@cifra-x/nest-keycloak 0.0.2

package/dist/src/decorators/public.decorator.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.Unprotected = exports.META_SKIP_AUTH = exports.META_UNPROTECTED = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_UNPROTECTED = 'unprotected';
+exports.META_SKIP_AUTH = 'skip-auth';
+/**
+ * Allow user to use unprotected routes.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+const Unprotected = (skipAuth = true) => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.META_UNPROTECTED, true), (0, common_1.SetMetadata)(exports.META_SKIP_AUTH, skipAuth));
+exports.Unprotected = Unprotected;
+/**
+ * Alias for `@Unprotected`.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+const Public = (skipAuth = true) => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.META_UNPROTECTED, true), (0, common_1.SetMetadata)(exports.META_SKIP_AUTH, skipAuth));
+exports.Public = Public;

package/dist/src/decorators/resource.decorator.d.ts

@@ -0,0 +1,6 @@
+export declare const META_RESOURCE = "resource";
+/**
+ * Keycloak Resource.
+ * @param resource - name of resource
+ */
+export declare const Resource: (resource: string) => import("@nestjs/common").CustomDecorator<string>;

package/dist/src/decorators/resource.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Resource = exports.META_RESOURCE = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_RESOURCE = 'resource';
+/**
+ * Keycloak Resource.
+ * @param resource - name of resource
+ */
+const Resource = (resource) => (0, common_1.SetMetadata)(exports.META_RESOURCE, resource);
+exports.Resource = Resource;

package/dist/src/decorators/roles.decorator.d.ts

@@ -0,0 +1,8 @@
+import { RoleDecoratorOptionsInterface } from '../interface/role-decorator-options.interface';
+export declare const META_ROLES = "roles";
+/**
+ * Keycloak user roles.
+ * @param roleMetaData - meta data for roles and matching mode
+ * @since 1.1.0
+ */
+export declare const Roles: (roleMetaData: RoleDecoratorOptionsInterface) => import("@nestjs/common").CustomDecorator<string>;

package/dist/src/decorators/roles.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Roles = exports.META_ROLES = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_ROLES = 'roles';
+/**
+ * Keycloak user roles.
+ * @param roleMetaData - meta data for roles and matching mode
+ * @since 1.1.0
+ */
+const Roles = (roleMetaData) => (0, common_1.SetMetadata)(exports.META_ROLES, roleMetaData);
+exports.Roles = Roles;

package/dist/src/decorators/scopes.decorator.d.ts

@@ -0,0 +1,6 @@
+export declare const META_SCOPES = "scopes";
+/**
+ * Keycloak Authorization Scopes.
+ * @param scopes - scopes that are associated with the resource
+ */
+export declare const Scopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;

package/dist/src/decorators/scopes.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Scopes = exports.META_SCOPES = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_SCOPES = 'scopes';
+/**
+ * Keycloak Authorization Scopes.
+ * @param scopes - scopes that are associated with the resource
+ */
+const Scopes = (...scopes) => (0, common_1.SetMetadata)(exports.META_SCOPES, scopes);
+exports.Scopes = Scopes;

package/dist/src/guards/auth.guard.d.ts

@@ -0,0 +1,21 @@
+import { CanActivate, ExecutionContext, Logger } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import * as KeycloakConnect from 'keycloak-connect';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+import { KeycloakConnectOptions } from '../interface/keycloak-connect-options.interface';
+/**
+ * An authentication guard. Will return a 401 unauthorized when it is unable to
+ * verify the JWT token or Bearer header is missing.
+ */
+export declare class AuthGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private logger;
+    private multiTenant;
+    private readonly reflector;
+    constructor(singleTenant: KeycloakConnect.Keycloak, keycloakOpts: KeycloakConnectOptions, logger: Logger, multiTenant: KeycloakMultiTenantService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private validateToken;
+    private extractJwtFromHeaders;
+    private extractJwtFromCookie;
+}

