@lenne.tech/nest-server 11.41.2 → 11.41.4

package/dist/core/modules/api-token/core-api-token.model.js

@@ -0,0 +1,199 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreApiTokenModel = void 0;
+const graphql_1 = require("@nestjs/graphql");
+const mongoose_1 = require("@nestjs/mongoose");
+const restricted_decorator_1 = require("../../common/decorators/restricted.decorator");
+const unified_field_decorator_1 = require("../../common/decorators/unified-field.decorator");
+const role_enum_1 = require("../../common/enums/role.enum");
+const access_denied_exception_1 = require("../../common/exceptions/access-denied.exception");
+const core_persistence_model_1 = require("../../common/models/core-persistence.model");
+const config_service_1 = require("../../common/services/config.service");
+const request_context_service_1 = require("../../common/services/request-context.service");
+const core_tenant_helpers_1 = require("../tenant/core-tenant.helpers");
+const core_api_token_constants_1 = require("./core-api-token.constants");
+const core_api_token_helpers_1 = require("./core-api-token.helpers");
+let CoreApiTokenModel = class CoreApiTokenModel extends core_persistence_model_1.CorePersistenceModel {
+    createdBy = undefined;
+    description = undefined;
+    expiresAt = undefined;
+    kind = undefined;
+    lastUsedAt = undefined;
+    maxTenantRole = undefined;
+    name = undefined;
+    publicId = undefined;
+    revokedAt = undefined;
+    scopes = undefined;
+    secretHash = undefined;
+    signingKeyEncrypted = undefined;
+    tenant = undefined;
+    updatedBy = undefined;
+    user = undefined;
+    securityCheck(user, force) {
+        if (force)
+            return this;
+        if (!user)
+            throw (0, access_denied_exception_1.accessDeniedException)(user);
+        if ((0, core_api_token_helpers_1.getApiTokenContext)(user))
+            throw (0, access_denied_exception_1.accessDeniedException)(user);
+        if (this.kind === core_api_token_constants_1.ApiTokenKind.USER && user.id === this.user)
+            return this;
+        const adminBypass = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.adminBypass !== false;
+        if (adminBypass && user.hasRole?.([role_enum_1.RoleEnum.ADMIN]))
+            return this;
+        const context = request_context_service_1.RequestContext.get();
+        if (this.kind === core_api_token_constants_1.ApiTokenKind.TENANT &&
+            context?.tenantId === this.tenant &&
+            context?.tenantRole &&
+            (0, core_tenant_helpers_1.checkRoleAccess)([(0, core_api_token_helpers_1.getApiTokenManageRole)()], undefined, context.tenantRole)) {
+            return this;
+        }
+        throw (0, access_denied_exception_1.accessDeniedException)(user);
+    }
+};
+exports.CoreApiTokenModel = CoreApiTokenModel;
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'ID of the creating user',
+        isOptional: true,
+        mongoose: { type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "createdBy", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({ description: 'Description', isOptional: true, mongoose: { type: String }, roles: role_enum_1.RoleEnum.S_USER }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "description", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Expiry date',
+        isOptional: true,
+        mongoose: { default: null, type: Date },
+        roles: role_enum_1.RoleEnum.S_USER,
+        type: Date,
+    }),
+    __metadata("design:type", Date)
+], CoreApiTokenModel.prototype, "expiresAt", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Token kind',
+        mongoose: { enum: Object.values(core_api_token_constants_1.ApiTokenKind), required: true, type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+        type: () => String,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "kind", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Last use',
+        isOptional: true,
+        mongoose: { default: null, type: Date },
+        roles: role_enum_1.RoleEnum.S_USER,
+        type: Date,
+    }),
+    __metadata("design:type", Date)
+], CoreApiTokenModel.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Maximum tenant role',
+        isOptional: true,
+        mongoose: { type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "maxTenantRole", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({ description: 'Name', mongoose: { required: true, type: String }, roles: role_enum_1.RoleEnum.S_USER }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "name", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Public token id',
+        mongoose: { required: true, type: String, unique: true },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "publicId", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Revocation date',
+        isOptional: true,
+        mongoose: { default: null, type: Date },
+        roles: role_enum_1.RoleEnum.S_USER,
+        type: Date,
+    }),
+    __metadata("design:type", Date)
+], CoreApiTokenModel.prototype, "revokedAt", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Scopes',
+        isArray: true,
+        mongoose: { default: [], type: [String] },
+        roles: role_enum_1.RoleEnum.S_USER,
+        type: () => String,
+    }),
+    __metadata("design:type", Array)
+], CoreApiTokenModel.prototype, "scopes", void 0);
+__decorate([
+    (0, restricted_decorator_1.Restricted)(role_enum_1.RoleEnum.S_NO_ONE),
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Secret hash',
+        isOptional: true,
+        mongoose: { select: false, type: String },
+        roles: role_enum_1.RoleEnum.S_NO_ONE,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "secretHash", void 0);
+__decorate([
+    (0, restricted_decorator_1.Restricted)(role_enum_1.RoleEnum.S_NO_ONE),
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Encrypted signing key',
+        isOptional: true,
+        mongoose: { select: false, type: String },
+        roles: role_enum_1.RoleEnum.S_NO_ONE,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "signingKeyEncrypted", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Tenant ID',
+        isOptional: true,
+        mongoose: { index: true, type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "tenant", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'ID of the last updating user',
+        isOptional: true,
+        mongoose: { type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "updatedBy", void 0);
+__decorate([
+    (0, unified_field_decorator_1.UnifiedField)({
+        description: 'Owning user ID',
+        isOptional: true,
+        mongoose: { index: true, type: String },
+        roles: role_enum_1.RoleEnum.S_USER,
+    }),
+    __metadata("design:type", String)
+], CoreApiTokenModel.prototype, "user", void 0);
+exports.CoreApiTokenModel = CoreApiTokenModel = __decorate([
+    (0, graphql_1.ObjectType)({ description: 'API token', isAbstract: true }),
+    (0, restricted_decorator_1.Restricted)(role_enum_1.RoleEnum.S_USER),
+    (0, mongoose_1.Schema)({ timestamps: true })
+], CoreApiTokenModel);
+//# sourceMappingURL=core-api-token.model.js.map

