@hilbras/keystone 1.6.0 → 2.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +625 -0
- package/README.md +198 -50
- package/dist/cli.js +25 -27
- package/dist/cli.js.map +1 -1
- package/dist/config.d.ts +23 -1
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +53 -8
- package/dist/config.js.map +1 -1
- package/dist/container.d.ts +4 -1
- package/dist/container.d.ts.map +1 -1
- package/dist/container.js.map +1 -1
- package/dist/db/migrations/0008_flashy_firestar.sql +5 -0
- package/dist/db/migrations/0009_daffy_changeling.sql +1 -0
- package/dist/db/migrations/0010_wealthy_shadow_king.sql +37 -0
- package/dist/db/migrations/0011_overrated_vector.sql +18 -0
- package/dist/db/migrations/0012_brave_darkhawk.sql +28 -0
- package/dist/db/migrations/0013_wonderful_chimera.sql +5 -0
- package/dist/db/migrations/0014_magical_morph.sql +48 -0
- package/dist/db/migrations/0015_chief_vargas.sql +7 -0
- package/dist/db/migrations/0016_gorgeous_charles_xavier.sql +5 -0
- package/dist/db/migrations/0017_flashy_nekra.sql +1 -0
- package/{src/db/migrations/meta/0007_snapshot.json → dist/db/migrations/meta/0008_snapshot.json} +136 -32
- package/{src/db/migrations/meta/0006_snapshot.json → dist/db/migrations/meta/0009_snapshot.json} +359 -30
- package/{src/db/migrations/meta/0005_snapshot.json → dist/db/migrations/meta/0010_snapshot.json} +459 -29
- package/{src/db/migrations/meta/0004_snapshot.json → dist/db/migrations/meta/0011_snapshot.json} +594 -30
- package/dist/db/migrations/meta/0012_snapshot.json +3891 -0
- package/dist/db/migrations/meta/0013_snapshot.json +3919 -0
- package/dist/db/migrations/meta/0014_snapshot.json +4311 -0
- package/dist/db/migrations/meta/0015_snapshot.json +4340 -0
- package/dist/db/migrations/meta/0016_snapshot.json +4363 -0
- package/dist/db/migrations/meta/0017_snapshot.json +4370 -0
- package/dist/db/migrations/meta/_journal.json +70 -0
- package/dist/db/reencryptOidcSecrets.d.ts +2 -0
- package/dist/db/reencryptOidcSecrets.d.ts.map +1 -0
- package/dist/db/reencryptOidcSecrets.js +41 -0
- package/dist/db/reencryptOidcSecrets.js.map +1 -0
- package/dist/db/schema.d.ts +2693 -88
- package/dist/db/schema.d.ts.map +1 -1
- package/dist/db/schema.js +157 -4
- package/dist/db/schema.js.map +1 -1
- package/dist/db/seed.js +67 -40
- package/dist/db/seed.js.map +1 -1
- package/dist/di.d.ts.map +1 -1
- package/dist/di.js +11 -3
- package/dist/di.js.map +1 -1
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +34 -3
- package/dist/index.js.map +1 -1
- package/dist/lib/errors.d.ts +2 -1
- package/dist/lib/errors.d.ts.map +1 -1
- package/dist/lib/errors.js +10 -0
- package/dist/lib/errors.js.map +1 -1
- package/dist/plugins/appContext.d.ts.map +1 -1
- package/dist/plugins/appContext.js +3 -12
- package/dist/plugins/appContext.js.map +1 -1
- package/dist/plugins/audit.d.ts.map +1 -1
- package/dist/plugins/audit.js +26 -6
- package/dist/plugins/audit.js.map +1 -1
- package/dist/plugins/auth.d.ts.map +1 -1
- package/dist/plugins/auth.js +32 -7
- package/dist/plugins/auth.js.map +1 -1
- package/dist/plugins/headerSanitization.d.ts +15 -0
- package/dist/plugins/headerSanitization.d.ts.map +1 -0
- package/dist/plugins/headerSanitization.js +39 -0
- package/dist/plugins/headerSanitization.js.map +1 -0
- package/dist/plugins/metrics.d.ts.map +1 -1
- package/dist/plugins/mtls.d.ts +21 -2
- package/dist/plugins/mtls.d.ts.map +1 -1
- package/dist/plugins/mtls.js +94 -47
- package/dist/plugins/mtls.js.map +1 -1
- package/dist/plugins/permissions.d.ts.map +1 -1
- package/dist/plugins/permissions.js +29 -9
- package/dist/plugins/permissions.js.map +1 -1
- package/dist/plugins/rateLimit.d.ts +16 -0
- package/dist/plugins/rateLimit.d.ts.map +1 -1
- package/dist/plugins/rateLimit.js +16 -3
- package/dist/plugins/rateLimit.js.map +1 -1
- package/dist/plugins/requestLogger.d.ts.map +1 -1
- package/dist/repositories/apiKey.d.ts.map +1 -1
- package/dist/repositories/application.d.ts +1 -1
- package/dist/repositories/application.d.ts.map +1 -1
- package/dist/repositories/application.js +9 -3
- package/dist/repositories/application.js.map +1 -1
- package/dist/repositories/audit.d.ts.map +1 -1
- package/dist/repositories/index.d.ts +3 -0
- package/dist/repositories/index.d.ts.map +1 -1
- package/dist/repositories/index.js +3 -0
- package/dist/repositories/index.js.map +1 -1
- package/dist/repositories/mfaChallenge.d.ts +23 -0
- package/dist/repositories/mfaChallenge.d.ts.map +1 -0
- package/dist/repositories/mfaChallenge.js +71 -0
- package/dist/repositories/mfaChallenge.js.map +1 -0
- package/dist/repositories/oidcConnection.d.ts +27 -43
- package/dist/repositories/oidcConnection.d.ts.map +1 -1
- package/dist/repositories/oidcConnection.js +15 -6
- package/dist/repositories/oidcConnection.js.map +1 -1
- package/dist/repositories/organization.d.ts +9 -9
- package/dist/repositories/organization.d.ts.map +1 -1
- package/dist/repositories/organization.js +91 -37
- package/dist/repositories/organization.js.map +1 -1
- package/dist/repositories/permission.d.ts.map +1 -1
- package/dist/repositories/permission.js +27 -5
- package/dist/repositories/permission.js.map +1 -1
- package/dist/repositories/samlConnection.d.ts +28 -28
- package/dist/repositories/samlConnection.d.ts.map +1 -1
- package/dist/repositories/samlConnection.js +12 -4
- package/dist/repositories/samlConnection.js.map +1 -1
- package/dist/repositories/scimConnection.d.ts +38 -0
- package/dist/repositories/scimConnection.d.ts.map +1 -0
- package/dist/repositories/scimConnection.js +123 -0
- package/dist/repositories/scimConnection.js.map +1 -0
- package/dist/repositories/scimGroup.d.ts +36 -0
- package/dist/repositories/scimGroup.d.ts.map +1 -0
- package/dist/repositories/scimGroup.js +113 -0
- package/dist/repositories/scimGroup.js.map +1 -0
- package/dist/repositories/session.d.ts +24 -13
- package/dist/repositories/session.d.ts.map +1 -1
- package/dist/repositories/session.js +13 -1
- package/dist/repositories/session.js.map +1 -1
- package/dist/repositories/types.d.ts +117 -6
- package/dist/repositories/types.d.ts.map +1 -1
- package/dist/repositories/types.js +7 -1
- package/dist/repositories/types.js.map +1 -1
- package/dist/repositories/user.d.ts +23 -1
- package/dist/repositories/user.d.ts.map +1 -1
- package/dist/repositories/user.js +180 -4
- package/dist/repositories/user.js.map +1 -1
- package/dist/routes/admin/billing.js +4 -4
- package/dist/routes/admin/billing.js.map +1 -1
- package/dist/routes/admin/helpers.d.ts +16 -20
- package/dist/routes/admin/helpers.d.ts.map +1 -1
- package/dist/routes/admin/helpers.js +53 -10
- package/dist/routes/admin/helpers.js.map +1 -1
- package/dist/routes/admin/organizations.d.ts.map +1 -1
- package/dist/routes/admin/organizations.js +105 -69
- package/dist/routes/admin/organizations.js.map +1 -1
- package/dist/routes/admin/permissions.d.ts.map +1 -1
- package/dist/routes/admin/permissions.js +48 -14
- package/dist/routes/admin/permissions.js.map +1 -1
- package/dist/routes/admin/platform.d.ts.map +1 -1
- package/dist/routes/admin/platform.js +86 -35
- package/dist/routes/admin/platform.js.map +1 -1
- package/dist/routes/admin/sso.d.ts.map +1 -1
- package/dist/routes/admin/sso.js +143 -12
- package/dist/routes/admin/sso.js.map +1 -1
- package/dist/routes/admin/webhooks.js +8 -8
- package/dist/routes/admin/webhooks.js.map +1 -1
- package/dist/routes/apiKeys.d.ts.map +1 -1
- package/dist/routes/apiKeys.js +23 -5
- package/dist/routes/apiKeys.js.map +1 -1
- package/dist/routes/auth.d.ts.map +1 -1
- package/dist/routes/auth.js +112 -22
- package/dist/routes/auth.js.map +1 -1
- package/dist/routes/authz.d.ts.map +1 -1
- package/dist/routes/authz.js +16 -4
- package/dist/routes/authz.js.map +1 -1
- package/dist/routes/config.d.ts.map +1 -1
- package/dist/routes/config.js +16 -14
- package/dist/routes/config.js.map +1 -1
- package/dist/routes/federation.d.ts.map +1 -1
- package/dist/routes/federation.js +17 -3
- package/dist/routes/federation.js.map +1 -1
- package/dist/routes/magicLinks.d.ts.map +1 -1
- package/dist/routes/magicLinks.js +15 -3
- package/dist/routes/magicLinks.js.map +1 -1
- package/dist/routes/oauth.d.ts.map +1 -1
- package/dist/routes/oauth.js +60 -5
- package/dist/routes/oauth.js.map +1 -1
- package/dist/routes/oauth2.d.ts.map +1 -1
- package/dist/routes/oauth2.js +188 -22