package/dist/src/guards/auth.guard.js

@@ -0,0 +1,179 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const KeycloakConnect = __importStar(require("keycloak-connect"));
+const public_decorator_1 = require("../decorators/public.decorator");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+const constants_1 = require("../constants");
+const extract_request_util_1 = require("../common/utils/extract-request.util");
+const get_keycloak_util_1 = require("../common/utils/get-keycloak.util");
+const parse_token_util_1 = require("../common/utils/parse-token.util");
+/**
+ * An authentication guard. Will return a 401 unauthorized when it is unable to
+ * verify the JWT token or Bearer header is missing.
+ */
+let AuthGuard = class AuthGuard {
+    constructor(singleTenant, keycloakOpts, logger, multiTenant, reflector) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.logger = logger;
+        this.multiTenant = multiTenant;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const isUnprotected = this.reflector.getAllAndOverride(public_decorator_1.META_UNPROTECTED, [context.getClass(), context.getHandler()]);
+        const skipAuth = this.reflector.getAllAndOverride(public_decorator_1.META_SKIP_AUTH, [
+            context.getClass(),
+            context.getHandler(),
+        ]);
+        // If unprotected is set skip Keycloak authentication
+        if (isUnprotected && skipAuth) {
+            return true;
+        }
+        // Extract request/response
+        const [request] = (0, extract_request_util_1.extractRequest)(context);
+        // if is not an HTTP request ignore this guard
+        if (!request) {
+            return true;
+        }
+        const jwt = this.extractJwtFromCookie(request.cookies) ??
+            this.extractJwtFromHeaders(request.headers);
+        // Empty jwt, but skipAuth = false, isUnprotected = true allow fallback
+        if (!jwt && !skipAuth && isUnprotected) {
+            this.logger.verbose('Empty JWT, skipAuth disabled, and a publicly marked route, allowed for fallback');
+            return true;
+        }
+        // Empty jwt given, immediate return
+        if (!jwt) {
+            this.logger.verbose('Empty JWT, unauthorized');
+            throw new common_1.UnauthorizedException();
+        }
+        this.logger.verbose(`User JWT: ${jwt}`);
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, jwt, this.singleTenant, this.multiTenant, this.keycloakOpts);
+        const isValidToken = await this.validateToken(keycloak, jwt);
+        if (isValidToken) {
+            // Attach user info object
+            request.user = (0, parse_token_util_1.parseToken)(jwt);
+            // Attach raw access token JWT extracted from bearer/cookie
+            request.accessTokenJWT = jwt;
+            this.logger.verbose(`Authenticated User: ${JSON.stringify(request.user)}`);
+            return true;
+        }
+        throw new common_1.UnauthorizedException();
+    }
+    async validateToken(keycloak, jwt) {
+        const tokenValidation = this.keycloakOpts.tokenValidation || constants_1.TokenValidation.ONLINE;
+        const grantManager = keycloak.grantManager;
+        let grant;
+        try {
+            const grantData = JSON.stringify({ access_token: jwt });
+            grant = await grantManager.createGrant(grantData);
+        }
+        catch (ex) {
+            this.logger.warn(`Cannot validate access token: ${ex}`);
+            // It will fail to create grants on invalid access token (i.e expired or wrong domain)
+            return false;
+        }
+        const token = grant.access_token;
+        if (!token) {
+            this.logger.warn(`No token`);
+            return false;
+        }
+        this.logger.verbose(`Using token validation method: ${tokenValidation.toUpperCase()}`);
+        try {
+            let result;
+            switch (tokenValidation) {
+                case constants_1.TokenValidation.ONLINE:
+                    result = await grantManager.validateAccessToken(token);
+                    return result === token;
+                case constants_1.TokenValidation.OFFLINE:
+                    result = await grantManager.validateToken(token, 'Bearer');
+                    return result === token;
+                case constants_1.TokenValidation.NONE:
+                    return true;
+                default:
+                    this.logger.warn(`Unknown validation method: ${tokenValidation}`);
+                    return false;
+            }
+        }
+        catch (ex) {
+            this.logger.warn(`Cannot validate access token: ${ex}`);
+        }
+        return false;
+    }
+    extractJwtFromHeaders(headers) {
+        if (!headers?.authorization) {
+            this.logger.verbose(`No authorization header`);
+            return null;
+        }
+        const auth = headers.authorization.split(' ');
+        // We only allow bearer
+        if (auth[0].toLowerCase() !== 'bearer') {
+            this.logger.verbose(`No bearer header`);
+            return null;
+        }
+        return auth[1];
+    }
+    extractJwtFromCookie(cookies) {
+        const cookieKey = this.keycloakOpts.cookieKey || constants_1.KEYCLOAK_COOKIE_DEFAULT;
+        return cookies && cookies[cookieKey];
+    }
+};
+exports.AuthGuard = AuthGuard;
+exports.AuthGuard = AuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_CONNECT_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, common_1.Logger,
+        keycloak_multitenant_service_1.KeycloakMultiTenantService,
+        core_1.Reflector])
+], AuthGuard);

