@culturefy/shared 1.0.33 → 1.0.34

package/build/esm/middlewares/token-validation.js

@@ -1,483 +1,34 @@
 import { AzureSecretKeysEnum } from "../enums";
-import { UserService } from "../service/user.service";
-import { KeycloakAdminService } from "../service/keycloak.service";
-import { getAzureVaultSecretByKey, parseCookies, verifyJsonWebToken } from "../utils";
-export async function tokenValidation(request, domain, context) {
+import { getAzureVaultSecretByKey } from "../utils";
+export async function tokenValidation(request, context) {
   try {
-    let cookies = parseCookies(request, context);
-    let accessToken = cookies["culturefy-auth-token"];
-    let refreshToken = cookies["culturefy-refresh-token"];
-    let expiresIn, refreshExpiresIn;
-    if (!accessToken) return {
-      status: false,
-      message: "Access token is required"
-    };
-    const keycloakService = await initializeKeycloakService(context);
-    const tokenValidation = await validateToken(accessToken, context);
-    if (!tokenValidation.success) {
-      if (tokenValidation.expired) {
-        const {
-          data: _data
-        } = tokenValidation;
-        if (!_data) return {
-          status: false,
-          message: "Invalid access token."
-        };
-        let {
-          userId: _userId,
-          clientId: _clientId,
-          realm: _realm,
-          email: _email
-        } = _data;
-        if (!_clientId) return {
-          status: false,
-          message: "Invalid access token provided"
-        };
-        if (!_userId) return {
-          status: false,
-          message: "Invalid access token provided"
-        };
-        if (!_realm) return {
-          status: false,
-          message: "Invalid access token provided"
-        };
-        context.log("Refreshing token for user:", JSON.stringify({
-          userId: _userId,
-          clientId: _clientId,
-          realm: _realm,
-          email: _email
-        }));
-        const refreshTokenResponse = await handleTokenRefresh(keycloakService, refreshToken, _userId, _clientId, _realm, _email, domain, context);
-        if (!refreshTokenResponse.success) return {
-          status: false,
-          message: refreshTokenResponse.message
-        };
-        const {
-          data: refreshTokenData
-        } = refreshTokenResponse;
-        if (!refreshTokenData) return {
-          status: false,
-          message: "Invalid refresh token."
-        };
-        context.log("Refreshed token for user:", JSON.stringify({
-          userId: _userId,
-          clientId: _clientId,
-          realm: _realm,
-          email: _email
-        }));
-        accessToken = refreshTokenData.access_token;
-        refreshToken = refreshTokenData.refresh_token;
-        expiresIn = refreshTokenData.expires_in;
-        refreshExpiresIn = refreshTokenData.refresh_expires_in;
-      } else {
-        return {
-          status: false,
-          message: tokenValidation.message
-        };
-      }
-    }
-    const {
-      data
-    } = tokenValidation;
-    if (!data) return {
-      status: false,
-      message: "Invalid access token."
-    };
-    let {
-      userId,
-      clientId,
-      realm,
-      email
-    } = data;
-    if (!clientId) return {
-      status: false,
-      message: "Invalid access token provided"
-    };
-    if (!userId) return {
-      status: false,
-      message: "Invalid access token provided"
-    };
-    if (!realm) return {
-      status: false,
-      message: "Invalid access token provided"
-    };
-    if (!email) return {
-      status: false,
-      message: "Invalid access token provided"
-    };
-    context.log("Validating user:", JSON.stringify({
-      userId,
-      clientId,
-      realm,
-      email
-    }));
-    let verifyFromDb;
-    let userInfo;
-    if (domain === "accounts.culturefy.app") {
-      const _introspectionValid = await validateTokenIntrospection(keycloakService, accessToken, realm, clientId, domain, context);
-      if (!_introspectionValid) return {
-        status: false,
-        message: "Token introspection failed"
-      };
-      context.log("Token introspection successful");
-      realm = "superadmin";
-      clientId = "cfy-superadmin-web";
-      userInfo = await keycloakService.getUserByToken(realm, accessToken);
-      context.log("User info-1:", JSON.stringify(userInfo));
-      if (!userInfo.email) return {
-        status: false,
-        message: "User email not found"
-      };
-      if (userInfo.email !== email) return {
-        status: false,
-        message: "User email does not match"
-      };
-      email = userInfo.email;
-      verifyFromDb = await validateUserByEmail(email, context);
-      if (!verifyFromDb.success) return {
-        status: false,
-        message: verifyFromDb.message
-      };
-    } else {
-      clientId = "cfy-web";
-      verifyFromDb = await validateUserByRealm(realm, email, context);
-    }
-    if (!verifyFromDb.success) return {
-      status: false,
-      message: verifyFromDb.message
-    };
-    const user = verifyFromDb.user;
-    if (!user) return {
-      status: false,
-      message: "User not found."
-    };
-    context.log("User:", JSON.stringify(user));
-    const introspectionValid = await validateTokenIntrospection(keycloakService, accessToken, realm, clientId, domain, context);
-    if (!introspectionValid) return {
-      status: false,
-      message: "Token introspection failed"
-    };
-    context.log("Token introspection successful");
-    if (domain === "accounts.culturefy.app") {
-      realm = "superadmin";
-      clientId = "cfy-superadmin-web";
-    } else {
-      if (!user.businessId) return {
+    const url = await getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.AUTH_SERVICE_AUTHENTICATION_URL);
+    if (!url) {
+      return {
         status: false,
-        message: "User not found"
+        message: "Auth service authenticaion API url not found"
       };
-      realm = user.businessId.toString();
-      clientId = "cfy-web";
     }
-    if (!userInfo) {
-      userInfo = await keycloakService.getUserByToken(realm, accessToken);
-      context.log("User info-2:", JSON.stringify(userInfo));
-    }
-    if (!userInfo) return {
-      status: false,
-      message: "User info not found"
-    };
-    let updatedCookies = {
-      access_token: accessToken,
-      refresh_token: refreshToken
-    };
-    if (expiresIn) updatedCookies.expires_in = expiresIn;
-    if (refreshExpiresIn) updatedCookies.refresh_expires_in = refreshExpiresIn;
+    context.log(`Auth service authentication API url: ${url}`);
+    const response = await fetch(url, {
+      method: "GET",
+      headers: request.headers
+    });
+    const data = await response.json();
     return {
       status: true,
-      message: "Token is valid",
+      message: "Token validation successful",
       data: {
