@ballistix.digital/identity-connector 0.0.0-local

package/dist/module/identity/service/identityAuth.guard.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityAuthGuard = void 0;
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../domain/exception/identityConnectorException");
+const userStore_1 = require("../domain/model/userStore");
+class IdentityAuthGuard {
+    constructor(runtime, store, providers) {
+        this.store = store;
+        this.runtime = runtime;
+        const guard = new.target.name;
+        if (!this.runtime?.providers) {
+            throw new Error(`${guard} needs the IdentityRuntime: register IdentityConnectorModule.forRoot() at the root of the app.`);
+        }
+        if (!Array.isArray(providers) || providers.length === 0 || Array.from(providers).some((provider) => !provider)) {
+            throw new Error(`${guard} needs at least one identity provider, and every one set: pass the providers it accepts to super().`);
+        }
+        this.providers = [...providers];
+        for (const provider of this.providers) {
+            if (!this.runtime.providers.includes(provider)) {
+                throw new Error(`${guard} accepts provider "${provider.name}", which is not an instance IdentityConnectorModule.forRoot() ` +
+                    `registers: list its class in forRoot() only, not in a module's providers as well, and inject it by that class.`);
+            }
+        }
+    }
+    onModuleInit() {
+        for (const provider of this.providers) {
+            this.assertStoreAllows(provider);
+        }
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        request.user = await this.signIn(request.headers.authorization);
+        return true;
+    }
+    async signIn(authorization) {
+        const accessToken = IdentityAuthGuard.readBearerToken(authorization);
+        const provider = this.providerOf(accessToken);
+        const identity = { ...(await this.authenticate(provider, accessToken)), provider: provider.name };
+        return this.runtime.signInCache.resolve(this.store, identity.provider, identity.id, () => this.resolveUser(provider, accessToken, identity));
+    }
+    providerOf(accessToken) {
+        const provider = this.runtime.providerOfIssuer(IdentityAuthGuard.readUnverifiedIssuer(accessToken) ?? '');
+        if (!provider) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.UNKNOWN_ISSUER);
+        }
+        if (!this.providers.includes(provider)) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_NOT_ACCEPTED);
+        }
+        return provider;
+    }
+    static readBearerToken(authorization) {
+        const [scheme, accessToken, ...rest] = (authorization ?? '').trim().split(/\s+/);
+        if (scheme?.toLowerCase() !== 'bearer' || !accessToken || rest.length > 0) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NO_TOKEN);
+        }
+        return accessToken;
+    }
+    static readUnverifiedIssuer(accessToken) {
+        try {
+            const claims = JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64url').toString());
+            return typeof claims?.iss === 'string' ? claims.iss : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    assertStoreAllows(provider) {
+        const missing = [
+            { allowed: provider.linkByEmail, option: 'linkByEmail', method: 'linkByEmail' },
+            { allowed: provider.createOnSignIn, option: 'createOnSignIn', method: 'create' },
+        ].filter(({ allowed, method }) => allowed && this.store[method] === userStore_1.UserStore.prototype[method]);
+        if (missing.length > 0) {
+            throw new Error(`${this.constructor.name} accepts provider "${provider.name}", which has ` +
+                `${missing.map(({ option }) => option).join(' and ')}, but ${this.store.constructor.name} does not ` +
+                `implement ${missing.map(({ method }) => `${method}()`).join(' and ')}: every first sign-in it allows would be refused.`);
+        }
+    }
+    async resolveUser(provider, accessToken, identity) {
+        const user = await this.store.findByIdentityId(identity.id, identity.provider);
+        if (user) {
+            return this.store.sync(user, identity);
+        }
+        return this.signInFirstTime(provider, accessToken, identity);
+    }
+    async authenticate(provider, accessToken) {
+        let identity;
+        try {
+            identity = await provider.authenticate(accessToken);
+        }
+        catch (error) {
+            if ((0, identityConnectorException_1.identityConnectorExceptionTypeOf)(error) !== undefined) {
+                throw error;
+            }
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        if (typeof identity?.id !== 'string' || identity.id.trim() === '') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        return identity;
+    }
+    async signInFirstTime(provider, accessToken, token) {
+        const identity = { ...(await provider.readProfile(accessToken, token)), provider: provider.name };
+        let user = null;
+        if (provider.linkByEmail && identity.email) {
+            user = await this.store.linkByEmail(identity);
+        }
+        if (!user && provider.createOnSignIn) {
+            user = await this.store.create(identity);
+        }
+        if (!user) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED);
+        }
+        return this.store.sync(user, identity);
+    }
+}
+exports.IdentityAuthGuard = IdentityAuthGuard;

