@gennext/lb-infra 0.2.2 → 0.3.0

package/dist/components/authenticate/oauth2-handlers/base.d.ts

@@ -0,0 +1,55 @@
+import { AnyObject, TInjectionGetter } from '../../../common';
+import { ApplicationLogger } from '../../../helpers';
+import { BaseModel, Client, Falsey, RequestAuthenticationModel, Token, User } from '@node-oauth/oauth2-server';
+import { IScopeValidationResult } from '../common';
+import { OAuth2Client, OAuth2Token } from '../models';
+import { OAuth2ScopeService } from '../services';
+import { UserDataFetcher } from './data';
+import { ScopeManager } from './scope';
+export interface IOAuth2AuthenticationHandler extends BaseModel, RequestAuthenticationModel {
+}
+export declare abstract class AbstractOAuth2AuthenticationHandler implements IOAuth2AuthenticationHandler {
+    protected authServiceKey: string;
+    protected logger: ApplicationLogger;
+    protected injectionGetter: TInjectionGetter;
+    protected scopeManager: ScopeManager | null;
+    protected userDataFetcher: UserDataFetcher | null;
+    protected scopeService: OAuth2ScopeService;
+    private initPromise;
+    constructor(opts: {
+        scope?: string;
+        authServiceKey: string;
+        injectionGetter: TInjectionGetter;
+    });
+    private initializeServices;
+    /**
+     * Ensure services are initialized before use
+     * Should be called at the start of async methods
+     */
+    protected ensureInitialized(): Promise<void>;
+    getClient(clientId: string, clientSecret: string): Promise<Client | Falsey>;
+    generateAccessToken(client: Client, user: User, _scope: string[]): Promise<string>;
+    protected _saveToken(opts: {
+        type: string;
+        token: string;
+        client: Client;
+        user: User;
+        details?: AnyObject;
+        scopes?: string[];
+    }): Promise<OAuth2Token | null>;
+    saveToken(token: Token, client: Client, user: User): Promise<Token | Falsey>;
+    _getToken(opts: {
+        type: string;
+        token: string;
+    }): Promise<{
+        token: OAuth2Token;
+        client: OAuth2Client;
+        user: AnyObject;
+    }>;
+    getAccessToken(accessToken: string): Promise<Token | Falsey>;
+    verifyScope(token: Token, requiredScopes?: string[]): Promise<boolean>;
+    validateScopes(requestedScopes?: string[]): Promise<IScopeValidationResult>;
+    protected getScopeManager(): ScopeManager | null;
+    protected getUserDataFetcher(): UserDataFetcher | null;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/components/authenticate/oauth2-handlers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../src/components/authenticate/oauth2-handlers/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAuB,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAiB,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,SAAS,EACT,MAAM,EACN,MAAM,EACN,0BAA0B,EAC1B,KAAK,EACL,IAAI,EACL,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAML,sBAAsB,EACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAmB,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,4BAA6B,SAAQ,SAAS,EAAE,0BAA0B;CAAG;AAE9F,8BAAsB,mCAAoC,YAAW,4BAA4B;IAC/F,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC;IACjC,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACpC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAC5C,SAAS,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAQ;IACnD,SAAS,CAAC,eAAe,EAAE,eAAe,GAAG,IAAI,CAAQ;IACzD,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC3C,OAAO,CAAC,WAAW,CAA8B;gBAErC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,gBAAgB,CAAA;KAAE;YAiBjF,kBAAkB;IA6ChC;;;OAGG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAUlD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAkDrE,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BxF,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,IAAI,CAAC;QACX,OAAO,CAAC,EAAE,SAAS,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAiBzB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;IAiB5E,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;;;;;IAwE/C,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC;IA2C5D,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IA4BtE,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAKjF,SAAS,CAAC,eAAe,IAAI,YAAY,GAAG,IAAI;IAIhD,SAAS,CAAC,kBAAkB,IAAI,eAAe,GAAG,IAAI;CAGvD"}