-        cookies: updatedCookies,
-        user: user
+        cookies: data.cookies,
+        user: data.user
       }
     };
   } catch (error) {
     context.error("Culturefy token validation error:", error);
     return {
       status: false,
-      message: "Internal server error during culturefy token validation"
-    };
-  }
-}
-async function initializeKeycloakService(context) {
-  const [keycloakBaseUrl, keycloakAdminClientId, keycloakAdminClientSecret] = await Promise.all([getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.KEYCLOAK_BASE_URL), getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.KEYCLOAK_ADMIN_CLIENT_ID), getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.KEYCLOAK_ADMIN_CLIENT_SECRET)]);
-  return new KeycloakAdminService(context, {
-    baseUrl: keycloakBaseUrl,
-    adminClientId: keycloakAdminClientId,
-    adminClientSecret: keycloakAdminClientSecret
-  });
-}
-async function validateToken(accessToken, context) {
-  const currentTime = Math.floor(Date.now() / 1000);
-  const decoded = verifyJsonWebToken(accessToken);
-  if (!decoded) return {
-    success: false,
-    message: "Invalid access token format"
-  };
-  let {
-    iat,
-    exp,
-    sub: userId,
-    azp: clientId,
-    iss,
-    email
-  } = decoded;
-  if (!userId || !clientId || !iss) return {
-    success: false,
-    message: "Access token missing required claims (sub or azp or iss)"
-  };
-  context.log("Access token claims:", JSON.stringify(decoded));
-  let realm = iss.split("/")[iss.split("/").length - 1];
-  if (!realm) return {
-    success: false,
-    message: "Access token missing required claims (iss)"
-  };
-  if (exp && exp < currentTime) return {
-    success: false,
-    message: "Access token expired and refresh token not provided",
-    expired: true,
-    data: {
-      userId,
-      clientId,
-      realm,
-      email
-    }
-  };
-  if (iat && iat > currentTime) return {
-    success: false,
-    message: "Invalid token issuance time"
-  };
-  return {
-    success: true,
-    message: "Token is valid",
-    data: {
-      userId,
-      clientId,
-      realm,
-      email
-    }
-  };
-}
-async function handleTokenRefresh(keycloakService, refreshToken, userId, clientId, realm, email, domain, context) {
-  const currentTime = Math.floor(Date.now() / 1000);
-  if (!clientId) return {
-    success: false,
-    message: "Client ID is missing"
-  };
-  if (!userId) return {
-    success: false,
-    message: "User ID is missing"
-  };
-  if (!realm) return {
-    success: false,
-    message: "Realm is missing"
-  };
-  if (!refreshToken) return {
-    success: false,
-    message: "Refresh token is missing"
-  };
-  if (!email) return {
-    success: false,
-    message: "Email is missing"
-  };
-  if (!domain) return {
-    success: false,
-    message: "Domain is missing"
-  };
-  context.info("values:", {
-    clientId,
-    userId,
-    realm,
-    email,
-    domain
-  });
-  const refreshTokenDecoded = verifyJsonWebToken(refreshToken);
-  if (!refreshTokenDecoded) return {
-    success: false,
-    message: "Invalid refresh token format"
-  };
-  let {
-    iss: refreshIss
-  } = refreshTokenDecoded;
-  refreshIss = refreshIss.split("/")[refreshIss.split("/").length - 1];
-  const {
-    iat: refreshIat,
-    exp: refreshExp,
-    sub: refreshUserId,
-    azp: refreshClientId,
-    email: refreshEmail
-  } = refreshTokenDecoded;
-  context.info("refreshTokenDecoded:", JSON.stringify({
-    refreshUserId,
-    refreshClientId,
-    refreshIss,
-    refreshEmail
-  }));
-  if (!refreshUserId || !refreshClientId || !refreshIss) return {
-    success: false,
-    message: "Refresh token missing required claims (sub or azp or iss)"
-  };
-  if (refreshExp && refreshExp < currentTime) return {
-    success: false,
-    message: "Refresh token has expired"
-  };
-  if (refreshIat && refreshIat > currentTime) return {
-    success: false,
-    message: "Invalid refresh token issuance time"
-  };
-  if (refreshUserId !== userId || refreshClientId !== clientId || refreshIss !== realm || refreshEmail !== email) return {
-    success: false,
-    message: "Refresh token does not match access token user"
-  };
-  if (domain === "accounts.culturefy.app") {
-    realm = "superadmin";
-    clientId = "cfy-superadmin-web";
-  } else {
-    realm = realm;
-    clientId = "cfy-web";
-  }
-  const newToken = await keycloakService.refreshToken(realm, clientId, refreshToken);
-  if (!newToken) return {
-    success: false,
-    message: "Failed to refresh access token"
-  };
-  const newTokenDecoded = verifyJsonWebToken(newToken.access_token);
-  if (!newTokenDecoded) return {
-    success: false,
-    message: "Invalid new token format"
-  };
-  const {
-    iat: newIat,
-    exp: newExp,
-    sub: newUserId,
-    azp: newClientId,
-    iss: newIss,
-    email: newEmail
-  } = newTokenDecoded;
-  if (!newUserId || !newClientId || !newIss || !newEmail) return {
-    success: false,
-    message: "New token missing required claims (sub or azp or iss or email)"
-  };
-  if (newExp && newExp < currentTime) return {
-    success: false,
-    message: "New token has expired"
-  };
-  if (newIat && newIat > currentTime) return {
-    success: false,
-    message: "Invalid new token issuance time"
-  };
-  context.info("Token refreshed successfully for user:", userId);
-  return {
-    success: true,
-    message: "Token refreshed successfully",
-    data: {
-      access_token: newToken.access_token,
-      expires_in: newToken.expires_in,
-      refresh_token: newToken.refresh_token,
-      refresh_expires_in: newToken.refresh_expires_in
-    }
-  };
-}
-async function validateUserByRealm(realm, email, context) {
-  try {
-    const authDbUrl = await getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.DB_CONNECTING_STRING_USER);
-    const userService = new UserService(context, authDbUrl);
-    let user = null;
-    context.log("Getting user by realm:", realm);
-    try {
-      // user = await userService.getUserByBusinessId(realm, email);
-      user = '';
-    } catch (err) {
-      context.error(`Failed to get user by realm:`, err);
-      return {
-        success: false,
-        message: "User not found.."
-      };
-    }
-    context.log("User:", JSON.stringify(user));
-    if (!user) return {
-      success: false,
-      message: "User not found..."
-    };
-    await userService.disconnect();
-    return {
-      success: true,
-      message: "User validation successful",
-      user
-    };
-  } catch (error) {
-    context.error("User validation error:", error);
-    return {
-      success: false,
-      message: "Error validating user information"
-    };
-  }
-}
-async function validateUserByEmail(email, context) {
-  try {
-    const authDbUrl = await getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || "", AzureSecretKeysEnum.DB_CONNECTING_STRING_USER);