package/dist/module/identity/service/identityManagement.d.ts

@@ -0,0 +1,16 @@
+import { IdentityProvider, ManagementOptionsOf } from '../domain/model/identityProvider';
+import { UserStore } from '../domain/model/userStore';
+import { IdentityRuntime } from './identityRuntime';
+export declare abstract class IdentityManagement<TUser, TProvider extends IdentityProvider = IdentityProvider> {
+    private readonly store;
+    private readonly provider;
+    private readonly runtime;
+    private readonly managementOptions;
+    constructor(runtime: IdentityRuntime, store: UserStore<TUser>, provider: TProvider, managementOptions: ManagementOptionsOf<TProvider>);
+    provision(user: TUser, transaction?: unknown): Promise<void>;
+    isFederated(user: TUser): Promise<boolean>;
+    createAccountSetupLink(user: TUser, options?: {
+        returnUrl?: string;
+    }): Promise<string>;
+    private profileOf;
+}

package/dist/module/identity/service/identityManagement.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityManagement = void 0;
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../domain/exception/identityConnectorException");
+const validateOptions_1 = require("../domain/validation/validateOptions");
+class IdentityManagement {
+    constructor(runtime, store, provider, managementOptions) {
+        this.store = store;
+        this.provider = provider;
+        this.runtime = runtime;
+        if (!this.runtime?.providers?.includes(provider)) {
+            throw new Error(`${new.target.name} needs a provider registered in IdentityConnectorModule.forRoot(): inject the provider class the module lists.`);
+        }
+        if (!store) {
+            throw new Error(`${new.target.name} needs a user store.`);
+        }
+        const type = provider.managementOptionsType;
+        this.managementOptions = (type
+            ? (0, validateOptions_1.validateOptions)(type, managementOptions, `${new.target.name}: identity provider "${provider.name}"`, 'management options')
+            : managementOptions);
+    }
+    async provision(user, transaction) {
+        const profile = this.profileOf(user);
+        if (profile.identityId) {
+            this.runtime.signInCache.forget(this.store, this.provider.name, profile.identityId);
+            return;
+        }
+        const identityId = (await this.provider.findByEmail(profile.email, this.managementOptions)) ??
+            (await this.provider.create(profile, this.managementOptions));
+        if (!(await this.store.link(user, identityId, this.provider.name, transaction))) {
+            const owner = await this.store.findByIdentityId(identityId, this.provider.name, transaction);
+            throw (0, identityConnectorException_1.identityConnectorException)(owner
+                ? identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.IDENTITY_ALREADY_LINKED
+                : identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.LINK_REFUSED);
+        }
+        this.runtime.signInCache.forget(this.store, this.provider.name, identityId);
+    }
+    async isFederated(user) {
+        const { email } = this.profileOf(user);
+        return this.provider.isFederated(email, this.managementOptions);
+    }
+    async createAccountSetupLink(user, options) {
+        const { identityId } = this.profileOf(user);
+        if (!identityId) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_PROVISIONED);
+        }
+        return this.provider.createAccountSetupLink(identityId, this.managementOptions, options);
+    }
+    profileOf(user) {
+        return this.store.toProfile(user, this.provider.name);
+    }
+}
+exports.IdentityManagement = IdentityManagement;

package/dist/module/identity/service/identityRuntime.d.ts

@@ -0,0 +1,2 @@
+export declare abstract class IdentityRuntime {
+}

package/dist/module/identity/service/identityRuntime.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityRuntime = void 0;
+class IdentityRuntime {
+}
+exports.IdentityRuntime = IdentityRuntime;