- package/dist/routes/oauth2.js.map +1 -1
- package/dist/routes/oidcEnterprise.d.ts.map +1 -1
- package/dist/routes/oidcEnterprise.js +67 -21
- package/dist/routes/oidcEnterprise.js.map +1 -1
- package/dist/routes/password.d.ts.map +1 -1
- package/dist/routes/password.js.map +1 -1
- package/dist/routes/profile.js +4 -4
- package/dist/routes/profile.js.map +1 -1
- package/dist/routes/saml.d.ts +33 -0
- package/dist/routes/saml.d.ts.map +1 -1
- package/dist/routes/saml.js +217 -12
- package/dist/routes/saml.js.map +1 -1
- package/dist/routes/scim.d.ts +13 -0
- package/dist/routes/scim.d.ts.map +1 -1
- package/dist/routes/scim.js +885 -110
- package/dist/routes/scim.js.map +1 -1
- package/dist/routes/sdk.d.ts.map +1 -1
- package/dist/routes/sdk.js +24 -8
- package/dist/routes/sdk.js.map +1 -1
- package/dist/routes/serviceAccounts.d.ts.map +1 -1
- package/dist/routes/serviceAccounts.js +63 -2
- package/dist/routes/serviceAccounts.js.map +1 -1
- package/dist/routes/setup.d.ts.map +1 -1
- package/dist/routes/setup.js +15 -16
- package/dist/routes/setup.js.map +1 -1
- package/dist/routes/smsOtp.js +1 -1
- package/dist/routes/smsOtp.js.map +1 -1
- package/dist/routes/totp.d.ts.map +1 -1
- package/dist/routes/totp.js +112 -23
- package/dist/routes/totp.js.map +1 -1
- package/dist/routes/webauthn.d.ts.map +1 -1
- package/dist/routes/webauthn.js +44 -8
- package/dist/routes/webauthn.js.map +1 -1
- package/dist/routes/workflows.d.ts.map +1 -1
- package/dist/routes/workflows.js +58 -25
- package/dist/routes/workflows.js.map +1 -1
- package/dist/sdk/index.d.ts.map +1 -1
- package/dist/sdk/index.js +141 -40
- package/dist/sdk/index.js.map +1 -1
- package/dist/sdk/types.d.ts +64 -30
- package/dist/sdk/types.d.ts.map +1 -1
- package/dist/services/application/authentication.d.ts +39 -1
- package/dist/services/application/authentication.d.ts.map +1 -1
- package/dist/services/application/authentication.js +43 -1
- package/dist/services/application/authentication.js.map +1 -1
- package/dist/services/application/identity.d.ts +10 -7
- package/dist/services/application/identity.d.ts.map +1 -1
- package/dist/services/application/identity.js +13 -10
- package/dist/services/application/identity.js.map +1 -1
- package/dist/services/application/organization.d.ts +16 -8
- package/dist/services/application/organization.d.ts.map +1 -1
- package/dist/services/application/organization.js +160 -12
- package/dist/services/application/organization.js.map +1 -1
- package/dist/services/applications.js +2 -2
- package/dist/services/applications.js.map +1 -1
- package/dist/services/audit.d.ts +1 -0
- package/dist/services/audit.d.ts.map +1 -1
- package/dist/services/audit.js +13 -0
- package/dist/services/audit.js.map +1 -1
- package/dist/services/cache.d.ts.map +1 -1
- package/dist/services/configuration/profiles.d.ts +4 -0
- package/dist/services/configuration/profiles.d.ts.map +1 -1
- package/dist/services/configuration/profiles.js +50 -0
- package/dist/services/configuration/profiles.js.map +1 -1
- package/dist/services/configuration.d.ts.map +1 -1
- package/dist/services/configuration.js.map +1 -1
- package/dist/services/connectors/google.d.ts +18 -1
- package/dist/services/connectors/google.d.ts.map +1 -1
- package/dist/services/connectors/google.js +27 -4
- package/dist/services/connectors/google.js.map +1 -1
- package/dist/services/connectors/oidc.d.ts +14 -2
- package/dist/services/connectors/oidc.d.ts.map +1 -1
- package/dist/services/connectors/oidc.js +35 -6
- package/dist/services/connectors/oidc.js.map +1 -1
- package/dist/services/connectors/types.d.ts +13 -1
- package/dist/services/connectors/types.d.ts.map +1 -1
- package/dist/services/connectors/zitadel.d.ts.map +1 -1
- package/dist/services/connectors/zitadel.js +4 -3
- package/dist/services/connectors/zitadel.js.map +1 -1
- package/dist/services/domain/authentication.d.ts +43 -4
- package/dist/services/domain/authentication.d.ts.map +1 -1
- package/dist/services/domain/authentication.js +119 -40
- package/dist/services/domain/authentication.js.map +1 -1
- package/dist/services/domain/authorization.d.ts +11 -0
- package/dist/services/domain/authorization.d.ts.map +1 -1
- package/dist/services/domain/authorization.js +36 -1
- package/dist/services/domain/authorization.js.map +1 -1
- package/dist/services/domain/identity.d.ts +21 -9
- package/dist/services/domain/identity.d.ts.map +1 -1
- package/dist/services/domain/identity.js +187 -10
- package/dist/services/domain/identity.js.map +1 -1
- package/dist/services/domain/organization.d.ts +11 -10
- package/dist/services/domain/organization.d.ts.map +1 -1
- package/dist/services/domain/organization.js +48 -30
- package/dist/services/domain/organization.js.map +1 -1
- package/dist/services/emailVerification.d.ts +2 -2
- package/dist/services/enterpriseSso.d.ts +13 -6
- package/dist/services/enterpriseSso.d.ts.map +1 -1
- package/dist/services/enterpriseSso.js +75 -6
- package/dist/services/enterpriseSso.js.map +1 -1
- package/dist/services/events/subscribers/auditLog.js +1 -1
- package/dist/services/events/subscribers/auditLog.js.map +1 -1
- package/dist/services/events/types.d.ts +7 -1
- package/dist/services/events/types.d.ts.map +1 -1
- package/dist/services/events/types.js.map +1 -1
- package/dist/services/events/validate.d.ts.map +1 -1
- package/dist/services/events/validate.js +33 -0
- package/dist/services/events/validate.js.map +1 -1
- package/dist/services/features.d.ts.map +1 -1
- package/dist/services/features.js.map +1 -1
- package/dist/services/federation.d.ts +6 -1
- package/dist/services/federation.d.ts.map +1 -1
- package/dist/services/federation.js +31 -4
- package/dist/services/federation.js.map +1 -1
- package/dist/services/ipControls.js +2 -2
- package/dist/services/ipControls.js.map +1 -1
- package/dist/services/magicLinks.d.ts +2 -2
- package/dist/services/magicLinks.d.ts.map +1 -1
- package/dist/services/magicLinks.js +13 -9
- package/dist/services/magicLinks.js.map +1 -1
- package/dist/services/mfa.d.ts +53 -0
- package/dist/services/mfa.d.ts.map +1 -0
- package/dist/services/mfa.js +157 -0
- package/dist/services/mfa.js.map +1 -0
- package/dist/services/oauth2.d.ts +88 -14
- package/dist/services/oauth2.d.ts.map +1 -1
- package/dist/services/oauth2.js +125 -16
- package/dist/services/oauth2.js.map +1 -1
- package/dist/services/oidcSecretFormat.d.ts +3 -0
- package/dist/services/oidcSecretFormat.d.ts.map +1 -0
- package/dist/services/oidcSecretFormat.js +5 -0
- package/dist/services/oidcSecretFormat.js.map +1 -0
- package/dist/services/organizations.d.ts +4 -16
- package/dist/services/organizations.d.ts.map +1 -1
- package/dist/services/organizations.js +0 -62
- package/dist/services/organizations.js.map +1 -1
- package/dist/services/permissions.d.ts.map +1 -1
- package/dist/services/permissions.js +9 -1
- package/dist/services/permissions.js.map +1 -1
- package/dist/services/plugins/registry.d.ts.map +1 -1
- package/dist/services/plugins/registry.js.map +1 -1
- package/dist/services/plugins/types.d.ts.map +1 -1
- package/dist/services/queue/bullmq.d.ts.map +1 -1
- package/dist/services/queue/inProcess.d.ts.map +1 -1
- package/dist/services/redirectUri.d.ts +56 -0
- package/dist/services/redirectUri.d.ts.map +1 -0
- package/dist/services/redirectUri.js +129 -0
- package/dist/services/redirectUri.js.map +1 -0
- package/dist/services/redis.d.ts +1 -1
- package/dist/services/redis.d.ts.map +1 -1
- package/dist/services/scimCredentials.d.ts +46 -0
- package/dist/services/scimCredentials.d.ts.map +1 -0
- package/dist/services/scimCredentials.js +123 -0
- package/dist/services/scimCredentials.js.map +1 -0
- package/dist/services/scimLegacyMigration.d.ts +12 -0
- package/dist/services/scimLegacyMigration.d.ts.map +1 -0
- package/dist/services/scimLegacyMigration.js +44 -0
- package/dist/services/scimLegacyMigration.js.map +1 -0
- package/dist/services/secrets/awsKms.d.ts +2 -2
- package/dist/services/secrets/awsKms.d.ts.map +1 -1
- package/dist/services/secrets/awsKms.js +3 -5
- package/dist/services/secrets/awsKms.js.map +1 -1
- package/dist/services/secrets/azureKeyVault.d.ts.map +1 -1
- package/dist/services/secrets/database.d.ts.map +1 -1
- package/dist/services/secrets/database.js.map +1 -1
- package/dist/services/secrets/environment.d.ts.map +1 -1
