@clemax/nest-keycloak-connect 2.1.0 → 2.1.1

package/dist/guards/resource.guard.js

@@ -0,0 +1,175 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var ResourceGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const KeycloakConnect = __importStar(require("keycloak-connect"));
+const constants_1 = require("../constants");
+const enforcer_options_decorator_1 = require("../decorators/enforcer-options.decorator");
+const public_decorator_1 = require("../decorators/public.decorator");
+const resource_decorator_1 = require("../decorators/resource.decorator");
+const scopes_decorator_1 = require("../decorators/scopes.decorator");
+const internal_util_1 = require("../internal.util");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+/**
+ * This adds a resource guard, which is policy enforcement by default is permissive.
+ * Only controllers annotated with `@Resource` and methods with `@Scopes`
+ * are handled by this guard.
+ */
+let ResourceGuard = ResourceGuard_1 = class ResourceGuard {
+    constructor(singleTenant, keycloakOpts, multiTenant) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.multiTenant = multiTenant;
+        this.logger = new common_1.Logger(ResourceGuard_1.name);
+        this.reflector = new core_1.Reflector();
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const defaultEnforcerOpts = {
+                claims: (request) => {
+                    const httpUri = request.url;
+                    const userAgent = request.headers['user-agent'];
+                    this.logger.verbose(`Enforcing claims, http.uri: ${httpUri}, user.agent: ${userAgent}`);
+                    return {
+                        'http.uri': [httpUri],
+                        'user.agent': [userAgent],
+                    };
+                },
+            };
+            const resource = this.reflector.get(resource_decorator_1.META_RESOURCE, context.getClass());
+            const explicitScopes = (_a = this.reflector.get(scopes_decorator_1.META_SCOPES, context.getHandler())) !== null && _a !== void 0 ? _a : [];
+            const conditionalScopes = this.reflector.get(scopes_decorator_1.META_CONDITIONAL_SCOPES, context.getHandler());
+            const isPublic = this.reflector.getAllAndOverride(public_decorator_1.META_PUBLIC, [
+                context.getClass(),
+                context.getHandler(),
+            ]);
+            const enforcerOpts = (_b = this.reflector.getAllAndOverride(enforcer_options_decorator_1.META_ENFORCER_OPTIONS, [context.getClass(), context.getHandler()])) !== null && _b !== void 0 ? _b : defaultEnforcerOpts;
+            // Default to permissive
+            const policyEnforcementMode = this.keycloakOpts.policyEnforcement || constants_1.PolicyEnforcementMode.PERMISSIVE;
+            const shouldAllow = policyEnforcementMode === constants_1.PolicyEnforcementMode.PERMISSIVE;
+            // Extract request/response
+            const cookieKey = this.keycloakOpts.cookieKey || constants_1.KEYCLOAK_COOKIE_DEFAULT;
+            const [request, response] = (0, internal_util_1.extractRequestAndAttachCookie)(context, cookieKey);
+            // if is not an HTTP request ignore this guard
+            if (!request) {
+                return true;
+            }
+            if (!request.user && isPublic) {
+                this.logger.verbose(`Route has no user, and is public, allowed`);
+                return true;
+            }
+            const keycloak = yield (0, internal_util_1.useKeycloak)(request, request.accessToken, this.singleTenant, this.multiTenant, this.keycloakOpts);
+            const grant = yield keycloak.grantManager.createGrant({
+                access_token: request.accessToken,
+            });
+            // No resource given, check policy enforcement mode
+            if (!resource) {
+                if (shouldAllow) {
+                    this.logger.verbose(`Controller has no @Resource defined, request allowed due to policy enforcement`);
+                }
+                else {
+                    this.logger.verbose(`Controller has no @Resource defined, request denied due to policy enforcement`);
+                }
+                return shouldAllow;
+            }
+            // Build the required scopes
+            const conditionalScopesResult = conditionalScopes != null || conditionalScopes != undefined
+                ? conditionalScopes(request, grant.access_token)
+                : [];
+            const scopes = [...explicitScopes, ...conditionalScopesResult];
+            // Attach resolved scopes
+            request.scopes = scopes;
+            // No scopes given, check policy enforcement mode
+            if (!scopes || scopes.length === 0) {
+                if (shouldAllow) {
+                    this.logger.verbose(`Route has no @Scope/@ConditionalScopes defined, request allowed due to policy enforcement`);
+                }
+                else {
+                    this.logger.verbose(`Route has no @Scope/@ConditionalScopes defined, request denied due to policy enforcement`);
+                }
+                return shouldAllow;
+            }
+            this.logger.verbose(`Protecting resource [ ${resource} ] with scopes: [ ${scopes} ]`);
+            const user = (_d = (_c = request.user) === null || _c === void 0 ? void 0 : _c.preferred_username) !== null && _d !== void 0 ? _d : 'user';
+            const enforcerFn = createEnforcerContext(request, response, enforcerOpts);
+            // Build permissions
+            const permissions = scopes.map((scope) => `${resource}:${scope}`);
+            const isAllowed = yield enforcerFn(keycloak, permissions);
+            // If statement for verbose logging only
+            if (!isAllowed) {
+                this.logger.verbose(`Resource [ ${resource} ] denied to [ ${user} ]`);
+            }
+            else {
+                this.logger.verbose(`Resource [ ${resource} ] granted to [ ${user} ]`);
+            }
+            return isAllowed;
+        });
+    }
+};
+exports.ResourceGuard = ResourceGuard;
+exports.ResourceGuard = ResourceGuard = ResourceGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_CONNECT_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, keycloak_multitenant_service_1.KeycloakMultiTenantService])
+], ResourceGuard);
+const createEnforcerContext = (request, response, options) => (keycloak, permissions) => 
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+new Promise((resolve, _) => 
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+keycloak.enforcer(permissions, options)(request, response, (_) => {
+    if (request.resourceDenied) {
+        resolve(false);
+    }
+    else {
+        resolve(true);
+    }
+}));