package/dist/components/authenticate/oauth2-handlers/base.js

@@ -0,0 +1,273 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AbstractOAuth2AuthenticationHandler = void 0;
+const common_1 = require("../../../common");
+const helpers_1 = require("../../../helpers");
+const utilities_1 = require("../../../utilities");
+const security_1 = require("@loopback/security");
+const get_1 = __importDefault(require("lodash/get"));
+const common_2 = require("../common");
+const services_1 = require("../services");
+const data_1 = require("./data");
+const scope_1 = require("./scope");
+class AbstractOAuth2AuthenticationHandler {
+    constructor(opts) {
+        this.scopeManager = null;
+        this.userDataFetcher = null;
+        this.initPromise = null;
+        this.logger = helpers_1.LoggerFactory.getLogger([
+            opts?.scope ?? AbstractOAuth2AuthenticationHandler.name,
+        ]);
+        this.injectionGetter = opts.injectionGetter;
+        this.authServiceKey = opts.authServiceKey;
+        // Initialize scope service
+        this.scopeService = new services_1.OAuth2ScopeService({
+            options: { injectionGetter: this.injectionGetter },
+            scope: `${this.constructor.name}:OAuth2ScopeService`,
+        });
+        // Start async initialization but don't wait
+        this.initPromise = this.initializeServices();
+    }
+    async initializeServices() {
+        try {
+            const oauth2Options = this.injectionGetter(common_2.AuthenticateKeys.OAUTH2_OPTIONS);
+            // Try to load scopes from database first
+            let availableScopes = await this.scopeService.loadScopes(true);
+            // Fallback to config if database is empty
+            if (availableScopes.length === 0) {
+                this.logger.warn('[initializeServices] No scopes found in database, falling back to config');
+                availableScopes = oauth2Options?.restOptions?.availableScopes ?? [];
+            }
+            const defaultScopes = oauth2Options?.restOptions?.defaultScopes ?? [];
+            // Initialize scope manager
+            this.scopeManager = new scope_1.ScopeManager({
+                availableScopes,
+                defaultScopes,
+                scope: `${this.constructor.name}:ScopeManager`,
+            });
+            // Initialize user data fetcher
+            this.userDataFetcher = new data_1.UserDataFetcher({
+                options: {
+                    injectionGetter: this.injectionGetter,
+                    scopeManager: this.scopeManager,
+                },
+                scope: `${this.constructor.name}:UserDataFetcher`,
+            });
+            this.logger.info('[initializeServices] Services initialized successfully');
+        }
+        catch (error) {
+            this.logger.error('[initializeServices] Failed to initialize services: %s', (0, utilities_1.getError)(error).message);
+            throw error;
+        }
+    }
+    /**
+     * Ensure services are initialized before use
+     * Should be called at the start of async methods
+     */
+    async ensureInitialized() {
+        if (this.initPromise) {
+            await this.initPromise;
+        }
+        if (!this.scopeManager || !this.userDataFetcher) {
+            throw (0, utilities_1.getError)({ message: 'OAuth2 services not initialized' });
+        }
+    }
+    getClient(clientId, clientSecret) {
+        return new Promise((resolve, reject) => {
+            this.logger.debug('[getClient] Retrieving application client | client_id: %s', clientId);
+            const clientRepository = this.injectionGetter('repositories.OAuth2ClientRepository');
+            clientRepository
+                .findOne({
+                where: { or: [{ clientId }, { clientId, clientSecret }] },
+                fields: [
+                    'id',
+                    'provider',
+                    'identifier',
+                    'clientId',
+                    'name',
+                    'description',
+                    'grants',
+                    'userId',
