@flusys/nestjs-auth 7.0.2 → 7.1.0

package/fesm/entities/index.spec.js

@@ -2,6 +2,7 @@ import { getAuthEntitiesByConfig } from './index';
 import { AppUser } from './app-user.entity';
 import { UserToken } from './user-token.entity';
 import { PendingRegistration } from './pending-registration.entity';
+import { SocialAuthConfig } from './social-auth-config.entity';
 import { Company } from './company.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
@@ -16,6 +17,15 @@ describe('getAuthEntitiesByConfig', ()=>{
             UserToken
         ]));
     });
+    it('should always include the social sign-in config entity, which no flag gates', ()=>{
+        const entities = getAuthEntitiesByConfig({
+            enableCompanyFeature: false,
+            enableEmailVerification: false
+        });
+        expect(entities).toEqual(expect.arrayContaining([
+            SocialAuthConfig
+        ]));
+    });
     it('should include PendingRegistration when email verification is enabled', ()=>{
         const entities = getAuthEntitiesByConfig({
             enableEmailVerification: true
@@ -56,10 +66,11 @@ describe('getAuthEntitiesByConfig', ()=>{
             enableCompanyFeature: true,
             enableEmailVerification: true
         });
-        expect(entities).toHaveLength(6);
+        expect(entities).toHaveLength(7);
         expect(entities).toEqual(expect.arrayContaining([
             AppUser,
             UserToken,
+            SocialAuthConfig,
             PendingRegistration,
             Company,
             CompanyBranch,

package/fesm/entities/social-auth-config.entity.js

@@ -0,0 +1,92 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+import { getJsonColumnType } from '@flusys/nestjs-shared';
+import { Identity } from '@flusys/nestjs-shared/entities';
+import { Column, Entity, Index } from 'typeorm';
+export class SocialAuthConfig extends Identity {
+    constructor(...args){
+        super(...args), _define_property(this, "provider", void 0), _define_property(this, "isEnabled", void 0), _define_property(this, "clientId", void 0), _define_property(this, "clientSecret", void 0), _define_property(this, "scopes", void 0), _define_property(this, "extraConfig", void 0);
+    }
+}
+_ts_decorate([
+    Column({
+        type: 'varchar',
+        length: 32,
+        nullable: false
+    }),
+    _ts_metadata("design:type", String)
+], SocialAuthConfig.prototype, "provider", void 0);
+_ts_decorate([
+    Column({
+        type: 'boolean',
+        default: false,
+        name: 'is_enabled'
+    }),
+    _ts_metadata("design:type", Boolean)
+], SocialAuthConfig.prototype, "isEnabled", void 0);
+_ts_decorate([
+    Column({
+        type: 'varchar',
+        length: 512,
+        nullable: true,
+        name: 'client_id'
+    }),
+    _ts_metadata("design:type", Object)
+], SocialAuthConfig.prototype, "clientId", void 0);
+_ts_decorate([
+    Column({
+        type: 'text',
+        nullable: true,
+        name: 'client_secret'
+    }),
+    _ts_metadata("design:type", Object)
+], SocialAuthConfig.prototype, "clientSecret", void 0);
+_ts_decorate([
+    Column({
+        type: 'simple-array',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], SocialAuthConfig.prototype, "scopes", void 0);
+_ts_decorate([
+    Column({
+        type: getJsonColumnType(),
+        nullable: true,
+        name: 'extra_config'
+    }),
+    _ts_metadata("design:type", Object)
+], SocialAuthConfig.prototype, "extraConfig", void 0);
+SocialAuthConfig = _ts_decorate([
+    Entity({
+        name: 'social_auth_config'
+    }),
+    Index('IDX_social_auth_config_provider', [
+        'provider'
+    ], {
+        unique: true,
+        where: '"deleted_at" IS NULL'
+    }),
+    Index([
+        'isEnabled'
+    ])
+], SocialAuthConfig);

package/fesm/enums/index.js

@@ -1 +1,2 @@
+export * from './social-provider-type.enum';
 export * from './user-org-permission-type.enum';

