@gennext/lb-infra 0.2.2 → 0.3.0

package/dist/components/authenticate/oauth2-handlers/config/scope-config-validator.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeConfigValidator = void 0;
+const helpers_1 = require("../../../../helpers");
+const constants_1 = require("../constants");
+/**
+ * ScopeConfigValidator validates OAuth2 scope configuration at startup
+ * Ensures configuration is well-formed and consistent
+ */
+class ScopeConfigValidator {
+    constructor(opts) {
+        const { scope } = opts;
+        this.logger = helpers_1.LoggerFactory.getLogger([scope ?? ScopeConfigValidator.name]);
+    }
+    /**
+     * Validate OAuth2 configuration
+     * @param config - OAuth2 options configuration
+     * @returns Validation result with errors and warnings
+     */
+    validate(config) {
+        const errors = [];
+        const warnings = [];
+        if (!config.enable) {
+            this.logger.info('[validate] OAuth2 is disabled, skipping validation');
+            return { valid: true, errors: [], warnings: [] };
+        }
+        const restOptions = config.restOptions;
+        if (!restOptions) {
+            warnings.push('No restOptions configured for OAuth2');
+            return { valid: true, errors, warnings };
+        }
+        // Validate available scopes
+        if (restOptions.availableScopes) {
+            this.validateAvailableScopes(restOptions.availableScopes, errors, warnings);
+        }
+        else {
+            warnings.push('No availableScopes configured - all scopes will be allowed (backward compatibility mode)');
+        }
+        // Validate default scopes
+        if (restOptions.defaultScopes) {
+            this.validateDefaultScopes(restOptions.defaultScopes, restOptions.availableScopes, errors, warnings);
+        }
+        else {
+            warnings.push('No defaultScopes configured - empty scopes will result in no data access');
+        }
+        const isValid = errors.length === 0;
+        if (isValid) {
+            this.logger.info('[validate] Configuration valid | Warnings: %d | Available scopes: %d | Default scopes: %s', warnings.length, restOptions.availableScopes?.length ?? 0, restOptions.defaultScopes?.join(', ') ?? 'none');
+        }
+        else {
+            this.logger.error('[validate] Configuration invalid | Errors: %d', errors.length);
+            errors.forEach(error => {
+                this.logger.error('[validate] Error: %s - %s', error.field, error.message);
+            });
+        }
+        if (warnings.length > 0) {
+            warnings.forEach(warning => {
+                this.logger.warn('[validate] Warning: %s', warning);
+            });
+        }
+        return { valid: isValid, errors, warnings };
+    }
+    /**
+     * Validate available scopes configuration
+     */
+    validateAvailableScopes(scopes, errors, warnings) {
+        const identifiers = new Set();
+        for (const scope of scopes) {
+            // Check for duplicate identifiers
+            if (identifiers.has(scope.identifier)) {
+                errors.push({
+                    field: 'availableScopes',
+                    message: `Duplicate scope identifier: ${scope.identifier}`,
+                    scopeIdentifier: scope.identifier,
+                });
+            }
+            identifiers.add(scope.identifier);
+            // Validate identifier format
+            if (!scope.identifier || scope.identifier.trim() === '') {
+                errors.push({
+                    field: 'availableScopes',
+                    message: 'Scope identifier cannot be empty',
+                    scopeIdentifier: scope.identifier,
+                });
+            }
+            // Validate name
+            if (!scope.name || scope.name.trim() === '') {
+                errors.push({
+                    field: 'availableScopes',
+                    message: `Scope name cannot be empty for identifier: ${scope.identifier}`,
+                    scopeIdentifier: scope.identifier,
+                });
+            }
+            // Check if scope has either fields or relations
+            if ((!scope.fields || scope.fields.length === 0) &&
+                (!scope.relations || scope.relations.length === 0)) {
+                warnings.push(`Scope '${scope.identifier}' has no fields or relations - it will not provide any data`);
