@cifra-x/nest-keycloak 0.0.2

package/README.md

@@ -0,0 +1,45 @@
+<div align="center">
+  
+# Nest Keycloak Adapter
+
+### [keycloak-nodejs-connect](https://github.com/keycloak/keycloak-nodejs-connect) module for NestJS 11
+
+*NestJS module adapter of keycloak-nodejs-connect library*
+
+</div>
+
+## Decorators
+
+| Decorator          | Description                                                                                               |
+| ------------------ | --------------------------------------------------------------------------------------------------------- |
+| @AuthenticatedUser | Retrieves the current Keycloak logged-in user. (must be per method, unless controller is request scoped.) |
+| @EnforcerOptions   | Keycloak enforcer options.                                                                                |
+| @Public            | Allow any user to use the route.                                                                          |
+| @Resource          | Keycloak application resource name.                                                                       |
+| @Scopes            | Keycloak application scope name.                                                                          |
+| @Roles             | Keycloak realm/application roles.                                                                         |
+
+### Nest Keycloak Options
+
+| Option            | Description                                                              | Required | Default      |
+| ----------------- | ------------------------------------------------------------------------ | -------- | ------------ |
+| cookieKey         | Cookie Key                                                               | no       | KEYCLOAK_JWT |
+| logLevels         | Built-in logger level (deprecated, will be removed in 2.0)               | no       | log          |
+| useNestLogger     | Use the nest logger (deprecated, will be removed in 2.0)                 | no       | true         |
+| policyEnforcement | Sets the policy enforcement mode                                         | no       | PERMISSIVE   |
+| tokenValidation   | Sets the token validation method                                         | no       | ONLINE       |
+| multiTenant       | Sets the options for [multi-tenant configuration](#multi-tenant-options) | no       | -            |
+| roleMerge         | Sets the merge mode for @Role decorator                                  | no       | OVERRIDE     |
+
+### Multi Tenant Options
+
+| Option                     | Description                                                                                             | Required | Default |
+| -------------------------- | ------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| resolveAlways              | Option to always resolve the realm and secret. Disabled by default.                                     | no       | false   |
+| realmResolver              | A function that passes a request (from respective platform i.e express or fastify) and returns a string | yes      | -       |
+| realmSecretResolver        | A function that passes the realm string, and an optional request and returns the secret string          | no       | -       |
+| realmAuthServerUrlResolver | A function that passes the realm string, and an optional request and returns the auth server url string | no       | -       |
+
+
+### TODO:
+1. keycloakProvider

package/dist/src/async-class-provider.type-guard.d.ts

@@ -0,0 +1,9 @@
+import { Type } from '@nestjs/common/interfaces';
+import { KeycloakConnectModuleAsyncOptions } from './interface/keycloak-connect-module-async-options.interface';
+import { KeycloakConnectOptionsFactory } from './interface/keycloak-connect-options-factory.interface';
+export declare function hasAsyncClassProvider(options: KeycloakConnectModuleAsyncOptions): options is KeycloakConnectModuleAsyncOptions & {
+    useExisting: Type<KeycloakConnectOptionsFactory>;
+};
+export declare function hasAsyncClassProvider(options: KeycloakConnectModuleAsyncOptions): options is KeycloakConnectModuleAsyncOptions & {
+    useClass: Type<KeycloakConnectOptionsFactory>;
+};

package/dist/src/async-class-provider.type-guard.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasAsyncClassProvider = hasAsyncClassProvider;
+function hasAsyncClassProvider(options) {
+    return options.useExisting !== undefined || options.useClass !== undefined;
+}

package/dist/src/common/interfaces/authentication-request.interface.d.ts

@@ -0,0 +1,11 @@
+import { JwtPayload } from './jwt-payload.interface';
+/**
+ * Расширение интерфейса Request полями аутентификации
+ */
+export interface AuthenticationRequest {
+    user?: JwtPayload;
+    accessTokenJWT?: string;
+    headers?: Record<string, string | undefined>;
+    cookies?: Record<string, string | undefined>;
+    [key: string]: unknown;
+}

package/dist/src/common/interfaces/authentication-request.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/common/interfaces/jwt-payload.interface.d.ts

