@benlampson/heimdall-server 5.5.3 → 5.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -0
- package/dist/client.js +5 -3
- package/dist/client.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/provisioning.d.ts +30 -0
- package/dist/provisioning.js +52 -0
- package/dist/provisioning.js.map +1 -0
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -1,9 +1,13 @@
|
|
|
1
1
|
# @benlampson/heimdall-server
|
|
2
2
|
|
|
3
|
+
新增独立的 `HeimdallUserProvisioningClient`，通过标准 `client_credentials` 和显式授予的 `heimdall.users.create` 创建本租户普通用户，按当前应用 RBAC 授予普通默认角色。接口、角色配置和迁移见 [用户创建接入](../../../../../docs/backend-user-provisioning.md)。该能力从 5.6.0 起提供，浏览器包不增加接口，现有登录不变。
|
|
4
|
+
|
|
3
5
|
Node 22+ 的 Heimdall 协议与只读目录客户端，版本跟随 Heimdall 整体 Release。支持 public/confidential 授权码、Device Code、服务 Token、刷新、JWT 校验、opaque Token、UserInfo、撤销/内省、退出地址和 MCP 认证头。没有 HTTP 路由、Cookie、UI 或数据库。
|
|
4
6
|
|
|
5
7
|
机密凭据由调用方的 credentialProvider 提供，不能将此入口打包到浏览器。完整示例与接口见仓库 sdk/README.md 和 sdk/API.md。
|
|
6
8
|
|
|
9
|
+
JWT 时间容差 `clockSkewSeconds` 默认 `30`，客户可设为非负安全整数秒数，`0` 禁用容差。`nbf`、`exp`、未来 `iat` 使用相同设置；缓存/刷新仍按真实到期时间执行，不跳过验签或身份边界。
|
|
10
|
+
|
|
7
11
|
```ts
|
|
8
12
|
import { HeimdallServerClient, HeimdallDirectoryClient } from '@benlampson/heimdall-server';
|
|
9
13
|
const server = new HeimdallServerClient({
|
package/dist/client.js
CHANGED
|
@@ -26,14 +26,16 @@ export class HeimdallServerClient extends HeimdallProtocolClient {
|
|
|
26
26
|
const promise = (async () => {
|
|
27
27
|
const tokens = await this.requestToken({ grant_type: 'client_credentials', scope: this.options.scope ?? '' }, signal, (fields, headers) => this.applyAuthentication(credential, fields, headers));
|
|
28
28
|
const claims = await this.validateTokens(tokens, 'BackendService');
|
|
29
|
-
|
|
29
|
+
// OAuth 响应省略 scope 时表示与请求一致；JWT 存在时仍以验签后的实际声明为准。
|
|
30
|
+
const scopes = typeof claims?.scope === 'string' ? parseScopes(claims.scope) : Array.isArray(claims?.scope) ? claims.scope : (tokens.scope ?? this.options.scope ?? '').split(' ');
|
|
30
31
|
if (!(this.options.scope ?? '').split(' ').filter(Boolean).every(scope => scopes.includes(scope)))
|
|
31
32
|
throw new HeimdallProtocolError('token_scope_mismatch');
|
|
32
33
|
const expires = Math.min(tokens.obtained_at + tokens.expires_in * 1000, typeof claims?.exp === 'number' ? claims.exp * 1000 : Infinity);
|
|
33
34
|
const refreshAt = expires - Math.min(30000, (expires - Date.now()) / 2);
|
|
35
|
+
const verifiedTokens = { ...tokens, scope: scopes.join(' ') };
|
|
34
36
|
if (this.serverOptions.cacheClientCredentials !== false)
|
|
35
|
-
this.cached = { tokens, version: credential.version, refreshAt };
|
|
36
|
-
return { ...
