@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/auth/decorators/current-org.decorator.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentOrg = void 0;
+exports.activeOrgIdOf = activeOrgIdOf;
+const common_1 = require("@nestjs/common");
+const current_principal_decorator_1 = require("./current-principal.decorator");
+// =============================================================================
+// @CurrentOrg(): the request's active organization id (issue #725)
+// =============================================================================
+//
+// Row-level security shows a request one organization's rows, and the
+// organization is `principal.activeOrgId`: carried in the signed access token,
+// validated against the user's memberships by the guard, never read from a
+// header, query or body. Handlers that touch tenant data pass it on to their
+// service, which scopes the database client with it (`PrismaService.forOrg`).
+//
+// A caller with no active organization (a worker-node credential is
+// system-scoped) is refused with 403: there is no organization to scope to,
+// and an unscoped client would see nothing anyway.
+// =============================================================================
+/**
+ * The id of the request's active organization.
+ *
+ * @stability stable
+ */
+function activeOrgIdOf(request) {
+    const fromPrincipal = (0, current_principal_decorator_1.principalOf)(request)?.activeOrgId;
+    if (fromPrincipal)
+        return fromPrincipal;
+    const fromUser = request.user?.activeOrgId;
+    return typeof fromUser === 'string' && fromUser.length > 0 ? fromUser : undefined;
+}
+/**
+ * Parameter decorator: the active organization's id.
+ *
+ * @throws ForbiddenException (403) when the credential has no active organization.
+ *
+ * @example
+ * ```ts
+ * @Get()
+ * @Auth({ permissions: [PERMISSIONS.STORAGE_READ] })
+ * list(@CurrentUser('id') userId: string, @CurrentOrg() orgId: string) {
+ *   return this.objects.list(query, userId, orgId);
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+exports.CurrentOrg = (0, common_1.createParamDecorator)((_data, ctx) => {
+    const orgId = activeOrgIdOf(ctx.switchToHttp().getRequest());
+    if (!orgId)
+        throw new common_1.ForbiddenException('This credential has no active organization');
+    return orgId;
+});
+//# sourceMappingURL=current-org.decorator.js.map

package/dist/identity/auth/decorators/current-org.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-org.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/current-org.decorator.ts"],"names":[],"mappings":";;;AAwBA,sCAKC;AA7BD,2CAA4F;AAE5F,+EAAuF;AAEvF,gFAAgF;AAChF,mEAAmE;AACnE,gFAAgF;AAChF,EAAE;AACF,sEAAsE;AACtE,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,mDAAmD;AACnD,gFAAgF;AAEhF;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAA0E;IACtG,MAAM,aAAa,GAAG,IAAA,yCAAW,EAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IACxD,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACU,QAAA,UAAU,GAAG,IAAA,6BAAoB,EAAC,CAAC,KAAc,EAAE,GAAqB,EAAU,EAAE;IAC/F,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC,CAAC;IACnF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,2BAAkB,CAAC,4CAA4C,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC"}

package/dist/identity/auth/decorators/current-principal.decorator.d.ts

@@ -0,0 +1,38 @@
+import type { Principal } from '../../../core/index';
+import type { AuthenticatedUser } from '../interfaces/authenticated-user.interface';
+/**
+ * The request properties the decorator reads.
+ *
+ * @stability stable
+ */
+export interface RequestWithPrincipal {
+    /** Set by `JwtAuthGuard` (ADR 0001). */
+    principal?: Principal;
+    /** The loaded user graph, set by the credential path that admitted the request. */
+    user?: AuthenticatedUser;
+}
+/**
+ * The request's principal, or `undefined` on a public route.
+ *
+ * @param request - the request.
+ * @returns the principal the guard set, or one built from `request.user`.
+ *
+ * @stability stable
+ */
+export declare function principalOf(request: RequestWithPrincipal | undefined): Principal | undefined;
+/**
+ * Parameter decorator: the authenticated caller as a `Principal`.
+ *
+ * @example
+ * ```ts
+ * @Get('mine')
+ * @Auth()
+ * list(@CurrentPrincipal() principal: Principal) {
+ *   return this.items.list({ userId: principal.userId, orgId: principal.activeOrgId });
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+export declare const CurrentPrincipal: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-principal.decorator.d.ts.map