package/fesm/enums/social-provider-type.enum.js

@@ -0,0 +1,7 @@
+export var SocialProviderTypeEnum = /*#__PURE__*/ function(SocialProviderTypeEnum) {
+    SocialProviderTypeEnum["GOOGLE"] = "google";
+    SocialProviderTypeEnum["FACEBOOK"] = "facebook";
+    SocialProviderTypeEnum["LINKEDIN"] = "linkedin";
+    SocialProviderTypeEnum["MICROSOFT"] = "microsoft";
+    return SocialProviderTypeEnum;
+}({});

package/fesm/index.js

@@ -8,5 +8,6 @@ export * from './helpers';
 export * from './interceptors';
 export * from './interfaces';
 export * from './modules';
+export * from './providers';
 export * from './services';
 export * from './strategies/jwt.strategy';

package/fesm/interfaces/index.js

@@ -2,6 +2,7 @@ export * from './authentication.interface';
 export * from './auth-email-provider.interface';
 export * from './company-branch.interface';
 export * from './company.interface';
+export * from './social-auth.interface';
 export * from './user.interface';
 export * from './user-enricher.interface';
 export * from './auth-module-options.interface';

package/fesm/interfaces/social-auth.interface.js

@@ -0,0 +1 @@
+export { };

package/fesm/modules/auth.module.js

@@ -10,11 +10,11 @@ import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
-import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, UserController, UserPermissionController } from '../controllers';
+import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, SocialAuthConfigController, SocialAuthController, UserController, UserPermissionController } from '../controllers';
 import { getAuthEntitiesByConfig } from '../entities';
 import { ClearToken } from '../interceptors/clear-token.interceptor';
 import { SetToken } from '../interceptors/set-token.interceptor';
-import { AuthEmailService, AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService, UserService } from '../services';
+import { AuthEmailService, AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, SocialAuthConfigService, SocialAuthService, UserPermissionService, UserService } from '../services';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { JwtStrategy } from '../strategies/jwt.strategy';
@@ -74,6 +74,8 @@ export class AuthModule {
         if (!includeController) return [];
         const controllers = [
             AuthenticationController,
+            SocialAuthController,
+            SocialAuthConfigController,
             UserController
         ];
         if (flags.enableEmailVerification) {
@@ -91,6 +93,8 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            SocialAuthService,
+            SocialAuthConfigService,
             SetToken,
             ClearToken,
             UserService,
@@ -113,6 +117,8 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            SocialAuthService,
+            SocialAuthConfigService,
             UserService
         ];
         if (flags.enableEmailVerification) {

package/fesm/modules/auth.module.spec.js

@@ -13,8 +13,8 @@ function _define_property(obj, key, value) {
 }
 import { AuthModule } from './auth.module';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
-import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, UserController, UserPermissionController } from '../controllers';
-import { AuthEmailService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService } from '../services';
+import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, SocialAuthConfigController, SocialAuthController, UserController, UserPermissionController } from '../controllers';
+import { AuthEmailService, BranchService, CompanySelectionSessionService, CompanyService, SocialAuthConfigService, SocialAuthService, UserPermissionService } from '../services';
 function providerTokens(providers) {
     return providers.map((p)=>typeof p === 'function' ? p : p.provide);
 }
@@ -30,11 +30,26 @@ describe('AuthModule', ()=>{
             expect(dynamicModule.global).toBe(false);
             expect(dynamicModule.controllers).toEqual([
                 AuthenticationController,
+                SocialAuthController,
+                SocialAuthConfigController,
                 UserController
             ]);
             expect(providerTokens(dynamicModule.providers)).not.toContain(AuthEmailService);
             expect(providerTokens(dynamicModule.providers)).not.toContain(CompanyService);
         });
+        it('should always register social sign-in, whatever the feature flags say', ()=>{
+            const dynamicModule = AuthModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(dynamicModule.controllers).toContain(SocialAuthController);
+            expect(dynamicModule.controllers).toContain(SocialAuthConfigController);
+            expect(providerTokens(dynamicModule.providers)).toContain(SocialAuthService);
+            expect(providerTokens(dynamicModule.providers)).toContain(SocialAuthConfigService);
+            expect(dynamicModule.exports).toContain(SocialAuthService);
+            expect(dynamicModule.exports).toContain(SocialAuthConfigService);
+        });
         it('should respect global: true', ()=>{
             const dynamicModule = AuthModule.forRoot({
                 global: true