-    const userService = new UserService(context, authDbUrl);
-    let user = null;
-    context.log("Getting user by email:", email);
-    try {
-      // user = await userService.getUserByEmail(email);
-      user = '';
-    } catch (err) {
-      context.error(`Failed to get user by email:`, err);
-      return {
-        success: false,
-        message: "User not found.."
-      };
-    }
-    context.log("User:", JSON.stringify(user));
-    if (!user) return {
-      success: false,
-      message: "User not found..."
-    };
-    await userService.disconnect();
-    return {
-      success: true,
-      message: "User validation successful",
-      user
-    };
-  } catch (error) {
-    context.error("User validation error:", error);
-    return {
-      success: false,
-      message: "Error validating user information"
+      message: error.message || "Internal server error during culturefy token validation"
     };
   }
 }
-async function validateTokenIntrospection(keycloakService, token, realm, clientId, domain, context) {
-  try {
-    if (!realm) return false;
-    if (!clientId) return false;
-    if (!token) return false;
-    if (domain === "accounts.culturefy.app") {
-      realm = "superadmin";
-      clientId = "cfy-superadmin-web";
-    } else {
-      realm = realm;
-      clientId = "cfy-web";
-    }
-    context.info("Validating token with Keycloak introspection");
-    const introspection = await keycloakService.introspectToken(realm, clientId, token);
-    if (!introspection.active) {
-      context.warn("Token introspection returned inactive token");
-      return false;
-    }
-    context.info("Token introspection successful - token is active");
-    return true;
-  } catch (error) {
-    var _error$message, _error$message2, _error$message3;
-    context.error("Token introspection error:", error);
-    if ((_error$message = error.message) != null && _error$message.includes('Client not allowed')) {
-      context.warn("Admin-cli client does not have introspection permissions - this is expected");
-      return true;
-    }
-    if ((_error$message2 = error.message) != null && _error$message2.includes('Invalid token')) return false;
-    if ((_error$message3 = error.message) != null && _error$message3.includes('Token is not active')) return false;
-    return false;
-  }
-}
 //# sourceMappingURL=token-validation.js.map

package/build/esm/middlewares/token-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-validation.js","names":["AzureSecretKeysEnum","UserService","KeycloakAdminService","getAzureVaultSecretByKey","parseCookies","verifyJsonWebToken","tokenValidation","request","domain","context","cookies","accessToken","refreshToken","expiresIn","refreshExpiresIn","status","message","keycloakService","initializeKeycloakService","validateToken","success","expired","data","userId","clientId","realm","email","log","JSON","stringify","refreshTokenResponse","handleTokenRefresh","refreshTokenData","access_token","refresh_token","expires_in","refresh_expires_in","verifyFromDb","userInfo","introspectionValid","validateTokenIntrospection","getUserByToken","validateUserByEmail","validateUserByRealm","user","businessId","toString","updatedCookies","error","keycloakBaseUrl","keycloakAdminClientId","keycloakAdminClientSecret","Promise","all","process","env","AZURE_KEY_VAULT_NAME","KEYCLOAK_BASE_URL","KEYCLOAK_ADMIN_CLIENT_ID","KEYCLOAK_ADMIN_CLIENT_SECRET","baseUrl","adminClientId","adminClientSecret","currentTime","Math","floor","Date","now","decoded","iat","exp","sub","azp","iss","split","length","info","refreshTokenDecoded","refreshIss","refreshIat","refreshExp","refreshUserId","refreshClientId","refreshEmail","newToken","newTokenDecoded","newIat","newExp","newUserId","newClientId","newIss","newEmail","authDbUrl","DB_CONNECTING_STRING_USER","userService","err","disconnect","token","introspection","introspectToken","active","warn","_error$message","_error$message2","_error$message3","includes"],"sources":["../../../src/middlewares/token-validation.ts"],"sourcesContent":["\nimport IUser from \"../models/user.model\";\nimport { AzureSecretKeysEnum } from \"../enums\";\nimport { UserService } from \"../service/user.service\";\nimport { HttpRequest, InvocationContext } from \"@azure/functions\";\nimport { KeycloakAdminService } from \"../service/keycloak.service\";\nimport { getAzureVaultSecretByKey, parseCookies, verifyJsonWebToken } from \"../utils\";\n\ninterface TokenValidationResult {\n    status: boolean;\n    message: string;\n    data?: {\n        cookies: {\n            access_token: string;\n            refresh_token: string;\n            expires_in?: number;\n            refresh_expires_in?: number;\n        };\n        user: IUser;\n    };\n}\n\ninterface TokenClaims {\n    iat?: number;\n    exp?: number;\n    sub: string;\n    azp: string;\n    iss: string;\n    email: string;\n}\n\nexport async function tokenValidation(request: HttpRequest, domain: string, context: InvocationContext): Promise<TokenValidationResult> {\n    try {\n        let cookies = parseCookies(request, context);\n        let accessToken = cookies[\"culturefy-auth-token\"];\n        let refreshToken = cookies[\"culturefy-refresh-token\"];\n\n        let expiresIn, refreshExpiresIn;\n\n        if (!accessToken) return { status: false, message: \"Access token is required\" };\n\n        const keycloakService = await initializeKeycloakService(context);\n\n        const tokenValidation = await validateToken(accessToken, context);\n\n        if (!tokenValidation.success) {\n            if (tokenValidation.expired) {\n                const { data } = tokenValidation;\n                if (!data) return { status: false, message: \"Invalid access token.\" };\n\n                let { userId, clientId, realm, email } = data;\n\n                if (!clientId) return { status: false, message: \"Invalid access token provided\" };\n                if (!userId) return { status: false, message: \"Invalid access token provided\" };\n                if (!realm) return { status: false, message: \"Invalid access token provided\" };\n\n                context.log(\"Refreshing token for user:\", JSON.stringify({ userId, clientId, realm, email }));\n\n                const refreshTokenResponse = await handleTokenRefresh(keycloakService, refreshToken, userId, clientId, realm, email, domain, context);\n                if (!refreshTokenResponse.success) return { status: false, message: refreshTokenResponse.message };\n\n                const { data: refreshTokenData } = refreshTokenResponse;\n                if (!refreshTokenData) return { status: false, message: \"Invalid refresh token.