package/dist/module/identity/service/identityRuntimeInternals.d.ts

@@ -0,0 +1,11 @@
+import { ExceptionMapperRegistry } from '@ballistix.digital/exception-mapper';
+import { IdentityProvider } from '../domain/model/identityProvider';
+import { IdentityRuntime } from './identityRuntime';
+import { SignInCache } from './signIn.cache';
+export declare class IdentityRuntimeInternals extends IdentityRuntime {
+    readonly providers: IdentityProvider[];
+    readonly signInCache: SignInCache;
+    private readonly byIssuer;
+    constructor(providers: IdentityProvider[], signInCache: SignInCache, exceptionMapperRegistry: ExceptionMapperRegistry);
+    providerOfIssuer(issuer: string): IdentityProvider | undefined;
+}

package/dist/module/identity/service/identityRuntimeInternals.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityRuntimeInternals = void 0;
+const exception_mapper_1 = require("@ballistix.digital/exception-mapper");
+const common_1 = require("@nestjs/common");
+const identityProvidersToken_1 = require("../domain/model/identityProvidersToken");
+const identityRuntime_1 = require("./identityRuntime");
+const signIn_cache_1 = require("./signIn.cache");
+let IdentityRuntimeInternals = class IdentityRuntimeInternals extends identityRuntime_1.IdentityRuntime {
+    constructor(providers, signInCache, exceptionMapperRegistry) {
+        super();
+        this.providers = providers;
+        this.signInCache = signInCache;
+        this.byIssuer = new Map();
+        const names = new Set();
+        for (const provider of providers) {
+            if (names.has(provider.name)) {
+                throw new Error(`Two identity providers share the name "${provider.name}".`);
+            }
+            names.add(provider.name);
+            for (const issuer of provider.issuers) {
+                const owner = this.byIssuer.get(issuer);
+                if (owner && owner !== provider) {
+                    throw new Error(`Two identity providers list the issuer "${issuer}".`);
+                }
+                this.byIssuer.set(issuer, provider);
+            }
+        }
+    }
+    providerOfIssuer(issuer) {
+        return this.byIssuer.get(issuer);
+    }
+};
+exports.IdentityRuntimeInternals = IdentityRuntimeInternals;
+exports.IdentityRuntimeInternals = IdentityRuntimeInternals = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(identityProvidersToken_1.IDENTITY_PROVIDERS)),
+    __metadata("design:paramtypes", [Array, signIn_cache_1.SignInCache,
+        exception_mapper_1.ExceptionMapperRegistry])
+], IdentityRuntimeInternals);

package/dist/module/identity/service/signIn.cache.d.ts

@@ -0,0 +1,20 @@
+import { IdentityConnectorExceptionTypeEnum } from '../../../common/domain/enum/identityConnectorExceptionType.enum';
+import { UserStore } from '../domain/model/userStore';
+export type SignInOutcome = {
+    user: unknown;
+} | {
+    refused: IdentityConnectorExceptionTypeEnum;
+};
+export declare class SignInCache {
+    private readonly byStore;
+    private readonly running;
+    private readonly ttlMs;
+    constructor(seconds: number);
+    static assertLifetime(seconds: number): void;
+    resolve<TUser>(store: UserStore<unknown>, provider: string, identityId: string, signIn: () => Promise<TUser>): Promise<TUser>;
+    forget(store: UserStore<unknown>, provider: string, identityId: string): void;
+    get(store: UserStore<unknown>, provider: string, identityId: string): SignInOutcome | undefined;
+    set(store: UserStore<unknown>, provider: string, identityId: string, outcome: SignInOutcome): void;
+    private settle;
+    private sweep;
+}