package/dist/src/guards/resource.guard.d.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext, Logger } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import * as KeycloakConnect from 'keycloak-connect';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+import { KeycloakConnectOptions } from '../interface/keycloak-connect-options.interface';
+/**
+ * This adds a resource guard, which is policy enforcement by default is permissive.
+ * Only controllers annotated with `@Resource` and methods with `@Scopes`
+ * are handled by this guard.
+ */
+export declare class ResourceGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private logger;
+    private multiTenant;
+    private readonly reflector;
+    constructor(singleTenant: KeycloakConnect.Keycloak, keycloakOpts: KeycloakConnectOptions, logger: Logger, multiTenant: KeycloakMultiTenantService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/src/guards/resource.guard.js

@@ -0,0 +1,151 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const KeycloakConnect = __importStar(require("keycloak-connect"));
+const enforcer_options_decorator_1 = require("../decorators/enforcer-options.decorator");
+const public_decorator_1 = require("../decorators/public.decorator");
+const resource_decorator_1 = require("../decorators/resource.decorator");
+const scopes_decorator_1 = require("../decorators/scopes.decorator");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+const constants_1 = require("../constants");
+const extract_request_util_1 = require("../common/utils/extract-request.util");
+const get_keycloak_util_1 = require("../common/utils/get-keycloak.util");
+/**
+ * This adds a resource guard, which is policy enforcement by default is permissive.
+ * Only controllers annotated with `@Resource` and methods with `@Scopes`
+ * are handled by this guard.
+ */
+let ResourceGuard = class ResourceGuard {
+    constructor(singleTenant, keycloakOpts, logger, multiTenant, reflector) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.logger = logger;
+        this.multiTenant = multiTenant;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const resource = this.reflector.get(resource_decorator_1.META_RESOURCE, context.getClass());
+        const scopes = this.reflector.get(scopes_decorator_1.META_SCOPES, context.getHandler());
+        const isUnprotected = this.reflector.getAllAndOverride(public_decorator_1.META_UNPROTECTED, [context.getClass(), context.getHandler()]);
+        const enforcerOpts = this.reflector.getAllAndOverride(enforcer_options_decorator_1.META_ENFORCER_OPTIONS, [context.getClass(), context.getHandler()]);
+        // Default to permissive
+        const pem = this.keycloakOpts.policyEnforcement || constants_1.PolicyEnforcementMode.PERMISSIVE;
+        const shouldAllow = pem === constants_1.PolicyEnforcementMode.PERMISSIVE;
+        // No resource given, check policy enforcement mode
+        if (!resource) {
+            if (shouldAllow) {
+                this.logger.verbose(`Controller has no @Resource defined, request allowed due to policy enforcement`);
+            }
+            else {
+                this.logger.verbose(`Controller has no @Resource defined, request denied due to policy enforcement`);
+            }
+            return shouldAllow;
+        }
+        // No scopes given, check policy enforcement mode
+        if (!scopes) {
+            if (shouldAllow) {
+                this.logger.verbose(`Route has no @Scope defined, request allowed due to policy enforcement`);
+            }
+            else {
+                this.logger.verbose(`Route has no @Scope defined, request denied due to policy enforcement`);
+            }
+            return shouldAllow;
+        }
+        this.logger.verbose(`Protecting resource [ ${resource} ] with scopes: [ ${scopes} ]`);
+        // Build permissions
+        const permissions = scopes.map((scope) => `${resource}:${scope}`);
+        // Extract request/response
+        const [request, response] = (0, extract_request_util_1.extractRequest)(context);
+        const { accessTokenJWT } = request;
+        // if is not an HTTP request ignore this guard
+        if (!request) {
+            return true;
+        }
+        if (!request.user && isUnprotected) {
+            this.logger.verbose(`Route has no user, and is public, allowed`);
+            return true;
+        }
+        if (!accessTokenJWT) {
+            this.logger.warn('No access token found in request, are you sure ResourceGuard is first in the chain?');
+            return false;
+        }
+        const user = request.user?.preferred_username ?? 'user';
+        const enforcerFn = createEnforcerContext(request, response, enforcerOpts);
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, accessTokenJWT, this.singleTenant, this.multiTenant, this.keycloakOpts);
+        const isAllowed = await enforcerFn(keycloak, permissions);
+        // If statement for verbose logging only
+        if (!isAllowed) {
+            this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ]`);
+        }
+        else {
+            this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ]`);
+        }
+        return isAllowed;
+    }
+};
+exports.ResourceGuard = ResourceGuard;
+exports.ResourceGuard = ResourceGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_CONNECT_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, common_1.Logger,
+        keycloak_multitenant_service_1.KeycloakMultiTenantService,
+        core_1.Reflector])
+], ResourceGuard);
+const createEnforcerContext = (request, response, options) => (keycloak, permissions) => new Promise((resolve, _) => keycloak.enforcer(permissions, options)(request, response, (_) => {
+    if (request.resourceDenied) {
+        resolve(false);
+    }
+    else {
+        resolve(true);
+    }
+}));

