@blimu/nestjs 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +87 -68
- package/dist/config/blimu.config.d.ts +0 -1
- package/dist/config/blimu.config.d.ts.map +1 -1
- package/dist/config/blimu.config.js +1 -1
- package/dist/config/blimu.config.js.map +1 -1
- package/dist/decorators/entitlement.decorator.d.ts +1 -2
- package/dist/decorators/entitlement.decorator.d.ts.map +1 -1
- package/dist/decorators/entitlement.decorator.js.map +1 -1
- package/dist/guards/entitlement.guard.d.ts +5 -6
- package/dist/guards/entitlement.guard.d.ts.map +1 -1
- package/dist/guards/entitlement.guard.js +12 -11
- package/dist/guards/entitlement.guard.js.map +1 -1
- package/dist/index.d.ts +4 -5
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +0 -1
- package/dist/index.js.map +1 -1
- package/dist/modules/blimu.module.d.ts +2 -3
- package/dist/modules/blimu.module.d.ts.map +1 -1
- package/dist/modules/blimu.module.js +11 -11
- package/dist/modules/blimu.module.js.map +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +6 -1
package/README.md
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# @blimu/nestjs
|
|
1
|
+
# @blimu/nestjs
|
|
2
2
|
|
|
3
3
|
NestJS integration library for Blimu authorization and entitlement system. This library provides decorators, guards, and services to easily integrate Blimu's authorization-as-a-service into your NestJS applications.
|
|
4
4
|
|
|
@@ -14,14 +14,14 @@ NestJS integration library for Blimu authorization and entitlement system. This
|
|
|
14
14
|
## Installation
|
|
15
15
|
|
|
16
16
|
```bash
|
|
17
|
-
npm install @blimu/nestjs
|
|
17
|
+
npm install @blimu/nestjs @blimu/backend
|
|
18
18
|
# or
|
|
19
|
-
yarn add @blimu/nestjs
|
|
19
|
+
yarn add @blimu/nestjs @blimu/backend
|
|
20
20
|
# or
|
|
21
|
-
pnpm add @blimu/nestjs
|
|
21
|
+
pnpm add @blimu/nestjs @blimu/backend
|
|
22
22
|
```
|
|
23
23
|
|
|
24
|
-
**Note:** `@blimu/
|
|
24
|
+
**Note:** `@blimu/backend` is a peer dependency and must be installed alongside this library.
|
|
25
25
|
|
|
26
26
|
## Quick Start
|
|
27
27
|
|
|
@@ -30,15 +30,15 @@ pnpm add @blimu/nestjs-blimu @blimu/runtime-sdk
|
|
|
30
30
|
#### Option A: Static Configuration
|
|
31
31
|
|
|
32
32
|
```typescript
|
|
33
|
-
import { Module } from
|
|
34
|
-
import { BlimuModule } from
|
|
33
|
+
import { Module } from "@nestjs/common";
|
|
34
|
+
import { BlimuModule } from "@blimu/nestjs";
|
|
35
35
|
|
|
36
36
|
@Module({
|
|
37
37
|
imports: [
|
|
38
38
|
BlimuModule.forRoot({
|
|
39
|
-
apiSecretKey:
|
|
40
|
-
baseURL:
|
|
41
|
-
environmentId:
|
|
39
|
+
apiSecretKey: "your-blimu-api-secret-key",
|
|
40
|
+
baseURL: "https://runtime.blimu.com", // optional
|
|
41
|
+
environmentId: "your-environment-id", // optional
|
|
42
42
|
timeoutMs: 30000, // optional
|
|
43
43
|
getUserId: (req) => req.user?.id, // Extract user ID from request
|
|
44
44
|
}),
|
|
@@ -50,19 +50,19 @@ export class AppModule {}
|
|
|
50
50
|
#### Option B: Async Configuration (Recommended)
|
|
51
51
|
|
|
52
52
|
```typescript
|
|
53
|
-
import { Module } from
|
|
54
|
-
import { ConfigModule, ConfigService } from
|
|
55
|
-
import { BlimuModule } from
|
|
53
|
+
import { Module } from "@nestjs/common";
|
|
54
|
+
import { ConfigModule, ConfigService } from "@nestjs/config";
|
|
55
|
+
import { BlimuModule } from "@blimu/nestjs";
|
|
56
56
|
|
|
57
57
|
@Module({
|
|
58
58
|
imports: [
|
|
59
59
|
ConfigModule.forRoot(),
|
|
60
60
|
BlimuModule.forRootAsync({
|
|
61
61
|
useFactory: (configService: ConfigService) => ({
|
|
62
|
-
apiSecretKey: configService.get(
|
|
63
|
-
baseURL: configService.get(
|
|
64
|
-
environmentId: configService.get(
|
|
65
|
-
timeoutMs: parseInt(configService.get(