package/dist/module/identity/service/signIn.cache.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInCache = void 0;
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../domain/exception/identityConnectorException");
+class SignInCache {
+    constructor(seconds) {
+        this.byStore = new WeakMap();
+        this.running = new WeakMap();
+        SignInCache.assertLifetime(seconds);
+        this.ttlMs = seconds * 1000;
+    }
+    static assertLifetime(seconds) {
+        if (typeof seconds !== 'number' || !Number.isFinite(seconds) || seconds < 0) {
+            throw new Error(`signInCacheSeconds must be a finite number of 0 or more, not ${String(seconds)}.`);
+        }
+    }
+    async resolve(store, provider, identityId, signIn) {
+        const cached = this.get(store, provider, identityId);
+        if (cached) {
+            if ('refused' in cached) {
+                throw (0, identityConnectorException_1.identityConnectorException)(cached.refused);
+            }
+            return cached.user;
+        }
+        let running = this.running.get(store);
+        if (!running) {
+            running = new Map();
+            this.running.set(store, running);
+        }
+        const key = JSON.stringify([provider, identityId]);
+        const inProgress = running.get(key);
+        if (inProgress) {
+            return inProgress;
+        }
+        const attempt = {};
+        const isCurrent = () => attempt.outcome === undefined || running.get(key) === attempt.outcome;
+        attempt.outcome = this.settle(store, provider, identityId, signIn, isCurrent).finally(() => {
+            if (isCurrent()) {
+                running.delete(key);
+            }
+        });
+        running.set(key, attempt.outcome);
+        return attempt.outcome;
+    }
+    forget(store, provider, identityId) {
+        const key = JSON.stringify([provider, identityId]);
+        this.byStore.get(store)?.entries.delete(key);
+        this.running.get(store)?.delete(key);
+    }
+    get(store, provider, identityId) {
+        const entries = this.byStore.get(store)?.entries;
+        const key = JSON.stringify([provider, identityId]);
+        const entry = entries?.get(key);
+        if (!entry || entry.expiresAt <= Date.now()) {
+            entries?.delete(key);
+            return undefined;
+        }
+        return entry.outcome;
+    }
+    set(store, provider, identityId, outcome) {
+        if (this.ttlMs <= 0) {
+            return;
+        }
+        let partition = this.byStore.get(store);
+        if (!partition) {
+            partition = { entries: new Map(), nextSweep: 0 };
+            this.byStore.set(store, partition);
+        }
+        const now = Date.now();
+        this.sweep(partition, now);
+        partition.entries.set(JSON.stringify([provider, identityId]), { outcome, expiresAt: now + this.ttlMs });
+    }
+    async settle(store, provider, identityId, signIn, isCurrent) {
+        try {
+            const user = await signIn();
+            if (isCurrent()) {
+                this.set(store, provider, identityId, { user });
+            }
+            return user;
+        }
+        catch (error) {
+            if (isCurrent() &&
+                (0, identityConnectorException_1.identityConnectorExceptionTypeOf)(error) === identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED) {
+                this.set(store, provider, identityId, { refused: identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED });
+            }
+            throw error;
+        }
+    }
+    sweep(partition, now) {
+        if (now < partition.nextSweep) {
+            return;
+        }
+        partition.nextSweep = now + this.ttlMs;
+        for (const [key, entry] of partition.entries) {
+            if (entry.expiresAt <= now) {
+                partition.entries.delete(key);
+            }
+        }
+    }
+}
+exports.SignInCache = SignInCache;

package/dist/module/jwt/service/signedToken.verifier.d.ts

@@ -0,0 +1,12 @@
+import { JWTPayload } from 'jose';
+export interface SignedTokenVerifierOptions {
+    keysUrl: string;
+    issuers: [string, ...string[]];
+    audience: string | [string, ...string[]];
+}
+export declare class SignedTokenVerifier {
+    private readonly options;
+    private readonly signingKey;
+    constructor(options: SignedTokenVerifierOptions);
+    verify(accessToken: string): Promise<JWTPayload>;
+}