- package/dist/services/secrets/environment.js.map +1 -1
- package/dist/services/secrets/index.d.ts.map +1 -1
- package/dist/services/secrets/password.d.ts.map +1 -1
- package/dist/services/secrets/password.js +0 -4
- package/dist/services/secrets/password.js.map +1 -1
- package/dist/services/secrets/provider.d.ts +2 -3
- package/dist/services/secrets/provider.d.ts.map +1 -1
- package/dist/services/secrets/vault.d.ts.map +1 -1
- package/dist/services/serviceAccounts.d.ts +20 -0
- package/dist/services/serviceAccounts.d.ts.map +1 -1
- package/dist/services/serviceAccounts.js +47 -1
- package/dist/services/serviceAccounts.js.map +1 -1
- package/dist/services/sessionRevocation.d.ts +76 -0
- package/dist/services/sessionRevocation.d.ts.map +1 -0
- package/dist/services/sessionRevocation.js +86 -0
- package/dist/services/sessionRevocation.js.map +1 -0
- package/dist/services/setup/configWriter.d.ts.map +1 -1
- package/dist/services/setup/configWriter.js.map +1 -1
- package/dist/services/singleUse.d.ts +68 -0
- package/dist/services/singleUse.d.ts.map +1 -0
- package/dist/services/singleUse.js +54 -0
- package/dist/services/singleUse.js.map +1 -0
- package/dist/services/smsOtp.d.ts.map +1 -1
- package/dist/services/smsOtp.js +12 -8
- package/dist/services/smsOtp.js.map +1 -1
- package/dist/services/ssoEndpointPolicy.d.ts +8 -0
- package/dist/services/ssoEndpointPolicy.d.ts.map +1 -0
- package/dist/services/ssoEndpointPolicy.js +136 -0
- package/dist/services/ssoEndpointPolicy.js.map +1 -0
- package/dist/services/stepUp.d.ts +35 -0
- package/dist/services/stepUp.d.ts.map +1 -0
- package/dist/services/stepUp.js +65 -0
- package/dist/services/stepUp.js.map +1 -0
- package/dist/services/tokens.d.ts +39 -11
- package/dist/services/tokens.d.ts.map +1 -1
- package/dist/services/tokens.js +80 -14
- package/dist/services/tokens.js.map +1 -1
- package/dist/services/totp.d.ts +46 -0
- package/dist/services/totp.d.ts.map +1 -1
- package/dist/services/totp.js +178 -41
- package/dist/services/totp.js.map +1 -1
- package/dist/services/trustedProxies.d.ts +90 -0
- package/dist/services/trustedProxies.d.ts.map +1 -0
- package/dist/services/trustedProxies.js +283 -0
- package/dist/services/trustedProxies.js.map +1 -0
- package/dist/services/users.d.ts +20 -12
- package/dist/services/users.d.ts.map +1 -1
- package/dist/services/users.js +24 -51
- package/dist/services/users.js.map +1 -1
- package/dist/services/webauthn.d.ts +8 -4
- package/dist/services/webauthn.d.ts.map +1 -1
- package/dist/services/webauthn.js +4 -4
- package/dist/services/webauthn.js.map +1 -1
- package/dist/services/webhooks.d.ts +20 -20
- package/dist/services/workflows/engine.d.ts +4 -2
- package/dist/services/workflows/engine.d.ts.map +1 -1
- package/dist/services/workflows/engine.js +181 -12
- package/dist/services/workflows/engine.js.map +1 -1
- package/dist/services/workflows/steps.d.ts +2 -0
- package/dist/services/workflows/steps.d.ts.map +1 -1
- package/dist/services/workflows/steps.js +8 -75
- package/dist/services/workflows/steps.js.map +1 -1
- package/dist/setup-server.js +2 -1
- package/dist/setup-server.js.map +1 -1
- package/dist/types.d.ts +33 -4
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +26 -2
- package/dist/types.js.map +1 -1
- package/package.json +25 -3
- package/dist/tests/errors.test.d.ts +0 -2
- package/dist/tests/errors.test.d.ts.map +0 -1
- package/dist/tests/errors.test.js +0 -64
- package/dist/tests/errors.test.js.map +0 -1
- package/dist/tests/events.test.d.ts +0 -2
- package/dist/tests/events.test.d.ts.map +0 -1
- package/dist/tests/events.test.js +0 -45
- package/dist/tests/events.test.js.map +0 -1
- package/dist/tests/featureFlags.test.d.ts +0 -2
- package/dist/tests/featureFlags.test.d.ts.map +0 -1
- package/dist/tests/featureFlags.test.js +0 -24
- package/dist/tests/featureFlags.test.js.map +0 -1
- package/dist/tests/integration/queue.test.d.ts +0 -2
- package/dist/tests/integration/queue.test.d.ts.map +0 -1
- package/dist/tests/integration/queue.test.js +0 -49
- package/dist/tests/integration/queue.test.js.map +0 -1
- package/dist/tests/plugins.test.d.ts +0 -2
- package/dist/tests/plugins.test.d.ts.map +0 -1
- package/dist/tests/plugins.test.js +0 -56
- package/dist/tests/plugins.test.js.map +0 -1
- package/dist/tests/result.test.d.ts +0 -2
- package/dist/tests/result.test.d.ts.map +0 -1
- package/dist/tests/result.test.js +0 -46
- package/dist/tests/result.test.js.map +0 -1
- package/dist/tests/setup/configWriter.test.d.ts +0 -2
- package/dist/tests/setup/configWriter.test.d.ts.map +0 -1
- package/dist/tests/setup/configWriter.test.js +0 -55
- package/dist/tests/setup/configWriter.test.js.map +0 -1
- package/dist/tests/setup/validation.test.d.ts +0 -2
- package/dist/tests/setup/validation.test.d.ts.map +0 -1
- package/dist/tests/setup/validation.test.js +0 -26
- package/dist/tests/setup/validation.test.js.map +0 -1
- package/dist/tests/smoke.test.d.ts +0 -2
- package/dist/tests/smoke.test.d.ts.map +0 -1
- package/dist/tests/smoke.test.js +0 -124
- package/dist/tests/smoke.test.js.map +0 -1
- package/src/cli.ts +0 -172
- package/src/config.ts +0 -143
- package/src/container.ts +0 -48
- package/src/db/index.ts +0 -53
- package/src/db/migrations/0000_skinny_ben_parker.sql +0 -553
- package/src/db/migrations/0001_brief_joseph.sql +0 -10
- package/src/db/migrations/0002_add_account_lockout.sql +0 -3
- package/src/db/migrations/0003_steep_rachel_grey.sql +0 -1
- package/src/db/migrations/0004_clever_bill_hollister.sql +0 -20
- package/src/db/migrations/0005_steep_the_call.sql +0 -2
- package/src/db/migrations/0006_ambitious_boomer.sql +0 -17
- package/src/db/migrations/0007_greedy_vindicator.sql +0 -40
- package/src/db/migrations/meta/0000_snapshot.json +0 -2964
- package/src/db/migrations/meta/0001_snapshot.json +0 -3031
- package/src/db/migrations/meta/0003_snapshot.json +0 -3051
- package/src/db/migrations/meta/_journal.json +0 -62
- package/src/db/schema.ts +0 -676
- package/src/db/seed.ts +0 -146
- package/src/di.ts +0 -81
- package/src/index.ts +0 -326
- package/src/lib/errors.ts +0 -139
- package/src/lib/result.ts +0 -44
- package/src/lib/webhookSignature.ts +0 -41
- package/src/plugins/appContext.ts +0 -76
- package/src/plugins/audit.ts +0 -42
- package/src/plugins/auth.ts +0 -230
- package/src/plugins/metrics.ts +0 -41
- package/src/plugins/mtls.ts +0 -94
- package/src/plugins/permissions.ts +0 -29
- package/src/plugins/rateLimit.ts +0 -133
- package/src/plugins/requestLogger.ts +0 -25
- package/src/plugins/tracing.ts +0 -22
- package/src/repositories/apiKey.ts +0 -158
- package/src/repositories/application.ts +0 -70
- package/src/repositories/audit.ts +0 -32
- package/src/repositories/index.ts +0 -9
- package/src/repositories/oidcConnection.ts +0 -111
- package/src/repositories/organization.ts +0 -167
- package/src/repositories/permission.ts +0 -153
- package/src/repositories/samlConnection.ts +0 -96
- package/src/repositories/session.ts +0 -86
- package/src/repositories/types.ts +0 -134
- package/src/repositories/user.ts +0 -161
- package/src/routes/admin/billing.ts +0 -48
- package/src/routes/admin/helpers.ts +0 -50
- package/src/routes/admin/index.ts +0 -16
- package/src/routes/admin/organizations.ts +0 -299
- package/src/routes/admin/permissions.ts +0 -80
- package/src/routes/admin/platform.ts +0 -335
- package/src/routes/admin/sso.ts +0 -138
- package/src/routes/admin/webhooks.ts +0 -73
- package/src/routes/admin.ts +0 -1
- package/src/routes/apiKeys.ts +0 -60
- package/src/routes/auth.ts +0 -214
- package/src/routes/authz.ts +0 -38
- package/src/routes/config.ts +0 -67
- package/src/routes/emailVerification.ts +0 -73
- package/src/routes/federation.ts +0 -156
- package/src/routes/helpers.ts +0 -17
- package/src/routes/magicLinks.ts +0 -107
- package/src/routes/oauth.ts +0 -167
- package/src/routes/oauth2.ts +0 -284
- package/src/routes/oidcEnterprise.ts +0 -166
- package/src/routes/password.ts +0 -90
- package/src/routes/profile.ts +0 -44
- package/src/routes/saml.ts +0 -209
- package/src/routes/scim.ts +0 -199
- package/src/routes/sdk.ts +0 -141
- package/src/routes/serviceAccounts.ts +0 -124
- package/src/routes/sessions.ts +0 -62
- package/src/routes/setup.ts +0 -315
- package/src/routes/smsOtp.ts +0 -67
- package/src/routes/totp.ts +0 -122
- package/src/routes/webauthn.ts +0 -147