@@ -0,0 +1,12 @@
+/**
+ * JWT payload with common claims
+ */
+export interface JwtPayload {
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    iat?: number;
+    jti?: string;
+    [key: string]: unknown;
+}

package/dist/src/common/interfaces/jwt-payload.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/common/interfaces/token.interface.d.ts

@@ -0,0 +1,2 @@
+import KeycloakConnect from 'keycloak-connect';
+export type KeycloakConnectToken = KeycloakConnect.Token;

package/dist/src/common/interfaces/token.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/common/utils/extract-request.util.d.ts

@@ -0,0 +1,2 @@
+import { ExecutionContext } from '@nestjs/common';
+export declare const extractRequest: <TRequest = unknown, TResponse = unknown>(context: ExecutionContext) => [TRequest, TResponse];

package/dist/src/common/utils/extract-request.util.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractRequest = void 0;
+let GqlExecutionContext = undefined;
+try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    GqlExecutionContext = require('@nestjs/graphql').GqlExecutionContext;
+}
+catch {
+    // Пакет не установлен
+}
+const extractRequest = (context) => {
+    const contextType = context.getType();
+    if (contextType === 'http') {
+        const httpContext = context.switchToHttp();
+        return [httpContext.getRequest(), httpContext.getResponse()];
+    }
+    if (contextType === 'graphql') {
+        if (!GqlExecutionContext) {
+            throw new Error('@nestjs/graphql is not installed, cannot proceed');
+        }
+        const gqlContext = GqlExecutionContext.create(context).getContext();
+        return [gqlContext.req, gqlContext.res];
+    }
+    throw new Error('Unsupported context type');
+};
+exports.extractRequest = extractRequest;

package/dist/src/common/utils/extract-request.util.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/common/utils/extract-request.util.spec.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const gqlContext = jest.fn();
+jest.mock('@nestjs/graphql', () => {
+    const original = jest.requireActual('@nestjs/graphql');
+    return {
+        ...original,
+        GqlExecutionContext: {
+            create: jest.fn().mockImplementation(() => ({
+                getContext: gqlContext,
+            })),
+        },
+    };
+});
+const extract_request_util_1 = require("./extract-request.util");
+describe('extractRequest', () => {
+    const context = {
+        getType: jest.fn(),
+        switchToHttp: jest.fn(),
+        switchToRpc: jest.fn(),
+        switchToWs: jest.fn(),
+        getArgs: jest.fn(),
+        getArgByIndex: jest.fn(),
+        getHandler: jest.fn(),
+        getClass: jest.fn(),
+    };
+    it('should return request and response form http context', () => {
+        context.getType.mockReturnValue('http');
+        context.switchToHttp.mockReturnValue({
+            getNext() {
+                return {};
+            },
+            getRequest: jest.fn().mockReturnValue({ _name: 'request' }),
+            getResponse: jest.fn().mockReturnValue({ _name: 'response' }),
+        });
+        const result = (0, extract_request_util_1.extractRequest)(context);
+        expect(result).toEqual([{ _name: 'request' }, { _name: 'response' }]);
+    });
+    it('should return request and response form graphql context', () => {
+        context.getType.mockReturnValue('graphql');
+        gqlContext.mockReturnValue({
+            req: { _name: 'gql-request' },
+            res: { _name: 'gql-response' },
+        });
+        const result = (0, extract_request_util_1.extractRequest)(context);
+        expect(result).toEqual([
+            { _name: 'gql-request' },
+            { _name: 'gql-response' },
+        ]);
+    });
+    it('should throw new Error when no graphql execution context', () => {
+        // 2. Сбрасываем кэш модулей, чтобы файл утилиты подгрузился заново
+        // jest.resetModules();
+        jest.doMock('@nestjs/graphql', () => ({
+            GqlExecutionContext: null,
+        }));
+        context.getType.mockReturnValue('graphql');
+        const result = (0, extract_request_util_1.extractRequest)(context);
+        expect(result).toEqual([
+            { _name: 'gql-request' },
+            { _name: 'gql-response' },
+        ]);
+    });
+});