\" };\n                \n                context.log(\"Refreshed token for user:\", JSON.stringify({ userId, clientId, realm, email }));\n\n                accessToken = refreshTokenData.access_token;\n                refreshToken = refreshTokenData.refresh_token;\n                expiresIn = refreshTokenData.expires_in;\n                refreshExpiresIn = refreshTokenData.refresh_expires_in;\n\n            } else {\n                return { status: false, message: tokenValidation.message };\n            }\n        }\n\n        const { data } = tokenValidation;\n\n        if (!data) return { status: false, message: \"Invalid access token.\" };\n\n        let { userId, clientId, realm, email } = data;\n\n        if (!clientId) return { status: false, message: \"Invalid access token provided\" };\n        if (!userId) return { status: false, message: \"Invalid access token provided\" };\n        if (!realm) return { status: false, message: \"Invalid access token provided\" };\n        if (!email) return { status: false, message: \"Invalid access token provided\" };\n\n        context.log(\"Validating user:\", JSON.stringify({ userId, clientId, realm, email }));\n\n        let verifyFromDb;\n        let userInfo;\n\n        if(domain === \"accounts.culturefy.app\") {\n            const introspectionValid = await validateTokenIntrospection(\n                keycloakService,\n                accessToken,\n                realm,\n                clientId,\n                domain,\n                context\n            );\n    \n            if (!introspectionValid) return { status: false, message: \"Token introspection failed\" };\n            context.log(\"Token introspection successful\");\n    \n            realm = \"superadmin\";\n            clientId = \"cfy-superadmin-web\";\n    \n            userInfo = await keycloakService.getUserByToken(realm, accessToken);\n            context.log(\"User info-1:\", JSON.stringify(userInfo));\n\n            if(!userInfo.email) return { status: false, message: \"User email not found\" };\n            if(userInfo.email !== email) return { status: false, message: \"User email does not match\" };\n            email = userInfo.email;\n            verifyFromDb = await validateUserByEmail(email, context);\n            if (!verifyFromDb.success) return { status: false, message: verifyFromDb.message };\n        } else {\n            clientId = \"cfy-web\";\n            verifyFromDb = await validateUserByRealm(realm, email, context);\n        }\n\n        if (!verifyFromDb.success) return { status: false, message: verifyFromDb.message };\n\n        const user = verifyFromDb.user;\n\n        if (!user) return { status: false, message: \"User not found.\" };\n        context.log(\"User:\", JSON.stringify(user));\n\n        const introspectionValid = await validateTokenIntrospection(\n            keycloakService,\n            accessToken,\n            realm,\n            clientId,\n            domain,\n            context\n        );\n\n        if (!introspectionValid) return { status: false, message: \"Token introspection failed\" };\n        context.log(\"Token introspection successful\");\n\n        if (domain === \"accounts.culturefy.app\") {\n            realm = \"superadmin\";\n            clientId = \"cfy-superadmin-web\";\n        } else {\n            if(!user.businessId) return { status: false, message: \"User not found\" };\n            realm = user.businessId.toString();\n            clientId = \"cfy-web\";\n        }\n\n        if(!userInfo) {\n            userInfo = await keycloakService.getUserByToken(realm, accessToken);\n            context.log(\"User info-2:\", JSON.stringify(userInfo));\n        }\n\n        if(!userInfo) return { status: false, message: \"User info not found\" };\n\n        let updatedCookies: {\n            access_token: string;\n            refresh_token: string;\n            expires_in?: number;\n            refresh_expires_in?: number;\n        } = {\n            access_token: accessToken,\n            refresh_token: refreshToken,\n        };\n\n        if(expiresIn) updatedCookies.expires_in = expiresIn;\n        if(refreshExpiresIn) updatedCookies.refresh_expires_in = refreshExpiresIn;\n\n        return {\n            status: true,\n            message: \"Token is valid\",\n            data: {\n                cookies: updatedCookies,\n                user: user\n            }\n        };\n\n    } catch (error) {\n        context.error(\"Culturefy token validation error:\", error);\n        return { status: false, message: \"Internal server error during culturefy token validation\" };\n    }\n}\n\nasync function initializeKeycloakService(context: InvocationContext): Promise<KeycloakAdminService> {\n    const [keycloakBaseUrl, keycloakAdminClientId, keycloakAdminClientSecret] = await Promise.all([\n        getAzureVaultSecretByKey(\n            context,\n            process.env.AZURE_KEY_VAULT_NAME || \"\",\n            AzureSecretKeysEnum.KEYCLOAK_BASE_URL\n        ),\n        getAzureVaultSecretByKey(\n            context,\n            process.env.AZURE_KEY_VAULT_NAME || \"\",\n            AzureSecretKeysEnum.KEYCLOAK_ADMIN_CLIENT_ID\n        ),\n        getAzureVaultSecretByKey(\n            context,\n            process.env.AZURE_KEY_VAULT_NAME || \"\",\n            AzureSecretKeysEnum.KEYCLOAK_ADMIN_CLIENT_SECRET\n        )\n    ]);\n\n    return new KeycloakAdminService(context, {\n        baseUrl: keycloakBaseUrl as string,\n        adminClientId: keycloakAdminClientId as string,\n        adminClientSecret: keycloakAdminClientSecret as string\n    });\n}\n\nasync function validateToken(\n    accessToken: string,\n    context: InvocationContext\n): Promise<{\n    success: boolean;\n    message: string;\n    expired?: boolean;\n    data?: {\n        userId: string;\n        clientId: string;\n        realm: string;\n        email: string;\n    };\n}> {\n    const currentTime = Math.floor(Date.now() / 1000);\n\n    const decoded = verifyJsonWebToken(accessToken);\n\n    if (!decoded) return { success: false, message: \"Invalid access token format\" };\n\n    let { iat, exp, sub: userId, azp: clientId, iss, email } = decoded as TokenClaims;\n    \n    if (!userId || !clientId || !iss) return { success: false, message: \"Access token missing required claims (sub or azp or iss)\" };\n    context.log(\"Access token claims:\", JSON.stringify(decoded));\n    \n    let realm = iss.split(\"/\")[iss.split(\"/\").length - 1];\n    if(!realm) return { success: false, message: \"Access token missing required claims (iss)\" };\n\n    if (exp && exp < currentTime) return { success: false, message: \"Access token expired and refresh token not provided\", expired: true, data: { userId, clientId, realm, email } };\n    \n    if (iat && iat > currentTime) return { success: false, message: \"Invalid token issuance time\" };\n\n    return {\n        success: true,\n        message: \"Token is valid\",\n        data: { userId, clientId, realm, email }\n    };\n}\n\nasync function handleTokenRefresh(\n    keycloakService: KeycloakAdminService,\n    refreshToken: string,\n    userId: string,\n    clientId: string,\n    realm: