@ballistix.digital/identity-connector 0.0.0-local

package/dist/module/zitadel/domain/validation/organizationIdList.decorator.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationIdList = OrganizationIdList;
+const class_validator_1 = require("class-validator");
+const trimmed_decorator_1 = require("../../../identity/domain/validation/trimmed.decorator");
+function OrganizationIdList() {
+    const stack = [
+        (0, trimmed_decorator_1.TrimmedList)(),
+        (0, class_validator_1.IsArray)(),
+        (0, class_validator_1.ArrayNotEmpty)({ message: '$property must list at least one organization id' }),
+        (0, class_validator_1.IsString)({ each: true }),
+        (0, class_validator_1.IsNotEmpty)({ each: true }),
+    ];
+    return (target, property) => {
+        for (const decorator of [...stack].reverse()) {
+            decorator(target, property);
+        }
+    };
+}

package/dist/module/zitadel/index.d.ts

@@ -0,0 +1,4 @@
+export { ZitadelManagementOptions } from './domain/model/zitadelManagementOptions';
+export { ZitadelProviderOptions } from './domain/model/zitadelProviderOptions';
+export { ZitadelServiceUserKey } from './domain/model/zitadelServiceUserKey';
+export { ZitadelProvider } from './service/zitadel.provider';

package/dist/module/zitadel/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZitadelProvider = exports.ZitadelServiceUserKey = exports.ZitadelProviderOptions = exports.ZitadelManagementOptions = void 0;
+var zitadelManagementOptions_1 = require("./domain/model/zitadelManagementOptions");
+Object.defineProperty(exports, "ZitadelManagementOptions", { enumerable: true, get: function () { return zitadelManagementOptions_1.ZitadelManagementOptions; } });
+var zitadelProviderOptions_1 = require("./domain/model/zitadelProviderOptions");
+Object.defineProperty(exports, "ZitadelProviderOptions", { enumerable: true, get: function () { return zitadelProviderOptions_1.ZitadelProviderOptions; } });
+var zitadelServiceUserKey_1 = require("./domain/model/zitadelServiceUserKey");
+Object.defineProperty(exports, "ZitadelServiceUserKey", { enumerable: true, get: function () { return zitadelServiceUserKey_1.ZitadelServiceUserKey; } });
+var zitadel_provider_1 = require("./service/zitadel.provider");
+Object.defineProperty(exports, "ZitadelProvider", { enumerable: true, get: function () { return zitadel_provider_1.ZitadelProvider; } });

package/dist/module/zitadel/service/zitadel.provider.d.ts

@@ -0,0 +1,40 @@
+import { Type } from '@nestjs/common';
+import { IdentityProfile } from '../../../common/domain/model/identityProfile';
+import { IdentityProvider, ProviderIdentity } from '../../identity/domain/model/identityProvider';
+import { ZitadelManagementOptions } from '../domain/model/zitadelManagementOptions';
+import { ZitadelProviderOptions } from '../domain/model/zitadelProviderOptions';
+export declare class ZitadelProvider extends IdentityProvider<ZitadelManagementOptions> {
+    readonly issuers: [string, ...string[]];
+    private readonly issuer;
+    private readonly projectId;
+    private readonly organizationIds;
+    private readonly roleOrganizationIds;
+    private readonly userinfoTimeoutMs;
+    private readonly serviceUserKey;
+    private readonly managementTimeoutMs;
+    private readonly verifier;
+    private accessToken;
+    private readonly organizationDomains;
+    constructor(options: ZitadelProviderOptions);
+    authenticate(accessToken: string): Promise<ProviderIdentity>;
+    private rolesOf;
+    readProfile(accessToken: string, identity: ProviderIdentity): Promise<ProviderIdentity>;
+    private fetchUserinfo;
+    get managementOptionsType(): Type<ZitadelManagementOptions> | undefined;
+    private request;
+    private serviceUserAccessToken;
+    private fetchServiceUserAccessToken;
+    private post;
+    private static normalizeEmail;
+    private static requireUserId;
+    private static isTemporary;
+    private static readAnswer;
+    findByEmail(email: string, managementOptions: ZitadelManagementOptions): Promise<string | null>;
+    create(profile: IdentityProfile, managementOptions: ZitadelManagementOptions): Promise<string>;
+    createAccountSetupLink(identityId: string, managementOptions: ZitadelManagementOptions, options?: {
+        returnUrl?: string;
+    }): Promise<string>;
+    isFederated(email: string, managementOptions: ZitadelManagementOptions): Promise<boolean>;
+    private domainsOf;
+    private fetchDomains;
+}