+                    'endpoints',
+                ],
+            })
+                .then(oauth2Client => {
+                if (!oauth2Client) {
+                    reject((0, utilities_1.getError)({
+                        message: `[getClient] OAuth2 client NOT FOUND | clientId: ${clientId}`,
+                    }));
+                    return;
+                }
+                resolve({
+                    id: oauth2Client.id.toString(),
+                    provider: oauth2Client.provider,
+                    identifier: oauth2Client.identifier,
+                    clientId: oauth2Client.clientId,
+                    name: oauth2Client.name,
+                    description: oauth2Client.description,
+                    grants: oauth2Client.grants,
+                    userId: oauth2Client.userId,
+                    redirectUris: oauth2Client?.endpoints?.redirectUrls ?? [],
+                    callbackUrls: oauth2Client?.endpoints?.callbackUrls ?? [],
+                });
+            })
+                .catch(reject);
+        });
+    }
+    async generateAccessToken(client, user, _scope) {
+        const service = this.injectionGetter('services.JWTTokenService');
+        const userId = (0, get_1.default)(user, 'id');
+        if (!userId) {
+            throw (0, utilities_1.getError)({
+                message: '[generateAccessToken] Invalid userId | Please verify getUserInformation response!',
+            });
+        }
+        const authService = this.injectionGetter(this.authServiceKey);
+        const userInformation = await authService?.getUserInformation?.({ userId });
+        const tokenValue = service.generate({
+            payload: {
+                [security_1.securityId]: userId.toString(),
+                userId: userInformation?.userId ?? userId.toString(),
+                roles: userInformation?.roles ?? [],
+                provider: client.provider,
+                clientId: client.id,
+            },
+        });
+        return Promise.resolve(tokenValue);
+    }
+    _saveToken(opts) {
+        const { type, token, client, user, details, scopes } = opts;
+        const oauth2TokenRepository = this.injectionGetter('repositories.OAuth2TokenRepository');
+        return oauth2TokenRepository.create({
+            token,
+            type,
+            status: common_1.OAuth2TokenStatuses.ACTIVATED,
+            clientId: (0, utilities_1.int)(client.id),
+            userId: (0, utilities_1.int)(user.id),
+            scopes: scopes ?? [],
+            details,
+        });
+    }
+    async saveToken(token, client, user) {
+        await this.ensureInitialized();
+        const scopes = this.scopeManager.normalizeScopes(token.scope);
+        await this._saveToken({
+            token: token.accessToken,
+            type: common_2.AuthenticationTokenTypes.TYPE_ACCESS_TOKEN,
+            client,
+            user,
+            scopes,
+            details: token,
+        });
+        return { ...token, client, user };
+    }
+    async _getToken(opts) {
+        const { type, token } = opts;
+        await this.ensureInitialized();
+        const oauth2TokenRepository = this.injectionGetter('repositories.OAuth2TokenRepository');
+        const oauth2Token = await oauth2TokenRepository.findOne({
+            where: { type, token },
+        });
+        if (!oauth2Token) {
+            this.logger.error('[_getToken] Not found OAuth2Token | type: %s | token: %s', type, token);
+            throw (0, utilities_1.getError)({
+                message: `[_getToken] Not found any OAuth2Token with type: ${type} | token: ${token}`,
+            });
+        }
+        if (oauth2Token.status !== common_1.OAuth2TokenStatuses.ACTIVATED) {
+            this.logger.error('[_getToken] Invalid OAuth2Token status | token: %j', oauth2Token);
+            throw (0, utilities_1.getError)({
+                message: `[_getToken] Invalid OAuth2Token status: ${oauth2Token.status}`,
+            });
+        }
+        // Fetch user data using UserDataFetcher