- package/src/routes/workflows.ts +0 -157
- package/src/sdk/index.ts +0 -152
- package/src/sdk/types.ts +0 -54
- package/src/services/anomalyDetection.ts +0 -73
- package/src/services/application/authentication.ts +0 -75
- package/src/services/application/identity.ts +0 -56
- package/src/services/application/index.ts +0 -3
- package/src/services/application/organization.ts +0 -77
- package/src/services/applications.ts +0 -89
- package/src/services/audit.ts +0 -41
- package/src/services/auditExport.ts +0 -59
- package/src/services/billing.ts +0 -87
- package/src/services/cache.ts +0 -131
- package/src/services/configuration/profiles.ts +0 -115
- package/src/services/configuration.ts +0 -120
- package/src/services/connectors/google.ts +0 -92
- package/src/services/connectors/oidc.ts +0 -111
- package/src/services/connectors/registry.ts +0 -124
- package/src/services/connectors/types.ts +0 -38
- package/src/services/connectors/zitadel.ts +0 -77
- package/src/services/devices.ts +0 -76
- package/src/services/domain/authentication.ts +0 -279
- package/src/services/domain/authorization.ts +0 -49
- package/src/services/domain/identity.ts +0 -108
- package/src/services/domain/index.ts +0 -4
- package/src/services/domain/organization.ts +0 -114
- package/src/services/email.ts +0 -167
- package/src/services/emailVerification.ts +0 -75
- package/src/services/enterpriseSso.ts +0 -58
- package/src/services/events/bus.ts +0 -43
- package/src/services/events/subscribers/anomaly.ts +0 -13
- package/src/services/events/subscribers/auditLog.ts +0 -21
- package/src/services/events/subscribers/webhook.ts +0 -39
- package/src/services/events/subscribers/webhookDispatch.ts +0 -14
- package/src/services/events/types.ts +0 -106
- package/src/services/events/validate.ts +0 -118
- package/src/services/featureFlags.ts +0 -90
- package/src/services/features.ts +0 -22
- package/src/services/federation.ts +0 -30
- package/src/services/hibp.ts +0 -28
- package/src/services/ipControls.ts +0 -99
- package/src/services/magicLinks.ts +0 -51
- package/src/services/oauth2.ts +0 -216
- package/src/services/organizations.ts +0 -171
- package/src/services/permissions.ts +0 -146
- package/src/services/plugins/registry.ts +0 -242
- package/src/services/plugins/types.ts +0 -98
- package/src/services/queue/bullmq.ts +0 -104
- package/src/services/queue/inProcess.ts +0 -75
- package/src/services/queue/index.ts +0 -19
- package/src/services/queue/types.ts +0 -26
- package/src/services/redis.ts +0 -16
- package/src/services/secrets/awsKms.ts +0 -97
- package/src/services/secrets/azureKeyVault.ts +0 -171
- package/src/services/secrets/database.ts +0 -166
- package/src/services/secrets/environment.ts +0 -117
- package/src/services/secrets/index.ts +0 -50
- package/src/services/secrets/password.ts +0 -73
- package/src/services/secrets/provider.ts +0 -36
- package/src/services/secrets/vault.ts +0 -149
- package/src/services/secrets.ts +0 -2
- package/src/services/serviceAccounts.ts +0 -74
- package/src/services/setup/configWriter.ts +0 -200
- package/src/services/setup/diagnostics.ts +0 -76
- package/src/services/setup/token.ts +0 -42
- package/src/services/setup/types.ts +0 -40
- package/src/services/setup/validation.ts +0 -205
- package/src/services/sms.ts +0 -81
- package/src/services/smsOtp.ts +0 -74
- package/src/services/tokens.ts +0 -287
- package/src/services/totp.ts +0 -113
- package/src/services/users.ts +0 -239
- package/src/services/webauthn.ts +0 -193
- package/src/services/webhooks.ts +0 -190
- package/src/services/workflows/engine.ts +0 -125
- package/src/services/workflows/steps.ts +0 -129
- package/src/services/zitadel.ts +0 -277
- package/src/setup-server.ts +0 -71
- package/src/tests/errors.test.ts +0 -74
- package/src/tests/events.test.ts +0 -52
- package/src/tests/featureFlags.test.ts +0 -26
- package/src/tests/integration/queue.test.ts +0 -54
- package/src/tests/plugins.test.ts +0 -73
- package/src/tests/result.test.ts +0 -52
- package/src/tests/setup/configWriter.test.ts +0 -69
- package/src/tests/setup/validation.test.ts +0 -29
- package/src/tests/smoke.test.ts +0 -136
- package/src/types.ts +0 -70
|
@@ -9,19 +9,6 @@ export function slugify(name) {
|
|
|
9
9
|
.replace(/^-+|-+$/g, "")
|
|
10
10
|
.slice(0, 64);
|
|
11
11
|
}
|
|
12
|
-
export async function createOrganization(input) {
|
|
13
|
-
const baseSlug = input.slug || slugify(input.name);
|
|
14
|
-
const slug = await ensureUniqueSlug(baseSlug);
|
|
15
|
-
const [org] = await db
|
|
16
|
-
.insert(organizations)
|
|
17
|
-
.values({
|
|
18
|
-
name: input.name,
|
|
19
|
-
slug,
|
|
20
|
-
plan: input.plan || "free",
|
|
21
|
-
})
|
|
22
|
-
.returning();
|
|
23
|
-
return org;
|
|
24
|
-
}
|
|
25
12
|
export async function findOrganizationById(id) {
|
|
26
13
|
const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
|
|
27
14
|
return org;
|
|
@@ -38,25 +25,6 @@ export async function findOrganizationsByUserId(userId) {
|
|
|
38
25
|
.innerJoin(organizations, eq(orgMemberships.orgId, organizations.id));
|
|
39
26
|
return rows.map((r) => r.org);
|
|
40
27
|
}
|
|
41
|
-
export async function addOrgMembership(input) {
|
|
42
|
-
const [membership] = await db
|
|
43
|
-
.insert(orgMemberships)
|
|
44
|
-
.values({
|
|
45
|
-
orgId: input.orgId,
|
|
46
|
-
userId: input.userId,
|
|
47
|
-
role: input.role,
|
|
48
|
-
})
|
|
49
|
-
.onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] })
|
|
50
|
-
.returning();
|
|
51
|
-
if (membership)
|
|
52
|
-
return membership;
|
|
53
|
-
const [existing] = await db
|
|
54
|
-
.select()
|
|
55
|
-
.from(orgMemberships)
|
|
56
|
-
.where(and(eq(orgMemberships.orgId, input.orgId), eq(orgMemberships.userId, input.userId)))
|
|
57
|
-
.limit(1);
|
|
58
|
-
return existing;
|
|
59
|
-
}
|
|
60
28
|
export async function findMembership(orgId, userId) {
|
|
61
29
|
const [membership] = await db
|
|
62
30
|
.select()
|
|
@@ -65,21 +33,6 @@ export async function findMembership(orgId, userId) {
|
|
|
65
33
|
.limit(1);
|
|
66
34
|
return membership;
|
|
67
35
|
}
|
|
68
|
-
export async function updateMembershipRole(orgId, userId, role) {
|
|
69
|
-
const [updated] = await db
|
|
70
|
-
.update(orgMemberships)
|
|
71
|
-
.set({ role, updatedAt: sql `now()` })
|
|
72
|
-
.where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
|
|
73
|
-
.returning();
|
|
74
|
-
return updated;
|
|
75
|
-
}
|
|
76
|
-
export async function removeMembership(orgId, userId) {
|
|
77
|
-
const deleted = await db
|
|
78
|
-
.delete(orgMemberships)
|
|
79
|
-
.where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
|
|
80
|
-
.returning();
|
|
81
|
-
return deleted.length > 0;
|
|
82
|
-
}
|
|
83
36
|
export async function countOwners(orgId) {
|
|
84
37
|
const rows = await db
|
|
85
38
|
.select({ count: sql `count(*)`.mapWith(Number) })
|
|
@@ -117,19 +70,4 @@ export async function listOrgMembers(orgId) {
|
|
|
117
70
|
.where(eq(orgMemberships.orgId, orgId))
|
|
118
71
|
.innerJoin(users, eq(orgMemberships.userId, users.id));
|
|
119
72
|
}
|
|
120
|
-
async function ensureUniqueSlug(base) {
|
|
121
|
-
let slug = base || "org";
|
|
122
|
-
let counter = 2;
|
|
123
|
-
while (true) {
|
|
124
|
-
const existing = await db
|
|
125
|
-
.select({ id: organizations.id })
|
|
126
|
-
.from(organizations)
|
|
127
|
-
.where(eq(organizations.slug, slug))
|
|
128
|
-
.limit(1);
|
|
129
|
-
if (existing.length === 0)
|
|
130
|
-
return slug;
|
|
131
|
-
slug = `${base}-${counter}`;
|
|
132
|
-
counter++;
|
|
133
|
-
}
|
|
134
|
-
}
|
|
135
73
|
//# sourceMappingURL=organizations.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/services/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAyC,MAAM,iBAAiB,CAAC;AAI9G,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,
|
|
1
|
+