package/dist/module/zitadel/service/zitadel.provider.js

@@ -0,0 +1,266 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZitadelProvider = void 0;
+const crypto_1 = require("crypto");
+const jose_1 = require("jose");
+const identityConnectorExceptionType_enum_1 = require("../../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../../identity/domain/exception/identityConnectorException");
+const identityProvider_1 = require("../../identity/domain/model/identityProvider");
+const validateOptions_1 = require("../../identity/domain/validation/validateOptions");
+const signedToken_verifier_1 = require("../../jwt/service/signedToken.verifier");
+const zitadelManagementOptions_1 = require("../domain/model/zitadelManagementOptions");
+const zitadelProviderOptions_1 = require("../domain/model/zitadelProviderOptions");
+const ROLES_CLAIM = 'urn:zitadel:iam:org:project:roles';
+const ORGANIZATION_CLAIM = 'urn:zitadel:iam:user:resourceowner:id';
+const USERINFO_TIMEOUT_MS = 5_000;
+const MANAGEMENT_TIMEOUT_MS = 5_000;
+const ACCESS_TOKEN_MARGIN_MS = 60_000;
+const MANAGEMENT_SCOPE = 'openid urn:zitadel:iam:org:project:id:zitadel:aud';
+const ERROR_BODY_LENGTH = 500;
+const DOMAINS_TTL_MS = 10 * 60_000;
+const ignoreFailure = () => undefined;
+class ZitadelProvider extends identityProvider_1.IdentityProvider {
+    constructor(options) {
+        const checked = (0, validateOptions_1.validateOptions)(zitadelProviderOptions_1.ZitadelProviderOptions, options, `Zitadel provider "${options?.name}"`);
+        super(checked);
+        this.userinfoTimeoutMs = USERINFO_TIMEOUT_MS;
+        this.managementTimeoutMs = MANAGEMENT_TIMEOUT_MS;
+        this.accessToken = null;
+        this.organizationDomains = new Map();
+        this.issuer = checked.issuer;
+        this.issuers = [this.issuer];
+        this.projectId = checked.projectId;
+        this.organizationIds = checked.organizationIds;
+        this.roleOrganizationIds = checked.roleOrganizationIds;
+        this.serviceUserKey = checked.serviceUserKey ?? null;
+        this.verifier = new signedToken_verifier_1.SignedTokenVerifier({
+            keysUrl: `${this.issuer}/oauth/v2/keys`,
+            issuers: this.issuers,
+            audience: this.projectId,
+        });
+    }
+    async authenticate(accessToken) {
+        const claims = await this.verifier.verify(accessToken);
+        if (typeof claims.sub !== 'string' || claims.sub === '') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        return {
+            id: claims.sub,
+            email: typeof claims.email === 'string' ? claims.email : null,
+            emailVerified: claims.email_verified === true,
+            givenName: typeof claims.given_name === 'string' ? claims.given_name : null,
+            familyName: typeof claims.family_name === 'string' ? claims.family_name : null,
+            roles: this.rolesOf(claims),
+        };
+    }
+    rolesOf(claims) {
+        const grants = claims[ROLES_CLAIM];
+        if (!grants || typeof grants !== 'object' || Array.isArray(grants)) {
+            return [];
+        }
+        return Object.entries(grants)
+            .filter(([, organizations]) => organizations !== null &&
+            typeof organizations === 'object' &&
+            this.roleOrganizationIds.some((organizationId) => Object.hasOwn(organizations, organizationId)))
+            .map(([role]) => role);
+    }
+    async readProfile(accessToken, identity) {
+        const info = await this.fetchUserinfo(accessToken);
+        if (info.sub !== identity.id) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        const organizationId = info[ORGANIZATION_CLAIM];
+        if (typeof organizationId !== 'string' || !this.organizationIds.includes(organizationId)) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED);
+        }
+        const fromUserinfo = typeof info.email === 'string';
+        return {
+            ...identity,
+            email: fromUserinfo ? info.email : identity.email,
+            emailVerified: fromUserinfo ? info.email_verified === true : identity.emailVerified,