+        const userId = (0, utilities_1.int)(oauth2Token.userId);
+        const grantedScopes = oauth2Token.scopes ?? [];
+        const user = await this.userDataFetcher.fetchByScopes({ userId, grantedScopes });
+        if (!user?.id) {
+            this.logger.error('[_getToken] Not found User | type: %s | token: %s | oauth2Token: %j', type, token, oauth2Token);
+            throw (0, utilities_1.getError)({
+                message: `[_getToken] Not found any User with type: ${type} | token: ${token}`,
+            });
+        }
+        const oauth2ClientRepository = this.injectionGetter('repositories.OAuth2ClientRepository');
+        const oauth2Client = await oauth2ClientRepository.findOne({
+            where: { id: (0, utilities_1.int)(oauth2Token.clientId) },
+            fields: ['id', 'provider', 'identifier', 'clientId', 'name', 'description', 'userId'],
+        });
+        if (!oauth2Client) {
+            this.logger.error('[_getToken] Not found OAuth2Client | type: %s | token: %s | oauth2Token: %j', type, token, oauth2Token);
+            throw (0, utilities_1.getError)({
+                message: `[_getToken] Not found any OAuth2Client with type: ${type} | token: ${token}`,
+            });
+        }
+        return {
+            token: oauth2Token,
+            client: oauth2Client,
+            user,
+        };
+    }
+    async getAccessToken(accessToken) {
+        const service = this.injectionGetter('services.JWTTokenService');
+        const tokenPayload = service.verify({
+            type: common_2.Authentication.TYPE_BEARER,
+            token: accessToken,
+        });
+        const clientId = tokenPayload['clientId'];
+        if (!clientId || clientId === 'NA') {
+            this.logger.error('[getAccessToken] Invalid clientId in tokenPayload | tokenPayload: %j', tokenPayload);
+            throw (0, utilities_1.getError)({
+                message: '[getAccessToken] Invalid clientId in token payload!',
+            });
+        }
+        const oauth2ClientRepository = this.injectionGetter('repositories.OAuth2ClientRepository');
+        const oauth2Client = await oauth2ClientRepository.findOne({
+            where: { clientId },
+            fields: ['id', 'provider', 'identifier', 'clientId', 'name', 'description', 'userId'],
+        });
+        if (!oauth2Client) {
+            throw (0, utilities_1.getError)({
+                message: `[getAccessToken] Not found any OAuth2Client with id: ${clientId}`,
+            });
+        }
+        return {
+            accessToken,
+            accessTokenExpiresAt: new Date((0, utilities_1.int)(tokenPayload['exp']) * 1000),
+            client: Object.assign({}, oauth2Client.toObject(), {
+                id: oauth2Client.id.toString(),
+            }),
+            user: { id: tokenPayload.userId },
+        };
+    }
+    async verifyScope(token, requiredScopes) {
+        await this.ensureInitialized();
+        this.logger.info('[verifyScope] Token: %j | Required scopes: %s', token, requiredScopes ?? []);
+        if (!token) {
+            return false;
+        }
+        // If no scopes required, allow access
+        if (!requiredScopes || requiredScopes.length === 0) {
+            return true;
+        }
+        const tokenScopes = this.scopeManager.normalizeScopes(token.scope);
+        // Check if token has all required scopes
+        const hasAllScopes = requiredScopes.every(scope => tokenScopes.includes(scope));
+        this.logger.info('[verifyScope] Token scopes: %s | Has all required scopes: %s', tokenScopes.join(', '), hasAllScopes);
+        return hasAllScopes;
+    }
+    async validateScopes(requestedScopes) {
+        await this.ensureInitialized();
+        return this.scopeManager.validateScopes(requestedScopes ?? []);
+    }
+    getScopeManager() {
+        return this.scopeManager;
+    }
+    getUserDataFetcher() {
+        return this.userDataFetcher;
+    }
+}
+exports.AbstractOAuth2AuthenticationHandler = AbstractOAuth2AuthenticationHandler;
+//# sourceMappingURL=base.js.map

