@kwirthmagnify/kwirth-common-back 0.5.41 → 0.5.43

package/dist/IIdpConnector.d.ts

@@ -1,10 +1,10 @@
-import { EConfigFieldType, IConfigFieldDef } from './IExtensionConfig';
+import { TConfigFieldType, IConfigFieldDef } from '@kwirthmagnify/kwirth-common';
 export declare enum EIdpConnectorKind {
     OIDC = "oidc",
     OAUTH2 = "oauth2"
 }
-/** @deprecated usa EConfigFieldType, comun a todas las extensiones. */
-export type IdpFieldType = EConfigFieldType;
+/** @deprecated usa TConfigFieldType, comun a todas las extensiones. */
+export type IdpFieldType = TConfigFieldType;
 export type IIdpConfigFieldDef = IConfigFieldDef;
 export interface IIdpIdentity {
     email: string;

package/dist/ILogin.d.ts

@@ -1,5 +1,5 @@
-import { EConfigFieldType, IConfigFieldDef } from './IExtensionConfig';
-/** @deprecated usa EConfigFieldType, comun a todas las extensiones. */
-export type LoginFieldType = EConfigFieldType;
+import { TConfigFieldType, IConfigFieldDef } from '@kwirthmagnify/kwirth-common';
+/** @deprecated usa TConfigFieldType, comun a todas las extensiones. */
+export type LoginFieldType = TConfigFieldType;
 /** Campo de configuracion de un login. Es el contrato comun IConfigFieldDef, sin nada propio. */
 export type ILoginFieldDef = IConfigFieldDef;

package/dist/IProvider.d.ts

@@ -1,5 +1,4 @@
-import { KwirthData } from '@kwirthmagnify/kwirth-common';
-import { IConfigFieldDef } from './IExtensionConfig';
+import { KwirthData, IConfigFieldDef } from '@kwirthmagnify/kwirth-common';
 /**
  * Minimal interface representing the channel side that providers interact with.
  * Providers only need to call processProviderEvent on their subscribers.

package/dist/ISender.d.ts

@@ -1,8 +1,7 @@
-import { ISenderMessage, ISenderConfig, ISenderAccess, ISenderStoredConfig, ISenderResult } from '@kwirthmagnify/kwirth-common';
-import { EConfigFieldType, IConfigFieldDef, IExtensionNodeMeta } from './IExtensionConfig';
+import { ISenderMessage, ISenderConfig, ISenderAccess, ISenderStoredConfig, ISenderResult, TConfigFieldType, IConfigFieldDef, IExtensionNodeMeta } from '@kwirthmagnify/kwirth-common';
 export { ISenderMessage, ISenderConfig, ISenderAccess, ISenderStoredConfig, ISenderResult };
-/** @deprecated usa EConfigFieldType, comun a todas las extensiones. */
-export type SenderFieldType = EConfigFieldType;
+/** @deprecated usa TConfigFieldType, comun a todas las extensiones. */
+export type SenderFieldType = TConfigFieldType;
 /** Campo de configuracion de un sender. Es el contrato comun IConfigFieldDef, sin nada propio. */
 export type ISenderFieldDef = IConfigFieldDef;
 /** @deprecated usa IExtensionNodeMeta, comun a todas las extensiones. */

package/dist/IWebhook.d.ts

@@ -1,8 +1,7 @@
-import { IWebhookEvent, IWebhookConfig, IWebhookAccess, IWebhookConsumer, IWebhookStoredConfig } from '@kwirthmagnify/kwirth-common';
-import { EConfigFieldType, IConfigFieldDef, IExtensionNodeMeta } from './IExtensionConfig';
+import { IWebhookEvent, IWebhookConfig, IWebhookAccess, IWebhookConsumer, IWebhookStoredConfig, TConfigFieldType, IConfigFieldDef, IExtensionNodeMeta } from '@kwirthmagnify/kwirth-common';
 export { IWebhookEvent, IWebhookConfig, IWebhookAccess, IWebhookConsumer, IWebhookStoredConfig };
-/** @deprecated usa EConfigFieldType, comun a todas las extensiones. */
-export type WebhookFieldType = EConfigFieldType;
+/** @deprecated usa TConfigFieldType, comun a todas las extensiones. */
+export type WebhookFieldType = TConfigFieldType;
 /** Campo de configuracion de un webhook. Es el contrato comun IConfigFieldDef, sin nada propio. */
 export type IWebhookFieldDef = IConfigFieldDef;
 /** @deprecated usa IExtensionNodeMeta, comun a todas las extensiones. */