{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/services/organizations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAyC,MAAM,iBAAiB,CAAC;AAI9G,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,WAAW,EAAE;SACb,IAAI,EAAE;SACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAU;IACnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAc;IAC5D,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;SAC9B,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACxC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAc;IAEd,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;SAC1B,MAAM,EAAE;SACR,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAa;IAC7C,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;SACxD,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,KAAa,EACb,YAAuB;IAEvB,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,mCAAmC,CAAmC,CAAC;QAC/F,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAe,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,uCAAuC,CAE9D,CAAC;QACF,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa;IAChD,OAAO,EAAE;SACN,MAAM,CAAC;QACN,UAAU,EAAE,cAAc;QAC1B,IAAI,EAAE;YACJ,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;KACF,CAAC;SACD,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;SACtC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/services/permissions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eAAe,
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/services/permissions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,eAAe,EAsBhD,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CA6B7D,CAAC;AAEF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtE;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAW7D;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAiBjE;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAE7D;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAOhF;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAGlF;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK9F;AAED,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhG;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIpG;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlG;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAOf"}
|
|
@@ -19,6 +19,10 @@ export const DEFAULT_PERMISSIONS = [
|
|
|
19
19
|
{ resource: "api_key", action: "create" },
|
|
20
20
|
{ resource: "api_key", action: "revoke" },
|
|
21
21
|
{ resource: "audit_log", action: "read" },
|
|
22
|
+
{ resource: "sso_connection", action: "read" },
|
|
23
|
+
{ resource: "sso_connection", action: "manage" },
|
|
24
|
+
{ resource: "billing", action: "read" },
|
|
25
|
+
{ resource: "billing", action: "update" },
|
|
22
26
|
];
|
|
23
27
|
export const DEFAULT_ROLE_PERMISSIONS = {
|
|
24
28
|
owner: DEFAULT_PERMISSIONS.map((p) => `${p.resource}:${p.action}`),
|
|
@@ -37,14 +41,18 @@ export const DEFAULT_ROLE_PERMISSIONS = {
|
|
|
37
41
|
"api_key:create",
|
|
38
42
|
"api_key:revoke",
|
|
39
43
|
"audit_log:read",
|
|
44
|
+
"sso_connection:read",
|
|
45
|
+
"sso_connection:manage",
|
|
46
|
+
"billing:read",
|
|
47
|
+
"billing:update",
|
|
40
48
|
],
|
|
41
49
|
member: [
|
|
42
50
|
"organization:read",
|
|
43
51
|
"application:read",
|
|
44
52
|
"service_account:read",
|
|
45
53
|
"api_key:read",
|
|
54
|
+
"sso_connection:read",
|
|
46
55
|
],
|
|
47
|
-
viewer: ["organization:read", "application:read", "audit_log:read"],
|
|
48
56
|
};
|
|
49
57
|
export function permissionKey(resource, action) {
|
|
50
58
|
return `${resource}:${action}`;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/services/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,
|
|
1
|
+
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/services/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAmB,MAAM,iBAAiB,CAAC;AAOhF,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC5C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACtD,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;IAC3C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;IACzC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC9C,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC1C,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAA6B;IAChE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,KAAK,EAAE;QACL,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;QACrB,6BAA6B;QAC7B,kBAAkB;QAClB,oBAAoB;QACpB,oBAAoB;QACpB,sBAAsB;QACtB,wBAAwB;QACxB,wBAAwB;QACxB,cAAc;QACd,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,qBAAqB;QACrB,uBAAuB;QACvB,cAAc;QACd,gBAAgB;KACjB;IACD,MAAM,EAAE;QACN,mBAAmB;QACnB,kBAAkB;QAClB,sBAAsB;QACtB,cAAc;QACd,qBAAqB;KACtB;CACF,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAc;IAC5D,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAExG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACrE,MAAM,aAAa,GAAG,KAAK;aACxB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACtC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAE7C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,MAAM,EAAE;iBACL,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;iBAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;SACnC,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACrC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY;IAC1D,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,YAAoB;IAC7E,MAAM,EAAE;SACL,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAY,EAAE,YAAoB;IAC/E,MAAM,EAAE;SACL,MAAM,CAAC,eAAe,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAA2B;IAC9E,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,QAAgB,EAChB,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,sBAAsB,QAAQ,IAAI,MAAM,EAAE,CAAmC,CAAC;QACtG,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/services/plugins/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/services/plugins/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAyB7C,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAoD3D;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAyDtD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,iBAAiB,CAAC,GAAG,SAAS,CAEvH;AAED,wBAAgB,sBAAsB,IAAI,aAAa,GAAG,SAAS,CAElE;AAED,wBAAgB,oBAAoB,IAAI,WAAW,GAAG,SAAS,CAE9D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAEpF;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,oBAAoB,CAAC,GAAG,SAAS,CAE1E;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,iBAAiB,CAAC,GAAG,SAAS,CAEvE;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,eAAe,CAAC,GAAG,SAAS,CAErE;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,mBAAmB,CAAC,GAAG,SAAS,CAEzE;AAED,wBAAgB,qBAAqB,IAAI,uBAAuB,EAAE,CAKjE;AAED,wBAAgB,mBAAmB,IAAI,qBAAqB,EAAE,CA2C7D"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/services/plugins/registry.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/services/plugins/registry.ts"],"names":[],"mappings":"AAcA,MAAM,OAAO,GAAqB,EAAE,CAAC;AACrC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmE,CAAC;AACtG,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAgC,CAAC;AACtE,MAAM,6BAA6B,GAAG,IAAI,GAAG,EAAsE,CAAC;AACpH,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAmE,CAAC;AAC9G,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAiE,CAAC;AAC1G,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAqE,CAAC;AAClH,IAAI,aAAwC,CAAC;AAC7C,IAAI,WAAoC,CAAC;AAEzC,SAAS,sBAAsB,CAAC,MAAsB;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,aAAa;QAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,qBAAqB;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,kBAAkB;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,gBAAgB;QAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,qBAAqB;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IACvC,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACnC,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACpE,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC3E,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxE,0BAA0B,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtE,wBAAwB,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC3E,4BAA4B,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjD,OAAO,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,IAAI,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAE1C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC7D,6BAA6B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1D,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxD,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC7D,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,IAAI,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QACnE,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7D,WAAW,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACnD,OAAO,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,CAAC,IAAI,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,IAAY;IAEZ,OAAO,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAAY;IAEZ,OAAO,