconditionFailedDetailDto } from '@ballistix.digital/exception-types';
+import { IdentityConnectorExceptionTypeEnum } from '../../../../common/domain/enum/identityConnectorExceptionType.enum';
+export type IdentityConnectorException = BaseException<GenericErrorDetailDto | PreconditionFailedDetailDto>;
+export declare function identityConnectorException(type: IdentityConnectorExceptionTypeEnum): IdentityConnectorException;
+export declare function identityConnectorExceptionTypeOf(error: unknown): IdentityConnectorExceptionTypeEnum | undefined;

package/dist/module/identity/domain/exception/identityConnectorException.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityConnectorException = identityConnectorException;
+exports.identityConnectorExceptionTypeOf = identityConnectorExceptionTypeOf;
+const exception_types_1 = require("@ballistix.digital/exception-types");
+const identityConnectorExceptionType_enum_1 = require("../../../../common/domain/enum/identityConnectorExceptionType.enum");
+const { ACCESS_DENIED, GENERIC_ERROR, PRECONDITION_FAILED, UNAUTHENTICATED } = exception_types_1.ExceptionCodeEnum;
+const ENVELOPE_BY_TYPE = {
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NO_TOKEN]: { code: UNAUTHENTICATED, status: 401 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.UNKNOWN_ISSUER]: { code: UNAUTHENTICATED, status: 401 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_NOT_ACCEPTED]: { code: UNAUTHENTICATED, status: 401 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN]: { code: UNAUTHENTICATED, status: 401 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE]: { code: GENERIC_ERROR, status: 503 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED]: { code: ACCESS_DENIED, status: 403 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_PROVISIONED]: { code: PRECONDITION_FAILED, status: 409 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.IDENTITY_ALREADY_LINKED]: { code: PRECONDITION_FAILED, status: 409 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.LINK_REFUSED]: { code: PRECONDITION_FAILED, status: 409 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NO_EMAIL]: { code: PRECONDITION_FAILED, status: 409 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_SUPPORTED]: { code: GENERIC_ERROR, status: 501 },
+    [identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_CONFIGURED]: { code: GENERIC_ERROR, status: 503 },
+};
+const TYPES = new Set(Object.values(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum));
+function identityConnectorException(type) {
+    const { code, status } = ENVELOPE_BY_TYPE[type];
+    if (code === PRECONDITION_FAILED) {
+        return new exception_types_1.PreconditionFailedException(type);
+    }
+    if (code === ACCESS_DENIED) {
+        return new exception_types_1.AccessDeniedException(type);
+    }
+    if (code === UNAUTHENTICATED) {
+        return new exception_types_1.UnauthenticatedException(type);
+    }
+    return new exception_types_1.GenericErrorException(type, status);
+}
+function identityConnectorExceptionTypeOf(error) {
+    if (!(error instanceof exception_types_1.BaseException)) {
+        return undefined;
+    }
+    const detail = error.errors?.[0];
+    const candidate = error.code === PRECONDITION_FAILED ? detail?.condition : detail?.message;
+    if (typeof candidate !== 'string' || !TYPES.has(candidate)) {
+        return undefined;
+    }
+    const type = candidate;
+    const expected = identityConnectorException(type);
+    return error.code === expected.code && error.status === expected.status ? type : undefined;
+}

package/dist/module/identity/domain/model/identityConnectorModuleOptions.d.ts

@@ -0,0 +1,7 @@
+import { ModuleMetadata, Type } from '@nestjs/common';
+import { IdentityProvider } from './identityProvider';
+export interface IdentityConnectorModuleOptions {
+    identityProviders: Type<IdentityProvider>[];
+    imports?: ModuleMetadata['imports'];
+    signInCacheSeconds?: number;
+}

package/dist/module/identity/domain/model/identityConnectorModuleOptions.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/module/identity/domain/model/identityProvider.d.ts