package/dist/guards/role.guard.d.ts

@@ -0,0 +1,17 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import * as KeycloakConnect from 'keycloak-connect';
+import { KeycloakConnectConfig } from '../interface/keycloak-connect-options.interface';
+import { KeycloakMultiTenantService } from '../services/keycloak-multitenant.service';
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+export declare class RoleGuard implements CanActivate {
+    private singleTenant;
+    private keycloakOpts;
+    private multiTenant;
+    private readonly logger;
+    private readonly reflector;
+    constructor(singleTenant: KeycloakConnect.Keycloak, keycloakOpts: KeycloakConnectConfig, multiTenant: KeycloakMultiTenantService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/guards/role.guard.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var RoleGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const KeycloakConnect = __importStar(require("keycloak-connect"));
+const constants_1 = require("../constants");
+const roles_decorator_1 = require("../decorators/roles.decorator");
+const internal_util_1 = require("../internal.util");
+const keycloak_multitenant_service_1 = require("../services/keycloak-multitenant.service");
+/**
+ * A permissive type of role guard. Roles are set via `@Roles` decorator.
+ * @since 1.1.0
+ */
+let RoleGuard = RoleGuard_1 = class RoleGuard {
+    constructor(singleTenant, keycloakOpts, multiTenant) {
+        this.singleTenant = singleTenant;
+        this.keycloakOpts = keycloakOpts;
+        this.multiTenant = multiTenant;
+        this.logger = new common_1.Logger(RoleGuard_1.name);
+        this.reflector = new core_1.Reflector();
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const roleMerge = this.keycloakOpts.roleMerge
+                ? this.keycloakOpts.roleMerge
+                : constants_1.RoleMerge.OVERRIDE;
+            const roles = [];
+            const matchingMode = this.reflector.getAllAndOverride(roles_decorator_1.META_ROLE_MATCHING_MODE, [context.getClass(), context.getHandler()]);
+            if (roleMerge == constants_1.RoleMerge.ALL) {
+                const mergedRoles = this.reflector.getAllAndMerge(roles_decorator_1.META_ROLES, [
+                    context.getClass(),
+                    context.getHandler(),
+                ]);
+                if (mergedRoles) {
+                    roles.push(...mergedRoles);
+                }
+            }
+            else if (roleMerge == constants_1.RoleMerge.OVERRIDE) {
+                const resultRoles = this.reflector.getAllAndOverride(roles_decorator_1.META_ROLES, [context.getClass(), context.getHandler()]);
+                if (resultRoles) {
+                    roles.push(...resultRoles);
+                }
+            }
+            else {
+                throw Error(`Unknown role merge: ${roleMerge}`);
+            }
+            if (roles.length === 0) {
+                return true;
+            }
+            const roleMatchingMode = matchingMode !== null && matchingMode !== void 0 ? matchingMode : constants_1.RoleMatch.ANY;
+            this.logger.verbose(`Using matching mode: ${roleMatchingMode}`, { roles });
+            // Extract request
+            const cookieKey = this.keycloakOpts.cookieKey || constants_1.KEYCLOAK_COOKIE_DEFAULT;
+            const [request] = (0, internal_util_1.extractRequestAndAttachCookie)(context, cookieKey);
+            const { accessToken } = request;
+            // if is not an HTTP request ignore this guard
+            if (!request) {
+                return true;
+            }
+            if (!accessToken) {
+                // No access token attached, auth guard should have attached the necessary token
+                this.logger.warn('No access token found in request, are you sure AuthGuard is first in the chain?');
+                return false;
+            }
+            // Create grant
+            const keycloak = yield (0, internal_util_1.useKeycloak)(request, request.accessToken, this.singleTenant, this.multiTenant, this.keycloakOpts);
+            const grant = yield keycloak.grantManager.createGrant({
+                access_token: accessToken,
+            });
+            // Grab access token from grant
+            const grantAccessToken = grant.access_token;
+            // For verbose logging, we store it instead of returning it immediately
+            const granted = roleMatchingMode === constants_1.RoleMatch.ANY
+                ? roles.some((r) => grantAccessToken.hasRole(r))
+                : roles.every((r) => grantAccessToken.hasRole(r));
+            if (granted) {
+                this.logger.verbose(`Resource granted due to role(s)`);
+            }
+            else {
+                this.logger.verbose(`Resource denied due to mismatched role(s)`);
+            }
+            return granted;
+        });
+    }
+};
+exports.RoleGuard = RoleGuard;
+exports.RoleGuard = RoleGuard = RoleGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_CONNECT_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, keycloak_multitenant_service_1.KeycloakMultiTenantService])
+], RoleGuard);