package/dist/components/authenticate/oauth2-handlers/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../src/components/authenticate/oauth2-handlers/base.ts"],"names":[],"mappings":";;;;;;AAAA,qCAA4E;AAC5E,uCAA6D;AAC7D,2CAA4C;AAC5C,iDAAgD;AAUhD,qDAA6B;AAC7B,sCAOmB;AAGnB,0CAAkE;AAClE,iCAAyC;AACzC,mCAAuC;AAIvC,MAAsB,mCAAmC;IASvD,YAAY,IAAmF;QALrF,iBAAY,GAAwB,IAAI,CAAC;QACzC,oBAAe,GAA2B,IAAI,CAAC;QAEjD,gBAAW,GAAyB,IAAI,CAAC;QAG/C,IAAI,CAAC,MAAM,GAAG,uBAAa,CAAC,SAAS,CAAC;YACpC,IAAI,EAAE,KAAK,IAAI,mCAAmC,CAAC,IAAI;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAE1C,2BAA2B;QAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,6BAAkB,CAAC;YACzC,OAAO,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;YAClD,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,qBAAqB;SACrD,CAAC,CAAC;QAEH,4CAA4C;QAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CACxC,yBAAgB,CAAC,cAAc,CAChC,CAAC;YAEF,yCAAyC;YACzC,IAAI,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE/D,0CAA0C;YAC1C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0EAA0E,CAC3E,CAAC;gBACF,eAAe,GAAG,aAAa,EAAE,WAAW,EAAE,eAAe,IAAI,EAAE,CAAC;YACtE,CAAC;YAED,MAAM,aAAa,GAAG,aAAa,EAAE,WAAW,EAAE,aAAa,IAAI,EAAE,CAAC;YAEtE,2BAA2B;YAC3B,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAY,CAAC;gBACnC,eAAe;gBACf,aAAa;gBACb,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,eAAe;aAC/C,CAAC,CAAC;YAEH,+BAA+B;YAC/B,IAAI,CAAC,eAAe,GAAG,IAAI,sBAAe,CAAC;gBACzC,OAAO,EAAE;oBACP,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,kBAAkB;aAClD,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wDAAwD,EACxD,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,OAAO,CACxB,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,KAAK,CAAC,iBAAiB;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,WAAW,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,MAAM,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE,YAAoB;QAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,QAAQ,CAAC,CAAC;YAEzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAC3C,qCAAqC,CACtC,CAAC;YAEF,gBAAgB;iBACb,OAAO,CAAC;gBACP,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EAAE;gBACzD,MAAM,EAAE;oBACN,IAAI;oBACJ,UAAU;oBACV,YAAY;oBACZ,UAAU;oBACV,MAAM;oBACN,aAAa;oBACb,QAAQ;oBACR,QAAQ;oBACR,WAAW;iBACZ;aACF,CAAC;iBACD,IAAI,CAAC,YAAY,CAAC,EAAE;gBACnB,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,CACJ,IAAA,oBAAQ,EAAC;wBACP,OAAO,EAAE,mDAAmD,QAAQ,EAAE;qBACvE,CAAC,CACH,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,OAAO,CAAC;oBACN,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE;oBAC9B,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,IAAI,EAAE,YAAY,CAAC,IAAI;oBACvB,WAAW,EAAE,YAAY,CAAC,WAAW;oBACrC,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,MAAM,EAAE,YAAY,CAAC,MAAM;oBAC3B,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,EAAE;oBACzD,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,IAAI,EAAE;iBAC1D,CAAC,CAAC;YACL,CAAC,CAAC;iBACD,KAAK,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,IAAU,EAAE,MAAgB;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAkB,0BAA0B,CAAC,CAAC;QAElF,MAAM,MAAM,GAAG,IAAA,aAAG,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EACL,mFAAmF;aACtF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,CAAe,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,MAAM,WAAW,EAAE,kBAAkB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE5E,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,OAAO,EAAE;gBACP,CAAC,qBAAU,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,eAAe,EAAE,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE;gBACpD,KAAK,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB;SACF,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAES,UAAU,CAAC,IAOpB;QACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC5D,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAChD,oCAAoC,CACrC,CAAC;QAEF,OAAO,qBAAqB,CAAC,MAAM,CAAC;YAClC,KAAK;YACL,IAAI;YACJ,MAAM,EAAE,4BAAmB,CAAC,SAAS;YACrC,QAAQ,EAAE,IAAA,eAAG,EAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,IAAA,eAAG,EAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,IAAI,EAAE;YACpB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAY,EAAE,MAAc,EAAE,IAAU;QACtD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAa,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/D,MAAM,IAAI,CAAC,UAAU,CAAC;YACpB,KAAK,EAAE,KAAK,CAAC,WAAW;YACxB,IAAI,EAAE,iCAAwB,CAAC,iBAAiB;YAChD,MAAM;YACN,IAAI;YACJ,MAAM;YACN,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAqC;QACnD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE7B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAChD,oCAAoC,CACrC,CAAC;QAEF,MAAM,WAAW,GAAuB,MAAM,qBAAqB,CAAC,OAAO,CAAC;YAC1E,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3F,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,oDAAoD,IAAI,aAAa,KAAK,EAAE;aACtF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,4BAAmB,CAAC,SAAS,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,WAAW,CAAC,CAAC;YACrF,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,2CAA2C,WAAW,CAAC,MAAM,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,MAAM,MAAM,GAAG,IAAA,eAAG,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,IAAI,EAAE,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAgB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAElF,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qEAAqE,EACrE,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,6CAA6C,IAAI,aAAa,KAAK,EAAE;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,CAAC,eAAe,CACjD,qCAAqC,CACtC,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,eAAG,EAAC,WAAW,CAAC,QAAQ,CAAC,EAAE;YACxC,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC;SACtF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,6EAA6E,EAC7E,IAAI,EACJ,KAAK,EACL,WAAW,CACZ,CAAC;YACF,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,qDAAqD,IAAI,aAAa,KAAK,EAAE;aACvF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,YAAY;YACpB,IAAI;SACL,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAkB,0BAA0B,CAAC,CAAC;QAClF,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,uBAAc,CAAC,WAAW;YAChC,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sEAAsE,EACtE,YAAY,CACb,CAAC;YACF,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,sBAAsB,GAAG,IAAI,CAAC,eAAe,CACjD,qCAAqC,CACtC,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC;YACxD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC;SACtF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,wDAAwD,QAAQ,EAAE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,WAAW;YACX,oBAAoB,EAAE,IAAI,IAAI,CAAC,IAAA,eAAG,EAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC/D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,YAAa,CAAC,QAAQ,EAAkB,EAAE;gBAClE,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE;aAC/B,CAAC;YACF,IAAI,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,MAAM,EAAE;SAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAY,EAAE,cAAyB;QACvD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,KAAK,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAE/F,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAa,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEpE,yCAAyC;QACzC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAEhF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8DAA8D,EAC9D,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EACtB,YAAY,CACb,CAAC;QAEF,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,eAA0B;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,YAAa,CAAC,cAAc,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAES,eAAe;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAES,kBAAkB;QAC1B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAvWD,kFAuWC"}