package/dist/module/jwt/service/signedToken.verifier.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignedTokenVerifier = void 0;
+const jose_1 = require("jose");
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../../identity/domain/exception/identityConnectorException");
+const SIGNING_KEYS_TIMEOUT_MS = 5_000;
+const SIGNING_KEYS_MAX_AGE_MS = 10 * 60_000;
+const SIGNING_KEYS_COOLDOWN_MS = 30_000;
+const TOKEN_KEY_ERRORS = new Set([
+    jose_1.errors.JWKSNoMatchingKey.code,
+    jose_1.errors.JWKSMultipleMatchingKeys.code,
+    jose_1.errors.JOSENotSupported.code,
+]);
+class SigningKeysUnavailable extends Error {
+}
+class SignedTokenVerifier {
+    constructor(options) {
+        this.options = options;
+        const keySet = (0, jose_1.createRemoteJWKSet)(new URL(options.keysUrl), {
+            timeoutDuration: SIGNING_KEYS_TIMEOUT_MS,
+            cacheMaxAge: SIGNING_KEYS_MAX_AGE_MS,
+            cooldownDuration: SIGNING_KEYS_COOLDOWN_MS,
+        });
+        this.signingKey = async (protectedHeader, token) => {
+            if (!protectedHeader.kid) {
+                throw new jose_1.errors.JWKSNoMatchingKey();
+            }
+            try {
+                return await keySet(protectedHeader, token);
+            }
+            catch (error) {
+                if (error instanceof jose_1.errors.JOSEError && TOKEN_KEY_ERRORS.has(error.code)) {
+                    throw error;
+                }
+                throw new SigningKeysUnavailable('The signing keys could not be fetched.', { cause: error });
+            }
+        };
+    }
+    async verify(accessToken) {
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(accessToken, this.signingKey, {
+                algorithms: ['RS256'],
+                issuer: this.options.issuers,
+                audience: this.options.audience,
+            });
+            return payload;
+        }
+        catch (error) {
+            throw (0, identityConnectorException_1.identityConnectorException)(error instanceof SigningKeysUnavailable
+                ? identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE
+                : identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+    }
+}
+exports.SignedTokenVerifier = SignedTokenVerifier;

package/dist/module/zitadel/domain/model/zitadelManagementOptions.d.ts

@@ -0,0 +1,4 @@
+export declare class ZitadelManagementOptions {
+    organizationId: string;
+    federatedOrganizationIds?: string[];
+}

package/dist/module/zitadel/domain/model/zitadelManagementOptions.js

@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZitadelManagementOptions = void 0;
+const class_validator_1 = require("class-validator");
+const trimmed_decorator_1 = require("../../../identity/domain/validation/trimmed.decorator");
+class ZitadelManagementOptions {
+}
+exports.ZitadelManagementOptions = ZitadelManagementOptions;
+__decorate([
+    (0, trimmed_decorator_1.Trimmed)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ZitadelManagementOptions.prototype, "organizationId", void 0);
+__decorate([
+    (0, class_validator_1.ValidateIf)((options) => options.federatedOrganizationIds !== undefined),
+    (0, trimmed_decorator_1.TrimmedList)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    (0, class_validator_1.IsNotEmpty)({ each: true }),
+    __metadata("design:type", Array)
+], ZitadelManagementOptions.prototype, "federatedOrganizationIds", void 0);

package/dist/module/zitadel/domain/model/zitadelProviderOptions.d.ts

@@ -0,0 +1,10 @@
+import 'reflect-metadata';
+import { IdentityProviderOptions } from '../../../identity/domain/model/identityProviderOptions';
+import { ZitadelServiceUserKey } from './zitadelServiceUserKey';
+export declare class ZitadelProviderOptions extends IdentityProviderOptions {
+    issuer: string;
+    projectId: string;
+    organizationIds: string[];
+    roleOrganizationIds: string[];
+    serviceUserKey?: ZitadelServiceUserKey;
+}