string,\n    email: string,\n    domain: string,\n    context: InvocationContext\n): Promise<{\n    success: boolean;\n    message: string;\n    data?: {\n        access_token: string;\n        expires_in: number;\n        refresh_token: string;\n        refresh_expires_in: number;\n    };\n}> {\n    const currentTime = Math.floor(Date.now() / 1000);\n\n    if(!clientId) return { success: false, message: \"Client ID is missing\" };\n    if(!userId) return { success: false, message: \"User ID is missing\" };\n    if(!realm) return { success: false, message: \"Realm is missing\" };\n    if(!refreshToken) return { success: false, message: \"Refresh token is missing\" };\n    if(!email) return { success: false, message: \"Email is missing\" };\n    if(!domain) return { success: false, message: \"Domain is missing\" };\n\n    context.info(\"values:\", {clientId, userId, realm, email, domain});\n\n    const refreshTokenDecoded = verifyJsonWebToken(refreshToken);\n    if (!refreshTokenDecoded) return { success: false, message: \"Invalid refresh token format\" };\n\n    let { iss: refreshIss } = refreshTokenDecoded as TokenClaims;\n    refreshIss = refreshIss.split(\"/\")[refreshIss.split(\"/\").length - 1];\n\n    const { iat: refreshIat, exp: refreshExp, sub: refreshUserId, azp: refreshClientId, email: refreshEmail } = refreshTokenDecoded as TokenClaims;\n\n    context.info(\"refreshTokenDecoded:\", JSON.stringify({refreshUserId, refreshClientId, refreshIss, refreshEmail}));\n\n    if (!refreshUserId || !refreshClientId || !refreshIss) return { success: false, message: \"Refresh token missing required claims (sub or azp or iss)\" };\n\n    if (refreshExp && refreshExp < currentTime) return { success: false, message: \"Refresh token has expired\" };\n\n    if (refreshIat && refreshIat > currentTime) return { success: false, message: \"Invalid refresh token issuance time\" };\n\n    if (refreshUserId !== userId || refreshClientId !== clientId || refreshIss !== realm || refreshEmail !== email) return { success: false, message: \"Refresh token does not match access token user\" };\n\n    if(domain === \"accounts.culturefy.app\") {\n        realm = \"superadmin\";\n        clientId = \"cfy-superadmin-web\";\n    } else {\n        realm = realm;\n        clientId = \"cfy-web\";\n    }\n\n    const newToken = await keycloakService.refreshToken(realm, clientId, refreshToken);\n    if (!newToken) return { success: false, message: \"Failed to refresh access token\" };\n\n    const newTokenDecoded = verifyJsonWebToken(newToken.access_token);\n    if (!newTokenDecoded) return { success: false, message: \"Invalid new token format\" };\n\n    const { iat: newIat, exp: newExp, sub: newUserId, azp: newClientId, iss: newIss, email: newEmail } = newTokenDecoded as TokenClaims;\n\n    if (!newUserId || !newClientId || !newIss || !newEmail) return { success: false, message: \"New token missing required claims (sub or azp or iss or email)\" };\n\n    if (newExp && newExp < currentTime) return { success: false, message: \"New token has expired\" };\n\n    if (newIat && newIat > currentTime) return { success: false, message: \"Invalid new token issuance time\" };\n\n    context.info(\"Token refreshed successfully for user:\", userId);\n\n    return {\n        success: true,\n        message: \"Token refreshed successfully\",\n        data: {\n            access_token: newToken.access_token, expires_in: newToken.expires_in,\n            refresh_token: newToken.refresh_token, refresh_expires_in: newToken.refresh_expires_in\n        }\n    };\n}\n\nasync function validateUserByRealm(\n    realm: string,\n    email: string,\n    context: InvocationContext\n): Promise<{\n    success: boolean;\n    message: string;\n    user?: any;\n}> {\n    try {\n        const authDbUrl = await getAzureVaultSecretByKey(\n            context,\n            process.env.AZURE_KEY_VAULT_NAME || \"\",\n            AzureSecretKeysEnum.DB_CONNECTING_STRING_USER\n        );\n\n        const userService = new UserService(context, authDbUrl);\n\n        let user = null;\n        context.log(\"Getting user by realm:\", realm);\n        try {\n            // user = await userService.getUserByBusinessId(realm, email);\n            user = '';\n        } catch (err: any) {\n            context.error(`Failed to get user by realm:`, err);\n            return { success: false, message: \"User not found..\" };\n        }\n        context.log(\"User:\", JSON.stringify(user));\n\n        if (!user) return { success: false, message: \"User not found...\" };\n\n        await userService.disconnect();\n\n        return { success: true, message: \"User validation successful\", user };\n\n    } catch (error) {\n        context.error(\"User validation error:\", error);\n        return { success: false, message: \"Error validating user information\" };\n    }\n}\n\nasync function validateUserByEmail(\n    email: string,\n    context: InvocationContext\n): Promise<{\n    success: boolean;\n    message: string;\n    user?: any;\n}> {\n    try {\n        const authDbUrl = await getAzureVaultSecretByKey(\n            context,\n            process.env.AZURE_KEY_VAULT_NAME || \"\",\n            AzureSecretKeysEnum.DB_CONNECTING_STRING_USER\n        );\n\n        const userService = new UserService(context, authDbUrl);\n\n        let user = null;\n        context.log(\"Getting user by email:\", email);\n        try {\n            // user = await userService.getUserByEmail(email);\n            user = '';\n        } catch (err: any) {\n            context.error(`Failed to get user by email:`, err);\n            return { success: false, message: \"User not found..\" };\n        }\n        context.log(\"User:\", JSON.stringify(user));\n\n        if (!user) return { success: false, message: \"User not found...\" };\n\n        await userService.disconnect();\n\n        return { success: true, message: \"User validation successful\", user };\n\n    } catch (error) {\n        context.error(\"User validation error:\", error);\n        return { success: false, message: \"Error validating user information\" };\n    }\n}\n\nasync function validateTokenIntrospection(\n    keycloakService: KeycloakAdminService,\n    token: string,\n    realm: string,\n    clientId: string,\n    domain: string,\n    context: InvocationContext\n): Promise<boolean> {\n    try {\n        if(!realm) return false;\n        if(!clientId) return false;\n        if(!token) return false;\n        \n        if (domain === \"accounts.culturefy.app\") {\n            realm = \"superadmin\";\n            clientId = \"cfy-superadmin-web\";\n        } else {\n            realm = realm;\n            clientId = \"cfy-web\";\n        }\n\n        context.info(\"Validating token with Keycloak introspection\");\n        const introspection = await keycloakService.introspectToken(realm, clientId, token);\n\n        if (!introspection.active) {\n            