package/dist/components/authenticate/oauth2-handlers/client-credential.handler.d.ts

@@ -0,0 +1,13 @@
+import { TInjectionGetter } from '../../../common';
+import { Client, ClientCredentialsModel, Falsey, User } from '@node-oauth/oauth2-server';
+import { AbstractOAuth2AuthenticationHandler } from './base';
+export declare class OAuth2ClientCredentialHandler extends AbstractOAuth2AuthenticationHandler implements ClientCredentialsModel {
+    constructor(opts: {
+        scope?: string;
+        authServiceKey: string;
+        injectionGetter: TInjectionGetter;
+        serviceKey: string;
+    });
+    getUserFromClient(client: Client): Promise<User | Falsey>;
+}
+//# sourceMappingURL=client-credential.handler.d.ts.map

package/dist/components/authenticate/oauth2-handlers/client-credential.handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credential.handler.d.ts","sourceRoot":"","sources":["../../../../src/components/authenticate/oauth2-handlers/client-credential.handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAEzF,OAAO,EAAE,mCAAmC,EAAE,MAAM,QAAQ,CAAC;AAE7D,qBAAa,6BACX,SAAQ,mCACR,YAAW,sBAAsB;gBAErB,IAAI,EAAE;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,eAAe,EAAE,gBAAgB,CAAC;QAClC,UAAU,EAAE,MAAM,CAAC;KACpB;IAQD,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC;CAa1D"}