+            }
+            // Validate relations
+            if (scope.relations) {
+                this.validateRelations(scope, errors, warnings);
+            }
+        }
+    }
+    /**
+     * Validate relations in a scope definition
+     */
+    validateRelations(scope, errors, warnings) {
+        const relationNames = new Set();
+        for (const relation of scope.relations) {
+            // Check for duplicate relation names
+            if (relationNames.has(relation.relation)) {
+                errors.push({
+                    field: 'availableScopes.relations',
+                    message: `Duplicate relation name '${relation.relation}' in scope: ${scope.identifier}`,
+                    scopeIdentifier: scope.identifier,
+                });
+            }
+            relationNames.add(relation.relation);
+            // Validate relation name
+            if (!relation.relation || relation.relation.trim() === '') {
+                errors.push({
+                    field: 'availableScopes.relations',
+                    message: `Relation name cannot be empty in scope: ${scope.identifier}`,
+                    scopeIdentifier: scope.identifier,
+                });
+            }
+            // Warn if relation has no fields
+            if (!relation.fields || relation.fields.length === 0) {
+                warnings.push(`Relation '${relation.relation}' in scope '${scope.identifier}' has no fields specified`);
+            }
+        }
+    }
+    /**
+     * Validate default scopes
+     */
+    validateDefaultScopes(defaultScopes, availableScopes, errors, warnings) {
+        if (defaultScopes.length === 0) {
+            warnings.push('Default scopes array is empty');
+            return;
+        }
+        // If no available scopes, can't validate default scopes
+        if (!availableScopes || availableScopes.length === 0) {
+            return;
+        }
+        // Check if default scopes are valid hierarchical scopes
+        for (const defaultScope of defaultScopes) {
+            const parts = defaultScope.split(':');
+            if (parts.length < 3) {
+                errors.push({
+                    field: 'defaultScopes',
+                    message: `Invalid scope format: ${defaultScope} (expected resource:action:path)`,
+                });
+                continue;
+            }
+            const [resource, action, ...path] = parts;
+            // Validate resource
+            if (resource !== constants_1.OAuth2Resources.USER) {
+                errors.push({
+                    field: 'defaultScopes',
+                    message: `Unsupported resource in default scope: ${defaultScope} (only 'user' is supported)`,
+                });
+            }
+            // Validate action
+            if (action !== constants_1.OAuth2Actions.READ) {
+                errors.push({
+                    field: 'defaultScopes',
+                    message: `Unsupported action in default scope: ${defaultScope} (only 'read' is supported)`,
+                });
+            }
+            // Check if path refers to an existing scope identifier
+            if (path.length > 0) {
+                const [firstPart] = path;
+                const isScopeFound = availableScopes.some(s => s.identifier === firstPart);
+                if (!isScopeFound && path.length > 1) {
+                    // Check if it's a valid relation
+                    const isRelationFound = availableScopes.some(s => s.relations?.some(r => r.relation === firstPart));
+                    if (!isRelationFound) {
+                        warnings.push(`Default scope '${defaultScope}' references unknown scope/relation: ${firstPart}`);
+                    }
+                }
+            }
+        }
+    }
+    /**
+     * Validate configuration and throw if invalid
+     * @param config - OAuth2 configuration
+     * @throws Error if configuration is invalid
+     */
+    validateOrThrow(config) {
+        const result = this.validate(config);
+        if (!result.valid) {
+            const errorMessages = result.errors.map(e => `${e.field}: ${e.message}`).join('\n');
+            throw new Error(`Invalid OAuth2 configuration:\n${errorMessages}`);
+        }
+    }
+}
+exports.ScopeConfigValidator = ScopeConfigValidator;
+//# sourceMappingURL=scope-config-validator.js.map