@@ -0,0 +1,22 @@
+import { Type } from '@nestjs/common';
+import { Identity } from '../../../../common/domain/model/identity';
+import { IdentityProfile } from '../../../../common/domain/model/identityProfile';
+import { IdentityProviderOptions } from './identityProviderOptions';
+export type ProviderIdentity = Omit<Identity, 'provider'>;
+export declare abstract class IdentityProvider<TManagementOptions = unknown> {
+    readonly name: string;
+    abstract readonly issuers: string[];
+    readonly linkByEmail: boolean;
+    readonly createOnSignIn: boolean;
+    constructor(options: IdentityProviderOptions);
+    abstract authenticate(accessToken: string): Promise<ProviderIdentity>;
+    abstract readProfile(accessToken: string, identity: ProviderIdentity): Promise<ProviderIdentity>;
+    get managementOptionsType(): Type<TManagementOptions> | undefined;
+    abstract findByEmail(email: string, managementOptions: TManagementOptions): Promise<string | null>;
+    abstract create(profile: IdentityProfile, managementOptions: TManagementOptions): Promise<string>;
+    abstract createAccountSetupLink(identityId: string, managementOptions: TManagementOptions, options?: {
+        returnUrl?: string;
+    }): Promise<string>;
+    abstract isFederated(email: string, managementOptions: TManagementOptions): Promise<boolean>;
+}
+export type ManagementOptionsOf<TProvider> = TProvider extends IdentityProvider<infer T> ? T : never;

package/dist/module/identity/domain/model/identityProvider.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProvider = void 0;
+const validateOptions_1 = require("../validation/validateOptions");
+const identityProviderOptions_1 = require("./identityProviderOptions");
+class IdentityProvider {
+    constructor(options) {
+        const checked = (0, validateOptions_1.validateOptions)(identityProviderOptions_1.IdentityProviderOptions, options, `Identity provider "${options?.name}"`);
+        this.name = checked.name;
+        this.linkByEmail = checked.linkByEmail;
+        this.createOnSignIn = checked.createOnSignIn;
+    }
+    get managementOptionsType() {
+        return undefined;
+    }
+}
+exports.IdentityProvider = IdentityProvider;

package/dist/module/identity/domain/model/identityProviderOptions.d.ts

@@ -0,0 +1,5 @@
+export declare class IdentityProviderOptions {
+    name: string;
+    linkByEmail?: boolean;
+    createOnSignIn?: boolean;
+}

package/dist/module/identity/domain/model/identityProviderOptions.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityProviderOptions = void 0;
+const class_validator_1 = require("class-validator");
+const default_decorator_1 = require("../validation/default.decorator");
+const trimmed_decorator_1 = require("../validation/trimmed.decorator");
+class IdentityProviderOptions {
+}
+exports.IdentityProviderOptions = IdentityProviderOptions;
+__decorate([
+    (0, trimmed_decorator_1.Trimmed)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], IdentityProviderOptions.prototype, "name", void 0);
+__decorate([
+    (0, default_decorator_1.Default)(false),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], IdentityProviderOptions.prototype, "linkByEmail", void 0);
+__decorate([
+    (0, default_decorator_1.Default)(false),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], IdentityProviderOptions.prototype, "createOnSignIn", void 0);

package/dist/module/identity/domain/model/identityProvidersToken.d.ts

@@ -0,0 +1 @@
+export declare const IDENTITY_PROVIDERS: unique symbol;

package/dist/module/identity/domain/model/identityProvidersToken.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_PROVIDERS = void 0;
+exports.IDENTITY_PROVIDERS = Symbol('IDENTITY_PROVIDERS');

