@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/identity/auth/filters/google-oauth-exception.filter.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var GoogleOAuthExceptionFilter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleOAuthExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const auth_error_codes_1 = require("../auth-error-codes");
+/**
+ * Turns a failure raised by `GoogleOAuthGuard` into the same redirect the
+ * callback controller issues for its own failures (#652).
+ *
+ * The guard runs before the controller body, so its errors never reach the
+ * controller's `try/catch`: consent cancelled at Google (`AuthorizationError`
+ * `access_denied`), a replayed or expired code (`TokenError`), a profile with no
+ * email. Without this filter each one surfaced as a raw JSON body from a
+ * top-level navigation to `/api/auth/google/callback`.
+ *
+ * Applied with `@UseFilters` on the callback route ONLY, never globally: every
+ * other route keeps `HttpExceptionFilter`'s JSON envelope.
+ *
+ * Only the code from the closed set (`auth-error-codes.ts`) leaves this
+ * filter. Logs carry the error's name and message and never the request URL,
+ * which holds the authorization code.
+ */
+let GoogleOAuthExceptionFilter = GoogleOAuthExceptionFilter_1 = class GoogleOAuthExceptionFilter {
+    configService;
+    logger = new common_1.Logger(GoogleOAuthExceptionFilter_1.name);
+    constructor(configService) {
+        this.configService = configService;
+    }
+    catch(exception, host) {
+        const reply = host.switchToHttp().getResponse();
+        const code = (0, auth_error_codes_1.resolveAuthErrorCode)(exception);
+        this.log(exception, code);
+        // Nothing sensible can be redirected once a response has started.
+        if (reply.sent || reply.raw?.headersSent)
+            return;
+        reply.redirect((0, auth_error_codes_1.buildAuthErrorRedirectUrl)(this.configService.get('appUrl'), code));
+    }
+    log(exception, code) {
+        const name = exception instanceof Error ? exception.name : typeof exception;
+        const message = exception instanceof Error ? exception.message : '';
+        // The person declining consent, or a policy refusal, is expected traffic.
+        if (code === 'access_denied' || code === 'not_allowlisted' || code === 'account_disabled') {
+            this.logger.warn(`Google sign-in ended as ${code} (${name})`);
+            return;
+        }
+        this.logger.error(`Google sign-in failed before the callback handler (${name}): ${message}`, exception instanceof Error ? exception.stack : undefined);
+    }
+};
+exports.GoogleOAuthExceptionFilter = GoogleOAuthExceptionFilter;
+exports.GoogleOAuthExceptionFilter = GoogleOAuthExceptionFilter = GoogleOAuthExceptionFilter_1 = __decorate([
+    (0, common_1.Catch)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], GoogleOAuthExceptionFilter);
+//# sourceMappingURL=google-oauth-exception.filter.js.map

package/dist/identity/auth/filters/google-oauth-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-oauth-exception.filter.js","sourceRoot":"","sources":["../../../../src/identity/auth/filters/google-oauth-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAKwB;AACxB,2CAA+C;AAC/C,0DAI6B;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,0BAA0B,kCAAhC,MAAM,0BAA0B;IAGR;IAFZ,MAAM,GAAG,IAAI,eAAM,CAAC,4BAA0B,CAAC,IAAI,CAAC,CAAC;IAEtE,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAE7D,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAA,uCAAoB,EAAC,SAAS,CAAC,CAAC;QAE7C,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAE1B,kEAAkE;QAClE,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,WAAW;YAAE,OAAO;QAEjD,KAAK,CAAC,QAAQ,CACZ,IAAA,4CAAyB,EAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,QAAQ,CAAC,EAAE,IAAI,CAAC,CAC1E,CAAC;IACJ,CAAC;IAEO,GAAG,CAAC,SAAkB,EAAE,IAAmB;QACjD,MAAM,IAAI,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC;QAC5E,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpE,0EAA0E;QAC1E,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC1F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,sDAAsD,IAAI,MAAM,OAAO,EAAE,EACzE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;qCAIsC,sBAAa;GAH9C,0BAA0B,CAkCtC"}

package/dist/identity/auth/guards/external-provider.guard.d.ts

@@ -0,0 +1,29 @@
+import { type CanActivate, type ExecutionContext, type Type } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { AuthService } from '../auth.service';
+/**
+ * A Passport guard for the strategy registered under `strategyName`, bridging
+ * Fastify to the raw Node objects Passport expects (the same bridge as
+ * `GoogleOAuthGuard`, without Google's `select_account` option).
+ *
+ * @param strategyName - the name the strategy is registered with in Passport.
+ * @returns a guard class.
+ *
+ * @stability experimental
+ */
+export declare function createPassportProviderGuard(strategyName: string): Type<CanActivate>;
+/**
+ * The guard of `AuthProviderController`.
+ *
+ * @internal
+ */
+export declare class ExternalProviderGuard implements CanActivate {
+    private readonly auth;
+    private readonly moduleRef;
+    private readonly logger;
+    private readonly delegates;
+    constructor(auth: AuthService, moduleRef: ModuleRef);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private delegateFor;
+}
+//# sourceMappingURL=external-provider.guard.d.ts.map

package/dist/identity/auth/guards/external-provider.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-provider.guard.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/external-provider.guard.ts"],"names":[],"mappings":"AAoBA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAKzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAU9C;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAkDnF;AAED;;;;GAIG;AACH,qBACa,qBAAsB,YAAW,WAAW;IAKrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkC;gBAGzC,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,SAAS;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAiBhD,WAAW;CA2B1B"}

