@clemax/nest-keycloak-connect 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 John Joshua Ferrer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,298 @@
+<div align="center">
+  
+# Nest Keycloak Connect
+
+### You are currently viewing the pre-release documentation for version 2.0. 
+## Click [here](https://github.com/ferrerojosh/nest-keycloak-connect/tree/v1.0) for the 1.0 stable release documentation.
+
+  
+![GitHub Issues or Pull Requests](https://img.shields.io/github/issues/ferrerojosh/nest-keycloak-connect?style=for-the-badge)
+![GitHub License](https://img.shields.io/github/license/ferrerojosh/nest-keycloak-connect?style=for-the-badge)
+  
+![NPM Version](https://img.shields.io/npm/v/nest-keycloak-connect?style=for-the-badge)
+![NPM dev or peer Dependency Version](https://img.shields.io/npm/dependency-version/nest-keycloak-connect/peer/%40nestjs%2Fcommon?style=for-the-badge)
+![NPM dev or peer Dependency Version](https://img.shields.io/npm/dependency-version/nest-keycloak-connect/peer/keycloak-connect?style=for-the-badge)
+
+![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/ferrerojosh/nest-keycloak-connect/build.yml?style=for-the-badge)
+![NPM Weekly Downloads](https://img.shields.io/npm/dw/nest-keycloak-connect?style=for-the-badge)
+![NPM Total Downloads](https://img.shields.io/npm/dt/nest-keycloak-connect?style=for-the-badge)
+
+An adapter for [keycloak-nodejs-connect](https://github.com/keycloak/keycloak-nodejs-connect)
+
+</div>
+
+## Features
+
+- Protect your resources using [Keycloak's Authorization Services](https://www.keycloak.org/docs/latest/authorization_services/).
+- Simply add `@Resource`, `@Scopes`, or `@Roles` in your controllers and you're good to go.
+- Compatible with [Fastify](https://github.com/fastify/fastify) platform.
+
+## Installation
+
+### Yarn
+
+```bash
+yarn add nest-keycloak-connect keycloak-connect
+```
+
+### NPM
+
+```bash
+npm install nest-keycloak-connect keycloak-connect --save
+```
+
+## Getting Started
+
+### Module registration
+
+Registering the module:
+
+```typescript
+KeycloakConnectModule.register({
+  authServerUrl: 'http://localhost:8080', // might be http://localhost:8080/auth for older keycloak versions
+  realm: 'master',
+  clientId: 'my-nestjs-app',
+  secret: 'secret',
+  policyEnforcement: PolicyEnforcementMode.PERMISSIVE, // optional
+  tokenValidation: TokenValidation.ONLINE, // optional
+});
+```
+
+Async registration is also available:
+
+```typescript
+KeycloakConnectModule.registerAsync({
+  useExisting: KeycloakConfigService,
+  imports: [ConfigModule],
+});
+```
+
+#### KeycloakConfigService
+
+```typescript
+import { Injectable } from '@nestjs/common';
+import {
+  KeycloakConnectOptions,
+  KeycloakConnectOptionsFactory,
+  PolicyEnforcementMode,
+  TokenValidation,
+} from 'nest-keycloak-connect';
+
+@Injectable()
+export class KeycloakConfigService implements KeycloakConnectOptionsFactory {
+  createKeycloakConnectOptions(): KeycloakConnectOptions {
+    return {
+      // http://localhost:8080/auth for older keycloak versions
+      authServerUrl: 'http://localhost:8080',
+      realm: 'master',
+      clientId: 'my-nestjs-app',
+      secret: 'secret',
+      policyEnforcement: PolicyEnforcementMode.PERMISSIVE,
+      tokenValidation: TokenValidation.ONLINE,
+    };
+  }
+}
+```
+
+You can also register by just providing the `keycloak.json` path and an optional module configuration:
+
+```typescript
+KeycloakConnectModule.register(`./keycloak.json`, {
+  policyEnforcement: PolicyEnforcementMode.PERMISSIVE,
+  tokenValidation: TokenValidation.ONLINE,
+});
+```
+
+### Guards
+
+Register any of the guards either globally, or scoped in your controller.
+
+#### Global registration using APP_GUARD token
+
+**_NOTE: These are in order, see https://docs.nestjs.com/guards#binding-guards for more information._**
+
+```typescript
+providers: [
+  {
+    provide: APP_GUARD,
+    useClass: AuthGuard,
+  },
+  {
+    provide: APP_GUARD,
+    useClass: ResourceGuard,
+  },
+  {
+    provide: APP_GUARD,
+    useClass: RoleGuard,
+  },
+];
+```
+
+#### Scoped registration
+
+```typescript
+@Controller('cats')
+@UseGuards(AuthGuard, ResourceGuard)
+export class CatsController {}
+```
+
+## What does these providers do ?
+
+### AuthGuard
+
+Adds an authentication guard, you can also have it scoped if you like (using regular `@UseGuards(AuthGuard)` in your controllers). By default, it will throw a 401 unauthorized when it is unable to verify the JWT token or `Bearer` header is missing.
+
+### ResourceGuard
+
+Adds a resource guard, which is permissive by default (can be configured see [options](#nest-keycloak-options)). Only controllers annotated with `@Resource` and methods with `@Scopes` are handled by this guard.
+
+**_NOTE: This guard is not necessary if you are using role-based authorization exclusively. You can use role guard exclusively for that._**
+
+### RoleGuard
+
+Adds a role guard, **can only be used in conjunction with resource guard when enforcement policy is PERMISSIVE**, unless you only use role guard exclusively.
+Permissive by default. Used by controller methods annotated with `@Roles` (matching can be configured)
+
+## Configuring controllers
+
+In your controllers, simply do:
+
+```typescript
+import {
+  Resource,
+  Roles,
+  Scopes,
+  Public,
+  RoleMatchingMode,
+} from 'nest-keycloak-connect';
+import { Controller, Get, Delete, Put, Post, Param } from '@nestjs/common';
+import { Product } from './product';
+import { ProductService } from './product.service';
+
+@Controller()
+@Resource(Product.name)
+export class ProductController {
+  constructor(private service: ProductService) {}
+
+  @Get()
+  @Public()
+  async findAll() {
+    return await this.service.findAll();
+  }
+
+  @Get()
+  @Roles({ roles: ['admin', 'other'] })
+  async findAllBarcodes() {