|
|
62
|
+
apiSecretKey: configService.get("BLIMU_API_SECRET_KEY"),
|
|
63
|
+
baseURL: configService.get("BLIMU_BASE_URL"),
|
|
64
|
+
environmentId: configService.get("BLIMU_ENVIRONMENT_ID"),
|
|
65
|
+
timeoutMs: parseInt(configService.get("BLIMU_TIMEOUT_MS", "30000")),
|
|
66
66
|
getUserId: (req) => req.user?.id, // Extract user ID from request
|
|
67
67
|
}),
|
|
68
68
|
inject: [ConfigService],
|
|
@@ -75,21 +75,21 @@ export class AppModule {}
|
|
|
75
75
|
### 2. Protect Routes with Entitlements
|
|
76
76
|
|
|
77
77
|
```typescript
|
|
78
|
-
import { Controller, Get, Param } from
|
|
79
|
-
import { Entitlement } from
|
|
78
|
+
import { Controller, Get, Param } from "@nestjs/common";
|
|
79
|
+
import { Entitlement } from "@blimu/nestjs";
|
|
80
80
|
|
|
81
|
-
@Controller(
|
|
81
|
+
@Controller("workspaces")
|
|
82
82
|
export class WorkspaceController {
|
|
83
|
-
@Get(
|
|
84
|
-
@Entitlement(
|
|
85
|
-
async getWorkspace(@Param(
|
|
83
|
+
@Get(":workspaceId")
|
|
84
|
+
@Entitlement("workspace:read", (req) => req.params.workspaceId)
|
|
85
|
+
async getWorkspace(@Param("workspaceId") workspaceId: string) {
|
|
86
86
|
// User is guaranteed to have 'workspace:read' entitlement on this workspace
|
|
87
|
-
return { id: workspaceId, name:
|
|
87
|
+
return { id: workspaceId, name: "My Workspace" };
|
|
88
88
|
}
|
|
89
89
|
|
|
90
|
-
@Delete(
|
|
91
|
-
@Entitlement(
|
|
92
|
-
async deleteWorkspace(@Param(
|
|
90
|
+
@Delete(":workspaceId")
|
|
91
|
+
@Entitlement("workspace:delete", (req) => req.params.workspaceId)
|
|
92
|
+
async deleteWorkspace(@Param("workspaceId") workspaceId: string) {
|
|
93
93
|
// User is guaranteed to have 'workspace:delete' entitlement on this workspace
|
|
94
94
|
return { success: true };
|
|
95
95
|
}
|
|
@@ -99,26 +99,45 @@ export class WorkspaceController {
|
|
|
99
99
|
### 3. Use Blimu Runtime SDK in Services
|
|
100
100
|
|
|
101
101
|
```typescript
|
|
102
|
-
import { Injectable } from
|
|
103
|
-
import { BlimuRuntimeService } from
|
|
102
|
+
import { Injectable } from "@nestjs/common";
|
|
103
|
+
import { BlimuRuntimeService } from "@blimu/nestjs";
|
|
104
104
|
|
|
105
105
|
@Injectable()
|
|
106
106
|
export class UserService {
|
|
107
107
|
constructor(private readonly blimuRuntime: BlimuRuntimeService) {}
|
|
108
108
|
|
|
109
|
-
async assignUserToWorkspace(
|
|
109
|
+
async assignUserToWorkspace(
|
|
110
|
+
userId: string,
|
|
111
|
+
workspaceId: string,
|
|
112
|
+
role: string
|
|
113
|
+
) {
|
|
110
114
|
// Assign a role to a user on a workspace
|
|
111
|
-
return await this.blimuRuntime.assignRole(
|
|
115
|
+
return await this.blimuRuntime.assignRole(
|
|
116
|
+
userId,
|
|
117
|
+
role,
|
|
118
|
+
"workspace",
|
|
119
|
+
workspaceId
|
|
120
|
+
);
|
|
112
121
|
}
|
|
113
122
|
|
|
114
|
-
async checkUserPermission(
|
|
123
|
+
async checkUserPermission(
|
|
124
|
+
userId: string,
|
|
125
|
+
entitlement: string,
|
|
126
|
+
resourceId: string
|
|
127
|
+
) {
|
|
115
128
|
// Check if user has specific entitlement
|
|
116
|
-
const result = await this.blimuRuntime.checkEntitlement(
|
|
129
|
+
const result = await this.blimuRuntime.checkEntitlement(
|
|
130
|
+
userId,
|
|
131
|
+
entitlement,
|
|
132
|
+
resourceId
|
|
133
|
+
);
|
|
117
134
|
|
|
118
135
|
return result.allowed;
|
|
119
136
|
}
|
|
120
137
|
|
|
121
|
-
async createWorkspaces(
|
|
138
|
+
async createWorkspaces(
|
|
139
|
+
workspaces: Array<{ id: string; extraFields?: Record<string, unknown> }>
|
|
140
|
+
) {
|
|
122
141
|
// Create workspace resources in bulk
|
|
123
142
|
return await this.blimuRuntime.bulkCreateWorkspaces(workspaces);
|
|
124
143
|
}
|
|