package/dist/core/modules/api-token/core-api-token.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.model.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.model.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA6C;AAC7C,+CAA0C;AAE1C,uFAA0E;AAC1E,6FAA+E;AAC/E,4DAAwD;AACxD,6FAAwF;AACxF,uFAAkF;AAClF,yEAAqE;AACrE,2FAA+E;AAC/E,uEAAgE;AAChE,yEAA0D;AAC1D,qEAAqF;AAmB9E,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,6CAAoB;IAQzD,SAAS,GAAW,SAAS,CAAC;IAI9B,WAAW,GAAW,SAAS,CAAC;IAUhC,SAAS,GAAS,SAAS,CAAC;IAS5B,IAAI,GAAiB,SAAS,CAAC;IAU/B,UAAU,GAAS,SAAS,CAAC;IAS7B,aAAa,GAAW,SAAS,CAAC;IAIlC,IAAI,GAAW,SAAS,CAAC;IAQzB,QAAQ,GAAW,SAAS,CAAC;IAU7B,SAAS,GAAS,SAAS,CAAC;IAU5B,MAAM,GAAa,SAAS,CAAC;IAU7B,UAAU,GAAW,SAAS,CAAC;IAU/B,mBAAmB,GAAW,SAAS,CAAC;IASxC,MAAM,GAAW,SAAS,CAAC;IAS3B,SAAS,GAAW,SAAS,CAAC;IAS9B,IAAI,GAAW,SAAS,CAAC;IAUhB,aAAa,CAAC,IAAS,EAAE,KAAe;QAC/C,IAAI,KAAK;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI;YAAE,MAAM,IAAA,+CAAqB,EAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAA,2CAAkB,EAAC,IAAI,CAAC;YAAE,MAAM,IAAA,+CAAqB,EAAC,IAAI,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,IAAI,KAAK,uCAAY,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAE1E,MAAM,WAAW,GAAG,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,WAAW,KAAK,KAAK,CAAC;QAC7F,IAAI,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjE,MAAM,OAAO,GAAG,wCAAc,CAAC,GAAG,EAAE,CAAC;QACrC,IACE,IAAI,CAAC,IAAI,KAAK,uCAAY,CAAC,MAAM;YACjC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC,MAAM;YACjC,OAAO,EAAE,UAAU;YACnB,IAAA,qCAAe,EAAC,CAAC,IAAA,8CAAqB,GAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EACzE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAA,+CAAqB,EAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAjKY,8CAAiB;AAQ5B;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,yBAAyB;QACtC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;oDAC4B;AAI9B;IADC,IAAA,sCAAY,EAAC,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAQ,CAAC,MAAM,EAAE,CAAC;;sDACnF;AAUhC;IAPC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,aAAa;QAC1B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,oBAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,IAAI;KACX,CAAC;8BACS,IAAI;oDAAa;AAS5B;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,uCAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC7E,KAAK,EAAE,oBAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC;;+CAC6B;AAU/B;IAPC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,oBAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,IAAI;KACX,CAAC;8BACU,IAAI;qDAAa;AAS7B;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,qBAAqB;QAClC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;wDACgC;AAIlC;IADC,IAAA,sCAAY,EAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,oBAAQ,CAAC,MAAM,EAAE,CAAC;;+CACjF;AAQzB;IALC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,iBAAiB;QAC9B,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QACxD,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;mDAC2B;AAU7B;IAPC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QACvC,KAAK,EAAE,oBAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,IAAI;KACX,CAAC;8BACS,IAAI;oDAAa;AAU5B;IAPC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,QAAQ;QACrB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;QACzC,KAAK,EAAE,oBAAQ,CAAC,MAAM;QACtB,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM;KACnB,CAAC;;iDAC2B;AAU7B;IAPC,IAAA,iCAAU,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IAC7B,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,aAAa;QAC1B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,KAAK,EAAE,oBAAQ,CAAC,QAAQ;KACzB,CAAC;;qDAC6B;AAU/B;IAPC,IAAA,iCAAU,EAAC,oBAAQ,CAAC,QAAQ,CAAC;IAC7B,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,uBAAuB;QACpC,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,KAAK,EAAE,oBAAQ,CAAC,QAAQ;KACzB,CAAC;;8DACsC;AASxC;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,WAAW;QACxB,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACvC,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;iDACyB;AAS3B;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,8BAA8B;QAC3C,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;oDAC4B;AAS9B;IANC,IAAA,sCAAY,EAAC;QACZ,WAAW,EAAE,gBAAgB;QAC7B,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACvC,KAAK,EAAE,oBAAQ,CAAC,MAAM;KACvB,CAAC;;+CACuB;4BAjId,iBAAiB;IAH7B,IAAA,oBAAU,EAAC,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAA,iCAAU,EAAC,oBAAQ,CAAC,MAAM,CAAC;IAC3B,IAAA,iBAAM,EAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;GAChB,iBAAiB,CAiK7B"}