package/dist/src/common/utils/get-keycloak.util.d.ts

@@ -0,0 +1,4 @@
+import KeycloakConnect from 'keycloak-connect';
+import { KeycloakMultiTenantService } from '../../services/keycloak-multitenant.service';
+import { KeycloakConnectOptions } from '../../interface/keycloak-connect-options.interface';
+export declare const getKeycloakInstance: <TRequest = unknown>(request: TRequest, jwt: string, singleTenant: KeycloakConnect.Keycloak, multiTenant: KeycloakMultiTenantService, opts: KeycloakConnectOptions) => Promise<KeycloakConnect.Keycloak>;

package/dist/src/common/utils/get-keycloak.util.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getKeycloakInstance = void 0;
+const parse_token_util_1 = require("./parse-token.util");
+const getKeycloakInstance = async (request, jwt, singleTenant, multiTenant, opts) => {
+    // Multi-tenant с кастомным realmResolver
+    if (opts.multiTenant?.realmResolver) {
+        const realm = await opts.multiTenant.realmResolver(request);
+        return await multiTenant.get(realm, request);
+    }
+    // Multi-tenant без realmResolver — извлекаем realm из JWT
+    if (!opts.realm) {
+        const payload = (0, parse_token_util_1.parseToken)(jwt);
+        if (!payload.iss) {
+            throw new Error('JWT token does not contain an issuer (iss) claim');
+        }
+        const issuerRealm = payload.iss.split('/').pop();
+        if (!issuerRealm) {
+            throw new Error('No issuer realm');
+        }
+        return await multiTenant.get(issuerRealm, request);
+    }
+    return singleTenant;
+};
+exports.getKeycloakInstance = getKeycloakInstance;