context.warn(\"Token introspection returned inactive token\");\n            return false;\n        }\n\n        context.info(\"Token introspection successful - token is active\");\n        return true;\n    } catch (error: any) {\n        context.error(\"Token introspection error:\", error);\n\n        if (error.message?.includes('Client not allowed')) {\n            context.warn(\"Admin-cli client does not have introspection permissions - this is expected\");\n            return true;\n        }\n\n        if (error.message?.includes('Invalid token')) return false;\n\n        if (error.message?.includes('Token is not active')) return false;\n\n        return false;\n    }\n}"],"mappings":"AAEA,SAASA,mBAAmB,QAAQ,UAAU;AAC9C,SAASC,WAAW,QAAQ,yBAAyB;AAErD,SAASC,oBAAoB,QAAQ,6BAA6B;AAClE,SAASC,wBAAwB,EAAEC,YAAY,EAAEC,kBAAkB,QAAQ,UAAU;AAyBrF,OAAO,eAAeC,eAAeA,CAACC,OAAoB,EAAEC,MAAc,EAAEC,OAA0B,EAAkC;EACpI,IAAI;IACA,IAAIC,OAAO,GAAGN,YAAY,CAACG,OAAO,EAAEE,OAAO,CAAC;IAC5C,IAAIE,WAAW,GAAGD,OAAO,CAAC,sBAAsB,CAAC;IACjD,IAAIE,YAAY,GAAGF,OAAO,CAAC,yBAAyB,CAAC;IAErD,IAAIG,SAAS,EAAEC,gBAAgB;IAE/B,IAAI,CAACH,WAAW,EAAE,OAAO;MAAEI,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAA2B,CAAC;IAE/E,MAAMC,eAAe,GAAG,MAAMC,yBAAyB,CAACT,OAAO,CAAC;IAEhE,MAAMH,eAAe,GAAG,MAAMa,aAAa,CAACR,WAAW,EAAEF,OAAO,CAAC;IAEjE,IAAI,CAACH,eAAe,CAACc,OAAO,EAAE;MAC1B,IAAId,eAAe,CAACe,OAAO,EAAE;QACzB,MAAM;UAAEC,IAAI,EAAJA;QAAK,CAAC,GAAGhB,eAAe;QAChC,IAAI,CAACgB,KAAI,EAAE,OAAO;UAAEP,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAE;QAAwB,CAAC;QAErE,IAAI;UAAEO,MAAM,EAANA,OAAM;UAAEC,QAAQ,EAARA,SAAQ;UAAEC,KAAK,EAALA,MAAK;UAAEC,KAAK,EAALA;QAAM,CAAC,GAAGJ,KAAI;QAE7C,IAAI,CAACE,SAAQ,EAAE,OAAO;UAAET,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAE;QAAgC,CAAC;QACjF,IAAI,CAACO,OAAM,EAAE,OAAO;UAAER,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAE;QAAgC,CAAC;QAC/E,IAAI,CAACS,MAAK,EAAE,OAAO;UAAEV,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAE;QAAgC,CAAC;QAE9EP,OAAO,CAACkB,GAAG,CAAC,4BAA4B,EAAEC,IAAI,CAACC,SAAS,CAAC;UAAEN,MAAM,EAANA,OAAM;UAAEC,QAAQ,EAARA,SAAQ;UAAEC,KAAK,EAALA,MAAK;UAAEC,KAAK,EAALA;QAAM,CAAC,CAAC,CAAC;QAE7F,MAAMI,oBAAoB,GAAG,MAAMC,kBAAkB,CAACd,eAAe,EAAEL,YAAY,EAAEW,OAAM,EAAEC,SAAQ,EAAEC,MAAK,EAAEC,MAAK,EAAElB,MAAM,EAAEC,OAAO,CAAC;QACrI,IAAI,CAACqB,oBAAoB,CAACV,OAAO,EAAE,OAAO;UAAEL,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAEc,oBAAoB,CAACd;QAAQ,CAAC;QAElG,MAAM;UAAEM,IAAI,EAAEU;QAAiB,CAAC,GAAGF,oBAAoB;QACvD,IAAI,CAACE,gBAAgB,EAAE,OAAO;UAAEjB,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAE;QAAyB,CAAC;QAElFP,OAAO,CAACkB,GAAG,CAAC,2BAA2B,EAAEC,IAAI,CAACC,SAAS,CAAC;UAAEN,MAAM,EAANA,OAAM;UAAEC,QAAQ,EAARA,SAAQ;UAAEC,KAAK,EAALA,MAAK;UAAEC,KAAK,EAALA;QAAM,CAAC,CAAC,CAAC;QAE5Ff,WAAW,GAAGqB,gBAAgB,CAACC,YAAY;QAC3CrB,YAAY,GAAGoB,gBAAgB,CAACE,aAAa;QAC7CrB,SAAS,GAAGmB,gBAAgB,CAACG,UAAU;QACvCrB,gBAAgB,GAAGkB,gBAAgB,CAACI,kBAAkB;MAE1D,CAAC,MAAM;QACH,OAAO;UAAErB,MAAM,EAAE,KAAK;UAAEC,OAAO,EAAEV,eAAe,CAACU;QAAQ,CAAC;MAC9D;IACJ;IAEA,MAAM;MAAEM;IAAK,CAAC,GAAGhB,eAAe;IAEhC,IAAI,CAACgB,IAAI,EAAE,OAAO;MAAEP,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAwB,CAAC;IAErE,IAAI;MAAEO,MAAM;MAAEC,QAAQ;MAAEC,KAAK;MAAEC;IAAM,CAAC,GAAGJ,IAAI;IAE7C,IAAI,CAACE,QAAQ,EAAE,OAAO;MAAET,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAgC,CAAC;IACjF,IAAI,CAACO,MAAM,EAAE,OAAO;MAAER,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAgC,CAAC;IAC/E,IAAI,CAACS,KAAK,EAAE,OAAO;MAAEV,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAgC,CAAC;IAC9E,IAAI,CAACU,KAAK,EAAE,OAAO;MAAEX,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAgC,CAAC;IAE9EP,OAAO,CAACkB,GAAG,CAAC,kBAAkB,EAAEC,IAAI,CAACC,SAAS,CAAC;MAAEN,MAAM;MAAEC,QAAQ;MAAEC,KAAK;MAAEC;IAAM,CAAC,CAAC,CAAC;IAEnF,IAAIW,YAAY;IAChB,IAAIC,QAAQ;IAEZ,IAAG9B,MAAM,KAAK,wBAAwB,EAAE;MACpC,MAAM+B,mBAAkB,GAAG,MAAMC,0BAA0B,CACvDvB,eAAe,EACfN,WAAW,EACXc,KAAK,EACLD,QAAQ,EACRhB,MAAM,EACNC,OACJ,CAAC;MAED,IAAI,CAAC8B,mBAAkB,EAAE,OAAO;QAAExB,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAE;MAA6B,CAAC;MACxFP,OAAO,CAACkB,GAAG,CAAC,gCAAgC,CAAC;MAE7CF,KAAK,GAAG,YAAY;MACpBD,QAAQ,GAAG,oBAAoB;MAE/Bc,QAAQ,GAAG,MAAMrB,eAAe,CAACwB,cAAc,CAAChB,KAAK,EAAEd,WAAW,CAAC;MACnEF,OAAO,CAACkB,GAAG,CAAC,cAAc,EAAEC,IAAI,CAACC,SAAS,CAACS,QAAQ,CAAC,CAAC;MAErD,IAAG,CAACA,QAAQ,CAACZ,KAAK,EAAE,OAAO;QAAEX,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAE;MAAuB,CAAC;MAC7E,IAAGsB,QAAQ,CAACZ,KAAK,KAAKA,KAAK,EAAE,OAAO;QAAEX,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAE;MAA4B,CAAC;MAC3FU,KAAK,GAAGY,QAAQ,CAACZ,KAAK;MACtBW,YAAY,GAAG,MAAMK,mBAAmB,CAAChB,KAAK,EAAEjB,OAAO,CAAC;MACxD,IAAI,CAAC4B,YAAY,CAACjB,OAAO,EAAE,OAAO;QAAEL,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAEqB,YAAY,CAACrB;MAAQ,CAAC;IACtF,CAAC,MAAM;MACHQ,QAAQ,GAAG,SAAS;MACpBa,YAAY,GAAG,MAAMM,mBAAmB,CAAClB,KAAK,EAAEC,KAAK,EAAEjB,OAAO,CAAC;IACnE;IAEA,IAAI,CAAC4B,YAAY,CAACjB,OAAO,EAAE,OAAO;MAAEL,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAEqB,YAAY,CAACrB;IAAQ,CAAC;IAElF,MAAM4B,IAAI,GAAGP,YAAY,CAACO,IAAI;IAE9B,IAAI,CAACA,IAAI,EAAE,OAAO;MAAE7B,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAkB,CAAC;IAC/DP,OAAO,CAACkB,GAAG,CAAC,OAAO,EAAEC,IAAI,CAACC,SAAS,CAACe,IAAI,CAAC,CAAC;IAE1C,MAAML,kBAAkB,GAAG,MAAMC,0BAA0B,CACvDvB,eAAe,EACfN,WAAW,EACXc,KAAK,EACLD,QAAQ,EACRhB,MAAM,EACNC,OACJ,CAAC;IAED,IAAI,CAAC8B,kBAAkB,EAAE,OAAO;MAAExB,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAA6B,CAAC;IACxFP,OAAO,CAACkB,GAAG,CAAC,gCAAgC,CAAC;IAE7C,IAAInB,MAAM,KAAK,wBAAwB,EAAE;MACrCiB,KAAK,GAAG,YAAY;MACpBD,QAAQ,GAAG,oBAAoB;IACnC,CAAC,MAAM;MACH,IAAG,CAACoB,IAAI,CAACC,UAAU,EAAE,OAAO;QAAE9B,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAE;MAAiB,CAAC;MACxES,KAAK,GAAGmB,IAAI,CAACC,UAAU,CAACC,QAAQ,CAAC,CAAC;MAClCtB,QAAQ,GAAG,SAAS;IACxB;IAEA,IAAG,CAACc,QAAQ,EAAE;MACVA,QAAQ,GAAG,MAAMrB,eAAe,CAACwB,cAAc,CAAChB,KAAK,EAAEd,WAAW,CAAC;MACnEF,OAAO,CAACkB,GAAG,CAAC,cAAc,EAAEC,IAAI,CAACC,SAAS,CAACS,QAAQ,CAAC,CAAC;IACzD;IAEA,IAAG,CAACA,QAAQ,EAAE,OAAO;MAAEvB,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAAsB,CAAC;IAEtE,IAAI+B,cAKH,GAAG;MACAd,YAAY,EAAEtB,WAAW;MACzBuB,aAAa,EAAEtB;IACnB,CAAC;IAED,IAAGC,SAAS,EAAEkC,cAAc,CAACZ,UAAU,GAAGtB,SAAS;IACnD,IAAGC,gBAAgB,EAAEiC,cAAc,CAACX,kBAAkB,GAAGtB,gBAAgB;IAEzE,OAAO;MACHC,MAAM,EAAE,IAAI;MACZC,OAAO,EAAE,gBAAgB;MACzBM,IAAI,EAAE;QACFZ,OAAO,EAAEqC,cAAc;QACvBH,IAAI,EAAEA;MACV;IACJ,CAAC;EAEL,CAAC,CAAC,OAAOI,KAAK,EAAE;IACZvC,OAAO,CAACuC,KAAK,CAAC,mCAAmC,EAAEA,KAAK,CAAC;IACzD,OAAO;MAAEjC,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAE;IAA0D,CAAC;EAChG;AACJ;AAEA,eAAeE,yBAAyBA,CAACT,OAA0B,EAAiC;EAChG,MAAM,CAACwC,eAAe,EAAEC,qBAAqB,EAAEC,yBAAyB,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAC1FlD,wBAAwB,CACpBM,OAAO,EACP6C,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EACtCxD,mBAAmB,CAACyD,iBACxB,CAAC,EACDtD,wBAAwB,CACpBM,OAAO,EACP6C,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EACtCxD,mBAAmB,CAAC0D,wBACxB,CAAC,EACDvD,wBAAwB,CACpBM,OAAO,EACP6C,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