@@ -242,8 +261,8 @@ The Blimu module supports generic request types for better type safety. This all
|
|
|
242
261
|
#### Basic Usage with Custom Request Type
|
|
243
262
|
|
|
244
263
|
```typescript
|
|
245
|
-
import { Request } from
|
|
246
|
-
import { BlimuModule, Entitlement } from
|
|
264
|
+
import { Request } from "express";
|
|
265
|
+
import { BlimuModule, Entitlement } from "@blimu/nestjs";
|
|
247
266
|
|
|
248
267
|
// Define your custom request interface
|
|
249
268
|
interface MyAuthenticatedRequest extends Request {
|
|
@@ -260,7 +279,7 @@ interface MyAuthenticatedRequest extends Request {
|
|
|
260
279
|
@Module({
|
|
261
280
|
imports: [
|
|
262
281
|
BlimuModule.forRoot<MyAuthenticatedRequest>({
|
|
263
|
-
apiSecretKey:
|
|
282
|
+
apiSecretKey: "your-api-secret-key",
|
|
264
283
|
getUserId: (req) => req.user.id, // req is typed as MyAuthenticatedRequest
|
|
265
284
|
}),
|
|
266
285
|
],
|
|
@@ -268,17 +287,17 @@ interface MyAuthenticatedRequest extends Request {
|
|
|
268
287
|
export class AppModule {}
|
|
269
288
|
|
|
270
289
|
// Use in controllers with full type safety
|
|
271
|
-
@Controller(
|
|
290
|
+
@Controller("workspaces")
|
|
272
291
|
export class WorkspaceController {
|
|
273
|
-
@Get(
|
|
274
|
-
@Entitlement<MyAuthenticatedRequest>(
|
|
292
|
+
@Get(":workspaceId")
|
|
293
|
+
@Entitlement<MyAuthenticatedRequest>("workspace:read", (req) => {
|
|
275
294
|
// req is properly typed, so you get IntelliSense and type checking
|
|
276
295
|
console.log(req.user.organizationId); // TypeScript knows this exists
|
|
277
296
|
console.log(req.sessionId); // This too!
|
|
278
297
|
return req.params.workspaceId;
|
|
279
298
|
})
|
|
280
|
-
async getWorkspace(@Param(
|
|
281
|
-
return { id: workspaceId, name:
|
|
299
|
+
async getWorkspace(@Param("workspaceId") workspaceId: string) {
|
|
300
|
+
return { id: workspaceId, name: "My Workspace" };
|
|
282
301
|
}
|
|
283
302
|
}
|
|
284
303
|
```
|
|
@@ -293,17 +312,17 @@ import {
|
|
|
293
312
|
AuthenticatedRequest,
|
|
294
313
|
StrictAuthenticatedRequest,
|
|
295
314
|
Entitlement,
|
|
296
|
-
} from
|
|
315
|
+
} from "@blimu/nestjs";
|
|
297
316
|
|
|
298
317
|
// Using AuthenticatedRequest (user is optional)
|
|
299
318
|
BlimuModule.forRoot<AuthenticatedRequest>({
|
|
300
|
-
apiSecretKey:
|
|
301
|
-
getUserId: (req) => req.user?.id ||
|
|
319
|
+
apiSecretKey: "your-key",
|
|
320
|
+
getUserId: (req) => req.user?.id || "", // Need optional chaining
|
|
302
321
|
});
|
|
303
322
|
|
|
304
323
|
// Using StrictAuthenticatedRequest (user is always present)
|
|
305
324
|
BlimuModule.forRoot<StrictAuthenticatedRequest>({
|
|
306
|
-
apiSecretKey:
|
|
325
|
+
apiSecretKey: "your-key",
|
|
307
326
|
getUserId: (req) => req.user.id, // No optional chaining needed
|
|
308
327
|
});
|
|
309
328
|
```
|
|
@@ -319,7 +338,7 @@ interface MyRequest extends Request {
|
|
|
319
338
|
imports: [
|
|
320
339
|
BlimuModule.forRootAsync<MyRequest>({
|
|
321
340
|
useFactory: (configService: ConfigService) => ({
|
|
322
|
-
apiSecretKey: configService.get(
|
|
341
|
+
apiSecretKey: configService.get("BLIMU_API_SECRET_KEY"),
|
|
323
342
|
getUserId: (req) => req.user.id, // Fully typed
|
|
324
343
|
}),
|
|
325
344
|
inject: [ConfigService],
|
|
@@ -342,7 +361,7 @@ BlimuModule.forRoot({
|
|
|
342
361
|
// ... other config
|
|
343
362
|
getUserId: (req) => {
|
|
344
363
|
if (!req.user?.id) {
|
|
345
|
-
throw new Error(
|
|
364
|
+
throw new Error("User not authenticated");
|
|
346
365
|
}
|
|
347
366
|
return req.user.id;
|
|
348
367
|
},
|
|
@@ -352,14 +371,14 @@ BlimuModule.forRoot({
|
|
|
352
371
|
**JWT Token Extraction:**
|
|
353
372
|
|
|
354
373
|
```typescript