package/dist/index.d.ts

@@ -0,0 +1 @@
+export * from './keycloak-connect.module';

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// public-api
+__exportStar(require("./keycloak-connect.module"), exports);

package/dist/interface/keycloak-connect-module-async-options.interface.d.ts

@@ -0,0 +1,9 @@
+import { ModuleMetadata, Type } from '@nestjs/common/interfaces';
+import { KeycloakConnectOptionsFactory } from './keycloak-connect-options-factory.interface';
+import { KeycloakConnectOptions } from './keycloak-connect-options.interface';
+export interface KeycloakConnectModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    inject?: any[];
+    useExisting?: Type<KeycloakConnectOptionsFactory>;
+    useClass?: Type<KeycloakConnectOptionsFactory>;
+    useFactory?: (...args: any[]) => Promise<KeycloakConnectOptions> | KeycloakConnectOptions;
+}

package/dist/interface/keycloak-connect-module-async-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/keycloak-connect-options-factory.interface.d.ts

@@ -0,0 +1,4 @@
+import { KeycloakConnectOptions } from './keycloak-connect-options.interface';
+export interface KeycloakConnectOptionsFactory {
+    createKeycloakConnectOptions(): Promise<KeycloakConnectOptions> | KeycloakConnectOptions;
+}

package/dist/interface/keycloak-connect-options-factory.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/interface/keycloak-connect-options.interface.d.ts