package/fesm/providers/facebook.social-provider.js

@@ -0,0 +1,63 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { buildQuery, getJson, postForm, readAccessToken, readString, resolveScopes } from './oauth-http.util';
+const GRAPH_VERSION = 'v21.0';
+const AUTHORIZE_URL = `https://www.facebook.com/${GRAPH_VERSION}/dialog/oauth`;
+const TOKEN_URL = `https://graph.facebook.com/${GRAPH_VERSION}/oauth/access_token`;
+const PROFILE_URL = `https://graph.facebook.com/${GRAPH_VERSION}/me?fields=id,name,email,picture.type(large)`;
+function readAvatarUrl(profile) {
+    const picture = profile['picture'];
+    if (typeof picture !== 'object' || picture === null) return null;
+    const data = picture['data'];
+    if (typeof data !== 'object' || data === null) return null;
+    return readString(data, 'url');
+}
+let FacebookSocialProvider = class FacebookSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            response_type: 'code',
+            scope: resolveScopes(credentials, this.defaultScopes, ','),
+            state
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, TOKEN_URL, {
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri
+        });
+        const profile = await getJson(this.provider, PROFILE_URL, readAccessToken(this.provider, token));
+        const email = readString(profile, 'email');
+        return {
+            providerUserId: readString(profile, 'id') ?? '',
+            email,
+            emailVerified: !!email,
+            name: readString(profile, 'name'),
+            avatarUrl: readAvatarUrl(profile)
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", SocialProviderTypeEnum.FACEBOOK);
+        _define_property(this, "defaultScopes", [
+            'email',
+            'public_profile'
+        ]);
+    }
+};
+export const facebookSocialProvider = new FacebookSocialProvider();

package/fesm/providers/google.social-provider.js

@@ -0,0 +1,58 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { buildQuery, getJson, postForm, readAccessToken, readString, resolveScopes } from './oauth-http.util';
+const AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo';
+let GoogleSocialProvider = class GoogleSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            response_type: 'code',
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state,
+            access_type: 'online',
+            prompt: 'select_account'
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, TOKEN_URL, {
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code'
+        });
+        const profile = await getJson(this.provider, USERINFO_URL, readAccessToken(this.provider, token));
+        return {
+            providerUserId: readString(profile, 'sub') ?? '',
+            email: readString(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: readString(profile, 'name'),
+            avatarUrl: readString(profile, 'picture')
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", SocialProviderTypeEnum.GOOGLE);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'email',
+            'profile'
+        ]);
+    }
+};
+export const googleSocialProvider = new GoogleSocialProvider();

package/fesm/providers/index.js

@@ -0,0 +1 @@
+export * from './social-provider.registry';

package/fesm/providers/linkedin.social-provider.js

@@ -0,0 +1,56 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { buildQuery, getJson, postForm, readAccessToken, readString, resolveScopes } from './oauth-http.util';
+const AUTHORIZE_URL = 'https://www.linkedin.com/oauth/v2/authorization';
+const TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
+const USERINFO_URL = 'https://api.linkedin.com/v2/userinfo';
+let LinkedInSocialProvider = class LinkedInSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            response_type: 'code',
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, TOKEN_URL, {
+            grant_type: 'authorization_code',
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri
+        });
+        const profile = await getJson(this.provider, USERINFO_URL, readAccessToken(this.provider, token));
+        return {
+            providerUserId: readString(profile, 'sub') ?? '',
+            email: readString(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: readString(profile, 'name'),
+            avatarUrl: readString(profile, 'picture')
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", SocialProviderTypeEnum.LINKEDIN);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'profile',
+            'email'
+        ]);
+    }
+};
+export const linkedInSocialProvider = new LinkedInSocialProvider();