|
|
355
|
-
import * as jwt from
|
|
374
|
+
import * as jwt from "jsonwebtoken";
|
|
356
375
|
|
|
357
376
|
BlimuModule.forRoot({
|
|
358
377
|
// ... other config
|
|
359
378
|
getUserId: (req) => {
|
|
360
|
-
const token = req.headers.authorization?.replace(
|
|
379
|
+
const token = req.headers.authorization?.replace("Bearer ", "");
|
|
361
380
|
if (!token) {
|
|
362
|
-
throw new Error(
|
|
381
|
+
throw new Error("No authorization token provided");
|
|
363
382
|
}
|
|
364
383
|
|
|
365
384
|
const decoded = jwt.verify(token, process.env.JWT_SECRET) as any;
|
|
@@ -374,9 +393,9 @@ BlimuModule.forRoot({
|
|
|
374
393
|
BlimuModule.forRoot({
|
|
375
394
|
// ... other config
|
|
376
395
|
getUserId: (req) => {
|
|
377
|
-
const userId = req.headers[
|
|
396
|
+
const userId = req.headers["x-user-id"] as string;
|
|
378
397
|
if (!userId) {
|
|
379
|
-
throw new Error(
|
|
398
|
+
throw new Error("User ID header missing");
|
|
380
399
|
}
|
|
381
400
|
return userId;
|
|
382
401
|
},
|
|
@@ -390,10 +409,10 @@ BlimuModule.forRootAsync({
|
|
|
390
409
|
useFactory: (userService: UserService) => ({
|
|
391
410
|
// ... other config
|
|
392
411
|
getUserId: async (req) => {
|
|
393
|
-
const sessionId = req.headers[
|
|
412
|
+
const sessionId = req.headers["x-session-id"] as string;
|
|
394
413
|
const user = await userService.findBySessionId(sessionId);
|
|
395
414
|
if (!user) {
|
|
396
|
-
throw new Error(
|
|
415
|
+
throw new Error("Invalid session");
|
|
397
416
|
}
|
|
398
417
|
return user.id;
|
|
399
418
|
},
|
|
@@ -408,15 +427,15 @@ BlimuModule.forRootAsync({
|
|
|
408
427
|
BlimuModule.forRoot({
|
|
409
428
|
// ... other config
|
|
410
429
|
getUserId: async (req) => {
|
|
411
|
-
const apiKey = req.headers[
|
|
430
|
+
const apiKey = req.headers["x-api-key"] as string;
|
|
412
431
|
if (!apiKey) {
|
|
413
|
-
throw new Error(
|
|
432
|
+
throw new Error("API key required");
|
|
414
433
|
}
|
|
415
434
|
|
|
416
435
|
// Look up user by API key
|
|
417
436
|
const user = await apiKeyService.findUserByKey(apiKey);
|
|
418
437
|
if (!user) {
|
|
419
|
-
throw new Error(
|
|
438
|
+
throw new Error("Invalid API key");
|
|
420
439
|
}
|
|
421
440
|
|
|
422
441
|
return user.id;
|
|
@@ -438,17 +457,17 @@ If the `getUserId` function throws an error or returns a falsy value, the entitl
|
|
|
438
457
|
For complex scenarios where the resource ID isn't directly in the request parameters:
|
|
439
458
|
|
|
440
459
|
```typescript
|
|
441
|
-
@Controller(
|
|
460
|
+
@Controller("projects")
|
|
442
461
|
export class ProjectController {
|
|
443
462
|
constructor(private readonly projectService: ProjectService) {}
|
|
444
463
|
|
|
445
|
-
@Delete(
|
|
446
|
-
@Entitlement(
|
|
464
|
+
@Delete(":projectId/items/:itemId")
|
|
465
|
+
@Entitlement("project:delete_item", async (req) => {
|
|
447
466
|
// Extract project ID from item
|
|
448
467
|
const item = await this.projectService.findItemById(req.params.itemId);
|
|
449
468
|
return item.projectId;
|
|
450
469
|
})
|
|
451
|
-
async deleteItem(@Param(
|
|
470
|
+
async deleteItem(@Param("itemId") itemId: string) {
|
|
452
471
|
// Implementation
|
|
453
472
|
}
|
|
454
473
|
}
|
|
@@ -480,8 +499,8 @@ export class AdvancedService {
|
|
|
480
499
|
const client = this.blimuRuntime.getClient();
|
|
481
500
|
|
|
482
501
|
// Use any SDK method
|
|
483
|
-
const users = await client.users.list({ resourceId:
|
|
484
|
-
const roles = await client.roles.list({ userId:
|
|
502
|
+
const users = await client.users.list({ resourceId: "workspace123" });
|
|
503
|
+
const roles = await client.roles.list({ userId: "user456" });
|
|
485
504
|
|
|
486
505
|
// Batch operations, etc.