package/dist/components/authenticate/oauth2-handlers/config/scope-config-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-config-validator.js","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/config/scope-config-validator.ts"],"names":[],"mappings":";;;AAAA,uCAA6D;AAE7D,4CAA8D;AAc9D;;;GAGG;AACH,MAAa,oBAAoB;IAG/B,YAAY,IAAwB;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,uBAAa,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,MAAkC;QACzC,MAAM,MAAM,GAAkC,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QAED,4BAA4B;QAC5B,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CACX,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,CAAC,qBAAqB,CACxB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,eAAe,EAC3B,MAAM,EACN,QAAQ,CACT,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;QAEpC,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2FAA2F,EAC3F,QAAQ,CAAC,MAAM,EACf,WAAW,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,EACxC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAChD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAClF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7E,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAA0B,EAC1B,MAAqC,EACrC,QAAkB;QAElB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAEtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,kCAAkC;YAClC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,+BAA+B,KAAK,CAAC,UAAU,EAAE;oBAC1D,eAAe,EAAE,KAAK,CAAC,UAAU;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAElC,6BAA6B;YAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,kCAAkC;oBAC3C,eAAe,EAAE,KAAK,CAAC,UAAU;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,gBAAgB;YAChB,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,8CAA8C,KAAK,CAAC,UAAU,EAAE;oBACzE,eAAe,EAAE,KAAK,CAAC,UAAU;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,gDAAgD;YAChD,IACE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;gBAC5C,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAClD,CAAC;gBACD,QAAQ,CAAC,IAAI,CACX,UAAU,KAAK,CAAC,UAAU,6DAA6D,CACxF,CAAC;YACJ,CAAC;YAED,qBAAqB;YACrB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CACvB,KAAuB,EACvB,MAAqC,EACrC,QAAkB;QAElB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QAExC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAU,EAAE,CAAC;YACxC,qCAAqC;YACrC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,4BAA4B,QAAQ,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,EAAE;oBACvF,eAAe,EAAE,KAAK,CAAC,UAAU;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAErC,yBAAyB;YACzB,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,2BAA2B;oBAClC,OAAO,EAAE,2CAA2C,KAAK,CAAC,UAAU,EAAE;oBACtE,eAAe,EAAE,KAAK,CAAC,UAAU;iBAClC,CAAC,CAAC;YACL,CAAC;YAED,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CACX,aAAa,QAAQ,CAAC,QAAQ,eAAe,KAAK,CAAC,UAAU,2BAA2B,CACzF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAC3B,aAAuB,EACvB,eAA+C,EAC/C,MAAqC,EACrC,QAAkB;QAElB,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,yBAAyB,YAAY,kCAAkC;iBACjF,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;YAE1C,oBAAoB;YACpB,IAAI,QAAQ,KAAK,2BAAe,CAAC,IAAI,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,0CAA0C,YAAY,6BAA6B;iBAC7F,CAAC,CAAC;YACL,CAAC;YAED,kBAAkB;YAClB,IAAI,MAAM,KAAK,yBAAa,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,eAAe;oBACtB,OAAO,EAAE,wCAAwC,YAAY,6BAA6B;iBAC3F,CAAC,CAAC;YACL,CAAC;YAED,uDAAuD;YACvD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;gBACzB,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;gBAE3E,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrC,iCAAiC;oBACjC,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CACjD,CAAC;oBAEF,IAAI,CAAC,eAAe,EAAE,CAAC;wBACrB,QAAQ,CAAC,IAAI,CACX,kBAAkB,YAAY,wCAAwC,SAAS,EAAE,CAClF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,MAAkC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,kCAAkC,aAAa,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF;AA7PD,oDA6PC"}