package/dist/module/identity/domain/model/userStore.d.ts

@@ -0,0 +1,10 @@
+import { Identity } from '../../../../common/domain/model/identity';
+import { IdentityProfile } from '../../../../common/domain/model/identityProfile';
+export declare abstract class UserStore<TUser> {
+    abstract findByIdentityId(identityId: string, provider: string, transaction?: unknown): Promise<TUser | null>;
+    linkByEmail(identity: Identity): Promise<TUser | null>;
+    create(identity: Identity): Promise<TUser | null>;
+    abstract sync(user: TUser, identity: Identity): Promise<TUser>;
+    abstract toProfile(user: TUser, provider: string): IdentityProfile;
+    abstract link(user: TUser, identityId: string, provider: string, transaction?: unknown): Promise<boolean>;
+}

package/dist/module/identity/domain/model/userStore.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserStore = void 0;
+class UserStore {
+    async linkByEmail(identity) {
+        return null;
+    }
+    async create(identity) {
+        return null;
+    }
+}
+exports.UserStore = UserStore;

package/dist/module/identity/domain/validation/default.decorator.d.ts

@@ -0,0 +1 @@
+export declare function Default(fallback: unknown): PropertyDecorator;

package/dist/module/identity/domain/validation/default.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Default = Default;
+const class_transformer_1 = require("class-transformer");
+function Default(fallback) {
+    return (target, property) => {
+        (0, class_transformer_1.Expose)()(target, property);
+        (0, class_transformer_1.Transform)(({ value }) => value ?? fallback)(target, property);
+    };
+}

package/dist/module/identity/domain/validation/trimmed.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare function Trimmed(): PropertyDecorator;
+export declare function TrimmedList(acceptOne?: boolean): PropertyDecorator;

package/dist/module/identity/domain/validation/trimmed.decorator.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Trimmed = Trimmed;
+exports.TrimmedList = TrimmedList;
+const class_transformer_1 = require("class-transformer");
+function Trimmed() {
+    return (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value));
+}
+function TrimmedList(acceptOne = false) {
+    return (0, class_transformer_1.Transform)(({ value }) => {
+        const list = acceptOne && typeof value === 'string' ? [value] : value;
+        if (!Array.isArray(list) || list.some((entry) => typeof entry !== 'string')) {
+            return list;
+        }
+        return [...new Set(list.map((entry) => entry.trim()))];
+    });
+}

package/dist/module/identity/domain/validation/validateOptions.d.ts

@@ -0,0 +1,2 @@
+import { Type } from '@nestjs/common';
+export declare function validateOptions<T extends object>(type: Type<T>, options: unknown, label: string, what?: string): T;

package/dist/module/identity/domain/validation/validateOptions.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateOptions = validateOptions;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+function validateOptions(type, options, label, what = 'options') {
+    const given = (options !== null && typeof options === 'object' && !Array.isArray(options) ? options : {});
+    const declared = declaredOptionsOf(type);
+    const read = Object.fromEntries(declared.filter((option) => option in given).map((option) => [option, given[option]]));
+    const checked = (0, class_transformer_1.plainToInstance)(type, read);
+    const errors = (0, class_validator_1.validateSync)(checked, {
+        forbidUnknownValues: false,
+        validationError: { target: false, value: false },
+    });
+    if (errors.length > 0) {
+        throw new Error(`${label} has invalid ${what}: ${messagesOf(errors).join('; ')}.`, { cause: errors });
+    }
+    for (const [option, value] of Object.entries(given)) {
+        if (!declared.includes(option)) {
+            Object.defineProperty(checked, option, { value, enumerable: true, writable: true, configurable: true });
+        }
+    }
+    return checked;
+}
+function declaredOptionsOf(type) {
+    const rules = (0, class_validator_1.getMetadataStorage)().getTargetValidationMetadatas(type, '', false, false);
+    return [...new Set(rules.map((rule) => rule.propertyName))];
+}
+function messagesOf(errors, parent) {
+    return errors.flatMap((error) => {
+        const path = parent ? `${parent}.${error.property}` : error.property;
+        const message = Object.values(error.constraints ?? {}).at(-1);
+        const own = message === undefined
+            ? []
+            : [
+                message.startsWith(`${error.property} `)
+                    ? `${path}${message.slice(error.property.length)}`
+                    : parent
+                        ? `${path}: ${message}`
+                        : message,
+            ];
+        return [...own, ...messagesOf(error.children ?? [], path)];
+    });
+}