+    return await this.service.findAllBarcodes();
+  }
+
+  @Get(':code')
+  @Scopes('View')
+  async findByCode(@Param('code') code: string) {
+    return await this.service.findByCode(code);
+  }
+
+  @Post()
+  @Scopes('Create')
+  @ConditionalScopes((request, token) => {
+    if (token.hasRealmRole('sysadmin')) {
+      return ['Overwrite'];
+    }
+    return [];
+  })
+  async create(@Body() product: Product) {
+    return await this.service.create(product);
+  }
+
+  @Delete(':code')
+  @Scopes('Delete')
+  @Roles({ roles: ['admin', 'realm:sysadmin'], mode: RoleMatchingMode.ALL })
+  async deleteByCode(@Param('code') code: string) {
+    return await this.service.deleteByCode(code);
+  }
+
+  @Put(':code')
+  @Scopes('Edit')
+  async update(@Param('code') code: string, @Body() product: Product) {
+    return await this.service.update(code, product);
+  }
+}
+```
+
+## Decorators
+
+Here is the decorators you can use in your controllers.
+
+| Decorator          | Description                                                                                               |
+| ------------------ | --------------------------------------------------------------------------------------------------------- |
+| @KeycloakUser      | Retrieves the current Keycloak logged-in user. (must be per method, unless controller is request scoped.) |
+| @AccessToken       | Retrieves the access token used in the request                                                            |
+| @ResolvedScopes    | Retrieves the resolved scopes (used in @ConditionalScopes)                                                |
+| @EnforcerOptions   | Keycloak enforcer options.                                                                                |
+| @Public            | Allow any user to use the route.                                                                          |
+| @Resource          | Keycloak application resource name.                                                                       |
+| @Scopes            | Keycloak application scopes.                                                                              |
+| @ConditionalScopes | Conditional keycloak application scopes.                                                                  |
+| @Roles             | Keycloak realm/application roles.                                                                         |
+
+## Multi tenant configuration
+
+Setting up for multi-tenant is configured as an option in your configuration:
+
+```typescript
+{
+  // Add /auth for older keycloak versions
+  authServerUrl: 'http://localhost:8180/', // will be used as fallback
+  clientId: 'nest-api', // will be used as fallback
+  secret: 'fallback', // will be used as fallback
+  multiTenant: {
+    resolveAlways: true,
+    realmResolver: (request) => {
+      return request.get('host').split('.')[0];
+    },
+    realmSecretResolver: (realm, request) => {
+      const secrets = { master: 'secret', slave: 'password' };
+      return secrets[realm];
+    },
+    realmClientIdResolver: (realm, request) => {
+      const clientIds = { master: 'angular-app', slave: 'vue-app' };
+      return clientIds[realm];
+    },
+    // note to add /auth for older keycloak versions
+    realmAuthServerUrlResolver: (realm, request) => {
+      const authServerUrls = { master: 'https://master.local/', slave: 'https://slave.local/' };
+      return authServerUrls[realm];
+    }
+  }
+}
+```
+
+## Configuration options
+
+### Keycloak Options
+
+For Keycloak options, refer to the official [keycloak-connect](https://github.com/keycloak/keycloak-nodejs-connect/blob/main/middleware/auth-utils/config.js) library.
+
+### Nest Keycloak Options
+
+| Option            | Description                                                              | Required | Default      |
+| ----------------- | ------------------------------------------------------------------------ | -------- | ------------ |
+| cookieKey         | Cookie Key                                                               | no       | KEYCLOAK_JWT |
+| policyEnforcement | Sets the policy enforcement mode                                         | no       | PERMISSIVE   |
+| tokenValidation   | Sets the token validation method                                         | no       | ONLINE       |
+| multiTenant       | Sets the options for [multi-tenant configuration](#multi-tenant-options) | no       | -            |
+| roleMerge         | Sets the merge mode for @Role decorator                                  | no       | OVERRIDE     |
+
+### Multi Tenant Options
+
+| Option                     | Description                                                                                             | Required | Default |
+| -------------------------- | ------------------------------------------------------------------------------------------------------- | -------- | ------- |
+| resolveAlways              | Option to always resolve the realm and secret. Disabled by default.                                     | no       | false   |
+| realmResolver              | A function that passes a request (from respective platform i.e express or fastify) and returns a string | yes      | -       |
+| realmSecretResolver        | A function that passes the realm string, and an optional request and returns the secret string          | no       | -       |
+| realmAuthServerUrlResolver | A function that passes the realm string, and an optional request and returns the auth server url string | no       | -       |
+| realmClientIdResolver      | A function that passes the realm string, and an optional request and returns the client-id string       | no       | -       |
+
+## Example app
+
+An [example application](example) is provided in the source code with both Keycloak Realm and Postman requests for you to experiment with.