package/dist/components/authenticate/oauth2-handlers/constants/index.d.ts

@@ -0,0 +1,2 @@
+export * from './scope-constants';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/authenticate/oauth2-handlers/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC"}

package/dist/components/authenticate/oauth2-handlers/constants/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./scope-constants"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/authenticate/oauth2-handlers/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC"}

package/dist/components/authenticate/oauth2-handlers/constants/scope-constants.d.ts

@@ -0,0 +1,79 @@
+export declare const OAuth2Resources: {
+    readonly USER: "user";
+};
+export declare const OAuth2Actions: {
+    readonly READ: "read";
+};
+export declare class ScopeBuilder {
+    private scopes;
+    /**
+     * Add a scope to the builder
+     * @param scope - Scope string (e.g., "user:read:basic")
+     * @returns This builder for chaining
+     */
+    add(scope: string): this;
+    /**
+     * Add multiple scopes at once
+     * @param scopes - Array of scope strings
+     * @returns This builder for chaining
+     */
+    addMultiple(scopes: string[]): this;
+    /**
+     * Build a scope string from resource, action, and path components
+     * @param resource - Resource name (e.g., 'user')
+     * @param action - Action name (e.g., 'read')
+     * @param path - Path components (e.g., ['basic'] or ['profile', 'firstName'])
+     * @returns This builder for chaining
+     */
+    buildScope(resource: string, action: string, ...path: string[]): this;
+    /**
+     * Build the final scope string (space-separated)
+     * @returns Space-separated scope string
+     */
+    build(): string;
+    /**
+     * Get scopes as array
+     * @returns Array of scope strings
+     */
+    toArray(): string[];
+    /**
+     * Clear all scopes
+     * @returns This builder for chaining
+     */
+    clear(): this;
+    /**
+     * Get number of scopes
+     * @returns Number of scopes
+     */
+    count(): number;
+}
+/**
+ * Helper function to create a new scope builder
+ * @returns New ScopeBuilder instance
+ */
+export declare function createScopeBuilder(): ScopeBuilder;
+/**
+ * Helper function to build scope string from array
+ * @param scopes - Array of scope strings
+ * @returns Space-separated scope string
+ */
+export declare function buildScopeString(...scopes: string[]): string;
+/**
+ * Helper function to build a single scope string
+ * @param resource - Resource name
+ * @param action - Action name
+ * @param path - Path components
+ * @returns Scope string in format "resource:action:path1:path2:..."
+ */
+export declare function buildScope(resource: string, action: string, ...path: string[]): string;
+/**
+ * Helper function to parse scope string into components
+ * @param scope - Scope string (e.g., "user:read:basic")
+ * @returns Object with resource, action, and path components or null if invalid
+ */
+export declare function parseScopeString(scope: string): {
+    resource: string;
+    action: string;
+    path: string[];
+} | null;
+//# sourceMappingURL=scope-constants.d.ts.map

package/dist/components/authenticate/oauth2-handlers/constants/scope-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-constants.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/constants/scope-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;;CAElB,CAAC;AAEX,eAAO,MAAM,aAAa;;CAEhB,CAAC;AAEX,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAA0B;IAExC;;;;OAIG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAKxB;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAKnC;;;;;;OAMG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI;IAMrE;;;OAGG;IACH,KAAK,IAAI,MAAM;IAIf;;;OAGG;IACH,OAAO,IAAI,MAAM,EAAE;IAInB;;;OAGG;IACH,KAAK,IAAI,IAAI;IAKb;;;OAGG;IACH,KAAK,IAAI,MAAM;CAGhB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,IAAI,CAOP"}