package/dist/index.d.ts

@@ -1,4 +1,3 @@
-export * from './IExtensionConfig';
 export * from './IBackChannelObject';
 export * from './ILogin';
 export * from './IChannel';

package/dist/index.js

@@ -14,7 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./IExtensionConfig"), exports);
 __exportStar(require("./IBackChannelObject"), exports);
 __exportStar(require("./ILogin"), exports);
 __exportStar(require("./IChannel"), exports);

package/dist/oauth2.js

@@ -3,13 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.oauth2ConfigSchema = oauth2ConfigSchema;
 exports.oauth2BuildAuthorizationUrl = oauth2BuildAuthorizationUrl;
 exports.oauth2HandleCallback = oauth2HandleCallback;
-const IExtensionConfig_1 = require("./IExtensionConfig");
 // esquema base de un IdP OAuth2 (el conector añade sus URLs si aplica; clientSecret 'password' → se enmascara)
 function oauth2ConfigSchema() {
     return [
-        { name: 'clientId', label: 'Client ID', type: IExtensionConfig_1.EConfigFieldType.TEXT, required: true },
-        { name: 'clientSecret', label: 'Client Secret', type: IExtensionConfig_1.EConfigFieldType.PASSWORD, required: true },
-        { name: 'scopes', label: 'Scopes', type: IExtensionConfig_1.EConfigFieldType.TEXT }
+        { name: 'clientId', label: 'Client ID', type: 'text', required: true },
+        { name: 'clientSecret', label: 'Client Secret', type: 'password', required: true },
+        { name: 'scopes', label: 'Scopes', type: 'text' }
     ];
 }
 function oauth2BuildAuthorizationUrl(config, ctx, ep) {

package/dist/oidc.d.ts

@@ -1,4 +1,12 @@
 import { IIdpAuthContext, IIdpCallbackContext, IIdpConfigFieldDef, IIdpIdentity } from './IIdpConnector';
+export interface IOidcCallbackOptions {
+    emailClaims?: string[];
+    assumeVerified?: boolean;
+    multiTenant?: boolean;
+    allowedTenants?: string[];
+}
 export declare function oidcConfigSchema(): IIdpConfigFieldDef[];
+export declare function mapOidcIdentity(claims: Record<string, unknown>, opts?: IOidcCallbackOptions): IIdpIdentity;
+export declare function tenantAllowed(tid: string | undefined, allowed?: string[]): boolean;
 export declare function oidcBuildAuthorizationUrl(config: Record<string, unknown>, ctx: IIdpAuthContext, defaultIssuer?: string): Promise<string>;
-export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string): Promise<IIdpIdentity>;
+export declare function oidcHandleCallback(config: Record<string, unknown>, ctx: IIdpCallbackContext, defaultIssuer?: string, opts?: IOidcCallbackOptions): Promise<IIdpIdentity>;