package/dist/src/guards/role.guard.d.ts

@@ -0,0 +1,18 @@
+import { CanActivate, ExecutionContext, Logger } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import * as KeycloakConnect from 'keycloak-connect';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+import { KeycloakConnectOptions } from '../interface/keycloak-connect-options.interface';
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+export declare class RoleGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private logger;
+    private multiTenant;
+    private readonly reflector;
+    constructor(singleTenant: KeycloakConnect.Keycloak, keycloakOpts: KeycloakConnectOptions, logger: Logger, multiTenant: KeycloakMultiTenantService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/src/guards/role.guard.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const KeycloakConnect = __importStar(require("keycloak-connect"));
+const roles_decorator_1 = require("../decorators/roles.decorator");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+const constants_1 = require("../constants");
+const extract_request_util_1 = require("../common/utils/extract-request.util");
+const get_keycloak_util_1 = require("../common/utils/get-keycloak.util");
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+let RoleGuard = class RoleGuard {
+    constructor(singleTenant, keycloakOpts, logger, multiTenant, reflector) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.logger = logger;
+        this.multiTenant = multiTenant;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const roleMerge = this.keycloakOpts.roleMerge
+            ? this.keycloakOpts.roleMerge
+            : constants_1.RoleMerge.OVERRIDE;
+        const rolesMetaDataArray = [];
+        if (roleMerge == constants_1.RoleMerge.ALL) {
+            const mergedRoleMetaData = this.reflector.getAllAndMerge(roles_decorator_1.META_ROLES, [context.getClass(), context.getHandler()]);
+            if (mergedRoleMetaData) {
+                rolesMetaDataArray.push(...mergedRoleMetaData);
+            }
+        }
+        else if (roleMerge == constants_1.RoleMerge.OVERRIDE) {
+            const roleMetaData = this.reflector.getAllAndOverride(roles_decorator_1.META_ROLES, [context.getClass(), context.getHandler()]);
+            if (roleMetaData) {
+                rolesMetaDataArray.push(roleMetaData);
+            }
+        }
+        else {
+            throw Error(`Unknown role merge: ${roleMerge}`);
+        }
+        const combinedRoles = rolesMetaDataArray.flatMap((x) => x.roles);
+        if (combinedRoles.length === 0) {
+            return true;
+        }
+        // Use matching mode of first item
+        const roleMetaData = rolesMetaDataArray[0];
+        const roleMatchingMode = roleMetaData.mode
+            ? roleMetaData.mode
+            : constants_1.RoleMatchingMode.ANY;
+        this.logger.verbose(`Using matching mode: ${roleMatchingMode}`);
+        this.logger.verbose(`Roles: ${JSON.stringify(combinedRoles)}`);
+        // Extract request