package/dist/constants.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Used internally, provides keycloak options for the Nest guards.
+ */
+export declare const KEYCLOAK_CONNECT_OPTIONS = "KEYCLOAK_CONNECT_OPTIONS";
+/**
+ * Key for injecting a keycloak instance.
+ */
+export declare const KEYCLOAK_INSTANCE = "KEYCLOAK_INSTANCE";
+/**
+ * Key for injecting a keycloak multi tenant service.
+ */
+export declare const KEYCLOAK_MULTITENANT_SERVICE = "KEYCLOAK_MULTITENANT_SERVICE";
+/**
+ * Default cookie key.
+ */
+export declare const KEYCLOAK_COOKIE_DEFAULT = "KEYCLOAK_JWT";
+/**
+ * Role matching mode.
+ */
+export declare enum RoleMatch {
+    /**
+     * Match all roles
+     */
+    ALL = "all",
+    /**
+     * Match any roles
+     */
+    ANY = "any"
+}
+/**
+ * Policy enforcement mode.
+ */
+export declare enum PolicyEnforcementMode {
+    /**
+     * Deny all request when there is no matching resource.
+     */
+    ENFORCING = "enforcing",
+    /**
+     * Allow all request even when there's no matching resource.
+     */
+    PERMISSIVE = "permissive"
+}
+/**
+ * Token validation methods.
+ */
+export declare enum TokenValidation {
+    /**
+     * The default validation method, performs live validation via Keycloak servers.
+     */
+    ONLINE = "online",
+    /**
+     * Validate offline against the configured keycloak options.
+     */
+    OFFLINE = "offline",
+    /**
+     * Does not check for any validation. Should only be used for special cases (i.e development, internal networks)
+     */
+    NONE = "none"
+}
+export declare enum RoleMerge {
+    /**
+     * Overrides roles if defined both controller and handlers, with controller taking over.
+     */
+    OVERRIDE = 0,
+    /**
+     * Merges all roles from both controller and handlers.
+     */
+    ALL = 1
+}