+            givenName: typeof info.given_name === 'string' ? info.given_name : identity.givenName,
+            familyName: typeof info.family_name === 'string' ? info.family_name : identity.familyName,
+        };
+    }
+    async fetchUserinfo(accessToken) {
+        let response;
+        try {
+            response = await fetch(`${this.issuer}/oidc/v1/userinfo`, {
+                headers: { authorization: `Bearer ${accessToken}` },
+                signal: AbortSignal.timeout(this.userinfoTimeoutMs),
+            });
+        }
+        catch {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(ignoreFailure);
+            throw (0, identityConnectorException_1.identityConnectorException)(ZitadelProvider.isTemporary(response.status)
+                ? identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE
+                : identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        }
+        const info = await response.json().catch(() => undefined);
+        if (!info || typeof info !== 'object' || Array.isArray(info)) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        return info;
+    }
+    get managementOptionsType() {
+        return this.serviceUserKey ? zitadelManagementOptions_1.ZitadelManagementOptions : undefined;
+    }
+    async request(path, body, description) {
+        const accessToken = await this.serviceUserAccessToken();
+        const response = await this.post(`${this.issuer}${path}`, {
+            headers: { authorization: `Bearer ${accessToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (response.status === 401) {
+            this.accessToken = null;
+            await response.body?.cancel().catch(ignoreFailure);
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        return ZitadelProvider.readAnswer(response, description);
+    }
+    async serviceUserAccessToken() {
+        if (!this.serviceUserKey) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_CONFIGURED);
+        }
+        if (this.accessToken && this.accessToken.renewAt > Date.now()) {
+            return this.accessToken.value;
+        }
+        return this.fetchServiceUserAccessToken(this.serviceUserKey);
+    }
+    async fetchServiceUserAccessToken({ key, keyId, userId }) {
+        const assertion = await new jose_1.SignJWT()
+            .setProtectedHeader({ alg: 'RS256', kid: keyId, typ: 'JWT' })
+            .setIssuer(userId)
+            .setSubject(userId)
+            .setAudience(this.issuer)
+            .setIssuedAt()
+            .setExpirationTime('1h')
+            .sign((0, crypto_1.createPrivateKey)(key));
+        const response = await this.post(`${this.issuer}/oauth/v2/token`, {
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                scope: MANAGEMENT_SCOPE,
+                assertion,
+            }).toString(),
+        });
+        const answer = await ZitadelProvider.readAnswer(response, 'issue the service user an access token');
+        if (typeof answer.access_token !== 'string' || typeof answer.expires_in !== 'number') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        this.accessToken = {
+            value: answer.access_token,
+            renewAt: Date.now() + answer.expires_in * 1000 - ACCESS_TOKEN_MARGIN_MS,
+        };
+        return answer.access_token;
+    }
+    async post(url, init) {
+        try {
+            return await fetch(url, { method: 'POST', ...init, signal: AbortSignal.timeout(this.managementTimeoutMs) });
+        }
+        catch {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+    }
+    static normalizeEmail(email) {
+        return email.trim().toLowerCase();
+    }
+    static requireUserId(userId) {
+        if (typeof userId !== 'string' || userId === '') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        return userId;
+    }
+    static isTemporary(status) {
+        return status >= 500 || status === 408 || status === 429;
+    }
+    static async readAnswer(response, description) {
+        if (ZitadelProvider.isTemporary(response.status)) {
+            await response.body?.cancel().catch(ignoreFailure);
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        if (!response.ok) {