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,IAAY;IAEZ,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,IAAY;IAEZ,OAAO,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,eAAe,EAAE,sBAAsB,CAAC,CAAC,CAAC;KAC3C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL;YACE,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,gDAAgD;YAC7D,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;SAClD;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,uCAAuC;YACpD,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;SAC5D;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;SACxD;QACD;YACE,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,0CAA0C;YACvD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;SACrD;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,wCAAwC;YACrD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC;SAC7D;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EAAE,wCAAwC;YACrD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC;SAC1D;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,wCAAwC;YACrD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC;SACxD;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,WAAW,EAAE,sCAAsC;YACnD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/plugins/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;AAElH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,GAAG,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,iBAAiB,CAAC,CAAC;IACrF,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,oBAAoB,CAAC,CAAC;IACnG,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,eAAe,CAAC,CAAC;IACzF,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,mBAAmB,CAAC,CAAC;IAClG,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,cAAc,CAAC;IACzB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bullmq.d.ts","sourceRoot":"","sources":["../../../src/services/queue/bullmq.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErE,qBAAa,WAAY,YAAW,KAAK;IACvC,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAS;
|
|
1
|
+
{"version":3,"file":"bullmq.d.ts","sourceRoot":"","sources":["../../../src/services/queue/bullmq.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErE,qBAAa,WAAY,YAAW,KAAK;IACvC,OAAO,CAAC,KAAK,CAAY;IACzB,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAAY,QAAQ,EAAE,MAAM,EAW3B;IAEK,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAK3C;IAED,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CA8B/C;IAEK,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAUtC;IAEK,SAAS,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAS1C;IAEK,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxC;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAG9B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"inProcess.d.ts","sourceRoot":"","sources":["../../../src/services/queue/inProcess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIrE,qBAAa,cAAe,YAAW,KAAK;IAC1C,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,KAAK,CAAwD;IAE/D,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"inProcess.d.ts","sourceRoot":"","sources":["../../../src/services/queue/inProcess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIrE,qBAAa,cAAe,YAAW,KAAK;IAC1C,OAAO,CAAC,QAAQ,CAAiC;IACjD,OAAO,CAAC,KAAK,CAAwD;IAE/D,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3C;IAED,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAE/C;IAEK,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAMtC;IAEK,SAAS,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAEhC;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;IAEK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAE9B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;YAEa,GAAG;IAwBjB,OAAO,CAAC,SAAS;CAKlB"}
|
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Redirect URI validation.
|
|
3
|
+
*
|
|
4
|
+
* Redirect URIs are the one place an authorization server sends a user's browser
|
|
5
|
+
* somewhere on its own authority. Anything accepted here becomes a `Location`
|
|
6
|
+
* header the identity provider itself emits, so the accepted set has to be a
|
|
7
|
+
* set a browser cannot be talked out of.
|
|
8
|
+
*
|
|
9
|
+
* Two distinct jobs, kept separate on purpose:
|
|
10
|
+
*
|
|
11
|
+
* - {@link validateRedirectUri} decides whether a URI may be **registered**.
|
|
12
|
+
* - {@link isRedirectUriRegistered} decides whether a URI may be **used**.
|
|
13
|
+
*
|
|
14
|
+
* Matching is exact string comparison. That is the strictest form available and
|
|
15
|
+
* the one RFC 9700 requires: no prefix matching, no normalization, no wildcards.
|
|
16
|
+
* Normalizing before comparing is what turns a strict check into a loose one,
|
|
17
|
+
* because the two sides then stop being compared as the bytes that will
|
|
18
|
+
* actually be sent.
|
|
19
|
+
*/
|
|
20
|
+
export interface RedirectUriRejection {
|
|
21
|
+
ok: false;
|
|
22
|
+
reason: string;
|
|
23
|
+
}
|
|
24
|
+
export type RedirectUriCheck = {
|
|
25
|
+
ok: true;
|
|
26
|
+
} | RedirectUriRejection;
|
|
27
|
+
/**
|
|
28
|
+
* Whether a redirect URI may be registered.
|
|
29
|
+
*
|
|
30
|
+
* Rejects, in order of how badly they fail:
|
|
31
|
+
* - `javascript:`, `data:`, and friends — script execution on our own origin
|
|
32
|
+
* - wildcards — accepted by the URL parser but can never match exactly, so they
|
|
33
|
+
* mislead the operator into thinking a redirect is configured when it is not
|
|
34
|
+
* - fragments — never transmitted to the server, so an exact comparison against
|
|
35
|
+
* them can never succeed
|
|
36
|
+
* - embedded credentials — `https://user:pass@host` is a phishing primitive
|
|
37
|
+
* - plaintext HTTP to anything that is not loopback
|
|
38
|
+
*/
|
|
39
|
+
export declare function validateRedirectUri(uri: string): RedirectUriCheck;
|
|
40
|
+
/**
|
|
41
|
+
* Validate a whole registration set, returning every problem rather than the
|
|
42
|
+
* first, so an operator fixing a configuration sees all of it at once.
|
|
43
|
+
*/
|
|
44
|
+
export declare function validateRedirectUris(uris: string[]): RedirectUriRejection[];
|
|
45
|
+
/**
|
|
46
|
+
* Whether a requested redirect URI is registered.
|
|
47
|
+
*
|
|
48
|
+
* Exact string comparison, deliberately. The requested value is compared as the
|
|
49
|
+
* exact bytes that will be sent in the `Location` header, with no parsing,
|
|
50
|
+
* case-folding, trailing-slash adjustment, or default-port removal. Any of those
|
|
51
|
+
* would widen the check: `https://example.com` and `https://example.com/` are
|
|
52
|
+
* different origins paths-wise, and a comparison that treats them as equal is a
|
|
53
|
+
* comparison that can be made to match something it should not.
|
|
54
|
+
*/
|
|
55
|
+
export declare function isRedirectUriRegistered(registered: string[], requested: string | undefined): boolean;
|
|
56
|
+
//# sourceMappingURL=redirectUri.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"redirectUri.d.ts","sourceRoot":"","sources":["../../src/services/redirectUri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,oBAAoB,CAAC;AAcnE;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA6DjE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAiB3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGpG"}
|
|
@@ -0,0 +1,129 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Redirect URI validation.
|
|
3
|
+
*
|
|
4
|
+
* Redirect URIs are the one place an authorization server sends a user's browser
|
|
5
|
+
* somewhere on its own authority. Anything accepted here becomes a `Location`
|
|
6
|
+
* header the identity provider itself emits, so the accepted set has to be a
|
|
7
|
+
* set a browser cannot be talked out of.
|
|
8
|
+
*
|
|
9
|
+
* Two distinct jobs, kept separate on purpose:
|
|
10
|
+
*
|
|
11
|
+
* - {@link validateRedirectUri} decides whether a URI may be **registered**.
|
|
12
|
+
* - {@link isRedirectUriRegistered} decides whether a URI may be **used**.
|
|
13
|
+
*
|
|
14
|
+
* Matching is exact string comparison. That is the strictest form available and
|
|
15
|
+
* the one RFC 9700 requires: no prefix matching, no normalization, no wildcards.
|
|
16
|
+
* Normalizing before comparing is what turns a strict check into a loose one,
|
|
17
|
+
* because the two sides then stop being compared as the bytes that will
|
|
18
|
+
* actually be sent.