package/dist/identity/auth/decorators/current-principal.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-principal.decorator.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/current-principal.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAmBpF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mFAAmF;IACnF,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAM5F;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,mDAG5B,CAAC"}

package/dist/identity/auth/decorators/current-principal.decorator.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentPrincipal = void 0;
+exports.principalOf = principalOf;
+const common_1 = require("@nestjs/common");
+const principal_factory_1 = require("../principal.factory");
+/**
+ * The request's principal, or `undefined` on a public route.
+ *
+ * @param request - the request.
+ * @returns the principal the guard set, or one built from `request.user`.
+ *
+ * @stability stable
+ */
+function principalOf(request) {
+    if (!request)
+        return undefined;
+    if (request.principal)
+        return request.principal;
+    const user = request.user;
+    if (!user || !Array.isArray(user.userRoles))
+        return undefined;
+    return (0, principal_factory_1.toPrincipal)(user, user.tokenKind ?? 'session');
+}
+/**
+ * Parameter decorator: the authenticated caller as a `Principal`.
+ *
+ * @example
+ * ```ts
+ * @Get('mine')
+ * @Auth()
+ * list(@CurrentPrincipal() principal: Principal) {
+ *   return this.items.list({ userId: principal.userId, orgId: principal.activeOrgId });
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+exports.CurrentPrincipal = (0, common_1.createParamDecorator)((_data, ctx) => principalOf(ctx.switchToHttp().getRequest()));
+//# sourceMappingURL=current-principal.decorator.js.map

package/dist/identity/auth/decorators/current-principal.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-principal.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/current-principal.decorator.ts"],"names":[],"mappings":";;;AA0CA,kCAMC;AAhDD,2CAAwE;AAIxE,4DAAmD;AA8BnD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,OAAyC;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAA,+BAAW,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACU,QAAA,gBAAgB,GAAG,IAAA,6BAAoB,EAClD,CAAC,KAAc,EAAE,GAAqB,EAAyB,EAAE,CAC/D,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC,CACrE,CAAC"}

package/dist/identity/auth/decorators/current-user.decorator.d.ts

@@ -0,0 +1,26 @@
+import { RequestUser } from '../interfaces/authenticated-user.interface';
+/**
+ * Decorator to extract the current authenticated user from the request
+ *
+ * The decorator can extract properties from either `request.requestUser` (simplified user
+ * set by guards) or `request.user` (full authenticated user from JWT strategy).
+ *
+ * @example
+ * ```typescript
+ * // Get full user object
+ * @Get('profile')
+ * getProfile(@CurrentUser() user: RequestUser) {
+ *   return user;
+ * }
+ *
+ * // Get specific property
+ * @Get('email')
+ * getEmail(@CurrentUser('email') email: string) {
+ *   return { email };
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+export declare const CurrentUser: (...dataOrPipes: (keyof RequestUser | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
+//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/identity/auth/decorators/current-user.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAUzE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,WAAW,gNAOvB,CAAC"}

package/dist/identity/auth/decorators/current-user.decorator.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Decorator to extract the current authenticated user from the request
+ *
+ * The decorator can extract properties from either `request.requestUser` (simplified user
+ * set by guards) or `request.user` (full authenticated user from JWT strategy).
+ *
+ * @example
+ * ```typescript
+ * // Get full user object
+ * @Get('profile')
+ * getProfile(@CurrentUser() user: RequestUser) {
+ *   return user;
+ * }
+ *
+ * // Get specific property
+ * @Get('email')
+ * getEmail(@CurrentUser('email') email: string) {
+ *   return { email };
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+exports.CurrentUser = (0, common_1.createParamDecorator)((data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    const user = request.requestUser || request.user;
+    return data ? user?.[data] : user;
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/identity/auth/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAWxE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,IAAmC,EAAE,GAAqB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAA0B,CAAC;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAEjD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC,CACF,CAAC"}

package/dist/identity/auth/decorators/index.d.ts

@@ -0,0 +1,9 @@
+export * from './auth.decorator';
+export * from './current-user.decorator';
+export * from './permissions.decorator';
+export * from './public.decorator';
+export * from './roles.decorator';
+export * from './auth-credential.decorator';
+export * from './current-principal.decorator';
+export * from './current-org.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/auth/decorators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC"}