|
|
487
506
|
}
|
|
@@ -509,7 +528,7 @@ The library throws `ForbiddenException` when:
|
|
|
509
528
|
- Blimu API is unreachable
|
|
510
529
|
|
|
511
530
|
```typescript
|
|
512
|
-
import { ForbiddenException } from
|
|
531
|
+
import { ForbiddenException } from "@nestjs/common";
|
|
513
532
|
|
|
514
533
|
// This is automatically handled by the @Entitlement decorator
|
|
515
534
|
// But you can catch it in your exception filters if needed
|
|
@@ -522,14 +541,14 @@ If you're migrating from platform-specific entitlement code:
|
|
|
522
541
|
### Before (Platform-specific)
|
|
523
542
|
|
|
524
543
|
```typescript
|
|
525
|
-
import { NestBlimuModule } from
|
|
526
|
-
import { Entitlement } from
|
|
544
|
+
import { NestBlimuModule } from "./entitlement/entitlement.module";
|
|
545
|
+
import { Entitlement } from "./entitlement/entitlement.decorator";
|
|
527
546
|
```
|
|
528
547
|
|
|
529
548
|
### After (Library)
|
|
530
549
|
|
|
531
550
|
```typescript
|
|
532
|
-
import { BlimuModule, Entitlement } from
|
|
551
|
+
import { BlimuModule, Entitlement } from "@blimu/nestjs";
|
|
533
552
|
```
|
|
534
553
|
|
|
535
554
|
The API is identical, just import from the library instead.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blimu.config.d.ts","sourceRoot":"","sources":["../../src/config/blimu.config.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"blimu.config.d.ts","sourceRoot":"","sources":["../../src/config/blimu.config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,WAAW,CAAC,QAAQ,SAAS,OAAO,GAAG,OAAO;IAI7D,YAAY,EAAE,MAAM,CAAC;IAMrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAMjB,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,SAAS,CAAC,EAAE,MAAM,CAAC;IA2BnB,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5D;AAKD,eAAO,MAAM,YAAY,eAAyB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blimu.config.js","sourceRoot":"","sources":["../../src/config/blimu.config.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"blimu.config.js","sourceRoot":"","sources":["../../src/config/blimu.config.ts"],"names":[],"mappings":";;;AA0Da,QAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC"}
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
import {
|
|
2
|
-
import { Schema } from '@blimu/runtime-sdk';
|
|
1
|
+
import { Schema } from "@blimu/backend";
|
|
3
2
|
export declare const Entitlement: <TRequest extends Request = Request>(entitlementKey: Schema.EntitlementType, resourceIdExtractor: (request: TRequest) => string | Promise<string>) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
|
|
4
3
|
//# sourceMappingURL=entitlement.decorator.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entitlement.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/entitlement.decorator.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"entitlement.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/entitlement.decorator.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA4ExC,eAAO,MAAM,WAAW,GAAI,QAAQ,SAAS,OAAO,GAAG,OAAO,EAC5D,gBAAgB,MAAM,CAAC,eAAe,EACtC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,gJAMrE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entitlement.decorator.js","sourceRoot":"","sources":["../../src/decorators/entitlement.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;
|
|
1
|
+
{"version":3,"file":"entitlement.decorator.js","sourceRoot":"","sources":["../../src/decorators/entitlement.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA4D;AAC5D,mEAGqC;AA6E9B,MAAM,WAAW,GAAG,CACzB,cAAsC,EACtC,mBAAoE,EACpE,EAAE;IACF,OAAO,IAAA,wBAAe,EACpB,IAAA,0CAAsB,EAAW,cAAc,EAAE,mBAAmB,CAAC,EACrE,IAAA,kBAAS,EAAC,oCAAgB,CAAC,CAC5B,CAAC;AACJ,CAAC,CAAC;AARW,QAAA,WAAW,eAQtB"}
|
|
@@ -1,8 +1,7 @@
|
|
|
1
|
-
import { CanActivate, ExecutionContext } from
|
|
2
|
-
import { Reflector } from
|
|
3
|
-
import {
|
|
4
|
-
import type { BlimuConfig } from
|
|
5
|
-
import { Request } from 'express';
|
|
1
|
+
import { CanActivate, ExecutionContext } from "@nestjs/common";
|
|
2
|
+
import { Reflector } from "@nestjs/core";
|
|
3
|
+
import { Blimu, Schema } from "@blimu/backend";
|
|
4
|
+
import type { BlimuConfig } from "../config/blimu.config";
|
|
6
5
|
export declare const ENTITLEMENT_KEY = "entitlement";
|
|
7