+        const [request] = (0, extract_request_util_1.extractRequest)(context);
+        const { accessTokenJWT } = request;
+        // if is not an HTTP request ignore this guard
+        if (!request) {
+            return true;
+        }
+        if (!accessTokenJWT) {
+            this.logger.warn('No access token found in request, are you sure AuthGuard is first in the chain?');
+            return false;
+        }
+        // Create grant
+        const keycloak = await (0, get_keycloak_util_1.getKeycloakInstance)(request, accessTokenJWT, this.singleTenant, this.multiTenant, this.keycloakOpts);
+        const grantData = JSON.stringify({ access_token: accessTokenJWT });
+        const grant = await keycloak.grantManager.createGrant(grantData);
+        // Grab access token from grant
+        const accessToken = grant.access_token;
+        // For verbose logging, we store it instead of returning it immediately
+        const granted = roleMatchingMode === constants_1.RoleMatchingMode.ANY
+            ? combinedRoles.some((r) => accessToken.hasRole(r))
+            : combinedRoles.every((r) => accessToken.hasRole(r));
+        if (granted) {
+            this.logger.verbose(`Resource granted due to role(s)`);
+        }
+        else {
+            this.logger.verbose(`Resource denied due to mismatched role(s)`);
+        }
+        return granted;
+    }
+};
+exports.RoleGuard = RoleGuard;
+exports.RoleGuard = RoleGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_CONNECT_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, common_1.Logger,
+        keycloak_multitenant_service_1.KeycloakMultiTenantService,
+        core_1.Reflector])
+], RoleGuard);

package/dist/src/index.d.ts

@@ -0,0 +1 @@
+export * from './keycloak-connect.module';

package/dist/src/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// public-api
+__exportStar(require("./keycloak-connect.module"), exports);

package/dist/src/interface/keycloak-connect-module-async-options.interface.d.ts

@@ -0,0 +1,9 @@
+import { FactoryProvider, ModuleMetadata, Type } from '@nestjs/common/interfaces';
+import { KeycloakConnectOptionsFactory } from './keycloak-connect-options-factory.interface';
+import { KeycloakConnectOptions } from './keycloak-connect-options.interface';
+export interface KeycloakConnectModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    inject?: FactoryProvider['inject'];
+    useExisting?: Type<KeycloakConnectOptionsFactory>;
+    useClass?: Type<KeycloakConnectOptionsFactory>;
+    useFactory?: (...args: unknown[]) => Promise<KeycloakConnectOptions> | KeycloakConnectOptions;
+}

package/dist/src/interface/keycloak-connect-module-async-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/interface/keycloak-connect-options-factory.interface.d.ts

@@ -0,0 +1,4 @@
+import { KeycloakConnectOptions } from './keycloak-connect-options.interface';
+export interface KeycloakConnectOptionsFactory {
+    createKeycloakConnectOptions(): Promise<KeycloakConnectOptions> | KeycloakConnectOptions;
+}