package/dist/identity/auth/decorators/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.decorator"), exports);
+__exportStar(require("./current-user.decorator"), exports);
+__exportStar(require("./permissions.decorator"), exports);
+__exportStar(require("./public.decorator"), exports);
+__exportStar(require("./roles.decorator"), exports);
+__exportStar(require("./auth-credential.decorator"), exports);
+__exportStar(require("./current-principal.decorator"), exports);
+__exportStar(require("./current-org.decorator"), exports);
+//# sourceMappingURL=index.js.map

package/dist/identity/auth/decorators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,2DAAyC;AACzC,0DAAwC;AACxC,qDAAmC;AACnC,oDAAkC;AAClC,8DAA4C;AAC5C,gEAA8C;AAC9C,0DAAwC"}

package/dist/identity/auth/decorators/permissions.decorator.d.ts

@@ -0,0 +1,43 @@
+import { PermissionName } from '../../identity.constants';
+/**
+ * The metadata key `@Permissions(...)` writes and `PermissionsGuard` reads.
+ *
+ * @stability stable
+ */
+export declare const PERMISSIONS_KEY = "permissions";
+/**
+ * Decorator to specify required permissions for an endpoint
+ * User must have ALL of the specified permissions
+ *
+ * @example
+ * ```ts
+ * class ExampleController {
+ *   @Permissions('users:read', 'users:write')
+ *   update() {}
+ * }
+ * ```
+ *
+ * @param permissions - every permission the caller must hold.
+ * @returns the metadata decorator `PermissionsGuard` reads.
+ *
+ * @stability stable
+ */
+export declare const Permissions: (...permissions: PermissionName[]) => import("@nestjs/common").CustomDecorator<string>;
+/**
+ * The metadata key `@AnyPermissions(...)` writes and `PermissionsGuard` reads (#738).
+ *
+ * @stability experimental
+ */
+export declare const ANY_PERMISSIONS_KEY = "anyPermissions";
+/**
+ * Decorator: the caller must hold AT LEAST ONE of the permissions. Applied by
+ * `@Auth({ anyPermissions })`; checked by `PermissionsGuard` after
+ * `@Permissions(...)`.
+ *
+ * @param permissions - the permissions, any one of which admits the caller.
+ * @returns the metadata decorator `PermissionsGuard` reads.
+ *
+ * @stability experimental
+ */
+export declare const AnyPermissions: (...permissions: PermissionName[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=permissions.decorator.d.ts.map

package/dist/identity/auth/decorators/permissions.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.decorator.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/permissions.decorator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,WAAW,GAAI,GAAG,aAAa,cAAc,EAAE,qDACjB,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,GAAG,aAAa,cAAc,EAAE,qDAAkD,CAAC"}

package/dist/identity/auth/decorators/permissions.decorator.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnyPermissions = exports.ANY_PERMISSIONS_KEY = exports.Permissions = exports.PERMISSIONS_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * The metadata key `@Permissions(...)` writes and `PermissionsGuard` reads.
+ *
+ * @stability stable
+ */
+exports.PERMISSIONS_KEY = 'permissions';
+/**
+ * Decorator to specify required permissions for an endpoint
+ * User must have ALL of the specified permissions
+ *
+ * @example
+ * ```ts
+ * class ExampleController {
+ *   @Permissions('users:read', 'users:write')
+ *   update() {}
+ * }
+ * ```
+ *
+ * @param permissions - every permission the caller must hold.
+ * @returns the metadata decorator `PermissionsGuard` reads.
+ *
+ * @stability stable
+ */
+const Permissions = (...permissions) => (0, common_1.SetMetadata)(exports.PERMISSIONS_KEY, permissions);
+exports.Permissions = Permissions;
+/**
+ * The metadata key `@AnyPermissions(...)` writes and `PermissionsGuard` reads (#738).
+ *
+ * @stability experimental
+ */
+exports.ANY_PERMISSIONS_KEY = 'anyPermissions';
+/**
+ * Decorator: the caller must hold AT LEAST ONE of the permissions. Applied by
+ * `@Auth({ anyPermissions })`; checked by `PermissionsGuard` after
+ * `@Permissions(...)`.
+ *
+ * @param permissions - the permissions, any one of which admits the caller.
+ * @returns the metadata decorator `PermissionsGuard` reads.
+ *
+ * @stability experimental
+ */
+const AnyPermissions = (...permissions) => (0, common_1.SetMetadata)(exports.ANY_PERMISSIONS_KEY, permissions);
+exports.AnyPermissions = AnyPermissions;
+//# sourceMappingURL=permissions.decorator.js.map