EACtCxD,mBAAmB,CAAC2D,4BACxB,CAAC,CACJ,CAAC;EAEF,OAAO,IAAIzD,oBAAoB,CAACO,OAAO,EAAE;IACrCmD,OAAO,EAAEX,eAAyB;IAClCY,aAAa,EAAEX,qBAA+B;IAC9CY,iBAAiB,EAAEX;EACvB,CAAC,CAAC;AACN;AAEA,eAAehC,aAAaA,CACxBR,WAAmB,EACnBF,OAA0B,EAW3B;EACC,MAAMsD,WAAW,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;EAEjD,MAAMC,OAAO,GAAG/D,kBAAkB,CAACM,WAAW,CAAC;EAE/C,IAAI,CAACyD,OAAO,EAAE,OAAO;IAAEhD,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA8B,CAAC;EAE/E,IAAI;IAAEqD,GAAG;IAAEC,GAAG;IAAEC,GAAG,EAAEhD,MAAM;IAAEiD,GAAG,EAAEhD,QAAQ;IAAEiD,GAAG;IAAE/C;EAAM,CAAC,GAAG0C,OAAsB;EAEjF,IAAI,CAAC7C,MAAM,IAAI,CAACC,QAAQ,IAAI,CAACiD,GAAG,EAAE,OAAO;IAAErD,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA2D,CAAC;EAChIP,OAAO,CAACkB,GAAG,CAAC,sBAAsB,EAAEC,IAAI,CAACC,SAAS,CAACuC,OAAO,CAAC,CAAC;EAE5D,IAAI3C,KAAK,GAAGgD,GAAG,CAACC,KAAK,CAAC,GAAG,CAAC,CAACD,GAAG,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,MAAM,GAAG,CAAC,CAAC;EACrD,IAAG,CAAClD,KAAK,EAAE,OAAO;IAAEL,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA6C,CAAC;EAE3F,IAAIsD,GAAG,IAAIA,GAAG,GAAGP,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE,qDAAqD;IAAEK,OAAO,EAAE,IAAI;IAAEC,IAAI,EAAE;MAAEC,MAAM;MAAEC,QAAQ;MAAEC,KAAK;MAAEC;IAAM;EAAE,CAAC;EAEhL,IAAI2C,GAAG,IAAIA,GAAG,GAAGN,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA8B,CAAC;EAE/F,OAAO;IACHI,OAAO,EAAE,IAAI;IACbJ,OAAO,EAAE,gBAAgB;IACzBM,IAAI,EAAE;MAAEC,MAAM;MAAEC,QAAQ;MAAEC,KAAK;MAAEC;IAAM;EAC3C,CAAC;AACL;AAEA,eAAeK,kBAAkBA,CAC7Bd,eAAqC,EACrCL,YAAoB,EACpBW,MAAc,EACdC,QAAgB,EAChBC,KAAa,EACbC,KAAa,EACblB,MAAc,EACdC,OAA0B,EAU3B;EACC,MAAMsD,WAAW,GAAGC,IAAI,CAACC,KAAK,CAACC,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;EAEjD,IAAG,CAAC3C,QAAQ,EAAE,OAAO;IAAEJ,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAuB,CAAC;EACxE,IAAG,CAACO,MAAM,EAAE,OAAO;IAAEH,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAqB,CAAC;EACpE,IAAG,CAACS,KAAK,EAAE,OAAO;IAAEL,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAmB,CAAC;EACjE,IAAG,CAACJ,YAAY,EAAE,OAAO;IAAEQ,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA2B,CAAC;EAChF,IAAG,CAACU,KAAK,EAAE,OAAO;IAAEN,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAmB,CAAC;EACjE,IAAG,CAACR,MAAM,EAAE,OAAO;IAAEY,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAoB,CAAC;EAEnEP,OAAO,CAACmE,IAAI,CAAC,SAAS,EAAE;IAACpD,QAAQ;IAAED,MAAM;IAAEE,KAAK;IAAEC,KAAK;IAAElB;EAAM,CAAC,CAAC;EAEjE,MAAMqE,mBAAmB,GAAGxE,kBAAkB,CAACO,YAAY,CAAC;EAC5D,IAAI,CAACiE,mBAAmB,EAAE,OAAO;IAAEzD,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA+B,CAAC;EAE5F,IAAI;IAAEyD,GAAG,EAAEK;EAAW,CAAC,GAAGD,mBAAkC;EAC5DC,UAAU,GAAGA,UAAU,CAACJ,KAAK,CAAC,GAAG,CAAC,CAACI,UAAU,CAACJ,KAAK,CAAC,GAAG,CAAC,CAACC,MAAM,GAAG,CAAC,CAAC;EAEpE,MAAM;IAAEN,GAAG,EAAEU,UAAU;IAAET,GAAG,EAAEU,UAAU;IAAET,GAAG,EAAEU,aAAa;IAAET,GAAG,EAAEU,eAAe;IAAExD,KAAK,EAAEyD;EAAa,CAAC,GAAGN,mBAAkC;EAE9IpE,OAAO,CAACmE,IAAI,CAAC,sBAAsB,EAAEhD,IAAI,CAACC,SAAS,CAAC;IAACoD,aAAa;IAAEC,eAAe;IAAEJ,UAAU;IAAEK;EAAY,CAAC,CAAC,CAAC;EAEhH,IAAI,CAACF,aAAa,IAAI,CAACC,eAAe,IAAI,CAACJ,UAAU,EAAE,OAAO;IAAE1D,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA4D,CAAC;EAEtJ,IAAIgE,UAAU,IAAIA,UAAU,GAAGjB,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA4B,CAAC;EAE3G,IAAI+D,UAAU,IAAIA,UAAU,GAAGhB,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAsC,CAAC;EAErH,IAAIiE,aAAa,KAAK1D,MAAM,IAAI2D,eAAe,KAAK1D,QAAQ,IAAIsD,UAAU,KAAKrD,KAAK,IAAI0D,YAAY,KAAKzD,KAAK,EAAE,OAAO;IAAEN,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAiD,CAAC;EAEpM,IAAGR,MAAM,KAAK,wBAAwB,EAAE;IACpCiB,KAAK,GAAG,YAAY;IACpBD,QAAQ,GAAG,oBAAoB;EACnC,CAAC,MAAM;IACHC,KAAK,GAAGA,KAAK;IACbD,QAAQ,GAAG,SAAS;EACxB;EAEA,MAAM4D,QAAQ,GAAG,MAAMnE,eAAe,CAACL,YAAY,CAACa,KAAK,EAAED,QAAQ,EAAEZ,YAAY,CAAC;EAClF,IAAI,CAACwE,QAAQ,EAAE,OAAO;IAAEhE,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAiC,CAAC;EAEnF,MAAMqE,eAAe,GAAGhF,kBAAkB,CAAC+E,QAAQ,CAACnD,YAAY,CAAC;EACjE,IAAI,CAACoD,eAAe,EAAE,OAAO;IAAEjE,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAA2B,CAAC;EAEpF,MAAM;IAAEqD,GAAG,EAAEiB,MAAM;IAAEhB,GAAG,EAAEiB,MAAM;IAAEhB,GAAG,EAAEiB,SAAS;IAAEhB,GAAG,EAAEiB,WAAW;IAAEhB,GAAG,EAAEiB,MAAM;IAAEhE,KAAK,EAAEiE;EAAS,CAAC,GAAGN,eAA8B;EAEnI,IAAI,CAACG,SAAS,IAAI,CAACC,WAAW,IAAI,CAACC,MAAM,IAAI,CAACC,QAAQ,EAAE,OAAO;IAAEvE,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAiE,CAAC;EAE5J,IAAIuE,MAAM,IAAIA,MAAM,GAAGxB,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAwB,CAAC;EAE/F,IAAIsE,MAAM,IAAIA,MAAM,GAAGvB,WAAW,EAAE,OAAO;IAAE3C,OAAO,EAAE,KAAK;IAAEJ,OAAO,EAAE;EAAkC,CAAC;EAEzGP,OAAO,CAACmE,IAAI,CAAC,wCAAwC,EAAErD,MAAM,CAAC;EAE9D,OAAO;IACHH,OAAO,EAAE,IAAI;IACbJ,OAAO,EAAE,8BAA8B;IACvCM,IAAI,EAAE;MACFW,YAAY,EAAEmD,QAAQ,CAACnD,YAAY;MAAEE,UAAU,EAAEiD,QAAQ,CAACjD,UAAU;MACpED,aAAa,EAAEkD,QAAQ,CAAClD,aAAa;MAAEE,kBAAkB,EAAEgD,QAAQ,CAAChD;IACxE;EACJ,CAAC;AACL;AAEA,eAAeO,mBAAmBA,CAC9BlB,KAAa,EACbC,KAAa,EACbjB,OAA0B,EAK3B;EACC,IAAI;IACA,MAAMmF,SAAS,GAAG,MAAMzF,wBAAwB,CAC5CM,OAAO,EACP6C,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EACtCxD,mBAAmB,CAAC6F,yBACxB,CAAC;IAED,MAAMC,WAAW,GAAG,IAAI7F,WAAW,CAACQ,OAAO,EAAEmF,SAAS,CAAC;IAEvD,IAAIhD,IAAI,GAAG,IAAI;IACfnC,OAAO,CAACkB,GAAG,CAAC,wBAAwB,EAAEF,KAAK,CAAC;IAC5C,IAAI;MACA;MACAmB,IAAI,GAAG,EAAE;IACb,CAAC,CAAC,OAAOmD,GAAQ,EAAE;MACftF,OAAO,CAACuC,KAAK,CAAC,8BAA8B,EAAE+C,GAAG,CAAC;MAClD,OAAO;QAAE3E,OAAO,EAAE,KAAK;QAAEJ,OAAO,EAAE;MAAmB,CAAC;IAC1D;IACAP,OAAO,CAACkB,GAAG,CAAC,OAAO,EAAEC,IAAI,CAACC,SAAS,CAACe,IAAI,CAAC,CAAC;IAE1C,IAAI,CAACA,IAAI,EAAE,OAAO;MAAExB,OAAO,EAAE,KAAK;MAAEJ,OAAO,EAAE;IAAoB,CAAC;IAElE,MAAM8E,WAAW,CAACE,UAAU,CAAC,CAAC;IAE9B,OAAO;MAAE5E,OAAO,EAAE,IAAI;MAAEJ,OAAO,EAAE,4BAA4B;MAAE4B;IAAK,CAAC;EAEzE,CAAC,CAAC,OAAOI,KAAK,EAAE;IACZvC,OAAO,CAACuC,KAAK,CAAC,wBAAwB,EAAEA,KAAK,CAAC;IAC9C,OAAO;MAAE5B,OAAO,EAAE,KAAK;MAAEJ,OAAO,EAAE;IAAoC,CAAC;EAC3E;AACJ;AAEA,eAAe0B,mBAAmBA,CAC9BhB,KAAa,EACbjB,OAA0B,EAK3B;EACC,IAAI;IACA,MAAMmF,SAAS,GAAG,MAAMzF,wBAAwB,CAC5CM,OAAO,EACP6C,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EACtCxD,mBAAmB,CAAC6F,yBACxB,CAAC;IAED,MAAMC,WAAW,GAAG,IAAI7F,WAAW,CAACQ,OAAO,EAAEmF,SAAS,CAAC;IAEvD,IAAIhD,IAAI,GAAG,IAAI;IACfnC,OAAO,CAACkB,GAAG,CAAC,wBAAwB,EAAED,KAAK,CAAC;IAC5C,IAAI;MACA;MACAkB,IAAI,GAAG,EAAE;IACb,CAAC,CAAC,OAAOmD,GAAQ,EAAE;MACftF,OAAO,CAACuC,KAAK,CAAC,8BAA8B,EAAE+C,GAAG,CAAC;MAClD,OAAO;QAAE3E,OAAO,EAAE,KAAK;QAAEJ,OAAO,EAAE;MAAmB,CAAC;IAC1D;IACAP,OAAO,CAACkB,GAAG,CAAC,OAAO,EAAEC,IAAI,CAACC,SAAS,CAACe,IAAI,CAAC,CAAC;IAE1C,IAAI,CAACA,IAAI,EAAE,OAAO;MAAExB,OAAO,EAAE,KAAK;MAAEJ,OAAO,EAAE;IAAoB,CAAC;IAElE,MAAM8E,WAAW,CAACE,UAAU,CAAC,CAAC;IAE9B,OAAO;MAAE5E,OAAO,EAAE,IAAI;MAAEJ,OAAO,EAAE,4BAA4B;MAAE4B;IAAK,CAAC;EAEzE,CAAC,CAAC,OAAOI,KAAK,EAAE;IACZvC,OAAO,CAACuC,KAAK,CAAC,wBAAwB,EAAEA,KAAK,CAAC;IAC9C,OAAO;MAAE5B,OAAO,EAAE,KAAK;MAAEJ,OAAO,EAAE;IAAoC,CAAC;EAC3E;AACJ;AAEA,eAAewB,0BAA0BA,CACrCvB,eAAqC,EACrCgF,KAAa,EACbxE,KAAa,EACbD,QAAgB,EAChBhB,MAAc,EACdC,OAA0B,EACV;EAChB,IAAI;IACA,IAAG,CAACgB,KAAK,EAAE,OAAO,KAAK;IACvB,IAAG,CAACD,QAAQ,EAAE,OAAO,KAAK;IAC1B,IAAG,CAACyE,KAAK,EAAE,OAAO,KAAK;IAEvB,IAAIzF,MAAM,KAAK,wBAAwB,EAAE;MACrCiB,KAAK,GAAG,YAAY;MACpBD,QAAQ,GAAG,oBAAoB;IACnC,CAAC,MAAM;MACHC,KAAK,GAAGA,KAAK;MACbD,QAAQ,GAAG,SAAS;IACxB;IAEAf,OAAO,CAACmE,IAAI,CAAC,8CAA8C,CAAC;IAC5D,MAAMsB,aAAa,GAAG,MAAMjF,eAAe,CAACkF,eAAe,CAAC1E,KAAK,EAAED,QAAQ,EAAEyE,KAAK,CAAC;IAEnF,IAAI,CAACC,aAAa,CAACE,MAAM,EAAE;MACvB3F,OAAO,CAAC4F,IAAI,CAAC,6CAA6C,CAAC;MAC3D,OAAO,KAAK;IAChB;IAEA5F,OAAO,CAACmE,IAAI,CAAC,kDAAkD,CAAC;IAChE,OAAO,IAAI;EACf,CAAC,CAAC,OAAO5B,KAAU,EAAE;IAAA,IAAAsD,cAAA,EAAAC,eAAA,EAAAC,eAAA;IACjB/F,OAAO,CAACuC,KAAK,CAAC,4BAA4B,EAAEA,KAAK,CAAC;IAElD,KAAAsD,cAAA,GAAItD,KAAK,CAAChC,OAAO,aAAbsF,cAAA,CAAeG,QAAQ,CAAC,oBAAoB,CAAC,EAAE;MAC/ChG,OAAO,CAAC4F,IAAI,CAAC,6EAA6E,CAAC;MAC3F,OAAO,IAAI;IACf;IAEA,KAAAE,eAAA,GAAIvD,KAAK,CAAChC,OAAO,aAAbuF,eAAA,CAAeE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,KAAK;IAE1D,KAAAD,eAAA,GAAIxD,KAAK,CAAChC,OAAO,aAAbwF,eAAA,CAAeC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,KAAK;IAEhE,OAAO,KAAK;EAChB;AACJ","ignoreList":[]}