+            const text = (await response.text().catch(ignoreFailure)) ?? '';
+            throw new Error(`Zitadel refused to ${description}: ${response.status} ${text.slice(0, ERROR_BODY_LENGTH)}`.trim());
+        }
+        const answer = await response.json().catch(ignoreFailure);
+        if (!answer || typeof answer !== 'object' || Array.isArray(answer)) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        return answer;
+    }
+    async findByEmail(email, managementOptions) {
+        const answer = await this.request('/v2/users', {
+            query: { limit: 2 },
+            queries: [
+                { organizationIdQuery: { organizationId: managementOptions?.organizationId } },
+                {
+                    emailQuery: {
+                        emailAddress: ZitadelProvider.normalizeEmail(email),
+                        method: 'TEXT_QUERY_METHOD_EQUALS_IGNORE_CASE',
+                    },
+                },
+            ],
+        }, 'search the users by email');
+        const users = answer.result ?? [];
+        if (users.length > 1) {
+            throw new Error(`Zitadel holds more than one user with this email in organization ${managementOptions.organizationId}.`);
+        }
+        return users.length === 0 ? null : ZitadelProvider.requireUserId(users[0].userId);
+    }
+    async create(profile, managementOptions) {
+        const answer = await this.request('/v2/users/human', {
+            organization: { orgId: managementOptions?.organizationId },
+            profile: { givenName: profile.givenName, familyName: profile.familyName },
+            email: { email: ZitadelProvider.normalizeEmail(profile.email), isVerified: true },
+        }, 'create the user');
+        return ZitadelProvider.requireUserId(answer.userId);
+    }
+    async createAccountSetupLink(identityId, managementOptions, options) {
+        const answer = await this.request(`/v2/users/${encodeURIComponent(identityId)}/password_reset`, { returnCode: {} }, 'create a password code');
+        if (typeof answer.verificationCode !== 'string' || answer.verificationCode === '') {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        const query = new URLSearchParams({
+            userId: identityId,
+            code: answer.verificationCode,
+            organization: managementOptions.organizationId,
+        });
+        return `${this.issuer}/ui/v2/login/password/set?${query}`;
+    }
+    async isFederated(email, managementOptions) {
+        if (!this.serviceUserKey) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.NOT_CONFIGURED);
+        }
+        const normalized = ZitadelProvider.normalizeEmail(email);
+        const at = normalized.lastIndexOf('@');
+        const organizationIds = managementOptions?.federatedOrganizationIds ?? [];
+        if (at < 0 || organizationIds.length === 0) {
+            return false;
+        }
+        const domain = normalized.slice(at + 1).replace(/\.$/, '');
+        const domainsPerOrganization = await Promise.all(organizationIds.map((id) => this.domainsOf(id)));
+        return domainsPerOrganization.some((domains) => domains.includes(domain));
+    }
+    async domainsOf(organizationId) {
+        const cached = this.organizationDomains.get(organizationId);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.domains;
+        }
+        return this.fetchDomains(organizationId);
+    }
+    async fetchDomains(organizationId) {
+        const answer = await this.request(`/v2/organizations/${encodeURIComponent(organizationId)}/domains/search`, {}, `list the domains of organization ${organizationId}`);
+        const listed = answer.domains ?? [];
+        if (!Array.isArray(listed) || listed.some((entry) => typeof entry?.domain !== 'string')) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+        const domains = listed.map((entry) => entry.domain.toLowerCase());
+        this.organizationDomains.set(organizationId, { domains, expiresAt: Date.now() + DOMAINS_TTL_MS });
+        return domains;
+    }
+}
+exports.ZitadelProvider = ZitadelProvider;