package/dist/core/modules/api-token/core-api-token.module.d.ts

@@ -0,0 +1,11 @@
+import { DynamicModule, MiddlewareConsumer, NestModule, Type } from '@nestjs/common';
+import { CoreApiTokenModel } from './core-api-token.model';
+import { CoreApiTokenService } from './core-api-token.service';
+export interface CoreApiTokenModuleOptions {
+    model?: Type<CoreApiTokenModel>;
+    service?: Type<CoreApiTokenService>;
+}
+export declare class CoreApiTokenModule implements NestModule {
+    static forRoot(options?: CoreApiTokenModuleOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}

package/dist/core/modules/api-token/core-api-token.module.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var CoreApiTokenModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreApiTokenModule = void 0;
+const common_1 = require("@nestjs/common");
+const mongoose_1 = require("@nestjs/mongoose");
+const core_api_token_constants_1 = require("./core-api-token.constants");
+const core_api_token_middleware_1 = require("./core-api-token.middleware");
+const core_api_token_model_1 = require("./core-api-token.model");
+const core_api_token_service_1 = require("./core-api-token.service");
+let CoreApiTokenModule = CoreApiTokenModule_1 = class CoreApiTokenModule {
+    static forRoot(options = {}) {
+        const schema = mongoose_1.SchemaFactory.createForClass(options.model || core_api_token_model_1.CoreApiTokenModel);
+        schema.index({ kind: 1, tenant: 1 });
+        schema.index({ kind: 1, user: 1 });
+        return {
+            exports: [core_api_token_service_1.CoreApiTokenService],
+            global: true,
+            imports: [mongoose_1.MongooseModule.forFeature([{ name: core_api_token_constants_1.API_TOKEN_MODEL_TOKEN, schema }])],
+            module: CoreApiTokenModule_1,
+            providers: [{ provide: core_api_token_service_1.CoreApiTokenService, useClass: options.service || core_api_token_service_1.CoreApiTokenService }],
+        };
+    }
+    configure(consumer) {
+        consumer.apply(core_api_token_middleware_1.CoreApiTokenMiddleware).forRoutes('*');
+    }
+};
+exports.CoreApiTokenModule = CoreApiTokenModule;
+exports.CoreApiTokenModule = CoreApiTokenModule = CoreApiTokenModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], CoreApiTokenModule);
+//# sourceMappingURL=core-api-token.module.js.map