package/dist/constants.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleMerge = exports.TokenValidation = exports.PolicyEnforcementMode = exports.RoleMatch = exports.KEYCLOAK_COOKIE_DEFAULT = exports.KEYCLOAK_MULTITENANT_SERVICE = exports.KEYCLOAK_INSTANCE = exports.KEYCLOAK_CONNECT_OPTIONS = void 0;
+/**
+ * Used internally, provides keycloak options for the Nest guards.
+ */
+exports.KEYCLOAK_CONNECT_OPTIONS = 'KEYCLOAK_CONNECT_OPTIONS';
+/**
+ * Key for injecting a keycloak instance.
+ */
+exports.KEYCLOAK_INSTANCE = 'KEYCLOAK_INSTANCE';
+/**
+ * Key for injecting a keycloak multi tenant service.
+ */
+exports.KEYCLOAK_MULTITENANT_SERVICE = 'KEYCLOAK_MULTITENANT_SERVICE';
+/**
+ * Default cookie key.
+ */
+exports.KEYCLOAK_COOKIE_DEFAULT = 'KEYCLOAK_JWT';
+/**
+ * Role matching mode.
+ */
+var RoleMatch;
+(function (RoleMatch) {
+    /**
+     * Match all roles
+     */
+    RoleMatch["ALL"] = "all";
+    /**
+     * Match any roles
+     */
+    RoleMatch["ANY"] = "any";
+})(RoleMatch || (exports.RoleMatch = RoleMatch = {}));
+/**
+ * Policy enforcement mode.
+ */
+var PolicyEnforcementMode;
+(function (PolicyEnforcementMode) {
+    /**
+     * Deny all request when there is no matching resource.
+     */
+    PolicyEnforcementMode["ENFORCING"] = "enforcing";
+    /**
+     * Allow all request even when there's no matching resource.
+     */
+    PolicyEnforcementMode["PERMISSIVE"] = "permissive";
+})(PolicyEnforcementMode || (exports.PolicyEnforcementMode = PolicyEnforcementMode = {}));
+/**
+ * Token validation methods.
+ */
+var TokenValidation;
+(function (TokenValidation) {
+    /**
+     * The default validation method, performs live validation via Keycloak servers.
+     */
+    TokenValidation["ONLINE"] = "online";
+    /**
+     * Validate offline against the configured keycloak options.
+     */
+    TokenValidation["OFFLINE"] = "offline";
+    /**
+     * Does not check for any validation. Should only be used for special cases (i.e development, internal networks)
+     */
+    TokenValidation["NONE"] = "none";
+})(TokenValidation || (exports.TokenValidation = TokenValidation = {}));
+var RoleMerge;
+(function (RoleMerge) {
+    /**
+     * Overrides roles if defined both controller and handlers, with controller taking over.
+     */
+    RoleMerge[RoleMerge["OVERRIDE"] = 0] = "OVERRIDE";
+    /**
+     * Merges all roles from both controller and handlers.
+     */
+    RoleMerge[RoleMerge["ALL"] = 1] = "ALL";
+})(RoleMerge || (exports.RoleMerge = RoleMerge = {}));