package/dist/module/zitadel/domain/model/zitadelProviderOptions.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZitadelProviderOptions = void 0;
+require("reflect-metadata");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const identityProviderOptions_1 = require("../../../identity/domain/model/identityProviderOptions");
+const trimmed_decorator_1 = require("../../../identity/domain/validation/trimmed.decorator");
+const organizationIdList_decorator_1 = require("../validation/organizationIdList.decorator");
+const zitadelServiceUserKey_1 = require("./zitadelServiceUserKey");
+class ZitadelProviderOptions extends identityProviderOptions_1.IdentityProviderOptions {
+}
+exports.ZitadelProviderOptions = ZitadelProviderOptions;
+__decorate([
+    (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim().replace(/\/+$/, '') : value)),
+    (0, class_validator_1.IsUrl)({ protocols: ['http', 'https'], require_protocol: true, require_tld: false, allow_underscores: true }, { message: '$property must be an http or https URL' }),
+    __metadata("design:type", String)
+], ZitadelProviderOptions.prototype, "issuer", void 0);
+__decorate([
+    (0, trimmed_decorator_1.Trimmed)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ZitadelProviderOptions.prototype, "projectId", void 0);
+__decorate([
+    (0, organizationIdList_decorator_1.OrganizationIdList)(),
+    __metadata("design:type", Array)
+], ZitadelProviderOptions.prototype, "organizationIds", void 0);
+__decorate([
+    (0, organizationIdList_decorator_1.OrganizationIdList)(),
+    __metadata("design:type", Array)
+], ZitadelProviderOptions.prototype, "roleOrganizationIds", void 0);
+__decorate([
+    (0, class_validator_1.ValidateIf)((options) => options.serviceUserKey !== undefined),
+    (0, class_validator_1.IsObject)({ message: '$property must be the parsed key file of a service user' }),
+    (0, class_validator_1.ValidateNested)({ message: '$property must be the parsed key file of a service user' }),
+    (0, class_transformer_1.Type)(() => zitadelServiceUserKey_1.ZitadelServiceUserKey),
+    __metadata("design:type", zitadelServiceUserKey_1.ZitadelServiceUserKey)
+], ZitadelProviderOptions.prototype, "serviceUserKey", void 0);

package/dist/module/zitadel/domain/model/zitadelServiceUserKey.d.ts

@@ -0,0 +1,6 @@
+export declare class ZitadelServiceUserKey {
+    type: 'serviceaccount';
+    keyId: string;
+    key: string;
+    userId: string;
+}

package/dist/module/zitadel/domain/model/zitadelServiceUserKey.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZitadelServiceUserKey = void 0;
+const class_validator_1 = require("class-validator");
+const trimmed_decorator_1 = require("../../../identity/domain/validation/trimmed.decorator");
+const isRsaPrivateKey_decorator_1 = require("../validation/isRsaPrivateKey.decorator");
+class ZitadelServiceUserKey {
+}
+exports.ZitadelServiceUserKey = ZitadelServiceUserKey;
+__decorate([
+    (0, class_validator_1.Equals)('serviceaccount', {
+        message: '$property must be "serviceaccount": the key file of a service user, not of an application',
+    }),
+    __metadata("design:type", String)
+], ZitadelServiceUserKey.prototype, "type", void 0);
+__decorate([
+    (0, trimmed_decorator_1.Trimmed)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ZitadelServiceUserKey.prototype, "keyId", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, isRsaPrivateKey_decorator_1.IsRsaPrivateKey)(),
+    __metadata("design:type", String)
+], ZitadelServiceUserKey.prototype, "key", void 0);
+__decorate([
+    (0, trimmed_decorator_1.Trimmed)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ZitadelServiceUserKey.prototype, "userId", void 0);

package/dist/module/zitadel/domain/validation/isRsaPrivateKey.decorator.d.ts

@@ -0,0 +1,2 @@
+import { ValidationOptions } from 'class-validator';
+export declare function IsRsaPrivateKey(options?: ValidationOptions): PropertyDecorator;

package/dist/module/zitadel/domain/validation/isRsaPrivateKey.decorator.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IsRsaPrivateKey = IsRsaPrivateKey;
+const crypto_1 = require("crypto");
+const class_validator_1 = require("class-validator");
+function IsRsaPrivateKey(options) {
+    return (target, property) => (0, class_validator_1.registerDecorator)({
+        name: 'isRsaPrivateKey',
+        target: target.constructor,
+        propertyName: property,
+        options: { message: '$property must be a PEM-encoded RSA private key Node can read', ...options },
+        validator: {
+            validate(value) {
+                if (typeof value !== 'string') {
+                    return false;
+                }
+                try {
+                    return (0, crypto_1.createPrivateKey)(value).asymmetricKeyType === 'rsa';
+                }
+                catch {
+                    return false;
+                }
+            },
+        },
+    });
+}

package/dist/module/zitadel/domain/validation/organizationIdList.decorator.d.ts

@@ -0,0 +1 @@
+export declare function OrganizationIdList(): PropertyDecorator;