package/dist/oidc.js

@@ -1,25 +1,52 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.oidcConfigSchema = oidcConfigSchema;
+exports.mapOidcIdentity = mapOidcIdentity;
+exports.tenantAllowed = tenantAllowed;
 exports.oidcBuildAuthorizationUrl = oidcBuildAuthorizationUrl;
 exports.oidcHandleCallback = oidcHandleCallback;
 const openid_client_1 = require("openid-client");
-const IExtensionConfig_1 = require("./IExtensionConfig");
-/*
-    Lógica OIDC compartida por todos los conectores OIDC (Google, Keycloak, GitLab, Microsoft, ...).
-    Vive en common-back y el back la expone como global (__kwirth_back__.kwirthCommonBack), de modo
-    que los conectores la usan por composición SIN bundlear openid-client ni duplicar el flujo.
-
-    Flujo Authorization Code + PKCE con intercambio back-channel (el id_token llega por TLS del
-    token endpoint, así que openid-client valida issuer/aud y basta con eso).
-*/
+const jose = __importStar(require("jose"));
 // esquema de config estándar de un IdP OIDC (clientSecret es 'password' → se enmascara en la UI)
 function oidcConfigSchema() {
     return [
-        { name: 'clientId', label: 'Client ID', type: IExtensionConfig_1.EConfigFieldType.TEXT, required: true },
-        { name: 'clientSecret', label: 'Client Secret', type: IExtensionConfig_1.EConfigFieldType.PASSWORD, required: true },
-        { name: 'scopes', label: 'Scopes', type: IExtensionConfig_1.EConfigFieldType.TEXT },
-        { name: 'issuer', label: 'Issuer URL', type: IExtensionConfig_1.EConfigFieldType.TEXT }
+        { name: 'clientId', label: 'Client ID', type: 'text', required: true },
+        { name: 'clientSecret', label: 'Client Secret', type: 'password', required: true },
+        { name: 'scopes', label: 'Scopes', type: 'text' },
+        { name: 'issuer', label: 'Issuer URL', type: 'text' }
     ];
 }
 async function makeClient(config, redirectUri, defaultIssuer) {
@@ -27,15 +54,43 @@ async function makeClient(config, redirectUri, defaultIssuer) {
     if (!issuerUrl)
         throw new Error('OIDC issuer not configured');
     const issuer = await openid_client_1.Issuer.discover(issuerUrl);
-    return new issuer.Client({
+    const client = new issuer.Client({
         client_id: config.clientId,
         client_secret: config.clientSecret,
         redirect_uris: [redirectUri],
         response_types: ['code']
     });
+    return { issuer, client };
+}
+// mapea los claims del id_token a la identidad de Kwirth (fallback de email + verified asumido)
+function mapOidcIdentity(claims, opts) {
+    const emailClaims = opts?.emailClaims ?? ['email'];
+    let email = '';
+    for (const claim of emailClaims) {
+        const value = claims[claim];
+        if (typeof value === 'string' && value !== '') {
+            email = value;
+            break;
+        }
+    }
+    return {
+        email,
+        emailVerified: claims.email_verified === true || opts?.assumeVerified === true,
+        name: typeof claims.name === 'string' ? claims.name : undefined,
+        sub: claims.sub !== undefined ? String(claims.sub) : undefined
+    };
+}
+// ¿el tenant (tid) está permitido? (allowlist vacía = cualquier tenant)
+function tenantAllowed(tid, allowed) {
+    if (!allowed || allowed.length === 0)
+        return true;
+    if (!tid)
+        return false;
+    const lower = tid.toLowerCase();
+    return allowed.some(t => t.toLowerCase() === lower);
 }
 async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
-    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    const { client } = await makeClient(config, ctx.redirectUri, defaultIssuer);
     const scope = config.scopes || 'openid email profile';
     return client.authorizationUrl({
         scope,
@@ -45,20 +100,42 @@ async function oidcBuildAuthorizationUrl(config, ctx, defaultIssuer) {
         code_challenge_method: 'S256'
     });
 }
-async function oidcHandleCallback(config, ctx, defaultIssuer) {
-    const client = await makeClient(config, ctx.redirectUri, defaultIssuer);
-    // pasamos los params crudos del callback (incluyen iss para RFC 9207 y state); el state ya lo
-    // valida el core, pero openid-client exige checks.state si el param state viene presente.
+async function oidcHandleCallback(config, ctx, defaultIssuer, opts) {
+    const { issuer, client } = await makeClient(config, ctx.redirectUri, defaultIssuer);
+    if (opts?.multiTenant) {
+        // openid-client valida el iss de forma LITERAL y en multi-tenant el issuer descubierto lleva el
+        // placeholder {tenantid}; hacemos el intercambio crudo (grant, sin validar id_token) y validamos
+        // el id_token a mano con jose: firma (JWKS del issuer) + iss contra el tid concreto del token.
+        const tokenSet = await client.grant({
+            grant_type: 'authorization_code',
+            code: ctx.code,
+            redirect_uri: ctx.redirectUri,
+            code_verifier: ctx.codeVerifier
+        });
+        if (!tokenSet.id_token)
+            throw new Error('OIDC multi-tenant: token response has no id_token');
+        const tid = tokenSet.claims().tid; // sin verificar; solo para conocer el tenant
+        if (!tid)
+            throw new Error('OIDC multi-tenant: id_token has no tid claim');
+        if (!tenantAllowed(tid, opts.allowedTenants))
+            throw new Error(`OIDC multi-tenant: tenant '${tid}' not allowed`);
+        const jwksUri = issuer.metadata.jwks_uri;
+        if (!jwksUri)
+            throw new Error('OIDC multi-tenant: issuer metadata has no jwks_uri');
+        const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+        const { payload } = await jose.jwtVerify(tokenSet.id_token, jwks, {
+            issuer: `https://login.microsoftonline.com/${tid}/v2.0`,
+            audience: config.clientId,
+            clockTolerance: 5
+        });
+        return mapOidcIdentity(payload, opts);
+    }
+    // single-tenant: pasamos los params crudos del callback (incluyen iss para RFC 9207 y state); el state
+    // ya lo valida el core, pero openid-client exige checks.state si el param state viene presente.
     const params = ctx.params ?? { code: ctx.code };
     const checks = { code_verifier: ctx.codeVerifier };
     if (params.state !== undefined)
         checks.state = params.state;
     const tokenSet = await client.callback(ctx.redirectUri, params, checks);
-    const claims = tokenSet.claims();
-    return {
-        email: String(claims.email ?? ''),
-        emailVerified: claims.email_verified === true,
-        name: claims.name ? String(claims.name) : undefined,
-        sub: claims.sub
-    };
+    return mapOidcIdentity(tokenSet.claims(), opts);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwirthmagnify/kwirth-common-back",
-  "version": "0.5.41",
+  "version": "0.5.43",
   "description": "Backend interfaces for building Kwirth provider and channel plugins",
   "scripts": {
     "build": "tsc",
@@ -26,8 +26,9 @@
   "license": "ISC",
   "dependencies": {
     "@kubernetes/client-node": "^1.4.0",
-    "@kwirthmagnify/kwirth-common": "^0.5.45",
+    "@kwirthmagnify/kwirth-common": "^0.5.46",
     "express": "^4.18.0",
+    "jose": "^4.15.9",
     "js-yaml": "^4.1.0",
     "openid-client": "^5.7.0"
   },