package/dist/decorators/access-token.decorator.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Retrieves the currently used access token
+ * @since 2.0.0
+ */
+export declare const AccessToken: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/decorators/access-token.decorator.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessToken = void 0;
+const common_1 = require("@nestjs/common");
+const internal_util_1 = require("../internal.util");
+/**
+ * Retrieves the currently used access token
+ * @since 2.0.0
+ */
+exports.AccessToken = (0, common_1.createParamDecorator)((data, ctx) => {
+    const [req] = (0, internal_util_1.extractRequest)(ctx);
+    return req.accessToken;
+});

package/dist/decorators/enforcer-options.decorator.d.ts

@@ -0,0 +1,8 @@
+import * as KeycloakConnect from 'keycloak-connect';
+export declare const META_ENFORCER_OPTIONS = "enforcer-options";
+/**
+ * Keycloak enforcer options
+ * @param opts - enforcer options
+ * @since 1.3.0
+ */
+export declare const EnforcerOptions: (opts: KeycloakConnect.EnforcerOptions) => import("@nestjs/common").CustomDecorator<string>;

package/dist/decorators/enforcer-options.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforcerOptions = exports.META_ENFORCER_OPTIONS = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_ENFORCER_OPTIONS = 'enforcer-options';
+/**
+ * Keycloak enforcer options
+ * @param opts - enforcer options
+ * @since 1.3.0
+ */
+const EnforcerOptions = (opts) => (0, common_1.SetMetadata)(exports.META_ENFORCER_OPTIONS, opts);
+exports.EnforcerOptions = EnforcerOptions;

package/dist/decorators/keycloak-user.decorator.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Retrieves the current Keycloak logged-in user.
+ * @since 1.5.0
+ */
+export declare const KeycloakUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/decorators/keycloak-user.decorator.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakUser = void 0;
+const common_1 = require("@nestjs/common");
+const internal_util_1 = require("../internal.util");
+/**
+ * Retrieves the current Keycloak logged-in user.
+ * @since 1.5.0
+ */
+exports.KeycloakUser = (0, common_1.createParamDecorator)((data, ctx) => {
+    const [req] = (0, internal_util_1.extractRequest)(ctx);
+    return req.user;
+});

package/dist/decorators/public.decorator.d.ts

@@ -0,0 +1,7 @@
+export declare const META_PUBLIC = "public";
+/**
+ * Allows unauthorized traffic to enter the route.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/decorators/public.decorator.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.META_PUBLIC = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_PUBLIC = 'public';
+/**
+ * Allows unauthorized traffic to enter the route.
+ * @since 1.2.0
+ * @param skipAuth attaches authorization header to user object when `false`, defaults to `true`
+ */
+const Public = () => (0, common_1.SetMetadata)(exports.META_PUBLIC, true);
+exports.Public = Public;

package/dist/decorators/resource.decorator.d.ts

@@ -0,0 +1,6 @@
+export declare const META_RESOURCE = "resource";
+/**
+ * Keycloak Resource.
+ * @param resource - name of resource
+ */
+export declare const Resource: (resource: string) => import("@nestjs/common").CustomDecorator<string>;

package/dist/decorators/resource.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Resource = exports.META_RESOURCE = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_RESOURCE = 'resource';
+/**
+ * Keycloak Resource.
+ * @param resource - name of resource
+ */
+const Resource = (resource) => (0, common_1.SetMetadata)(exports.META_RESOURCE, resource);
+exports.Resource = Resource;