package/dist/testing/index.d.ts

@@ -0,0 +1,2 @@
+export { RecordedManagementCall, TestIdentityProvider, TestIdentityProviderOptions, TestTokenIdentity, } from './service/testIdentityProvider.mock';
+export { ContractCheck, UserStoreContractFixture, userStoreContract } from './service/userStore.contract';

package/dist/testing/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userStoreContract = exports.TestIdentityProvider = void 0;
+var testIdentityProvider_mock_1 = require("./service/testIdentityProvider.mock");
+Object.defineProperty(exports, "TestIdentityProvider", { enumerable: true, get: function () { return testIdentityProvider_mock_1.TestIdentityProvider; } });
+var userStore_contract_1 = require("./service/userStore.contract");
+Object.defineProperty(exports, "userStoreContract", { enumerable: true, get: function () { return userStore_contract_1.userStoreContract; } });

package/dist/testing/service/testIdentityProvider.mock.d.ts

@@ -0,0 +1,42 @@
+import { IdentityProfile } from '../../common/domain/model/identityProfile';
+import { IdentityProviderOptions } from '../../module/identity/domain/model/identityProviderOptions';
+import { IdentityProvider, ProviderIdentity } from '../../module/identity/domain/model/identityProvider';
+export interface TestIdentityProviderOptions extends IdentityProviderOptions {
+    issuers: string[];
+    federatedDomains?: string[];
+}
+export type TestTokenIdentity = Partial<ProviderIdentity> & Pick<ProviderIdentity, 'id'>;
+export interface RecordedManagementCall<TManagementOptions> {
+    method: 'findByEmail' | 'create' | 'createAccountSetupLink' | 'isFederated';
+    args: unknown[];
+    managementOptions: TManagementOptions;
+}
+export declare class TestIdentityProvider<TManagementOptions = unknown> extends IdentityProvider<TManagementOptions> {
+    readonly issuers: string[];
+    readonly profiles: Map<string, Partial<ProviderIdentity>>;
+    readonly rejectedProfiles: Set<string>;
+    readonly identities: Map<string, string>;
+    readonly calls: RecordedManagementCall<TManagementOptions>[];
+    unreachable: boolean;
+    private readonly key;
+    private readonly federatedDomains;
+    private created;
+    constructor(options: TestIdentityProviderOptions);
+    createToken(identity: TestTokenIdentity, options?: {
+        issuer?: string;
+        expiresInSeconds?: number;
+    }): string;
+    authenticate(accessToken: string): Promise<ProviderIdentity>;
+    readProfile(accessToken: string, identity: ProviderIdentity): Promise<ProviderIdentity>;
+    findByEmail(email: string, managementOptions: TManagementOptions): Promise<string | null>;
+    create(profile: IdentityProfile, managementOptions: TManagementOptions): Promise<string>;
+    createAccountSetupLink(identityId: string, managementOptions: TManagementOptions, options?: {
+        returnUrl?: string;
+    }): Promise<string>;
+    isFederated(email: string, managementOptions: TManagementOptions): Promise<boolean>;
+    private static normalizeEmail;
+    reset(): void;
+    private sign;
+    private verify;
+    private assertReachable;
+}