package/dist/components/authenticate/oauth2-handlers/constants/scope-constants.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeBuilder = exports.OAuth2Actions = exports.OAuth2Resources = void 0;
+exports.createScopeBuilder = createScopeBuilder;
+exports.buildScopeString = buildScopeString;
+exports.buildScope = buildScope;
+exports.parseScopeString = parseScopeString;
+exports.OAuth2Resources = {
+    USER: 'user',
+};
+exports.OAuth2Actions = {
+    READ: 'read',
+};
+class ScopeBuilder {
+    constructor() {
+        this.scopes = new Set();
+    }
+    /**
+     * Add a scope to the builder
+     * @param scope - Scope string (e.g., "user:read:basic")
+     * @returns This builder for chaining
+     */
+    add(scope) {
+        this.scopes.add(scope);
+        return this;
+    }
+    /**
+     * Add multiple scopes at once
+     * @param scopes - Array of scope strings
+     * @returns This builder for chaining
+     */
+    addMultiple(scopes) {
+        scopes.forEach(scope => this.scopes.add(scope));
+        return this;
+    }
+    /**
+     * Build a scope string from resource, action, and path components
+     * @param resource - Resource name (e.g., 'user')
+     * @param action - Action name (e.g., 'read')
+     * @param path - Path components (e.g., ['basic'] or ['profile', 'firstName'])
+     * @returns This builder for chaining
+     */
+    buildScope(resource, action, ...path) {
+        const scope = [resource, action, ...path].join(':');
+        this.scopes.add(scope);
+        return this;
+    }
+    /**
+     * Build the final scope string (space-separated)
+     * @returns Space-separated scope string
+     */
+    build() {
+        return Array.from(this.scopes).join(' ');
+    }
+    /**
+     * Get scopes as array
+     * @returns Array of scope strings
+     */
+    toArray() {
+        return Array.from(this.scopes);
+    }
+    /**
+     * Clear all scopes
+     * @returns This builder for chaining
+     */
+    clear() {
+        this.scopes.clear();
+        return this;
+    }
+    /**
+     * Get number of scopes
+     * @returns Number of scopes
+     */
+    count() {
+        return this.scopes.size;
+    }
+}
+exports.ScopeBuilder = ScopeBuilder;
+/**
+ * Helper function to create a new scope builder
+ * @returns New ScopeBuilder instance
+ */
+function createScopeBuilder() {
+    return new ScopeBuilder();
+}
+/**
+ * Helper function to build scope string from array
+ * @param scopes - Array of scope strings
+ * @returns Space-separated scope string
+ */
+function buildScopeString(...scopes) {
+    return scopes.join(' ');
+}
+/**
+ * Helper function to build a single scope string
+ * @param resource - Resource name
+ * @param action - Action name
+ * @param path - Path components
+ * @returns Scope string in format "resource:action:path1:path2:..."
+ */
+function buildScope(resource, action, ...path) {
+    return [resource, action, ...path].join(':');
+}
+/**
+ * Helper function to parse scope string into components
+ * @param scope - Scope string (e.g., "user:read:basic")
+ * @returns Object with resource, action, and path components or null if invalid
+ */
+function parseScopeString(scope) {
+    const parts = scope.split(':');
+    if (parts.length < 3) {
+        return null;
+    }
+    const [resource, action, ...path] = parts;
+    return { resource, action, path };
+}
+//# sourceMappingURL=scope-constants.js.map

package/dist/components/authenticate/oauth2-handlers/constants/scope-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-constants.js","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/constants/scope-constants.ts"],"names":[],"mappings":";;;AAkFA,gDAEC;AAOD,4CAEC;AASD,gCAEC;AAOD,4CAWC;AA1HY,QAAA,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEE,QAAA,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;CACJ,CAAC;AAEX,MAAa,YAAY;IAAzB;QACU,WAAM,GAAgB,IAAI,GAAG,EAAE,CAAC;IAmE1C,CAAC;IAjEC;;;;OAIG;IACH,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,MAAgB;QAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,GAAG,IAAc;QAC5D,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AApED,oCAoEC;AAED;;;GAGG;AACH,SAAgB,kBAAkB;IAChC,OAAO,IAAI,YAAY,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,GAAG,MAAgB;IAClD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,GAAG,IAAc;IAC5E,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,KAAa;IAK5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/dist/components/authenticate/oauth2-handlers/data/index.d.ts