@@ -0,0 +1,170 @@
+import { PolicyEnforcementMode, RoleMerge, TokenValidation } from '../constants';
+export type KeycloakConnectOptions = string | KeycloakConnectConfig;
+/**
+ * Multi tenant configuration.
+ */
+export interface MultiTenantOptions {
+    /**
+     * Option to always resolve the realm and secret. Disabled by default.
+     */
+    resolveAlways?: boolean;
+    /**
+     * The realm resolver function.
+     */
+    realmResolver: (request: any) => Promise<string> | string;
+    /**
+     * The realm secret resolver function.
+     */
+    realmSecretResolver?: (realm: string, request?: any) => Promise<string> | string;
+    /**
+     * The realm auth server url resolver function.
+     */
+    realmAuthServerUrlResolver?: (realm: string, request?: any) => Promise<string> | string;
+    /**
+     * The realm client id resolver function.
+     */
+    realmClientIdResolver: (realm: string, request?: any) => Promise<string> | string;
+}
+/**
+ * Library only configuration.
+ */
+export interface NestKeycloakConfig {
+    /**
+     * Cookie key.
+     */
+    cookieKey?: string;
+    /**
+     * Sets the policy enforcement mode for this adapter, defaults to {@link PolicyEnforcementMode.PERMISSIVE}.
+     */
+    policyEnforcement?: PolicyEnforcementMode;
+    /**
+     * Sets the token validation method, defaults to {@link TokenValidation.ONLINE}.
+     */
+    tokenValidation?: TokenValidation;
+    /**
+     * Multi tenant options.
+     */
+    multiTenant?: MultiTenantOptions;
+    /**
+     * Role merging options.
+     */
+    roleMerge?: RoleMerge;
+}
+/**
+ * Keycloak Connect options.
+ * @see {@link https://github.com/keycloak/keycloak-nodejs-connect/blob/f8e011aea5/middleware/auth-utils/config.js}
+ */
+export interface KeycloakConnectConfig extends NestKeycloakConfig {
+    /**
+     * Realm ID.
+     */
+    realm?: string;
+    /**
+     * Client/Application ID.
+     */
+    resource?: string;
+    /**
+     * Client/Application ID.
+     * @see {KeycloakConnectOptions#resource}
+     */
+    'client-id'?: string;
+    /**
+     * Client/Application ID.
+     * @see {KeycloakConnectOptions#resource}
+     */
+    clientId?: string;
+    /**
+     * Client/Application secret.
+     */
+    credentials?: KeycloakCredentials;
+    /**
+     * Client/Application secret.
+     * @see {KeycloakCredentials#secret}
+     */
+    secret: string;
+    /**
+     * If this is a public application or confidential.
+     * @see {KeycloakConnectOptions#public}
+     */
+    'public-client'?: boolean;
+    /**
+     * If this is a public application or confidential.
+     */
+    public?: boolean;
+    /**
+     * Authentication server URL.
+     * @see {KeycloakConnectOptions#authServerUrl}
+     */
+    'auth-server-url'?: string;
+    /**
+     * Authentication server URL.
+     * @see {KeycloakConnectOptions#authServerUrl}
+     */
+    'server-url'?: string;
+    /**
+     * Authentication server URL.
+     * @see {KeycloakConnectOptions#authServerUrl}
+     */
+    serverUrl?: string;
+    /**
+     * Authentication server URL.
+     */
+    authServerUrl?: string;
+    /**
+     * How many minutes before retrying getting the keys.
+     * @see {KeycloakConnectOptions#minTimeBetweenJwksRequests}
+     */
+    'min-time-between-jwks-requests'?: number;
+    /**
+     * How many minutes before retrying getting the keys.
+     */
+    minTimeBetweenJwksRequests?: number;
+    /**
+     * If this is a Bearer Only application.
+     * @see {KeycloakConnectOptions#bearerOnly}
+     */
+    'bearer-only'?: boolean;
+    /**
+     * If this is a Bearer Only application.
+     */
+    bearerOnly?: boolean;
+    /**
+     * Formatted public-key.
+     * @see {KeycloakConnectOptions#realmPublicKey}
+     */
+    'realm-public-key'?: string;
+    /**
+     * Formatted public-key.
+     */
+    realmPublicKey?: string;
+    /**
+     * Verify token audience.
+     * @see {KeycloakConnectOptions#verifyTokenAudience}
+     */
+    'verify-token-audience'?: boolean;
+    /**
+     * Verify token audience.
+     */
+    verifyTokenAudience?: boolean;
+    /**
+     * Confidential port.
+     */
+    'confidential-port'?: string | number;
+    /**
+     * Require SSL.
+     */
+    'ssl-required'?: string;
+    /**
+     * Allowed issuers.
+     */
+    'allowed-issuers'?: string[] | string;
+}
+/**
+ * Represents Keycloak credentials.
+ */
+export interface KeycloakCredentials {
+    /**
+     * Client/Application secret.
+     */
+    secret: string;
+}

package/dist/interface/keycloak-connect-options.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+// The typings are a bit of a mess, I'm sure there's a better way to do this.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/internal.util.d.ts

@@ -0,0 +1,8 @@
+import { ExecutionContext } from '@nestjs/common';
+import KeycloakConnect from 'keycloak-connect';
+import { KeycloakConnectConfig } from './interface/keycloak-connect-options.interface';
+import { KeycloakMultiTenantService } from './services/keycloak-multitenant.service';
+export declare const useKeycloak: (request: any, jwt: string, singleTenant: KeycloakConnect.Keycloak, multiTenant: KeycloakMultiTenantService, opts: KeycloakConnectConfig) => Promise<KeycloakConnect.Keycloak>;
+export declare const attachCookieToHeader: (request: any, cookieKey: string) => any;
+export declare const extractRequest: (context: ExecutionContext) => [any, any];
+export declare const extractRequestAndAttachCookie: (context: ExecutionContext, cookieKey: string) => any[];