package/dist/decorators/roles.decorator.d.ts

@@ -0,0 +1,10 @@
+import { RoleMatch } from '../constants';
+export declare const META_ROLES = "roles";
+export declare const META_ROLE_MATCHING_MODE = "role-matching-mode";
+/**
+ * Keycloak user roles.
+ * @param roles - the roles to match
+ * @since 2.0.0
+ */
+export declare const Roles: (...roles: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export declare const RoleMatchingMode: (mode: RoleMatch) => import("@nestjs/common").CustomDecorator<string>;

package/dist/decorators/roles.decorator.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleMatchingMode = exports.Roles = exports.META_ROLE_MATCHING_MODE = exports.META_ROLES = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_ROLES = 'roles';
+exports.META_ROLE_MATCHING_MODE = 'role-matching-mode';
+/**
+ * Keycloak user roles.
+ * @param roles - the roles to match
+ * @since 2.0.0
+ */
+const Roles = (...roles) => (0, common_1.SetMetadata)(exports.META_ROLES, roles);
+exports.Roles = Roles;
+const RoleMatchingMode = (mode) => (0, common_1.SetMetadata)(exports.META_ROLE_MATCHING_MODE, mode);
+exports.RoleMatchingMode = RoleMatchingMode;

package/dist/decorators/scopes.decorator.d.ts

@@ -0,0 +1,19 @@
+import * as KeycloakConnect from 'keycloak-connect';
+export declare const META_SCOPES = "scopes";
+export declare const META_CONDITIONAL_SCOPES = "conditional-scopes";
+export type ConditionalScopeFn = (request: any, token: KeycloakConnect.Token) => string[];
+/**
+ * Keycloak authorization scopes.
+ * @param scopes - scopes that are associated with the resource
+ */
+export declare const Scopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+/**
+ * Keycloak authorization conditional scopes.
+ * @param scopes - scopes that are associated with the resource depending on the conditions
+ */
+export declare const ConditionalScopes: (resolver: ConditionalScopeFn) => import("@nestjs/common").CustomDecorator<string>;
+/**
+ * Retrieves the resolved scopes.
+ * @since 1.5.0
+ */
+export declare const ResolvedScopes: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/decorators/scopes.decorator.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolvedScopes = exports.ConditionalScopes = exports.Scopes = exports.META_CONDITIONAL_SCOPES = exports.META_SCOPES = void 0;
+const common_1 = require("@nestjs/common");
+exports.META_SCOPES = 'scopes';
+exports.META_CONDITIONAL_SCOPES = 'conditional-scopes';
+/**
+ * Keycloak authorization scopes.
+ * @param scopes - scopes that are associated with the resource
+ */
+const Scopes = (...scopes) => (0, common_1.SetMetadata)(exports.META_SCOPES, scopes);
+exports.Scopes = Scopes;
+/**
+ * Keycloak authorization conditional scopes.
+ * @param scopes - scopes that are associated with the resource depending on the conditions
+ */
+const ConditionalScopes = (resolver) => (0, common_1.SetMetadata)(exports.META_CONDITIONAL_SCOPES, resolver);
+exports.ConditionalScopes = ConditionalScopes;
+const common_2 = require("@nestjs/common");
+const internal_util_1 = require("../internal.util");
+/**
+ * Retrieves the resolved scopes.
+ * @since 1.5.0
+ */
+exports.ResolvedScopes = (0, common_2.createParamDecorator)((data, ctx) => {
+    const [req] = (0, internal_util_1.extractRequest)(ctx);
+    return req.scopes;
+});

package/dist/guards/auth.guard.d.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import * as KeycloakConnect from 'keycloak-connect';
+import { KeycloakConnectConfig } from '../interface/keycloak-connect-options.interface';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+/**
+ * An authentication guard. Will return a 401 unauthorized when it is unable to
+ * verify the JWT token or Bearer header is missing.
+ */
+export declare class AuthGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private multiTenant;
+    private readonly logger;
+    private readonly reflector;
+    constructor(singleTenant: KeycloakConnect.Keycloak, keycloakOpts: KeycloakConnectConfig, multiTenant: KeycloakMultiTenantService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private validateToken;
+    private extractJwt;
+}