package/dist/IExtensionConfig.d.ts

@@ -1,28 +0,0 @@
-export declare enum EConfigFieldType {
-    TEXT = "text",
-    NUMBER = "number",
-    BOOLEAN = "boolean",
-    PASSWORD = "password",
-    SELECT = "select",
-    JSON = "json"
-}
-export interface IConfigFieldDef {
-    /** Clave con la que el valor se guarda en la configuracion. */
-    name: string;
-    /** Etiqueta que ve el usuario en el formulario. */
-    label: string;
-    /** Ausente = EConfigFieldType.TEXT. */
-    type?: EConfigFieldType;
-    required?: boolean;
-    /** Valores admitidos cuando 'type' es SELECT. Ignorado en el resto. */
-    options?: string[];
-    /** Valor con el que se precarga el campo mientras no haya nada guardado. */
-    default?: string | number | boolean;
-    /** El campo es comun a TODAS las configuraciones de la extension, no propio de cada una. */
-    common?: boolean;
-}
-export interface IExtensionNodeMeta {
-    label: string;
-    icon?: string;
-    description?: string;
-}

package/dist/IExtensionConfig.js

@@ -1,38 +0,0 @@
-"use strict";
-/*
-    Contrato COMUN de configuracion de extensiones.
-
-    Toda extension que publique un formulario de configuracion (senders, webhooks, conectores IdP,
-    logins y providers) describe sus campos con ESTE tipo. Antes cada familia tenia el suyo, casi
-    identico pero divergente: provider decia 'string' donde el resto decia 'text', solo el tenia
-    'default', solo sender y webhook tenian 'common', y su definicion ni siquiera vivia aqui (estaba
-    dentro del core, en back/src/tools/ProviderManager.ts).
-
-    OJO: no confundir EConfigFieldType (el tipo de UN CAMPO del formulario) con EExtensionType (el
-    tipo de la extension: provider, sender, plugin...), que vive en kwirth-common y es lo que declara
-    el package.json del artefacto.
-*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EConfigFieldType = void 0;
-/*
-    Tipo de un campo del formulario de configuracion.
-
-    Lo que hoy pinta el front para cada valor:
-      TEXT      campo de texto. Es el comportamiento por defecto cuando 'type' se omite.
-      NUMBER    campo numerico.
-      BOOLEAN   switch. Los gestores de sender, webhook, idp y provider lo pintan; el de login no.
-      PASSWORD  campo enmascarado con ojo de visibilidad.
-      SELECT    desplegable alimentado por 'options'. Los gestores de sender, webhook y login lo
-                pintan; los de idp y provider no.
-      JSON      area de texto libre para JSON. NINGUN gestor lo pinta todavia: hoy cae a campo de
-                texto. Declararlo es valido, pero no esperes editor estructurado.
-*/
-var EConfigFieldType;
-(function (EConfigFieldType) {
-    EConfigFieldType["TEXT"] = "text";
-    EConfigFieldType["NUMBER"] = "number";
-    EConfigFieldType["BOOLEAN"] = "boolean";
-    EConfigFieldType["PASSWORD"] = "password";
-    EConfigFieldType["SELECT"] = "select";
-    EConfigFieldType["JSON"] = "json";
-})(EConfigFieldType || (exports.EConfigFieldType = EConfigFieldType = {}));