package/dist/src/common/utils/get-keycloak.util.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/common/utils/get-keycloak.util.spec.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const get_keycloak_util_1 = require("./get-keycloak.util");
+describe('getKeycloak', () => {
+    it('should return keycloak instance single tenant', async () => {
+        const request = {};
+        const jwt = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkxlbXJKamY4d1pVWGZ0Nld5cFdDbHY1cWswTlRCSXBxNUlMbF8wVmkwNjQifQ.eyJleHAiOjE3ODM2Njc1MTAsImlhdCI6MTc4MzY2NDQ2NCwianRpIjoib25ydGFjOmEyNmQ5NDNlLWY3ZWEtNmYzMC04MTNlLTVhYjE5NmQzZGM1NSIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA5MC9yZWFsbXMvZXN3aXBlIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjljNTYzNWU1LTk4NDAtNGRkMi1hNDI5LWE2M2M4OWExYmZjMSIsImFjciI6IjAiLCJzY29wZSI6Im9wZW5pZCJ9.B_IMLshPJEyH_vowwzbWPqTJ3w2T_a9U7JwSOwyPt9pzuMmsYyuJ_PLTfGjcPNDqLtsXjLV2hHUu6KdkVHRmNxqqSLYP61GcRF9yeiOcdH8dykGqK-ER_iUhwt24o_fNs0PXzAI8DaGdOQ9LIuHwYtU6B8jUIGa4g13N1pr7fiqSNQIc1J18OPZu34zSx-oOVZhCLT4xhBe6Sphi4IDO9_DWoMl91olFtQZnp_KZ9de3q_S1f_OdA1ypZYgPu2N0k_mz2AKMJxs5byBTAapLxL-6TVPVkeSn6I_i2VUoSte4Ns1Uc4BrFCkVImnav_tyzpB9t8ZSulseNqM0a_543Q';
+        const singleTenant = {};
+        const multiTenant = {};
+        const opts = {
+            authServerUrl: '',
+            realm: 'test-realm',
+            secret: '',
+        };
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, jwt, singleTenant, multiTenant, opts);
+        expect(keycloak).toEqual(singleTenant);
+    });
+    it('should return keycloak instance multi tenant', async () => {
+        const request = {};
+        const jwt = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkxlbXJKamY4d1pVWGZ0Nld5cFdDbHY1cWswTlRCSXBxNUlMbF8wVmkwNjQifQ.eyJleHAiOjE3ODM2Njc1MTAsImlhdCI6MTc4MzY2NDQ2NCwianRpIjoib25ydGFjOmEyNmQ5NDNlLWY3ZWEtNmYzMC04MTNlLTVhYjE5NmQzZGM1NSIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA5MC9yZWFsbXMvZXN3aXBlIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjljNTYzNWU1LTk4NDAtNGRkMi1hNDI5LWE2M2M4OWExYmZjMSIsImFjciI6IjAiLCJzY29wZSI6Im9wZW5pZCJ9.B_IMLshPJEyH_vowwzbWPqTJ3w2T_a9U7JwSOwyPt9pzuMmsYyuJ_PLTfGjcPNDqLtsXjLV2hHUu6KdkVHRmNxqqSLYP61GcRF9yeiOcdH8dykGqK-ER_iUhwt24o_fNs0PXzAI8DaGdOQ9LIuHwYtU6B8jUIGa4g13N1pr7fiqSNQIc1J18OPZu34zSx-oOVZhCLT4xhBe6Sphi4IDO9_DWoMl91olFtQZnp_KZ9de3q_S1f_OdA1ypZYgPu2N0k_mz2AKMJxs5byBTAapLxL-6TVPVkeSn6I_i2VUoSte4Ns1Uc4BrFCkVImnav_tyzpB9t8ZSulseNqM0a_543Q';
+        const singleTenant = {};
+        const multiTenantKeycloakItem = {
+            _name: 'multi',
+        };
+        const multiTenant = {
+            get: jest.fn().mockResolvedValue(multiTenantKeycloakItem),
+        };
+        const opts = {
+            authServerUrl: '',
+            multiTenant: {
+                realmResolver: () => '',
+            },
+            secret: '',
+        };
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, jwt, singleTenant, multiTenant, opts);
+        expect(keycloak).toEqual(multiTenantKeycloakItem);
+    });
+    it('should return keycloak instance multi tenant without realmResolver', async () => {
+        const request = {};
+        const jwt = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkxlbXJKamY4d1pVWGZ0Nld5cFdDbHY1cWswTlRCSXBxNUlMbF8wVmkwNjQifQ.eyJleHAiOjE3ODM2Njc1MTAsImlhdCI6MTc4MzY2NDQ2NCwianRpIjoib25ydGFjOmEyNmQ5NDNlLWY3ZWEtNmYzMC04MTNlLTVhYjE5NmQzZGM1NSIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA5MC9yZWFsbXMvZXN3aXBlIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjljNTYzNWU1LTk4NDAtNGRkMi1hNDI5LWE2M2M4OWExYmZjMSIsImFjciI6IjAiLCJzY29wZSI6Im9wZW5pZCJ9.B_IMLshPJEyH_vowwzbWPqTJ3w2T_a9U7JwSOwyPt9pzuMmsYyuJ_PLTfGjcPNDqLtsXjLV2hHUu6KdkVHRmNxqqSLYP61GcRF9yeiOcdH8dykGqK-ER_iUhwt24o_fNs0PXzAI8DaGdOQ9LIuHwYtU6B8jUIGa4g13N1pr7fiqSNQIc1J18OPZu34zSx-oOVZhCLT4xhBe6Sphi4IDO9_DWoMl91olFtQZnp_KZ9de3q_S1f_OdA1ypZYgPu2N0k_mz2AKMJxs5byBTAapLxL-6TVPVkeSn6I_i2VUoSte4Ns1Uc4BrFCkVImnav_tyzpB9t8ZSulseNqM0a_543Q';
+        const singleTenant = {};
+        const multiTenantKeycloakItem = {
+            _name: 'multi',
+        };
+        const multiTenant = {
+            get: jest.fn().mockResolvedValue(multiTenantKeycloakItem),
+        };
+        const opts = {
+            authServerUrl: '',
+            secret: '',
+        };
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, jwt, singleTenant, multiTenant, opts);
+        expect(keycloak).toEqual(multiTenantKeycloakItem);
+    });
+});

package/dist/src/common/utils/parse-token.util.d.ts

@@ -0,0 +1,2 @@
+import { JwtPayload } from '../interfaces/jwt-payload.interface';
+export declare function parseToken<T extends JwtPayload = JwtPayload>(token: string): T;