|
|
19
|
+
*/
|
|
20
|
+
/** Schemes that would execute script or inline a document if navigated to. */
|
|
21
|
+
const SCRIPT_SCHEMES = new Set(["javascript", "data", "vbscript", "blob", "file"]);
|
|
22
|
+
/**
|
|
23
|
+
* Hostnames that may legitimately be reached over plaintext HTTP, because they
|
|
24
|
+
* never leave the developer's machine.
|
|
25
|
+
*/
|
|
26
|
+
const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
|
|
27
|
+
/** `scheme:` per RFC 3986, which custom app schemes (`myapp://`) must match. */
|
|
28
|
+
const SCHEME = /^([a-z][a-z0-9+.-]*):/i;
|
|
29
|
+
/**
|
|
30
|
+
* Whether a redirect URI may be registered.
|
|
31
|
+
*
|
|
32
|
+
* Rejects, in order of how badly they fail:
|
|
33
|
+
* - `javascript:`, `data:`, and friends — script execution on our own origin
|
|
34
|
+
* - wildcards — accepted by the URL parser but can never match exactly, so they
|
|
35
|
+
* mislead the operator into thinking a redirect is configured when it is not
|
|
36
|
+
* - fragments — never transmitted to the server, so an exact comparison against
|
|
37
|
+
* them can never succeed
|
|
38
|
+
* - embedded credentials — `https://user:pass@host` is a phishing primitive
|
|
39
|
+
* - plaintext HTTP to anything that is not loopback
|
|
40
|
+
*/
|
|
41
|
+
export function validateRedirectUri(uri) {
|
|
42
|
+
if (typeof uri !== "string" || uri.trim() === "") {
|
|
43
|
+
return { ok: false, reason: "must be a non-empty string" };
|
|
44
|
+
}
|
|
45
|
+
const value = uri.trim();
|
|
46
|
+
// A wildcard is a valid URL character sequence to the parser, so it has to be
|
|
47
|
+
// rejected explicitly rather than caught by scheme or host rules.
|
|
48
|
+
if (value.includes("*")) {
|
|
49
|
+
return { ok: false, reason: "must not contain a wildcard; register each redirect URI exactly" };
|
|
50
|
+
}
|
|
51
|
+
let url;
|
|
52
|
+
try {
|
|
53
|
+
url = new URL(value);
|
|
54
|
+
}
|
|
55
|
+
catch {
|
|
56
|
+
return { ok: false, reason: "must be a valid absolute URL" };
|
|
57
|
+
}
|
|
58
|
+
const scheme = url.protocol.replace(/:$/, "").toLowerCase();
|
|
59
|
+
if (SCRIPT_SCHEMES.has(scheme)) {
|
|
60
|
+
return {
|
|
61
|
+
ok: false,
|
|
62
|
+
reason: `scheme "${scheme}" would execute script or inline a document and is never a valid redirect target`,
|
|
63
|
+
};
|
|
64
|
+
}
|
|
65
|
+
if (url.hash) {
|
|
66
|
+
return { ok: false, reason: "must not contain a fragment; fragments are not sent to the server" };
|
|
67
|
+
}
|
|
68
|
+
if (url.username || url.password) {
|
|
69
|
+
return { ok: false, reason: "must not embed credentials" };
|
|
70
|
+
}
|
|
71
|
+
if (scheme === "https") {
|
|
72
|
+
return { ok: true };
|
|
73
|
+
}
|
|
74
|
+
if (scheme === "http") {
|
|
75
|
+
const host = url.hostname.toLowerCase();
|
|
76
|
+
if (LOOPBACK_HOSTS.has(host))
|
|
77
|
+
return { ok: true };
|
|
78
|
+
return {
|
|
79
|
+
ok: false,
|
|
80
|
+
reason: "must use https; plaintext http is accepted only for loopback addresses during development",
|
|
81
|
+
};
|
|
82
|
+
}
|
|
83
|
+
// A custom scheme is how native and mobile clients receive the redirect, so it
|
|
84
|
+
// is allowed — provided it is not one of the script-bearing schemes handled
|
|
85
|
+
// above. It must be a reverse-DNS style identifier, not a bare word.
|
|
86
|
+
if (SCHEME.test(value) && url.protocol !== ":") {
|
|
87
|
+
if (!/^[a-z][a-z0-9+.-]*:$/i.test(url.protocol)) {
|
|
88
|
+
return { ok: false, reason: "scheme is malformed" };
|
|
89
|
+
}
|
|
90
|
+
return { ok: true };
|
|
91
|
+
}
|
|
92
|
+
return { ok: false, reason: `scheme "${scheme}" is not supported` };
|
|
93
|
+
}
|
|
94
|
+
/**
|
|
95
|
+
* Validate a whole registration set, returning every problem rather than the
|
|
96
|
+
* first, so an operator fixing a configuration sees all of it at once.
|
|
97
|
+
*/
|
|
98
|
+
export function validateRedirectUris(uris) {
|
|
99
|
+
const problems = [];
|
|
100
|
+
for (const uri of uris) {
|
|
101
|
+
const result = validateRedirectUri(uri);
|
|
102
|
+
if (!result.ok)
|
|
103
|
+
problems.push({ ok: false, reason: `${uri}: ${result.reason}` });
|
|
104
|
+
}
|
|
105
|
+
const seen = new Set();
|
|
106
|
+
for (const uri of uris) {
|
|
107
|
+
if (seen.has(uri)) {
|
|
108
|
+
problems.push({ ok: false, reason: `${uri}: registered more than once` });
|
|
109
|
+
}
|
|
110
|
+
seen.add(uri);
|
|
111
|
+
}
|
|
112
|
+
return problems;
|
|
113
|
+
}
|
|
114
|
+
/**
|
|
115
|
+
* Whether a requested redirect URI is registered.
|
|
116
|
+
*
|
|
117
|
+
* Exact string comparison, deliberately. The requested value is compared as the
|
|
118
|
+
* exact bytes that will be sent in the `Location` header, with no parsing,
|
|
119
|
+
* case-folding, trailing-slash adjustment, or default-port removal. Any of those
|
|
120
|
+
* would widen the check: `https://example.com` and `https://example.com/` are
|
|
121
|
+
* different origins paths-wise, and a comparison that treats them as equal is a
|
|
122
|
+
* comparison that can be made to match something it should not.
|
|
123
|
+
*/
|
|
124
|
+
export function isRedirectUriRegistered(registered, requested) {
|
|
125
|
+
if (typeof requested !== "string" || requested === "")
|
|
126
|
+
return false;
|
|
127
|
+
return registered.includes(requested);
|
|
128
|
+
}
|
|
129
|
+
//# sourceMappingURL=redirectUri.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"redirectUri.js","sourceRoot":"","sources":["../../src/services/redirectUri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,8EAA8E;AAC9E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnF;;;GAGG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtF,gFAAgF;AAChF,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAEzB,8EAA8E;IAC9E,kEAAkE;IAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAE5D,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,WAAW,MAAM,kFAAkF;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2FAA2F;SACpG,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC/C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,MAAM,oBAAoB,EAAE,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAoB,EAAE,SAA6B;IACzF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC"}
|
package/dist/services/redis.d.ts
CHANGED
|
@@ -4,6 +4,6 @@ import { Redis } from "ioredis";
|
|
|
4
4
|
* other distributed state in Keystone. Lazy connection means the process will
|
|
5
5
|
* not fail at import time if Redis is temporarily unavailable.
|
|
6
6
|
*/
|
|
7
|
-
export declare const redis: Redis
|
|
7
|
+
export declare const redis: Redis<"legacy">;
|
|
8
8
|
export declare function isRedisReady(): boolean;
|
|
9
9
|
//# sourceMappingURL=redis.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/services/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGhC;;;;GAIG;AACH,eAAO,MAAM,KAAK,
|
|
1
|
+
{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/services/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGhC;;;;GAIG;AACH,eAAO,MAAM,KAAK,iBAGhB,CAAC;AAEH,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
import type { ScimConnectionRepository } from "../repositories/types.js";
|
|
2
|
+
import { type Result } from "../lib/result.js";
|
|
3
|
+
export interface IssuedScimToken {
|
|
4
|
+
/** The only time the plaintext token is ever available. */
|
|
5
|
+
token: string;
|
|
6
|
+
tokenHash: string;
|
|
7
|
+
tokenHint: string;
|
|
8
|
+
}
|
|
9
|
+
export declare function generateScimToken(): IssuedScimToken;
|
|
10
|
+
/**
|
|
11
|
+
* Tokens are always high-entropy random values, so an unkeyed digest is
|
|
12
|
+
* sufficient and keeps lookup a plain indexed equality check.