package/dist/components/authenticate/oauth2-handlers/client-credential.handler.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2ClientCredentialHandler = void 0;
+const utilities_1 = require("../../../utilities");
+const base_1 = require("./base");
+class OAuth2ClientCredentialHandler extends base_1.AbstractOAuth2AuthenticationHandler {
+    constructor(opts) {
+        super({
+            scope: opts.scope,
+            authServiceKey: opts.authServiceKey,
+            injectionGetter: opts.injectionGetter,
+        });
+    }
+    getUserFromClient(client) {
+        this.logger.debug('[getUserFromClient] Client: %j', client);
+        const service = this.injectionGetter(this.authServiceKey);
+        if (!service?.getUserInformation) {
+            throw (0, utilities_1.getError)({
+                message: `${this.authServiceKey} has no 'getUserInformation' method!`,
+            });
+        }
+        const userInformation = service?.getUserInformation?.(client);
+        return Promise.resolve(userInformation);
+    }
+}
+exports.OAuth2ClientCredentialHandler = OAuth2ClientCredentialHandler;
+//# sourceMappingURL=client-credential.handler.js.map

package/dist/components/authenticate/oauth2-handlers/client-credential.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-credential.handler.js","sourceRoot":"","sources":["../../../../src/components/authenticate/oauth2-handlers/client-credential.handler.ts"],"names":[],"mappings":";;;AACA,2CAAuC;AAGvC,iCAA6D;AAE7D,MAAa,6BACX,SAAQ,0CAAmC;IAG3C,YAAY,IAKX;QACC,KAAK,CAAC;YACJ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,MAAc;QAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAe,IAAI,CAAC,cAAc,CAAC,CAAC;QAExE,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,IAAA,oBAAQ,EAAC;gBACb,OAAO,EAAE,GAAG,IAAI,CAAC,cAAc,sCAAsC;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,OAAO,EAAE,kBAAkB,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;CACF;AA9BD,sEA8BC"}

package/dist/components/authenticate/oauth2-handlers/config/index.d.ts

@@ -0,0 +1,2 @@
+export * from './scope-config-validator';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/authenticate/oauth2-handlers/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC"}

package/dist/components/authenticate/oauth2-handlers/config/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./scope-config-validator"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/authenticate/oauth2-handlers/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/config/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC"}

package/dist/components/authenticate/oauth2-handlers/config/scope-config-validator.d.ts

@@ -0,0 +1,46 @@
+import { IAuthenticateOAuth2Options } from '../../common';
+export interface IScopeConfigValidationError {
+    field: string;
+    message: string;
+    scopeIdentifier?: string;
+}
+export interface IScopeConfigValidationResult {
+    valid: boolean;
+    errors: IScopeConfigValidationError[];
+    warnings: string[];
+}
+/**
+ * ScopeConfigValidator validates OAuth2 scope configuration at startup
+ * Ensures configuration is well-formed and consistent
+ */
+export declare class ScopeConfigValidator {
+    private logger;
+    constructor(opts: {
+        scope?: string;
+    });
+    /**
+     * Validate OAuth2 configuration
+     * @param config - OAuth2 options configuration
+     * @returns Validation result with errors and warnings
+     */
+    validate(config: IAuthenticateOAuth2Options): IScopeConfigValidationResult;
+    /**
+     * Validate available scopes configuration
+     */
+    private validateAvailableScopes;
+    /**
+     * Validate relations in a scope definition
+     */
+    private validateRelations;
+    /**
+     * Validate default scopes
+     */
+    private validateDefaultScopes;
+    /**
+     * Validate configuration and throw if invalid
+     * @param config - OAuth2 configuration
+     * @throws Error if configuration is invalid
+     */
+    validateOrThrow(config: IAuthenticateOAuth2Options): void;
+}
+//# sourceMappingURL=scope-config-validator.d.ts.map

package/dist/components/authenticate/oauth2-handlers/config/scope-config-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-config-validator.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/config/scope-config-validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAoB,MAAM,cAAc,CAAC;AAG5E,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,2BAA2B,EAAE,CAAC;IACtC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,MAAM,CAAoB;gBAEtB,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAKpC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,0BAA0B,GAAG,4BAA4B;IA8D1E;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAqD/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAoCzB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAmE7B;;;;OAIG;IACH,eAAe,CAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI;CAQ1D"}