package/dist/src/common/utils/parse-token.util.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseToken = parseToken;
+function parseToken(token) {
+    const parts = token.split('.');
+    return JSON.parse(Buffer.from(parts[1], 'base64').toString());
+}

package/dist/src/common/utils/parse-token.util.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/common/utils/parse-token.util.spec.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const parse_token_util_1 = require("./parse-token.util");
+describe('parseToken', () => {
+    it('should parse token payload from string', () => {
+        const token = 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IkxlbXJKamY4d1pVWGZ0Nld5cFdDbHY1cWswTlRCSXBxNUlMbF8wVmkwNjQifQ.eyJleHAiOjE3ODM2Njc1MTAsImlhdCI6MTc4MzY2NDQ2NCwianRpIjoib25ydGFjOmEyNmQ5NDNlLWY3ZWEtNmYzMC04MTNlLTVhYjE5NmQzZGM1NSIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODA5MC9yZWFsbXMvZXN3aXBlIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjljNTYzNWU1LTk4NDAtNGRkMi1hNDI5LWE2M2M4OWExYmZjMSIsImFjciI6IjAiLCJzY29wZSI6Im9wZW5pZCJ9.B_IMLshPJEyH_vowwzbWPqTJ3w2T_a9U7JwSOwyPt9pzuMmsYyuJ_PLTfGjcPNDqLtsXjLV2hHUu6KdkVHRmNxqqSLYP61GcRF9yeiOcdH8dykGqK-ER_iUhwt24o_fNs0PXzAI8DaGdOQ9LIuHwYtU6B8jUIGa4g13N1pr7fiqSNQIc1J18OPZu34zSx-oOVZhCLT4xhBe6Sphi4IDO9_DWoMl91olFtQZnp_KZ9de3q_S1f_OdA1ypZYgPu2N0k_mz2AKMJxs5byBTAapLxL-6TVPVkeSn6I_i2VUoSte4Ns1Uc4BrFCkVImnav_tyzpB9t8ZSulseNqM0a_543Q';
+        const payload = (0, parse_token_util_1.parseToken)(token);
+        expect(payload).toStrictEqual({
+            acr: '0',
+            aud: 'account',
+            exp: 1783667510,
+            iat: 1783664464,
+            iss: 'http://localhost:8090/realms/eswipe',
+            jti: 'onrtac:a26d943e-f7ea-6f30-813e-5ab196d3dc55',
+            scope: 'openid',
+            sub: '9c5635e5-9840-4dd2-a429-a63c89a1bfc1',
+        });
+    });
+});

package/dist/src/constants/index.d.ts

@@ -0,0 +1,5 @@
+export * from './keycloak-module.constants';
+export * from './policy-enforcement-mode.enum';
+export * from './role-matching-mode.enum';
+export * from './role-merge.enum';
+export * from './token-validation.enum';

package/dist/src/constants/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./keycloak-module.constants"), exports);
+__exportStar(require("./policy-enforcement-mode.enum"), exports);
+__exportStar(require("./role-matching-mode.enum"), exports);
+__exportStar(require("./role-merge.enum"), exports);
+__exportStar(require("./token-validation.enum"), exports);

package/dist/src/constants/keycloak-module.constants.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Used internally, provides keycloak options for the Nest guards.
+ */
+export declare const KEYCLOAK_CONNECT_OPTIONS = "KEYCLOAK_CONNECT_OPTIONS";
+/**
+ * Key for injecting a keycloak instance.
+ */
+export declare const KEYCLOAK_INSTANCE = "KEYCLOAK_INSTANCE";
+/**
+ * Key for injecting a keycloak multi tenant service.
+ */
+export declare const KEYCLOAK_MULTITENANT_SERVICE = "KEYCLOAK_MULTITENANT_SERVICE";
+/**
+ * Key for injecting the nest keycloak logger.
+ */
+export declare const KEYCLOAK_LOGGER = "KEYCLOAK_LOGGER";
+/**
+ * Default cookie key.
+ */
+export declare const KEYCLOAK_COOKIE_DEFAULT = "KEYCLOAK_JWT";