package/dist/identity/auth/decorators/permissions.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/permissions.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAG7C;;;;GAIG;AACU,QAAA,eAAe,GAAG,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,WAAW,GAAG,CAAC,GAAG,WAA6B,EAAE,EAAE,CAC9D,IAAA,oBAAW,EAAC,uBAAe,EAAE,WAAW,CAAC,CAAC;AAD/B,QAAA,WAAW,eACoB;AAE5C;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACI,MAAM,cAAc,GAAG,CAAC,GAAG,WAA6B,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,2BAAmB,EAAE,WAAW,CAAC,CAAC;AAArG,QAAA,cAAc,kBAAuF"}

package/dist/identity/auth/decorators/public.decorator.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Metadata key for public routes
+ *
+ * @stability stable
+ */
+export declare const IS_PUBLIC_KEY = "isPublic";
+/**
+ * Decorator to mark routes as public (skip JWT authentication)
+ *
+ * @example
+ * ```typescript
+ * @Public()
+ * @Get('health')
+ * getHealth() {
+ *   return { status: 'ok' };
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=public.decorator.d.ts.map

package/dist/identity/auth/decorators/public.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/public.decorator.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM,wDAAyC,CAAC"}

package/dist/identity/auth/decorators/public.decorator.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Metadata key for public routes
+ *
+ * @stability stable
+ */
+exports.IS_PUBLIC_KEY = 'isPublic';
+/**
+ * Decorator to mark routes as public (skip JWT authentication)
+ *
+ * @example
+ * ```typescript
+ * @Public()
+ * @Get('health')
+ * getHealth() {
+ *   return { status: 'ok' };
+ * }
+ * ```
+ *
+ * @stability stable
+ */
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;
+//# sourceMappingURL=public.decorator.js.map

package/dist/identity/auth/decorators/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C;;;;GAIG;AACU,QAAA,aAAa,GAAG,UAAU,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACI,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,qBAAa,EAAE,IAAI,CAAC,CAAC;AAAhD,QAAA,MAAM,UAA0C"}

package/dist/identity/auth/decorators/roles.decorator.d.ts

@@ -0,0 +1,26 @@
+import { RoleName } from '../../identity.constants';
+/**
+ * The metadata key `@Roles(...)` writes and `RolesGuard` reads.
+ *
+ * @stability stable
+ */
+export declare const ROLES_KEY = "roles";
+/**
+ * Decorator to specify required roles for an endpoint
+ * User must have AT LEAST ONE of the specified roles
+ *
+ * @example
+ * ```ts
+ * class ExampleController {
+ *   @Roles('admin')
+ *   operate() {}
+ * }
+ * ```
+ *
+ * @param roles - the system roles, any of which admits the caller.
+ * @returns the metadata decorator `RolesGuard` reads.
+ *
+ * @stability stable
+ */
+export declare const Roles: (...roles: RoleName[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=roles.decorator.d.ts.map

package/dist/identity/auth/decorators/roles.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/roles.decorator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD;;;;GAIG;AACH,eAAO,MAAM,SAAS,UAAU,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,GAAI,GAAG,OAAO,QAAQ,EAAE,qDAAkC,CAAC"}

package/dist/identity/auth/decorators/roles.decorator.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Roles = exports.ROLES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * The metadata key `@Roles(...)` writes and `RolesGuard` reads.
+ *
+ * @stability stable
+ */
+exports.ROLES_KEY = 'roles';
+/**
+ * Decorator to specify required roles for an endpoint
+ * User must have AT LEAST ONE of the specified roles
+ *
+ * @example
+ * ```ts
+ * class ExampleController {
+ *   @Roles('admin')
+ *   operate() {}
+ * }
+ * ```
+ *
+ * @param roles - the system roles, any of which admits the caller.
+ * @returns the metadata decorator `RolesGuard` reads.
+ *
+ * @stability stable
+ */
+const Roles = (...roles) => (0, common_1.SetMetadata)(exports.ROLES_KEY, roles);
+exports.Roles = Roles;
+//# sourceMappingURL=roles.decorator.js.map