6
|
export declare const ENTITLEMENT_METADATA_KEY: unique symbol;
|
|
8
7
|
export interface EntitlementMetadata<TRequest extends Request = Request> {
|
|
@@ -14,7 +13,7 @@ export declare class EntitlementGuard<TRequest extends Request = Request> implem
|
|
|
14
13
|
private readonly reflector;
|
|
15
14
|
private readonly config;
|
|
16
15
|
private readonly runtime;
|
|
17
|
-
constructor(reflector: Reflector, config: BlimuConfig<TRequest>, runtime:
|
|
16
|
+
constructor(reflector: Reflector, config: BlimuConfig<TRequest>, runtime: Blimu);
|
|
18
17
|
canActivate(context: ExecutionContext): Promise<boolean>;
|
|
19
18
|
}
|
|
20
19
|
//# sourceMappingURL=entitlement.guard.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entitlement.guard.d.ts","sourceRoot":"","sources":["../../src/guards/entitlement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"entitlement.guard.d.ts","sourceRoot":"","sources":["../../src/guards/entitlement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,wBAAwB,eAAwB,CAAC;AAK9D,MAAM,WAAW,mBAAmB,CAAC,QAAQ,SAAS,OAAO,GAAG,OAAO;IACrE,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC;IACvC,mBAAmB,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtE;AAMD,eAAO,MAAM,sBAAsB,GAAI,QAAQ,SAAS,OAAO,GAAG,OAAO,EACvE,gBAAgB,MAAM,EACtB,qBAAqB,CAAC,OAAO,EAAE,QAAQ,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,8EAKjC,CAAC;AAWtC,qBACa,gBAAgB,CAAC,QAAQ,SAAS,OAAO,GAAG,OAAO,CAC9D,YAAW,WAAW;IAGpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAJP,SAAS,EAAE,SAAS,EAEpB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAE7B,OAAO,EAAE,KAAK;IAG3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA2D/D"}
|
|
@@ -15,10 +15,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.EntitlementGuard = exports.SetEntitlementMetadata = exports.ENTITLEMENT_METADATA_KEY = exports.ENTITLEMENT_KEY = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const core_1 = require("@nestjs/core");
|
|
18
|
-
const
|
|
18
|
+
const backend_1 = require("@blimu/backend");
|
|
19
19
|
const blimu_config_1 = require("../config/blimu.config");
|
|
20
|
-
exports.ENTITLEMENT_KEY =
|
|
21
|
-
exports.ENTITLEMENT_METADATA_KEY = Symbol(
|
|
20
|
+
exports.ENTITLEMENT_KEY = "entitlement";
|
|
21
|
+
exports.ENTITLEMENT_METADATA_KEY = Symbol("entitlement");
|
|
22
22
|
const SetEntitlementMetadata = (entitlementKey, resourceIdExtractor) => (0, common_1.SetMetadata)(exports.ENTITLEMENT_METADATA_KEY, {
|
|
23
23
|
entitlementKey,
|
|
24
24
|
resourceIdExtractor,
|
|
@@ -41,14 +41,14 @@ let EntitlementGuard = class EntitlementGuard {
|
|
|
41
41
|
userId = await this.config.getUserId(request);
|
|
42
42
|
}
|
|
43
43
|
catch (error) {
|
|
44
|
-
throw new common_1.ForbiddenException(
|
|
44
|
+
throw new common_1.ForbiddenException("Failed to extract user ID from request");
|
|
45
45
|
}
|
|
46
46
|
if (!userId) {
|
|
47
|
-
throw new common_1.ForbiddenException(
|
|
47
|
+
throw new common_1.ForbiddenException("User ID is required for entitlement check");
|
|
48
48
|
}
|
|
49
49
|
const resourceId = await metadata.resourceIdExtractor(request);
|
|
50
50
|
if (!resourceId) {
|
|
51
|
-
throw new common_1.ForbiddenException(
|
|
51
|
+
throw new common_1.ForbiddenException("Resource ID is required for entitlement check");
|
|
52
52
|
}
|
|
53
53
|
try {
|
|
54
54
|
const result = await this.runtime.entitlements.checkEntitlement({
|
|
@@ -57,7 +57,8 @@ let EntitlementGuard = class EntitlementGuard {
|
|
|
57
57
|
resourceId,
|
|
58
58
|
});
|
|
59
59
|
if (!result.allowed) {
|
|
60
|
-
throw new common_1.ForbiddenException(result.reason ||
|
|
60
|
+
throw new common_1.ForbiddenException(result.reason ||
|
|
61
|
+
`User does not have required entitlement: ${metadata.entitlementKey}`);
|
|
61
62
|
}
|
|
62
63
|
return true;
|
|
63
64
|
}
|
|
@@ -65,8 +66,8 @@ let EntitlementGuard = class EntitlementGuard {
|
|
|
65
66
|
if (error instanceof common_1.ForbiddenException) {
|
|
66
67
|
throw error;
|
|
67
68
|
}
|
|
68
|
-
console.error(
|
|
69
|
-
throw new common_1.ForbiddenException(
|
|
69
|
+
console.error("Entitlement check failed:", error);
|
|
70
|
+
throw new common_1.ForbiddenException("Failed to verify entitlements");
|
|
70
71
|
}
|
|
71
72
|
}
|
|
72
73
|
};
|
|