package/dist/internal.util.js

@@ -0,0 +1,69 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractRequestAndAttachCookie = exports.extractRequest = exports.attachCookieToHeader = exports.useKeycloak = void 0;
+const util_1 = require("./util");
+// Confusing and all, but I needed to extract this fn to avoid more repeating code
+// TODO: Rework in 2.0
+const useKeycloak = (request, jwt, singleTenant, multiTenant, opts) => __awaiter(void 0, void 0, void 0, function* () {
+    if (opts.multiTenant && opts.multiTenant.realmResolver) {
+        const resolvedRealm = opts.multiTenant.realmResolver(request);
+        const realm = resolvedRealm instanceof Promise ? yield resolvedRealm : resolvedRealm;
+        return yield multiTenant.get(realm, request);
+    }
+    else if (!opts.realm) {
+        const payload = (0, util_1.parseToken)(jwt);
+        const issuerRealm = payload.iss.split('/').pop();
+        return yield multiTenant.get(issuerRealm, request);
+    }
+    return singleTenant;
+});
+exports.useKeycloak = useKeycloak;
+const attachCookieToHeader = (request, cookieKey) => {
+    // Attach cookie as authorization header
+    if (request && request.cookies && request.cookies[cookieKey]) {
+        request.headers.authorization = `Bearer ${request.cookies[cookieKey]}`;
+    }
+    return request;
+};
+exports.attachCookieToHeader = attachCookieToHeader;
+const extractRequest = (context) => {
+    let request, response;
+    // Check if request is coming from graphql or http
+    if (context.getType() === 'http') {
+        // http request
+        const httpContext = context.switchToHttp();
+        request = httpContext.getRequest();
+        response = httpContext.getResponse();
+    }
+    else if (context.getType() === 'graphql') {
+        let gql;
+        // Check if graphql is installed
+        try {
+            gql = require('@nestjs/graphql');
+        }
+        catch (er) {
+            throw new Error('@nestjs/graphql is not installed, cannot proceed');
+        }
+        // graphql request
+        const gqlContext = gql.GqlExecutionContext.create(context).getContext();
+        request = gqlContext.req;
+        response = gqlContext.res;
+    }
+    return [request, response];
+};
+exports.extractRequest = extractRequest;
+const extractRequestAndAttachCookie = (context, cookieKey) => {
+    const [tmpRequest, response] = (0, exports.extractRequest)(context);
+    const request = (0, exports.attachCookieToHeader)(tmpRequest, cookieKey);
+    return [request, response];
+};
+exports.extractRequestAndAttachCookie = extractRequestAndAttachCookie;

package/dist/keycloak-connect.module.d.ts

@@ -0,0 +1,32 @@
+import { DynamicModule, Logger } from '@nestjs/common';
+import { KeycloakConnectModuleAsyncOptions } from './interface/keycloak-connect-module-async-options.interface';
+import { KeycloakConnectOptions, NestKeycloakConfig } from './interface/keycloak-connect-options.interface';
+export * from './constants';
+export * from './decorators/access-token.decorator';
+export * from './decorators/enforcer-options.decorator';
+export * from './decorators/keycloak-user.decorator';
+export * from './decorators/public.decorator';
+export * from './decorators/resource.decorator';
+export * from './decorators/roles.decorator';
+export * from './decorators/scopes.decorator';
+export * from './guards/auth.guard';
+export * from './guards/resource.guard';
+export * from './guards/role.guard';
+export * from './interface/keycloak-connect-module-async-options.interface';
+export * from './interface/keycloak-connect-options-factory.interface';
+export * from './interface/keycloak-connect-options.interface';
+export * from './services/keycloak-multitenant.service';
+export * from './util';
+export declare class KeycloakConnectModule {
+    static logger: Logger;
+    /**
+     * Register the `KeycloakConnect` module.
+     * @param opts `keycloak.json` path in string or {@link NestKeycloakConfig} object.
+     * @param config {@link NestKeycloakConfig} when using `keycloak.json` path, optional
+     * @returns
+     */
+    static register(opts: KeycloakConnectOptions, config?: NestKeycloakConfig): DynamicModule;
+    static registerAsync(opts: KeycloakConnectModuleAsyncOptions): DynamicModule;
+    private static createAsyncProviders;
+    private static createAsyncOptionsProvider;
+}