package/dist/identity/auth/decorators/roles.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.decorator.js","sourceRoot":"","sources":["../../../../src/identity/auth/decorators/roles.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAG7C;;;;GAIG;AACU,QAAA,SAAS,GAAG,OAAO,CAAC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,KAAK,GAAG,CAAC,GAAG,KAAiB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,iBAAS,EAAE,KAAK,CAAC,CAAC;AAAhE,QAAA,KAAK,SAA2D"}

package/dist/identity/auth/doctor/auth-providers.doctor-check.d.ts

@@ -0,0 +1,27 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import { AuthService } from '../auth.service';
+/**
+ * `auth` / `auth.providers` — at least one sign-in provider is configured, and
+ * every registered provider's state (PP-14.9).
+ *
+ * Asks `AuthService.getEnabledProviders()`, the same list the sign-in page
+ * renders, so the doctor cannot disagree with what a user actually sees. Every
+ * registered provider is listed in `data` (`provider.<id>`: `enabled` or
+ * `not enabled`, and `remedy.<id>` with its `doctorRemedy` while it is off); a
+ * provider being off does not lower the status (an optional provider is not a
+ * fault). With nothing enabled the check fails and the remedy carries each
+ * registered provider's own instruction.
+ */
+export declare class AuthProvidersDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly auth;
+    readonly id = "auth.providers";
+    readonly category = "auth";
+    readonly label = "Sign-in providers";
+    constructor(registry: DoctorCheckRegistry, auth: AuthService);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=auth-providers.doctor-check.d.ts.map

package/dist/identity/auth/doctor/auth-providers.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/auth-providers.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAQ9C;;;;;;;;;;;GAWG;AACH,qBACa,wBAAyB,YAAW,WAAW,EAAE,YAAY;IAMtE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,QAAQ,CAAC,EAAE,oBAAoB;IAC/B,QAAQ,CAAC,QAAQ,UAAU;IAC3B,QAAQ,CAAC,KAAK,uBAAuB;gBAGlB,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,WAAW;IAGpC,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CA4BzC"}

package/dist/identity/auth/doctor/auth-providers.doctor-check.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthProvidersDoctorCheck = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const auth_service_1 = require("../auth.service");
+const auth_provider_registry_1 = require("../providers/auth-provider.registry");
+/** What an operator is told when no registered provider offers a remedy of its own. */
+const GENERIC_REMEDY = 'Configure at least one sign-in provider (for Google: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and GOOGLE_CALLBACK_URL, ' +
+    'see infra/compose/.env.example) and restart the API.';
+/**
+ * `auth` / `auth.providers` — at least one sign-in provider is configured, and
+ * every registered provider's state (PP-14.9).
+ *
+ * Asks `AuthService.getEnabledProviders()`, the same list the sign-in page
+ * renders, so the doctor cannot disagree with what a user actually sees. Every
+ * registered provider is listed in `data` (`provider.<id>`: `enabled` or
+ * `not enabled`, and `remedy.<id>` with its `doctorRemedy` while it is off); a
+ * provider being off does not lower the status (an optional provider is not a
+ * fault). With nothing enabled the check fails and the remedy carries each
+ * registered provider's own instruction.
+ */
+let AuthProvidersDoctorCheck = class AuthProvidersDoctorCheck {
+    registry;
+    auth;
+    id = 'auth.providers';
+    category = 'auth';
+    label = 'Sign-in providers';
+    constructor(registry, auth) {
+        this.registry = registry;
+        this.auth = auth;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        const providers = (await this.auth.getEnabledProviders()).filter((p) => p.enabled);
+        const enabledIds = new Set(providers.map((p) => p.name));
+        const registered = auth_provider_registry_1.authProviderRegistry.list();
+        const notEnabled = registered.filter((provider) => !enabledIds.has(provider.id));
+        const data = { providers: providers.length };
+        for (const provider of registered) {
+            data[`provider.${provider.id}`] = enabledIds.has(provider.id) ? 'enabled' : 'not enabled';
+            if (!enabledIds.has(provider.id) && provider.doctorRemedy)
+                data[`remedy.${provider.id}`] = provider.doctorRemedy;
+        }
+        if (providers.length === 0) {
+            const remedies = notEnabled.flatMap((p) => (p.doctorRemedy ? [`${p.label ?? p.id}: ${p.doctorRemedy}`] : []));
+            return {
+                status: 'fail',
+                detail: 'No sign-in provider is configured; nobody can sign in',
+                remedy: remedies.length > 0 ? remedies.join(' ') : GENERIC_REMEDY,
+                data,
+            };
+        }
+        return {
+            status: 'pass',
+            detail: `Enabled: ${providers.map((p) => p.name).join(', ')}`,
+            data,
+        };
+    }
+};
+exports.AuthProvidersDoctorCheck = AuthProvidersDoctorCheck;
+exports.AuthProvidersDoctorCheck = AuthProvidersDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        auth_service_1.AuthService])
+], AuthProvidersDoctorCheck);
+//# sourceMappingURL=auth-providers.doctor-check.js.map