+{"version":3,"file":"token-validation.js","names":["AzureSecretKeysEnum","getAzureVaultSecretByKey","tokenValidation","request","context","url","process","env","AZURE_KEY_VAULT_NAME","AUTH_SERVICE_AUTHENTICATION_URL","status","message","log","response","fetch","method","headers","data","json","cookies","user","error"],"sources":["../../../src/middlewares/token-validation.ts"],"sourcesContent":["\nimport IUser from \"../models/user.model\";\nimport { AzureSecretKeysEnum } from \"../enums\";\nimport { getAzureVaultSecretByKey } from \"../utils\";\nimport { HttpRequest, InvocationContext } from \"@azure/functions\";\n\ninterface TokenValidationResult {\n    status: boolean;\n    message: string;\n    data?: {\n        cookies: {\n            access_token: string;\n            refresh_token: string;\n            expires_in?: number;\n            refresh_expires_in?: number;\n        };\n        user: IUser;\n    };\n}\n\nexport async function tokenValidation(request: HttpRequest, context: InvocationContext): Promise<TokenValidationResult> {\n    try {\n        const url = await getAzureVaultSecretByKey(context, process.env.AZURE_KEY_VAULT_NAME || \"\", AzureSecretKeysEnum.AUTH_SERVICE_AUTHENTICATION_URL);\n        if(!url) {\n            return { status: false, message: \"Auth service authenticaion API url not found\" };\n        }\n        context.log(`Auth service authentication API url: ${url}`);\n        \n        const response = await fetch(url, {\n            method: \"GET\",\n            headers: request.headers\n        });\n        const data = await response.json();\n        return { status: true, message: \"Token validation successful\", data: {\n            cookies: data.cookies,\n            user: data.user\n        } };\n\n    } catch (error:any) {\n        context.error(\"Culturefy token validation error:\", error);\n        return { status: false, message: error.message || \"Internal server error during culturefy token validation\" };\n    }\n}"],"mappings":"AAEA,SAASA,mBAAmB,QAAQ,UAAU;AAC9C,SAASC,wBAAwB,QAAQ,UAAU;AAiBnD,OAAO,eAAeC,eAAeA,CAACC,OAAoB,EAAEC,OAA0B,EAAkC;EACpH,IAAI;IACA,MAAMC,GAAG,GAAG,MAAMJ,wBAAwB,CAACG,OAAO,EAAEE,OAAO,CAACC,GAAG,CAACC,oBAAoB,IAAI,EAAE,EAAER,mBAAmB,CAACS,+BAA+B,CAAC;IAChJ,IAAG,CAACJ,GAAG,EAAE;MACL,OAAO;QAAEK,MAAM,EAAE,KAAK;QAAEC,OAAO,EAAE;MAA+C,CAAC;IACrF;IACAP,OAAO,CAACQ,GAAG,CAAC,wCAAwCP,GAAG,EAAE,CAAC;IAE1D,MAAMQ,QAAQ,GAAG,MAAMC,KAAK,CAACT,GAAG,EAAE;MAC9BU,MAAM,EAAE,KAAK;MACbC,OAAO,EAAEb,OAAO,CAACa;IACrB,CAAC,CAAC;IACF,MAAMC,IAAI,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAAC,CAAC;IAClC,OAAO;MAAER,MAAM,EAAE,IAAI;MAAEC,OAAO,EAAE,6BAA6B;MAAEM,IAAI,EAAE;QACjEE,OAAO,EAAEF,IAAI,CAACE,OAAO;QACrBC,IAAI,EAAEH,IAAI,CAACG;MACf;IAAE,CAAC;EAEP,CAAC,CAAC,OAAOC,KAAS,EAAE;IAChBjB,OAAO,CAACiB,KAAK,CAAC,mCAAmC,EAAEA,KAAK,CAAC;IACzD,OAAO;MAAEX,MAAM,EAAE,KAAK;MAAEC,OAAO,EAAEU,KAAK,CAACV,OAAO,IAAI;IAA0D,CAAC;EACjH;AACJ","ignoreList":[]}

package/build/src/enums/secretKeys.enum.d.ts

@@ -24,5 +24,6 @@ export declare enum AzureSecretKeysEnum {
     FIREBASE_SERVICE_ACCOUNTS_VARIABLE = "firebase_service_accounts_variable",
     HMS_ACCESS_KEY = "MEETING-HMS-ACCESS-KEY-APP-SECRET",
     MEETING_ROOM_APP_SECRET = "MEETING-ROOM-APP-SECRET",
-    BASE_DB_CLUSTER_CONNECTING_STRING_CHAT = "BASE-DB-CLUSTER-CONNECTING-STRING-CHAT"
+    BASE_DB_CLUSTER_CONNECTING_STRING_CHAT = "BASE-DB-CLUSTER-CONNECTING-STRING-CHAT",
+    AUTH_SERVICE_AUTHENTICATION_URL = "AUTH-SERVICE-AUTHENTICATION-URL"
 }

package/build/src/enums/secretKeys.enum.js

@@ -30,5 +30,6 @@ var AzureSecretKeysEnum;
     AzureSecretKeysEnum["HMS_ACCESS_KEY"] = "MEETING-HMS-ACCESS-KEY-APP-SECRET";
     AzureSecretKeysEnum["MEETING_ROOM_APP_SECRET"] = "MEETING-ROOM-APP-SECRET";
     AzureSecretKeysEnum["BASE_DB_CLUSTER_CONNECTING_STRING_CHAT"] = "BASE-DB-CLUSTER-CONNECTING-STRING-CHAT";
+    AzureSecretKeysEnum["AUTH_SERVICE_AUTHENTICATION_URL"] = "AUTH-SERVICE-AUTHENTICATION-URL";
 })(AzureSecretKeysEnum || (exports.AzureSecretKeysEnum = AzureSecretKeysEnum = {}));
 //# sourceMappingURL=secretKeys.enum.js.map

package/build/src/enums/secretKeys.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretKeys.enum.js","sourceRoot":"","sources":["../../../src/enums/secretKeys.enum.ts"],"names":[],"mappings":";;;AAAA,uBAAuB;AACvB,IAAY,mBA2BX;AA3BD,WAAY,mBAAmB;IAC7B,oFAA6D,CAAA;IAC7D,4EAAqD,CAAA;IACrD,8DAAuC,CAAA;IACvC,8FAAuE,CAAA;IACvE,0FAAmE,CAAA;IACnE,sFAA+D,CAAA;IAC/D,8DAAuC,CAAA;IACvC,8EAAuD,CAAA;IACvD,8EAAuD,CAAA;IACvD,gGAAyE,CAAA;IACzE,oFAA6D,CAAA;IAC7D,8EAAuD,CAAA;IACvD,oFAA6D,CAAA;IAC7D,oFAA8D,CAAA;IAC9D,oFAA6D,CAAA;IAC7D,qFAA8D,CAAA;IAC9D,sGAA+E,CAAA;IAC/E,oGAA6E,CAAA;IAC7E,oGAA6E,CAAA;IAC7E,8DAAuC,CAAA;IACvC,gHAAyF,CAAA;IACzF,8GAAuF,CAAA;IACvF,gGAAyE,CAAA;IACzE,2EAAkD,CAAA;IAClD,0EAAiD,CAAA;IACjD,wGAAiF,CAAA;AACnF,CAAC,EA3BW,mBAAmB,mCAAnB,mBAAmB,QA2B9B"}
+{"version":3,"file":"secretKeys.enum.js","sourceRoot":"","sources":["../../../src/enums/secretKeys.enum.ts"],"names":[],"mappings":";;;AAAA,uBAAuB;AACvB,IAAY,mBA4BX;AA5BD,WAAY,mBAAmB;IAC7B,oFAA6D,CAAA;IAC7D,4EAAqD,CAAA;IACrD,8DAAuC,CAAA;IACvC,8FAAuE,CAAA;IACvE,0FAAmE,CAAA;IACnE,sFAA+D,CAAA;IAC/D,8DAAuC,CAAA;IACvC,8EAAuD,CAAA;IACvD,8EAAuD,CAAA;IACvD,gGAAyE,CAAA;IACzE,oFAA6D,CAAA;IAC7D,8EAAuD,CAAA;IACvD,oFAA6D,CAAA;IAC7D,oFAA8D,CAAA;IAC9D,oFAA6D,CAAA;IAC7D,qFAA8D,CAAA;IAC9D,sGAA+E,CAAA;IAC/E,oGAA6E,CAAA;IAC7E,oGAA6E,CAAA;IAC7E,8DAAuC,CAAA;IACvC,gHAAyF,CAAA;IACzF,8GAAuF,CAAA;IACvF,gGAAyE,CAAA;IACzE,2EAAkD,CAAA;IAClD,0EAAiD,CAAA;IACjD,wGAAiF,CAAA;IACjF,0FAAmE,CAAA;AACrE,CAAC,EA5BW,mBAAmB,mCAAnB,mBAAmB,QA4B9B"}

package/build/src/middlewares/token-validation.d.ts

@@ -13,5 +13,5 @@ interface TokenValidationResult {
         user: IUser;
     };
 }
-export declare function tokenValidation(request: HttpRequest, domain: string, context: InvocationContext): Promise<TokenValidationResult>;
+export declare function tokenValidation(request: HttpRequest, context: InvocationContext): Promise<TokenValidationResult>;
 export {};