package/dist/src/constants/keycloak-module.constants.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEYCLOAK_COOKIE_DEFAULT = exports.KEYCLOAK_LOGGER = exports.KEYCLOAK_MULTITENANT_SERVICE = exports.KEYCLOAK_INSTANCE = exports.KEYCLOAK_CONNECT_OPTIONS = void 0;
+/**
+ * Used internally, provides keycloak options for the Nest guards.
+ */
+exports.KEYCLOAK_CONNECT_OPTIONS = 'KEYCLOAK_CONNECT_OPTIONS';
+/**
+ * Key for injecting a keycloak instance.
+ */
+exports.KEYCLOAK_INSTANCE = 'KEYCLOAK_INSTANCE';
+/**
+ * Key for injecting a keycloak multi tenant service.
+ */
+exports.KEYCLOAK_MULTITENANT_SERVICE = 'KEYCLOAK_MULTITENANT_SERVICE';
+/**
+ * Key for injecting the nest keycloak logger.
+ */
+exports.KEYCLOAK_LOGGER = 'KEYCLOAK_LOGGER';
+/**
+ * Default cookie key.
+ */
+exports.KEYCLOAK_COOKIE_DEFAULT = 'KEYCLOAK_JWT';

package/dist/src/constants/policy-enforcement-mode.enum.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Policy enforcement mode.
+ */
+export declare enum PolicyEnforcementMode {
+    /**
+     * Deny all request when there is no matching resource.
+     */
+    ENFORCING = "enforcing",
+    /**
+     * Allow all request even when there's no matching resource.
+     */
+    PERMISSIVE = "permissive"
+}

package/dist/src/constants/policy-enforcement-mode.enum.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyEnforcementMode = void 0;
+/**
+ * Policy enforcement mode.
+ */
+var PolicyEnforcementMode;
+(function (PolicyEnforcementMode) {
+    /**
+     * Deny all request when there is no matching resource.
+     */
+    PolicyEnforcementMode["ENFORCING"] = "enforcing";
+    /**
+     * Allow all request even when there's no matching resource.
+     */
+    PolicyEnforcementMode["PERMISSIVE"] = "permissive";
+})(PolicyEnforcementMode || (exports.PolicyEnforcementMode = PolicyEnforcementMode = {}));

package/dist/src/constants/role-matching-mode.enum.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Role matching mode.
+ */
+export declare enum RoleMatchingMode {
+    /**
+     * Match all roles
+     */
+    ALL = "all",
+    /**
+     * Match any roles
+     */
+    ANY = "any"
+}

package/dist/src/constants/role-matching-mode.enum.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleMatchingMode = void 0;
+/**
+ * Role matching mode.
+ */
+var RoleMatchingMode;
+(function (RoleMatchingMode) {
+    /**
+     * Match all roles
+     */
+    RoleMatchingMode["ALL"] = "all";
+    /**
+     * Match any roles
+     */
+    RoleMatchingMode["ANY"] = "any";
+})(RoleMatchingMode || (exports.RoleMatchingMode = RoleMatchingMode = {}));

package/dist/src/constants/role-merge.enum.d.ts

@@ -0,0 +1,10 @@
+export declare enum RoleMerge {
+    /**
+     * Overrides roles if defined both controller and handlers, with controller taking over.
+     */
+    OVERRIDE = 0,
+    /**
+     * Merges all roles from both controller and handlers.
+     */
+    ALL = 1
+}

package/dist/src/constants/role-merge.enum.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleMerge = void 0;
+var RoleMerge;
+(function (RoleMerge) {
+    /**
+     * Overrides roles if defined both controller and handlers, with controller taking over.
+     */
+    RoleMerge[RoleMerge["OVERRIDE"] = 0] = "OVERRIDE";
+    /**
+     * Merges all roles from both controller and handlers.
+     */
+    RoleMerge[RoleMerge["ALL"] = 1] = "ALL";
+})(RoleMerge || (exports.RoleMerge = RoleMerge = {}));

package/dist/src/constants/token-validation.enum.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Token validation methods.
+ */
+export declare enum TokenValidation {
+    /**
+     * The default validation method, performs live validation via Keycloak servers.
+     */
+    ONLINE = "online",
+    /**
+     * Validate offline against the configured keycloak options.
+     */
+    OFFLINE = "offline",
+    /**
+     * Does not check for any validation. Should only be used for special cases (i.e development, internal networks)
+     */
+    NONE = "none"
+}