package/dist/core/modules/api-token/core-api-token.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.module.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAqG;AACrG,+CAAiE;AAEjE,yEAAmE;AACnE,2EAAqE;AACrE,iEAA2D;AAC3D,qEAA+D;AAsBxD,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC7B,MAAM,CAAC,OAAO,CAAC,UAAqC,EAAE;QACpD,MAAM,MAAM,GAAG,wBAAa,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,IAAI,wCAAiB,CAAC,CAAC;QAEhF,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAEnC,OAAO;YACL,OAAO,EAAE,CAAC,4CAAmB,CAAC;YAC9B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,yBAAc,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,gDAAqB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,EAAE,oBAAkB;YAC1B,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,4CAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,4CAAmB,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kDAAsB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AAnBY,gDAAkB;6BAAlB,kBAAkB;IAF9B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,kBAAkB,CAmB9B"}

package/dist/core/modules/api-token/core-api-token.registry.d.ts

@@ -0,0 +1,9 @@
+export interface ApiTokenOwnerIdentity {
+    email?: string;
+    iamId?: string;
+    userId?: string;
+}
+type ApiTokenRevoker = (identity: ApiTokenOwnerIdentity) => Promise<number>;
+export declare function setApiTokenRevoker(fn: ApiTokenRevoker | undefined): () => void;
+export declare function revokeApiTokensOfUser(identity: ApiTokenOwnerIdentity): Promise<number>;
+export {};

package/dist/core/modules/api-token/core-api-token.registry.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setApiTokenRevoker = setApiTokenRevoker;
+exports.revokeApiTokensOfUser = revokeApiTokensOfUser;
+let revoker;
+function setApiTokenRevoker(fn) {
+    revoker = fn;
+    return () => {
+        if (revoker === fn) {
+            revoker = undefined;
+        }
+    };
+}
+async function revokeApiTokensOfUser(identity) {
+    return revoker ? revoker(identity) : 0;
+}
+//# sourceMappingURL=core-api-token.registry.js.map

package/dist/core/modules/api-token/core-api-token.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.registry.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.registry.ts"],"names":[],"mappings":";;AAmCA,gDAOC;AAQD,sDAEC;AAzBD,IAAI,OAAoC,CAAC;AAQzC,SAAgB,kBAAkB,CAAC,EAA+B;IAChE,OAAO,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACnB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAQM,KAAK,UAAU,qBAAqB,CAAC,QAA+B;IACzE,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/core/modules/api-token/core-api-token.service.d.ts