@@ -74,7 +75,7 @@ exports.EntitlementGuard = EntitlementGuard;
|
|
|
74
75
|
exports.EntitlementGuard = EntitlementGuard = __decorate([
|
|
75
76
|
(0, common_1.Injectable)(),
|
|
76
77
|
__param(1, (0, common_1.Inject)(blimu_config_1.BLIMU_CONFIG)),
|
|
77
|
-
__param(2, (0, common_1.Inject)(
|
|
78
|
-
__metadata("design:paramtypes", [core_1.Reflector, Object,
|
|
78
|
+
__param(2, (0, common_1.Inject)(backend_1.Blimu)),
|
|
79
|
+
__metadata("design:paramtypes", [core_1.Reflector, Object, backend_1.Blimu])
|
|
79
80
|
], EntitlementGuard);
|
|
80
81
|
//# sourceMappingURL=entitlement.guard.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"entitlement.guard.js","sourceRoot":"","sources":["../../src/guards/entitlement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,
|
|
1
|
+
{"version":3,"file":"entitlement.guard.js","sourceRoot":"","sources":["../../src/guards/entitlement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,4CAA+C;AAE/C,yDAAsD;AAEzC,QAAA,eAAe,GAAG,aAAa,CAAC;AAChC,QAAA,wBAAwB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AAcvD,MAAM,sBAAsB,GAAG,CACpC,cAAsB,EACtB,mBAAoE,EACpE,EAAE,CACF,IAAA,oBAAW,EAAC,gCAAwB,EAAE;IACpC,cAAc;IACd,mBAAmB;CACa,CAAC,CAAC;AAPzB,QAAA,sBAAsB,0BAOG;AAY/B,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAG3B,YACmB,SAAoB,EAEpB,MAA6B,EAE7B,OAAc;QAJd,cAAS,GAAT,SAAS,CAAW;QAEpB,WAAM,GAAN,MAAM,CAAuB;QAE7B,YAAO,GAAP,OAAO,CAAO;IAC9B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAY,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACjC,gCAAwB,EACxB,OAAO,CAAC,UAAU,EAAE,CACrB,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YAEd,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAAC,wCAAwC,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,2BAAkB,CAAC,2CAA2C,CAAC,CAAC;QAC5E,CAAC;QAGD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE/D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,2BAAkB,CAC1B,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC;gBAC9D,MAAM;gBACN,WAAW,EAAE,QAAQ,CAAC,cAAc;gBACpC,UAAU;aACX,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,2BAAkB,CAC1B,MAAM,CAAC,MAAM;oBACX,4CAA4C,QAAQ,CAAC,cAAc,EAAE,CACxE,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YAGD,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;YAClD,MAAM,IAAI,2BAAkB,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;CACF,CAAA;AAtEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,2BAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,eAAM,EAAC,eAAK,CAAC,CAAA;qCAHc,gBAAS,UAIX,eAAK;GARtB,gBAAgB,CAsE5B"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,5 @@
|
|
|
1
|
-
export * from
|
|
2
|
-
export * from
|
|
3
|
-
export * from
|
|
4
|
-
export * from
|
|
5
|
-
export * from '@blimu/runtime-sdk';
|
|
1
|
+
export * from "./modules/blimu.module";
|
|
2
|
+
export * from "./config/blimu.config";
|
|
3
|
+
export * from "./guards/entitlement.guard";
|
|
4
|
+
export * from "./decorators/entitlement.decorator";
|
|
6
5
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,wBAAwB,CAAC;AAGvC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,4BAA4B,CAAC;AAG3C,cAAc,oCAAoC,CAAC
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,wBAAwB,CAAC;AAGvC,cAAc,uBAAuB,CAAC;AAGtC,cAAc,4BAA4B,CAAC;AAG3C,cAAc,oCAAoC,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -18,5 +18,4 @@ __exportStar(require("./modules/blimu.module"), exports);
|
|
|
18
18
|
__exportStar(require("./config/blimu.config"), exports);
|
|
19
19
|
__exportStar(require("./guards/entitlement.guard"), exports);
|
|
20
20
|
__exportStar(require("./decorators/entitlement.decorator"), exports);
|
|
21
|
-
__exportStar(require("@blimu/runtime-sdk"), exports);
|
|
22
21
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,yDAAuC;AAGvC,wDAAsC;AAGtC,6DAA2C;AAG3C,qEAAmD
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,yDAAuC;AAGvC,wDAAsC;AAGtC,6DAA2C;AAG3C,qEAAmD"}
|
|
@@ -1,6 +1,5 @@
|
|
|
1
|
-
import { DynamicModule, Type, ForwardReference, InjectionToken, OptionalFactoryDependency } from
|
|
2
|
-
import {
|
|
3
|
-
import type { BlimuConfig } from '../config/blimu.config';
|
|
1
|
+
import { DynamicModule, Type, ForwardReference, InjectionToken, OptionalFactoryDependency } from "@nestjs/common";
|
|
2
|
+