|
|
37
|
+
this.cached = { tokens: verifiedTokens, version: credential.version, refreshAt };
|
|
38
|
+
return { ...verifiedTokens };
|
|
37
39
|
})().finally(() => { this.tokenRequest = undefined; });
|
|
38
40
|
this.tokenRequest = { version: credential.version, promise };
|
|
39
41
|
return promise;
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAuD,MAAM,uCAAuC,CAAC;AAS3J,8CAA8C;AAC9C,MAAM,OAAO,oBAAqB,SAAQ,sBAAsB;IAGjC;IAFrB,MAAM,CAAoE;IAC1E,YAAY,CAA2D;IAC/E,YAA6B,aAAoC;QAC/D,KAAK,CAAC,aAAa,CAAC,CAAC;QADM,kBAAa,GAAb,aAAa,CAAuB;QAE/D,MAAM,MAAM,GAAG,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC;QAC5D,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;IAC5M,CAAC;IACD,uCAAuC;IACvC,KAAK,CAAC,yBAAyB,CAAC,MAAoB;QAClD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACpI,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/K,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,EAClH,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACnE,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAuD,MAAM,uCAAuC,CAAC;AAS3J,8CAA8C;AAC9C,MAAM,OAAO,oBAAqB,SAAQ,sBAAsB;IAGjC;IAFrB,MAAM,CAAoE;IAC1E,YAAY,CAA2D;IAC/E,YAA6B,aAAoC;QAC/D,KAAK,CAAC,aAAa,CAAC,CAAC;QADM,kBAAa,GAAb,aAAa,CAAuB;QAE/D,MAAM,MAAM,GAAG,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC;QAC5D,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;IAC5M,CAAC;IACD,uCAAuC;IACvC,KAAK,CAAC,yBAAyB,CAAC,MAAoB;QAClD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACpI,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/K,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,MAAM,EAClH,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACnE,iDAAiD;YACjD,MAAM,MAAM,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnL,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC3J,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxI,MAAM,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,IAAI,CAAC,aAAa,CAAC,sBAAsB,KAAK,KAAK;gBAAE,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC;YAC1I,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAC/B,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,OAAO,OAAO,CAAC;IAC/E,CAAC;IACD,4CAA4C;IAC5C,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,OAAoB,EAAE,EAAE,WAAoB;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAAG,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtJ,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QACpK,MAAM,KAAK,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAC3G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;YACrF,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,kDAAkD;IAClD,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAoB;QACvD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,MAAM;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACpI,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAChG,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IACzH,CAAC;IACD,+BAA+B;IACtB,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAsC,EAAE,MAAoB;QACpG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACxE,CAAC;IACD,gEAAgE;IAC7C,KAAK,CAAC,YAAY,CAAC,MAAuB,EAAE,OAAgB;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,IAAI,MAAM,CAAC;QACjE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACO,KAAK,CAAC,mBAAmB,CAAC,UAAgD,EAAE,MAAuB,EAAE,OAAgB;QAC3H,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC;QACvD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;aAAM,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IAC1G,CAAC;IACO,KAAK,CAAC,WAAW;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;QACzJ,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpF,CAAC;CACF;AACD,mDAAmD;AACnD,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC;QAAC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACxK,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;AACzD,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
export { HeimdallServerClient } from './client.js';
|
|
2
2
|