@@ -0,0 +1,2 @@
+export * from './user-data-fetcher';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/authenticate/oauth2-handlers/data/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/data/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/components/authenticate/oauth2-handlers/data/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./user-data-fetcher"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/authenticate/oauth2-handlers/data/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/data/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}

package/dist/components/authenticate/oauth2-handlers/data/user-data-fetcher.d.ts

@@ -0,0 +1,99 @@
+import { AnyObject, IdType, TInjectionGetter } from '../../../../common';
+import { ScopeManager } from '../scope';
+export interface IUserDataFetcherOptions {
+    injectionGetter: TInjectionGetter;
+    scopeManager: ScopeManager;
+}
+export interface IFetchByScopes {
+    userId: IdType;
+    grantedScopes: string[];
+}
+export declare class UserDataFetcher {
+    private logger;
+    private injectionGetter;
+    private userRepositoryKey;
+    private scopeManager;
+    private relationMetadata;
+    constructor(opts: {
+        options: IUserDataFetcherOptions;
+        scope?: string;
+    });
+    /**
+     * Build relation metadata from available scopes configuration
+     * Extracts relation type and groupBy settings from scope definitions
+     * @returns Map of relation name to metadata
+     */
+    private buildRelationMetadata;
+    /**
+     * Fetch user data based on granted scopes
+     * Builds a single optimized query to UserRepository
+     * @param options - Fetch options containing userId and granted scopes
+     * @returns User data object
+     */
+    fetchByScopes(options: IFetchByScopes): Promise<AnyObject>;
+    /**
+     * Build query structure from granted scopes
+     * Determines which base fields and relations to fetch
+     * @param scopes - Array of granted scope strings
+     * @returns Query structure with base fields and relation includes
+     */
+    private buildQueryStructure;
+    /**
+     * Process a single scope path
+     * Determines if it's a base field, relation field, or scope group
+     * @param path - Scope path array
+     * @param relationFieldsMap - Map to collect relation fields
+     * @param baseFieldsSet - Set to collect base fields
+     */
+    private processScope;
+    /**
+     * Expand a scope group into base fields and relations
+     * @param scopeGroup - Scope group definition
+     * @param relationFieldsMap - Map to collect relation fields
+     * @param baseFieldsSet - Set to collect base fields
+     */
+    private expandScopeGroup;
+    /**
+     * Execute repository query with built structure
+     * @param userId - User ID to fetch
+     * @param structure - Query structure with fields and relations
+     * @returns User data object or null
+     */
+    private executeQuery;
+    /**
+     * Fetch minimal user data (just ID)
+     * @param userId - User ID
+     * @returns User object with ID only
+     */
+    fetchMinimal(userId: IdType): Promise<AnyObject>;
+    /**
+     * Flatten user data by removing internal fields and flattening relations
+     * - Base fields and primitives are kept as-is
+     * - hasOne relations are flattened with configured prefix
+     * - hasMany relations are grouped by configured field with prefix
+     * @param obj - Raw user object from repository
+     * @returns Flattened user data object
+     */
+    private flattenUserData;
+    /**
+     * Check if value is a valid object for processing
+     */
+    private isValidObject;
+    /**
+     * Check if a value is a primitive (non-object) type
+     */
+    private isPrimitive;
+    /**
+     * Add base fields from the user object
+     */
+    private addBaseFields;
+    /**
+     * Flatten hasOne relation with configured prefix
+     */
+    private flattenHasOneRelation;
+    /**
+     * Flatten hasMany relation grouped by configured field with prefix
+     */
+    private flattenHasManyRelation;
+}
+//# sourceMappingURL=user-data-fetcher.d.ts.map

package/dist/components/authenticate/oauth2-handlers/data/user-data-fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-data-fetcher.d.ts","sourceRoot":"","sources":["../../../../../src/components/authenticate/oauth2-handlers/data/user-data-fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAiB,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAIvF,OAAO,EAAqB,YAAY,EAAE,MAAM,UAAU,CAAC;AAG3D,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAYD,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAiC;gBAE7C,IAAI,EAAE;QAAE,OAAO,EAAE,uBAAuB,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAkBtE;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAoC7B;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC;IA4ChE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAyC3B;;;;;;OAMG;IACH,OAAO,CAAC,YAAY;IA8DpB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAyBxB;;;;;OAKG;YACW,YAAY;IA2C1B;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAmBtD;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAkCvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,OAAO,CAAC,aAAa;IAuBrB;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAgC7B;;OAEG;IACH,OAAO,CAAC,sBAAsB;CA8C/B"}