import type { BlimuConfig } from "../config/blimu.config";
|
|
4
3
|
export declare class BlimuModule {
|
|
5
4
|
static forRoot<TRequest extends Request = Request>(config: BlimuConfig<TRequest>): DynamicModule;
|
|
6
5
|
static forRootAsync<TRequest extends Request = Request>(options: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"blimu.module.d.ts","sourceRoot":"","sources":["../../src/modules/blimu.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EAC1B,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"blimu.module.d.ts","sourceRoot":"","sources":["../../src/modules/blimu.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,IAAI,EACJ,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EAC1B,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAU1D,qBACa,WAAW;IA0CtB,MAAM,CAAC,OAAO,CAAC,QAAQ,SAAS,OAAO,GAAG,OAAO,EAC/C,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,GAC5B,aAAa;IAyGhB,MAAM,CAAC,YAAY,CAAC,QAAQ,SAAS,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE;QAC/D,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC,CAAC;QAC3D,OAAO,CAAC,EAAE,KAAK,CACX,IAAI,CAAC,OAAO,CAAC,GACb,aAAa,GACb,OAAO,CAAC,aAAa,CAAC,GACtB,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CACxC,CAAC;KACH,GAAG,aAAa;CA0ClB"}
|
|
@@ -11,7 +11,7 @@ exports.BlimuModule = void 0;
|
|
|
11
11
|
const common_1 = require("@nestjs/common");
|
|
12
12
|
const entitlement_guard_1 = require("../guards/entitlement.guard");
|
|
13
13
|
const blimu_config_1 = require("../config/blimu.config");
|
|
14
|
-
const
|
|
14
|
+
const backend_1 = require("@blimu/backend");
|
|
15
15
|
let BlimuModule = BlimuModule_1 = class BlimuModule {
|
|
16
16
|
static forRoot(config) {
|
|
17
17
|
return {
|
|
@@ -22,7 +22,7 @@ let BlimuModule = BlimuModule_1 = class BlimuModule {
|
|
|
22
22
|
provide: blimu_config_1.BLIMU_CONFIG,
|
|
23
23
|
useValue: {
|
|
24
24
|
apiSecretKey: config.apiSecretKey,
|
|
25
|
-
baseURL: config.baseURL ||
|
|
25
|
+
baseURL: config.baseURL || "https://runtime.blimu.com",
|
|
26
26
|
environmentId: config.environmentId,
|
|
27
27
|
timeoutMs: config.timeoutMs ?? 30000,
|
|
28
28
|
getUserId: config.getUserId,
|
|
@@ -30,16 +30,16 @@ let BlimuModule = BlimuModule_1 = class BlimuModule {
|
|
|
30
30
|
},
|
|
31
31
|
entitlement_guard_1.EntitlementGuard,
|
|
32
32
|
{
|
|
33
|
-
provide:
|
|
34
|
-
useFactory: (config) => new
|
|
33
|
+
provide: backend_1.Blimu,
|
|
34
|
+
useFactory: (config) => new backend_1.Blimu({
|
|
35
35
|
apiKeyAuth: config.apiSecretKey,
|
|
36
|
-
baseURL: config.baseURL ||
|
|
36
|
+
baseURL: config.baseURL || "https://runtime.blimu.com",
|
|
37
37
|
timeoutMs: config.timeoutMs ?? 30000,
|
|
38
38
|
}),
|
|
39
39
|
inject: [blimu_config_1.BLIMU_CONFIG],
|
|
40
40
|
},
|
|
41
41
|
],
|
|
42
|
-
exports: [entitlement_guard_1.EntitlementGuard,
|
|
42
|
+
exports: [entitlement_guard_1.EntitlementGuard, backend_1.Blimu, blimu_config_1.BLIMU_CONFIG],
|
|
43
43
|
};
|
|
44
44
|
}
|
|
45
45
|
static forRootAsync(options) {
|
|
@@ -55,7 +55,7 @@ let BlimuModule = BlimuModule_1 = class BlimuModule {
|
|
|
55
55
|
const config = await options.useFactory(...args);
|
|
56
56
|
return {
|
|
57
57
|
apiSecretKey: config.apiSecretKey,
|
|
58
|
-
baseURL: config.baseURL ||
|
|
58
|
+
baseURL: config.baseURL || "https://runtime.blimu.com",
|
|
59
59
|
environmentId: config.environmentId,
|
|
60
60
|
timeoutMs: config.timeoutMs ?? 30000,
|
|
61
61
|
getUserId: config.getUserId,
|
|
@@ -65,16 +65,16 @@ let BlimuModule = BlimuModule_1 = class BlimuModule {
|
|
|
65
65
|
},
|
|
66
66
|
entitlement_guard_1.EntitlementGuard,
|
|
67
67
|
{
|
|
68
|
-
provide:
|
|
69
|
-
useFactory: (config) => new
|
|
68
|
+
provide: backend_1.Blimu,
|
|
69
|
+
useFactory: (config) => new backend_1.Blimu({
|
|
70
70
|
apiKeyAuth: config.apiSecretKey,
|
|
71
|
-
baseURL: config.baseURL ||
|
|
71
|
+
baseURL: config.baseURL || "https://runtime.blimu.com",
|
|
72
72
|
timeoutMs: config.timeoutMs ?? 30000,
|
|
73
73
|
}),
|
|
74
74
|
inject: [blimu_config_1.BLIMU_CONFIG],
|
|
75
75
|
},
|
|
76
76
|
],
|
|
77
|
-
exports: [entitlement_guard_1.EntitlementGuard,
|
|
77
|
+
exports: [entitlement_guard_1.EntitlementGuard, backend_1.Blimu, blimu_config_1.BLIMU_CONFIG],
|
|
78
78
|
};
|
|
79
79
|
}
|
|
80
80
|
};
|