export type { HeimdallServerOptions } from './client.js';
|
|
3
3
|
export { HeimdallDirectoryClient } from './directory.js';
|
|
4
|
+
export { HeimdallUserProvisioningClient } from './provisioning.js';
|
|
5
|
+
export type { HeimdallUserCreateRequest, HeimdallCreatedUser } from './provisioning.js';
|
|
4
6
|
export type { DirectoryUser, DirectoryGroup, DirectoryMember, DirectoryUserPermissions, HeimdallPage } from './directory.js';
|
|
5
7
|
export { createMcpAuthenticationHeaders } from './mcp.js';
|
|
6
8
|
export { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
|
package/dist/index.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
export { HeimdallServerClient } from './client.js';
|
|
2
2
|
export { HeimdallDirectoryClient } from './directory.js';
|
|
3
|
+
export { HeimdallUserProvisioningClient } from './provisioning.js';
|
|
3
4
|
export { createMcpAuthenticationHeaders } from './mcp.js';
|
|
4
5
|
export { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
|
|
5
6
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
import { HeimdallServerClient } from './client.js';
|
|
2
|
+
/** 仅允许普通用户资料；归属、角色和审计字段不由请求决定。 */
|
|
3
|
+
export interface HeimdallUserCreateRequest {
|
|
4
|
+
username: string;
|
|
5
|
+
email: string;
|
|
6
|
+
password: string;
|
|
7
|
+
displayName?: string;
|
|
8
|
+
phone?: string;
|
|
9
|
+
}
|
|
10
|
+
/** 用户与当前应用角色已提交的结果，不包含登录凭据。 */
|
|
11
|
+
export interface HeimdallCreatedUser {
|
|
12
|
+
id: string;
|
|
13
|
+
tenantId: string;
|
|
14
|
+
applicationId: string;
|
|
15
|
+
username: string;
|
|
16
|
+
email: string;
|
|
17
|
+
displayName?: string | null;
|
|
18
|
+
phone?: string | null;
|
|
19
|
+
roleCodes: string[];
|
|
20
|
+
}
|
|
21
|
+
/** 独立的 Node 服务端用户创建客户端，不向浏览器包增加任何能力。 */
|
|
22
|
+
export declare class HeimdallUserProvisioningClient {
|
|
23
|
+
private readonly tokens;
|
|
24
|
+
private readonly tenantId;
|
|
25
|
+
private readonly applicationId;
|
|
26
|
+
private readonly endpoint;
|
|
27
|
+
constructor(tokens: HeimdallServerClient, apiBaseUrl: string, tenantId: string, applicationId: string, allowLocalhostHttp?: boolean);
|
|
28
|
+
/** 单次 POST；超时或网络失败保留失败结果，不自动重试创建。 */
|
|
29
|
+
createUser(user: HeimdallUserCreateRequest, signal?: AbortSignal): Promise<HeimdallCreatedUser>;
|
|
30
|
+
}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
import { HeimdallProtocolError } from '@benlampson/heimdall-browser/protocol';
|
|
2
|
+
/** 独立的 Node 服务端用户创建客户端，不向浏览器包增加任何能力。 */
|
|
3
|
+
export class HeimdallUserProvisioningClient {
|
|
4
|
+
tokens;
|
|
5
|
+
tenantId;
|
|
6
|
+
applicationId;
|
|
7
|
+
endpoint;
|
|
8
|
+
constructor(tokens, apiBaseUrl, tenantId, applicationId, allowLocalhostHttp = false) {
|
|
9
|
+
this.tokens = tokens;
|
|
10
|
+
this.tenantId = tenantId;
|
|
11
|
+
this.applicationId = applicationId;
|
|
12
|
+
const base = new URL(apiBaseUrl.endsWith('/') ? apiBaseUrl : apiBaseUrl + '/');
|
|
13
|
+
if ((base.protocol !== 'https:' && !(allowLocalhostHttp && base.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(base.hostname)))
|
|
14
|
+
|| base.username || base.password || base.search || base.hash || !tenantId || !applicationId)
|
|
15
|
+
throw new HeimdallProtocolError('invalid_user_provisioning_configuration');
|
|
16
|
+
this.endpoint = new URL('api/backend/users', base);
|
|
17
|
+
}
|
|
18
|
+
/** 单次 POST；超时或网络失败保留失败结果，不自动重试创建。 */
|
|
19
|
+
async createUser(user, signal) {
|
|
20
|
+
const allowed = ['username', 'email', 'password', 'displayName', 'phone'];
|
|
21
|
+
if (!user || Object.keys(user).some(key => !allowed.includes(key)) || typeof user.username !== 'string' || !user.username.trim()
|
|
22
|
+
|| typeof user.email !== 'string' || !user.email.trim() || typeof user.password !== 'string' || !user.password.trim()
|
|
23
|
+
|| user.password.length < 12 || user.password.length > 128)
|
|
24
|
+
throw new HeimdallProtocolError('invalid_user_create_request');
|
|