package/dist/module/identity/identityConnector.module.d.ts

@@ -0,0 +1,6 @@
+import { DynamicModule } from '@nestjs/common';
+import { IdentityConnectorModuleOptions } from './domain/model/identityConnectorModuleOptions';
+export declare const DEFAULT_SIGN_IN_CACHE_SECONDS = 60;
+export declare class IdentityConnectorModule {
+    static forRoot(options: IdentityConnectorModuleOptions): DynamicModule;
+}

package/dist/module/identity/identityConnector.module.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var IdentityConnectorModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityConnectorModule = exports.DEFAULT_SIGN_IN_CACHE_SECONDS = void 0;
+const common_1 = require("@nestjs/common");
+const identityProvidersToken_1 = require("./domain/model/identityProvidersToken");
+const identityRuntime_1 = require("./service/identityRuntime");
+const identityRuntimeInternals_1 = require("./service/identityRuntimeInternals");
+const signIn_cache_1 = require("./service/signIn.cache");
+exports.DEFAULT_SIGN_IN_CACHE_SECONDS = 60;
+let IdentityConnectorModule = IdentityConnectorModule_1 = class IdentityConnectorModule {
+    static forRoot(options) {
+        const { identityProviders } = options;
+        const signInCacheSeconds = options.signInCacheSeconds ?? exports.DEFAULT_SIGN_IN_CACHE_SECONDS;
+        signIn_cache_1.SignInCache.assertLifetime(signInCacheSeconds);
+        const listedTwice = identityProviders.find((type, index) => identityProviders.indexOf(type) !== index);
+        if (listedTwice) {
+            throw new Error(`IdentityConnectorModule.forRoot() lists ${listedTwice.name} twice in identityProviders.`);
+        }
+        return {
+            module: IdentityConnectorModule_1,
+            imports: options.imports ?? [],
+            providers: [
+                ...identityProviders,
+                {
+                    provide: identityProvidersToken_1.IDENTITY_PROVIDERS,
+                    useFactory: (...providers) => providers,
+                    inject: identityProviders,
+                },
+                { provide: signIn_cache_1.SignInCache, useFactory: () => new signIn_cache_1.SignInCache(signInCacheSeconds) },
+                { provide: identityRuntime_1.IdentityRuntime, useClass: identityRuntimeInternals_1.IdentityRuntimeInternals },
+            ],
+            exports: [identityRuntime_1.IdentityRuntime, ...identityProviders],
+        };
+    }
+};
+exports.IdentityConnectorModule = IdentityConnectorModule;
+exports.IdentityConnectorModule = IdentityConnectorModule = IdentityConnectorModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], IdentityConnectorModule);

package/dist/module/identity/service/identityAuth.guard.d.ts

@@ -0,0 +1,20 @@
+import { CanActivate, ExecutionContext, OnModuleInit } from '@nestjs/common';
+import { IdentityProvider } from '../domain/model/identityProvider';
+import { UserStore } from '../domain/model/userStore';
+import { IdentityRuntime } from './identityRuntime';
+export declare abstract class IdentityAuthGuard<TUser> implements CanActivate, OnModuleInit {
+    private readonly store;
+    private readonly runtime;
+    private readonly providers;
+    constructor(runtime: IdentityRuntime, store: UserStore<TUser>, providers: [IdentityProvider, ...IdentityProvider[]]);
+    onModuleInit(): void;
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private signIn;
+    private providerOf;
+    private static readBearerToken;
+    private static readUnverifiedIssuer;
+    private assertStoreAllows;
+    private resolveUser;
+    private authenticate;
+    private signInFirstTime;
+}