package/fesm/providers/microsoft.social-provider.js

@@ -0,0 +1,68 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { buildQuery, getJson, postForm, readAccessToken, readString, resolveScopes } from './oauth-http.util';
+const GRAPH_ME_URL = 'https://graph.microsoft.com/v1.0/me';
+const DEFAULT_TENANT = 'common';
+function resolveTenant(credentials) {
+    const tenantId = credentials.extraConfig?.['tenantId'];
+    return typeof tenantId === 'string' && tenantId ? tenantId : DEFAULT_TENANT;
+}
+function endpoint(credentials, action) {
+    return `https://login.microsoftonline.com/${resolveTenant(credentials)}/oauth2/v2.0/${action}`;
+}
+let MicrosoftSocialProvider = class MicrosoftSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = buildQuery({
+            client_id: credentials.clientId,
+            response_type: 'code',
+            redirect_uri: credentials.redirectUri,
+            response_mode: 'query',
+            scope: resolveScopes(credentials, this.defaultScopes),
+            state
+        });
+        return `${endpoint(credentials, 'authorize')}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await postForm(this.provider, endpoint(credentials, 'token'), {
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            code,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code',
+            scope: resolveScopes(credentials, this.defaultScopes)
+        });
+        const profile = await getJson(this.provider, GRAPH_ME_URL, readAccessToken(this.provider, token));
+        // `mail` is Microsoft's confirmed mailbox claim; `userPrincipalName` is a sign-in
+        // identifier that is not guaranteed to be a verified, owned mailbox address.
+        const verifiedEmail = readString(profile, 'mail');
+        return {
+            providerUserId: readString(profile, 'id') ?? '',
+            email: verifiedEmail ?? readString(profile, 'userPrincipalName'),
+            emailVerified: !!verifiedEmail,
+            name: readString(profile, 'displayName'),
+            avatarUrl: null
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", SocialProviderTypeEnum.MICROSOFT);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'profile',
+            'email',
+            'User.Read'
+        ]);
+    }
+};
+export const microsoftSocialProvider = new MicrosoftSocialProvider();

package/fesm/providers/oauth-http.util.js

@@ -0,0 +1,77 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { SOCIAL_AUTH_MESSAGES } from '../config/message-keys';
+const OAUTH_HTTP_TIMEOUT_MS = 10_000;
+function failExchange(provider, detail) {
+    throw new UnauthorizedException({
+        message: `Social sign-in with ${provider} failed: ${detail}`,
+        messageKey: SOCIAL_AUTH_MESSAGES.EXCHANGE_FAILED,
+        messageVariables: {
+            provider
+        }
+    });
+}
+async function fetchWithTimeout(provider, url, init) {
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
+        });
+    } catch (error) {
+        if (error instanceof Error && error.name === 'TimeoutError') {
+            failExchange(provider, 'request timed out');
+        }
+        throw error;
+    }
+}
+async function readJson(provider, response) {
+    const body = await response.text();
+    if (!response.ok) {
+        failExchange(provider, `${response.status} ${body.slice(0, 200)}`);
+    }
+    try {
+        return JSON.parse(body);
+    } catch  {
+        return failExchange(provider, 'response was not JSON');
+    }
+}
+export async function postForm(provider, url, form) {
+    const response = await fetchWithTimeout(provider, url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json'
+        },
+        body: new URLSearchParams(form).toString()
+    });
+    return readJson(provider, response);
+}
+export async function getJson(provider, url, accessToken) {
+    const response = await fetchWithTimeout(provider, url, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/json'
+        }
+    });
+    return readJson(provider, response);
+}
+export function readAccessToken(provider, token) {
+    const accessToken = token['access_token'];
+    if (typeof accessToken !== 'string' || !accessToken) {
+        failExchange(provider, 'no access token returned');
+    }
+    return accessToken;
+}
+export function readString(source, key) {
+    const value = source[key];
+    return typeof value === 'string' && value ? value : null;
+}
+export function buildQuery(params) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)){
+        if (value) query.append(key, value);
+    }
+    return query.toString();
+}
+export function resolveScopes(credentials, defaults, separator = ' ') {
+    return (credentials.scopes?.length ? credentials.scopes : defaults).join(separator);
+}

package/fesm/providers/social-provider.registry.js

@@ -0,0 +1,14 @@
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { facebookSocialProvider } from './facebook.social-provider';
+import { googleSocialProvider } from './google.social-provider';
+import { linkedInSocialProvider } from './linkedin.social-provider';
+import { microsoftSocialProvider } from './microsoft.social-provider';
+const PROVIDERS = {
+    [SocialProviderTypeEnum.GOOGLE]: googleSocialProvider,
+    [SocialProviderTypeEnum.FACEBOOK]: facebookSocialProvider,
+    [SocialProviderTypeEnum.LINKEDIN]: linkedInSocialProvider,
+    [SocialProviderTypeEnum.MICROSOFT]: microsoftSocialProvider
+};
+export function getSocialProvider(provider) {
+    return PROVIDERS[provider];
+}