25
|
+
const token = await this.tokens.getClientCredentialsToken(signal);
|
|
26
|
+
if (!(token.scope ?? '').split(' ').includes('heimdall.users.create'))
|
|
27
|
+
throw new HeimdallProtocolError('missing_user_create_scope');
|
|
28
|
+
const response = await fetch(this.endpoint, {
|
|
29
|
+
method: 'POST', headers: { Authorization: `Bearer ${token.access_token}`, 'Content-Type': 'application/json' },
|
|
30
|
+
body: JSON.stringify({ username: user.username, email: user.email, password: user.password, displayName: user.displayName, phone: user.phone }),
|
|
31
|
+
credentials: 'omit', redirect: 'error', signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(15000)]) : AbortSignal.timeout(15000),
|
|
32
|
+
});
|
|
33
|
+
if (!response.ok)
|
|
34
|
+
throw new HeimdallProtocolError(`http_${response.status}`, response.status);
|
|
35
|
+
let value;
|
|
36
|
+
try {
|
|
37
|
+
value = await response.json();
|
|
38
|
+
}
|
|
39
|
+
catch {
|
|
40
|
+
throw new HeimdallProtocolError('invalid_response');
|
|
41
|
+
}
|
|
42
|
+
if (!value || typeof value !== 'object' || value.code !== 200)
|
|
43
|
+
throw new HeimdallProtocolError('resource_error');
|
|
44
|
+
const created = value.data;
|
|
45
|
+
if (!created || typeof created.id !== 'string' || !created.id.trim() || created.tenantId !== this.tenantId
|
|
46
|
+
|| created.applicationId !== this.applicationId || created.username !== user.username.trim() || created.email !== user.email.trim()
|
|
47
|
+
|| !Array.isArray(created.roleCodes) || !created.roleCodes.length || created.roleCodes.some(code => typeof code !== 'string' || !code.trim()))
|
|
48
|
+
throw new HeimdallProtocolError('invalid_user_response');
|
|
49
|
+
return created;
|
|
50
|
+
}
|
|
51
|
+
}
|
|
52
|
+
//# sourceMappingURL=provisioning.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../src/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAY9E,wCAAwC;AACxC,MAAM,OAAO,8BAA8B;IAEZ;IACV;IAAmC;IAFrC,QAAQ,CAAM;IAC/B,YAA6B,MAA4B,EAAE,UAAkB,EAC1D,QAAgB,EAAmB,aAAqB,EAAE,kBAAkB,GAAG,KAAK;QAD1E,WAAM,GAAN,MAAM,CAAsB;QACtC,aAAQ,GAAR,QAAQ,CAAQ;QAAmB,kBAAa,GAAb,aAAa,CAAQ;QACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;eAChJ,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa;YAC5F,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,UAAU,CAAC,IAA+B,EAAE,MAAoB;QACpE,MAAM,OAAO,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;eAC3H,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;eAClH,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC;QACpI,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC9G,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/I,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SAC5I,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,KAAc,CAAC;QAAC,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;QACzH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAiC,CAAC,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QAC9I,MAAM,OAAO,GAAI,KAAwC,CAAC,IAAI,CAAC;QAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;eACrG,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;eAChI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7I,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@benlampson/heimdall-server",
|
|
3
|
-
"version": "5.
|
|
3
|
+
"version": "5.6.0",
|
|
4
4
|
"type": "module",
|
|
5
|
-
"description": "Heimdall server OAuth, read-only directory and MCP authentication adapters.",
|
|
5
|
+
"description": "Heimdall server OAuth, tenant user provisioning, read-only directory and MCP authentication adapters.",
|
|
6
6
|
"license": "MIT",
|
|
7
7
|
"repository": {
|
|
8
8
|
"type": "git",
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"build": "tsc -p tsconfig.json"
|
|
25
25
|
},
|
|
26
26
|
"dependencies": {
|
|
27
|
-
"@benlampson/heimdall-browser": "5.
|
|
27
|
+
"@benlampson/heimdall-browser": "5.6.0"
|
|
28
28
|
},
|
|
29
29
|
"engines": {
|
|
30
30
|
"node": ">=22"
|