package/dist/identity/auth/doctor/auth-providers.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.doctor-check.js","sourceRoot":"","sources":["../../../../src/identity/auth/doctor/auth-providers.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0D;AAG1D,iDAA4D;AAC5D,kDAA8C;AAC9C,gFAA2E;AAE3E,uFAAuF;AACvF,MAAM,cAAc,GAClB,uHAAuH;IACvH,sDAAsD,CAAC;AAEzD;;;;;;;;;;;GAWG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAMhB;IACA;IANV,EAAE,GAAG,gBAAgB,CAAC;IACtB,QAAQ,GAAG,MAAM,CAAC;IAClB,KAAK,GAAG,mBAAmB,CAAC;IAErC,YACmB,QAA6B,EAC7B,IAAiB;QADjB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,SAAI,GAAJ,IAAI,CAAa;IACjC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,6CAAoB,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAEjF,MAAM,IAAI,GAAoC,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QAC9E,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,YAAY,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;YAC1F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,YAAY;gBAAE,IAAI,CAAC,UAAU,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;QACnH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9G,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,uDAAuD;gBAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc;gBACjE,IAAI;aACL,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC7D,IAAI;SACL,CAAC;IACJ,CAAC;CACF,CAAA;AA1CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAOkB,2BAAmB;QACvB,0BAAW;GAPzB,wBAAwB,CA0CpC"}

package/dist/identity/auth/doctor/egress/auth-providers.egress.contributor.d.ts

@@ -0,0 +1,29 @@
+import { OnModuleInit } from '@nestjs/common';
+import { EgressContributor, EgressDependency, EgressRegistry } from '../../../../doctor/index';
+import { AuthService } from '../../auth.service';
+/** Where the browser signs in, and where the API exchanges the code and reads the profile. */
+export declare const GOOGLE_OAUTH_HOSTS: readonly ["accounts.google.com", "oauth2.googleapis.com", "www.googleapis.com"];
+/** Where a Google profile picture is served from (the browser loads it). */
+export declare const GOOGLE_AVATAR_HOSTS: readonly ["lh3.googleusercontent.com"];
+/**
+ * The sign-in providers' outbound dependencies (#773, PP-14.9):
+ *
+ * - `auth.google` and `auth.google.avatars`: Google sign-in, exactly as before.
+ * - `auth.<id>`: one per other registered provider that declared
+ *   `egressHosts` (direction `both`: the browser signs in, the API exchanges
+ *   the code).
+ *
+ * Reads `AuthService.getEnabledProviders()`, the same list the sign-in page
+ * renders (configuration only: whether a provider is configured, never a
+ * secret). A provider is `required` when it is the only enabled one: then
+ * nobody can sign in without reaching it.
+ */
+export declare class AuthProvidersEgressContributor implements EgressContributor, OnModuleInit {
+    private readonly egress;
+    private readonly auth;
+    readonly id = "auth";
+    constructor(egress: EgressRegistry, auth: AuthService);
+    onModuleInit(): void;
+    describe(): Promise<EgressDependency[]>;
+}
+//# sourceMappingURL=auth-providers.egress.contributor.d.ts.map

package/dist/identity/auth/doctor/egress/auth-providers.egress.contributor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-providers.egress.contributor.d.ts","sourceRoot":"","sources":["../../../../../src/identity/auth/doctor/egress/auth-providers.egress.contributor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EAEf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,iFAAkF,CAAC;AAElH,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,wCAAyC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,qBACa,8BAA+B,YAAW,iBAAiB,EAAE,YAAY;IAIlF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,QAAQ,CAAC,EAAE,UAAU;gBAGF,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,WAAW;IAGpC,YAAY,IAAI,IAAI;IAId,QAAQ,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAiD9C"}