package/dist/src/constants/token-validation.enum.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenValidation = void 0;
+/**
+ * Token validation methods.
+ */
+var TokenValidation;
+(function (TokenValidation) {
+    /**
+     * The default validation method, performs live validation via Keycloak servers.
+     */
+    TokenValidation["ONLINE"] = "online";
+    /**
+     * Validate offline against the configured keycloak options.
+     */
+    TokenValidation["OFFLINE"] = "offline";
+    /**
+     * Does not check for any validation. Should only be used for special cases (i.e development, internal networks)
+     */
+    TokenValidation["NONE"] = "none";
+})(TokenValidation || (exports.TokenValidation = TokenValidation = {}));

package/dist/src/decorators/authenticated-user.decorator.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Retrieves the current Keycloak logged-in user
+ */
+export declare const AuthenticatedUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/src/decorators/authenticated-user.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticatedUser = void 0;
+const common_1 = require("@nestjs/common");
+const extract_request_util_1 = require("../common/utils/extract-request.util");
+/**
+ * Retrieves the current Keycloak logged-in user
+ */
+exports.AuthenticatedUser = (0, common_1.createParamDecorator)((data, ctx) => {
+    const [req] = (0, extract_request_util_1.extractRequest)(ctx);
+    return req.user;
+});

package/dist/src/decorators/authenticated-user.decorator.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/decorators/authenticated-user.decorator.spec.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const authenticated_user_decorator_1 = require("./authenticated-user.decorator");
+const extract_request_util_1 = require("../common/utils/extract-request.util");
+jest.mock('@common/utils/extract-request.util', () => ({
+    extractRequest: jest.fn(),
+}));
+// Мокаем createParamDecorator, чтобы он возвращал саму фабричную функцию
+jest.mock('@nestjs/common', () => {
+    const originalModule = jest.requireActual('@nestjs/common');
+    return {
+        ...originalModule,
+        createParamDecorator: (factory) => factory,
+    };
+});
+describe('AuthenticatedUser decorator', () => {
+    it('should return user object', () => {
+        const context = {};
+        // Задаем возвращаемое значение для extractRequest
+        extract_request_util_1.extractRequest.mockReturnValue([
+            { user: { _name: 'user' } },
+            {},
+        ]);
+        // Благодаря моку createParamDecorator, AuthenticatedUser теперь является самой фабричной функцией
+        const result = (0, authenticated_user_decorator_1.AuthenticatedUser)({}, context);
+        expect(result).toEqual({ _name: 'user' });
+    });
+});

package/dist/src/decorators/enforcer-options.decorator.d.ts

@@ -0,0 +1,8 @@
+import * as KeycloakConnect from 'keycloak-connect';
+export declare const META_ENFORCER_OPTIONS = "enforcer-options";
+/**
+ * Keycloak enforcer options
+ * @param opts - enforcer options
+ * @since 1.3.0
+ */
+export declare const EnforcerOptions: (opts: KeycloakConnect.EnforcerOptions) => import("@nestjs/common").CustomDecorator<string>;

package/dist/src/decorators/enforcer-options.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforcerOptions = exports.META_ENFORCER_OPTIONS = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_ENFORCER_OPTIONS = 'enforcer-options';
+/**
+ * Keycloak enforcer options
+ * @param opts - enforcer options
+ * @since 1.3.0
+ */
+const EnforcerOptions = (opts) => (0, common_1.SetMetadata)(exports.META_ENFORCER_OPTIONS, opts);
+exports.EnforcerOptions = EnforcerOptions;

package/dist/src/decorators/public.decorator.d.ts

@@ -0,0 +1,14 @@
+export declare const META_UNPROTECTED = "unprotected";
+export declare const META_SKIP_AUTH = "skip-auth";
+/**
+ * Allow user to use unprotected routes.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+export declare const Unprotected: (skipAuth?: boolean) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+/**
+ * Alias for `@Unprotected`.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+export declare const Public: (skipAuth?: boolean) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;