@@ -0,0 +1,104 @@
+import { Logger, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { Connection, Model, Types } from 'mongoose';
+import { CoreRedisService } from '../../common/services/core-redis.service';
+import { RateLimitStore } from '../../common/services/rate-limit-store';
+import { CoreTenantService } from '../tenant/core-tenant.service';
+import { ApiTokenKind } from './core-api-token.constants';
+import { IApiTokenContext, IApiTokenCredential, IResolvedApiTokenConfig } from './core-api-token.helpers';
+import { CoreApiTokenModel } from './core-api-token.model';
+import { ApiTokenOwnerIdentity } from './core-api-token.registry';
+export interface ICreateUserApiTokenInput {
+    [projectField: string]: unknown;
+    description?: string;
+    expiresAt?: Date | null | string;
+    maxTenantRole?: null | string;
+    name: string;
+    scopes?: string[];
+    tenantId?: null | string;
+}
+export interface ICreateTenantApiTokenInput {
+    [projectField: string]: unknown;
+    description?: string;
+    expiresAt?: Date | null | string;
+    name: string;
+    scopes: string[];
+}
+export interface IUpdateApiTokenInput {
+    [projectField: string]: unknown;
+    description?: null | string;
+    expiresAt?: Date | null | string;
+    maxTenantRole?: null | string;
+    name?: string;
+    scopes?: string[];
+    tenantId?: null | string;
+}
+export type ApiTokenInfo = Omit<CoreApiTokenModel, 'secretHash' | 'securityCheck' | 'signingKeyEncrypted'> & {
+    [projectField: string]: unknown;
+};
+export interface ICreatedApiToken {
+    apiToken: ApiTokenInfo;
+    signingKey: string;
+    token: string;
+}
+export declare class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
+    protected readonly apiTokenModel: Model<CoreApiTokenModel>;
+    protected readonly connection?: Connection;
+    protected readonly tenantService?: CoreTenantService;
+    protected readonly redisService?: CoreRedisService;
+    protected readonly logger: Logger;
+    protected readonly lastUsedWrites: Map<string, number>;
+    protected rateLimitStore?: RateLimitStore;
+    private warnedAboutDevelopmentKey;
+    private disposeRevoker?;
+    protected static readonly LAST_USED_INTERVAL_MS = 60000;
+    protected static readonly LAST_USED_MAX_ENTRIES = 5000;
+    constructor(apiTokenModel: Model<CoreApiTokenModel>, connection?: Connection, tenantService?: CoreTenantService, redisService?: CoreRedisService);
+    onModuleInit(): void;
+    onModuleDestroy(): void;
+    authenticate(credential: IApiTokenCredential): Promise<null | object>;
+    consumeRateLimit(tokenId: string): Promise<undefined | {
+        retryAfter: number;
+    }>;
+    touchLastUsed(tokenId: string): void;
+    protected findUsableToken(publicId: string, config: IResolvedApiTokenConfig): Promise<CoreApiTokenModel | null>;
+    protected buildRequestUser(token: CoreApiTokenModel, assertion?: IApiTokenContext['assertion']): Promise<null | object>;
+    protected loadTokenUser(userId: string): Promise<null | Record<string, any>>;
+    protected getRateLimitStore(): RateLimitStore;
+    createUserToken(input: ICreateUserApiTokenInput, currentUser: any): Promise<ICreatedApiToken>;
+    findUserTokens(currentUser: any): Promise<ApiTokenInfo[]>;
+    updateUserToken(tokenId: string, input: IUpdateApiTokenInput, currentUser: any): Promise<ApiTokenInfo>;
+    revokeUserToken(tokenId: string, currentUser: any): Promise<ApiTokenInfo>;
+    deleteUserToken(tokenId: string, currentUser: any): Promise<ApiTokenInfo>;
+    revokeAllForUser(userId: string): Promise<number>;
+    revokeAllForOwner(identity: ApiTokenOwnerIdentity): Promise<number>;
+    deleteAllForUser(userId: string): Promise<number>;
+    createTenantToken(tenantId: string, input: ICreateTenantApiTokenInput, currentUser: any): Promise<ICreatedApiToken>;
+    findTenantTokens(tenantId: string, currentUser: any): Promise<ApiTokenInfo[]>;
+    updateTenantToken(tenantId: string, tokenId: string, input: IUpdateApiTokenInput, currentUser: any): Promise<ApiTokenInfo>;
+    revokeTenantToken(tenantId: string, tokenId: string, currentUser: any): Promise<ApiTokenInfo>;
+    deleteTenantToken(tenantId: string, tokenId: string, currentUser: any): Promise<ApiTokenInfo>;
+    deleteAllForTenant(tenantId: string): Promise<number>;
+    assertCanManageTenant(tenantId: string, currentUser: any, config?: IResolvedApiTokenConfig): Promise<void>;
+    protected encryptSigningKey(plain: string): string;
+    protected decryptSigningKey(stored: string): string;
+    protected getEncryptionKey(): Buffer;
+    protected requireKind(kind: ApiTokenKind): IResolvedApiTokenConfig;
+    protected assertPerson(currentUser: any): void;
+    protected issue(document: Record<string, unknown>, currentUser: any): Promise<ICreatedApiToken>;
+    protected list(filter: Record<string, unknown>): Promise<ApiTokenInfo[]>;
+    protected applyUpdate(filter: Record<string, unknown>, $set: Record<string, unknown>, currentUser: any): Promise<ApiTokenInfo>;
+    protected applyRevoke(filter: Record<string, unknown>, currentUser: any): Promise<ApiTokenInfo>;
+    protected applyDelete(filter: Record<string, unknown>): Promise<ApiTokenInfo>;
+    protected userTokenFilter(tokenId: string, currentUser: any): Record<string, unknown>;
+    protected tenantTokenFilter(tenantId: string, tokenId: string): Record<string, unknown>;
+    protected objectId(tokenId: string): Types.ObjectId;
+    protected commonUpdate(input: IUpdateApiTokenInput, config: IResolvedApiTokenConfig): Record<string, unknown>;
+    protected projectFields(input: Record<string, unknown> | undefined): Record<string, unknown>;
+    protected validateName(name: unknown): string;
+    protected validateDescription(description: unknown): null | string;
+    protected validateExpiry(expiresAt: unknown): Date | null;
+    protected validateScopes(scopes: unknown, config: IResolvedApiTokenConfig): string[];
+    protected validateUserTokenTenant(tenantId: unknown, currentUser: any, config: IResolvedApiTokenConfig): Promise<null | string>;
+    protected validateMaxTenantRole(role: unknown, config: IResolvedApiTokenConfig): null | string;
+    protected toInfo(document: Record<string, any>): ApiTokenInfo;
+}