package/dist/testing/service/testIdentityProvider.mock.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TestIdentityProvider = void 0;
+const crypto_1 = require("crypto");
+const identityConnectorExceptionType_enum_1 = require("../../common/domain/enum/identityConnectorExceptionType.enum");
+const identityConnectorException_1 = require("../../module/identity/domain/exception/identityConnectorException");
+const identityProvider_1 = require("../../module/identity/domain/model/identityProvider");
+const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
+class TestIdentityProvider extends identityProvider_1.IdentityProvider {
+    constructor(options) {
+        super(options);
+        this.profiles = new Map();
+        this.rejectedProfiles = new Set();
+        this.identities = new Map();
+        this.calls = [];
+        this.unreachable = false;
+        this.key = (0, crypto_1.randomBytes)(32);
+        this.created = 0;
+        this.issuers = options.issuers;
+        this.federatedDomains = (options.federatedDomains ?? []).map((domain) => domain.trim().toLowerCase());
+    }
+    createToken(identity, options = {}) {
+        const now = Math.floor(Date.now() / 1000);
+        const header = encode({ alg: 'HS256', typ: 'JWT' });
+        const payload = encode({
+            iss: options.issuer ?? this.issuers[0],
+            sub: identity.id,
+            iat: now,
+            exp: now + (options.expiresInSeconds ?? 3600),
+            email: identity.email ?? undefined,
+            email_verified: identity.emailVerified ?? undefined,
+            given_name: identity.givenName ?? undefined,
+            family_name: identity.familyName ?? undefined,
+            roles: identity.roles ?? undefined,
+        });
+        return `${header}.${payload}.${this.sign(`${header}.${payload}`)}`;
+    }
+    async authenticate(accessToken) {
+        this.assertReachable();
+        const claims = this.verify(accessToken);
+        return {
+            id: claims.sub,
+            email: claims.email ?? null,
+            emailVerified: claims.email_verified === true,
+            givenName: claims.given_name ?? null,
+            familyName: claims.family_name ?? null,
+            roles: Array.isArray(claims.roles) ? claims.roles : [],
+        };
+    }
+    async readProfile(accessToken, identity) {
+        this.assertReachable();
+        if (this.rejectedProfiles.has(identity.id)) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.USER_NOT_LINKED);
+        }
+        return { ...identity, ...this.profiles.get(identity.id) };
+    }
+    async findByEmail(email, managementOptions) {
+        this.calls.push({ method: 'findByEmail', args: [email], managementOptions });
+        const wanted = TestIdentityProvider.normalizeEmail(email);
+        const match = [...this.identities].find(([held]) => TestIdentityProvider.normalizeEmail(held) === wanted);
+        return match?.[1] ?? null;
+    }
+    async create(profile, managementOptions) {
+        this.calls.push({ method: 'create', args: [profile], managementOptions });
+        this.created += 1;
+        const identityId = `${this.name}-identity-${this.created}`;
+        this.identities.set(TestIdentityProvider.normalizeEmail(profile.email), identityId);
+        return identityId;
+    }
+    async createAccountSetupLink(identityId, managementOptions, options) {
+        this.calls.push({ method: 'createAccountSetupLink', args: [identityId, options], managementOptions });
+        const query = options?.returnUrl ? `?returnUrl=${encodeURIComponent(options.returnUrl)}` : '';
+        return `${this.issuers[0]}/account-setup/${identityId}${query}`;
+    }
+    async isFederated(email, managementOptions) {
+        this.calls.push({ method: 'isFederated', args: [email], managementOptions });
+        const normalized = TestIdentityProvider.normalizeEmail(email);
+        return this.federatedDomains.includes(normalized.slice(normalized.lastIndexOf('@') + 1));
+    }
+    static normalizeEmail(email) {
+        return email.trim().toLowerCase();
+    }
+    reset() {
+        this.profiles.clear();
+        this.rejectedProfiles.clear();
+        this.identities.clear();
+        this.calls.length = 0;
+        this.unreachable = false;
+        this.created = 0;
+    }
+    sign(content) {
+        return (0, crypto_1.createHmac)('sha256', this.key).update(content).digest('base64url');
+    }
+    verify(accessToken) {
+        const invalid = (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.INVALID_TOKEN);
+        const [header, payload, signature, ...rest] = accessToken.split('.');
+        if (!header || !payload || !signature || rest.length > 0) {
+            throw invalid;
+        }
+        const expected = Buffer.from(this.sign(`${header}.${payload}`));
+        const actual = Buffer.from(signature);
+        if (expected.length !== actual.length || !(0, crypto_1.timingSafeEqual)(expected, actual)) {
+            throw invalid;
+        }
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString());
+        const expired = claims.exp <= Math.floor(Date.now() / 1000);
+        if (!this.issuers.includes(claims.iss) || expired) {
+            throw invalid;
+        }
+        return claims;
+    }
+    assertReachable() {
+        if (this.unreachable) {
+            throw (0, identityConnectorException_1.identityConnectorException)(identityConnectorExceptionType_enum_1.IdentityConnectorExceptionTypeEnum.PROVIDER_UNREACHABLE);
+        }
+    }
+}
+exports.TestIdentityProvider = TestIdentityProvider;

package/dist/testing/service/userStore.contract.d.ts

@@ -0,0 +1,17 @@
+import { UserStore } from '../../module/identity/domain/model/userStore';
+export interface UserStoreContractFixture<TUser> {
+    store: UserStore<TUser>;
+    providers: string[];
+    createUser(values: {
+        email: string | null;
+        givenName: string;
+        familyName: string;
+    }): Promise<TUser>;
+    userId(user: TUser): unknown;
+    usersWithoutEmail?: boolean;
+}
+export interface ContractCheck {
+    name: string;
+    run(): Promise<void>;
+}
+export declare function userStoreContract<TUser>(fixture: () => UserStoreContractFixture<TUser> | Promise<UserStoreContractFixture<TUser>>): ContractCheck[];