|
|
13
|
+
*/
|
|
14
|
+
export declare function hashScimToken(token: string): string;
|
|
15
|
+
export interface ScimCredentialOptions {
|
|
16
|
+
expiresInDays?: number;
|
|
17
|
+
rotationGraceSeconds?: number;
|
|
18
|
+
}
|
|
19
|
+
export declare class ScimConnectionService {
|
|
20
|
+
private readonly connections;
|
|
21
|
+
constructor(connections: ScimConnectionRepository);
|
|
22
|
+
create(input: {
|
|
23
|
+
orgId: string;
|
|
24
|
+
name: string;
|
|
25
|
+
createdByUserId?: string;
|
|
26
|
+
options?: ScimCredentialOptions;
|
|
27
|
+
}): Promise<Result<{
|
|
28
|
+
connectionId: string;
|
|
29
|
+
token: string;
|
|
30
|
+
tokenHint: string;
|
|
31
|
+
expiresAt: Date | null;
|
|
32
|
+
}>>;
|
|
33
|
+
/**
|
|
34
|
+
* Issue a new token. The previous token keeps working for the grace period so
|
|
35
|
+
* an IdM does not lose provisioning mid-rotation.
|
|
36
|
+
*/
|
|
37
|
+
rotate(connectionId: string, options?: ScimCredentialOptions): Promise<Result<{
|
|
38
|
+
token: string;
|
|
39
|
+
tokenHint: string;
|
|
40
|
+
previousTokenValidUntil: Date;
|
|
41
|
+
}>>;
|
|
42
|
+
revoke(connectionId: string): Promise<Result<{
|
|
43
|
+
orgId: string;
|
|
44
|
+
}>>;
|
|
45
|
+
}
|
|
46
|
+
//# sourceMappingURL=scimCredentials.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scimCredentials.d.ts","sourceRoot":"","sources":["../../src/services/scimCredentials.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,wBAAwB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAaxD,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,IAAI,eAAe,CAInD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,wBAAwB,EAAI;IAEhE,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,OAAO,CAAC,EAAE,qBAAqB,CAAC;KACjC,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CA4CtG;IAED;;;OAGG;IACG,MAAM,CACV,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,uBAAuB,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,CAoCtF;IAEK,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAUrE;CACF"}
|
|
@@ -0,0 +1,123 @@
|
|
|
1
|
+
import crypto from "node:crypto";
|
|
2
|
+
import { config } from "../config.js";
|
|
3
|
+
import { emit } from "./events/bus.js";
|
|
4
|
+
import { err, ok } from "../lib/result.js";
|
|
5
|
+
/**
|
|
6
|
+
* SCIM credential lifecycle.
|
|
7
|
+
*
|
|
8
|
+
* A SCIM credential is always bound to exactly one organization. There is no
|
|
9
|
+
* global SCIM configuration, and the bearer token is stored only as a SHA-256
|
|
10
|
+
* digest, so neither a database dump nor a log line yields a usable token.
|
|
11
|
+
*/
|
|
12
|
+
const TOKEN_PREFIX = "ksc_";
|
|
13
|
+
const TOKEN_ENTROPY_BYTES = 32;
|
|
14
|
+
export function generateScimToken() {
|
|
15
|
+
const secret = crypto.randomBytes(TOKEN_ENTROPY_BYTES).toString("base64url");
|
|
16
|
+
const token = `${TOKEN_PREFIX}${secret}`;
|
|
17
|
+
return { token, tokenHash: hashScimToken(token), tokenHint: token.slice(-4) };
|
|
18
|
+
}
|
|
19
|
+
/**
|
|
20
|
+
* Tokens are always high-entropy random values, so an unkeyed digest is
|
|
21
|
+
* sufficient and keeps lookup a plain indexed equality check.
|
|
22
|
+
*/
|
|
23
|
+
export function hashScimToken(token) {
|
|
24
|
+
return crypto.createHash("sha256").update(token, "utf8").digest("hex");
|
|
25
|
+
}
|
|
26
|
+
export class ScimConnectionService {
|
|
27
|
+
connections;
|
|
28
|
+
constructor(connections) {
|
|
29
|
+
this.connections = connections;
|
|
30
|
+
}
|
|
31
|
+
async create(input) {
|
|
32
|
+
const existing = await this.connections.findActiveByOrg(input.orgId);
|
|
33
|
+
if (existing) {
|
|
34
|
+
return err({
|
|
35
|
+
code: "SCIM_CONNECTION_EXISTS",
|
|
36
|
+
message: "This organization already has an active SCIM connection. Revoke it before creating another.",
|
|
37
|
+
statusCode: 409,
|
|
38
|
+
});
|
|
39
|
+
}
|
|
40
|
+
const issued = generateScimToken();
|
|
41
|
+
const expiresAt = input.options?.expiresInDays
|
|
42
|
+
? new Date(Date.now() + input.options.expiresInDays * 24 * 60 * 60 * 1000)
|
|
43
|
+
: null;
|
|
44
|
+
const record = {
|
|
45
|
+
orgId: input.orgId,
|
|
46
|
+
name: input.name,
|
|
47
|
+
tokenHash: issued.tokenHash,
|
|
48
|
+
tokenHint: issued.tokenHint,
|
|
49
|
+
createdByUserId: input.createdByUserId ?? null,
|
|
50
|
+
expiresAt,
|
|
51
|
+
};
|
|
52
|
+
try {
|
|
53
|
+
const created = await this.connections.create(record);
|
|
54
|
+
await emit({
|
|
55
|
+
type: "scim_connection_created",
|
|
56
|
+
payload: { orgId: input.orgId, connectionId: created.id, name: created.name },
|
|
57
|
+
});
|
|
58
|
+
return ok({
|
|
59
|
+
connectionId: created.id,
|
|
60
|
+
token: issued.token,
|
|
61
|
+
tokenHint: issued.tokenHint,
|
|
62
|
+
expiresAt,
|
|
63
|
+
});
|
|
64
|
+
}
|
|
65
|
+
catch (error) {
|
|
66
|
+
return err({
|
|
67
|
+
code: "SCIM_CONNECTION_CREATE_FAILED",
|
|
68
|
+
message: "Could not create the SCIM connection.",
|
|
69
|
+
statusCode: 400,
|
|
70
|
+
details: { reason: error instanceof Error ? error.message : "unknown" },
|
|
71
|
+
});
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
/**
|
|
75
|
+
* Issue a new token. The previous token keeps working for the grace period so
|
|
76
|
+
* an IdM does not lose provisioning mid-rotation.
|
|
77
|
+
*/
|
|
78
|
+
async rotate(connectionId, options) {
|
|
79
|
+
const connection = await this.connections.findById(connectionId);
|
|
80
|
+
if (!connection) {
|
|
81
|
+
return err({ code: "NOT_FOUND", message: "SCIM connection not found.", statusCode: 404 });
|
|
82
|
+
}
|
|
83
|
+
if (connection.revokedAt) {
|
|
84
|
+
return err({ code: "SCIM_CONNECTION_REVOKED", message: "This SCIM connection is revoked.", statusCode: 409 });
|
|
85
|
+
}
|
|
86
|
+
const graceSeconds = options?.rotationGraceSeconds ?? config.SCIM_ROTATION_GRACE_SECONDS;
|
|
87
|
+
const issued = generateScimToken();
|
|
88
|
+
const rotated = await this.connections.rotate(connectionId, {
|
|
89
|
+
tokenHash: issued.tokenHash,
|
|
90
|
+
tokenHint: issued.tokenHint,
|
|
91
|
+
graceSeconds,
|
|
92
|
+
});
|
|
93
|
+
if (!rotated) {
|
|
94
|
+
return err({ code: "SCIM_ROTATION_FAILED", message: "Could not rotate the SCIM connection.", statusCode: 409 });
|
|
95
|
+
}
|
|
96
|
+
await emit({
|
|
97
|
+
type: "scim_connection_rotated",
|
|
98
|
+
payload: {
|
|
99
|
+
orgId: connection.orgId,
|
|
100
|
+
connectionId,
|
|
101
|
+
graceSeconds,
|
|
102
|
+
previousTokenValidUntil: rotated.previousTokenValidUntil?.toISOString(),
|
|
103
|
+
},
|
|
104
|
+
});
|
|
105
|
+
return ok({
|
|
106
|
+
token: issued.token,
|
|
107
|
+
tokenHint: issued.tokenHint,
|
|
108
|
+
previousTokenValidUntil: rotated.previousTokenValidUntil,
|
|
109
|
+
});
|
|
110
|
+
}
|
|
111
|
+
async revoke(connectionId) {
|
|
112
|
+
const revoked = await this.connections.revoke(connectionId);
|
|
113
|
+
if (!revoked) {
|
|
114
|
+
return err({ code: "NOT_FOUND", message: "No active SCIM connection with that id.", statusCode: 404 });
|
|
115
|
+
}
|
|
116
|
+
await emit({
|
|
117
|
+
type: "scim_connection_revoked",
|
|
118
|
+
payload: { orgId: revoked.orgId, connectionId },
|
|
119
|
+
});
|
|
120
|
+
return ok({ orgId: revoked.orgId });
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
//# sourceMappingURL=scimCredentials.js.map
|