package/dist/identity/auth/guards/external-provider.guard.js

@@ -0,0 +1,166 @@
+"use strict";
+// =============================================================================
+// The guard of the generic sign-in routes (PP-14.9)
+// =============================================================================
+//
+// `GET /api/auth/:providerId` and `/callback` serve every registered REDIRECT
+// provider that can complete a login (`mapProfile` present). This guard
+//
+//   1. resolves the provider from the route and answers 404 for anything that is
+//      not an enabled redirect provider (unknown, `custom`, not configured: one
+//      message, so the response does not tell a probe which ids exist);
+//   2. for a provider that supplies `createStrategy`, builds the strategy NOW,
+//      from the credential store as it is at this moment, and registers it with
+//      Passport under the provider id (a rotated secret needs no restart);
+//   3. runs Passport through the same raw-request/raw-response bridge
+//      `GoogleOAuthGuard` uses, and copies the strategy's result to the Fastify
+//      request as `req.user`.
+//
+// A class-based registration (`strategy` + `guard`) delegates to its own guard.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var ExternalProviderGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExternalProviderGuard = void 0;
+exports.createPassportProviderGuard = createPassportProviderGuard;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const passport_2 = __importDefault(require("passport"));
+const auth_error_codes_1 = require("../auth-error-codes");
+const auth_service_1 = require("../auth.service");
+const auth_provider_registry_1 = require("../providers/auth-provider.registry");
+/** The registered, enabled, redirect-mode definition behind a request, or a 404. */
+const UNKNOWN_PROVIDER = 'Unknown sign-in provider';
+/**
+ * A Passport guard for the strategy registered under `strategyName`, bridging
+ * Fastify to the raw Node objects Passport expects (the same bridge as
+ * `GoogleOAuthGuard`, without Google's `select_account` option).
+ *
+ * @param strategyName - the name the strategy is registered with in Passport.
+ * @returns a guard class.
+ *
+ * @stability experimental
+ */
+function createPassportProviderGuard(strategyName) {
+    let PassportProviderGuard = class PassportProviderGuard extends (0, passport_1.AuthGuard)(strategyName) {
+        getRequest(context) {
+            const request = context.switchToHttp().getRequest();
+            const raw = request.raw || request;
+            // Passport strategies read `req.query` (Express); Node's IncomingMessage
+            // has none, so hand it the Fastify request's parsed query.
+            if (raw !== request && raw.query === undefined)
+                raw.query = request.query;
+            // A strategy's state store (createCookieStateStore) writes its cookie on the
+            // response, which Passport does not hand it.
+            if (raw !== request && raw.res === undefined)
+                raw.res = context.switchToHttp().getResponse().raw;
+            // Return the raw Node.js IncomingMessage for Passport compatibility
+            return raw;
+        }
+        getResponse(context) {
+            const response = context.switchToHttp().getResponse();
+            // Return the raw Node.js ServerResponse for Passport compatibility
+            return response.raw || response;
+        }
+        handleRequest(err, user, _info, context) {
+            // A verified (or failed) state cookie is single use: expire it on the
+            // Fastify reply, whose own Set-Cookie would overwrite a raw header.
+            const raw = context.switchToHttp().getRequest().raw;
+            const reply = context.switchToHttp().getResponse();
+            if (raw?.clearAuthStateCookie && typeof reply.clearCookie === 'function') {
+                reply.clearCookie(raw.clearAuthStateCookie, { path: '/api/auth' });
+            }
+            if (err)
+                throw err;
+            if (!user) {
+                // `passport-oauth2` reports `?error=access_denied` (the person cancelled
+                // or denied consent) through `fail()`. Only the code is read, never the
+                // provider's `error_description`.
+                const query = context.switchToHttp().getRequest()?.query;
+                if (query?.error === 'access_denied') {
+                    throw new auth_error_codes_1.AuthLoginDeniedException('access_denied', 'Sign-in was cancelled or denied');
+                }
+                throw new Error('Authentication failed');
+            }
+            // Copy user from raw request to Fastify request so controllers can access it
+            context.switchToHttp().getRequest().user = user;
+            return user;
+        }
+    };
+    PassportProviderGuard = __decorate([
+        (0, common_1.Injectable)()
+    ], PassportProviderGuard);
+    return PassportProviderGuard;
+}
+/**
+ * The guard of `AuthProviderController`.
+ *
+ * @internal
+ */
+let ExternalProviderGuard = ExternalProviderGuard_1 = class ExternalProviderGuard {
+    auth;
+    moduleRef;
+    logger = new common_1.Logger(ExternalProviderGuard_1.name);
+    delegates = new Map();
+    constructor(auth, moduleRef) {
+        this.auth = auth;
+        this.moduleRef = moduleRef;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const id = request?.params?.providerId;
+        const provider = typeof id === 'string' ? auth_provider_registry_1.authProviderRegistry.get(id) : undefined;
+        if (!provider ||
+            (provider.mode ?? 'redirect') !== 'redirect' ||
+            typeof provider.mapProfile !== 'function' ||
+            !(await this.auth.isProviderEnabled(provider))) {
+            throw new common_1.NotFoundException(UNKNOWN_PROVIDER);
+        }
+        return (await this.delegateFor(provider)).canActivate(context);
+    }
+    async delegateFor(provider) {
+        if (provider.createStrategy) {
+            // Rebuilt for every request: the strategy reads the credential store, and
+            // a secret an administrator rotated must apply to the next sign-in.
+            const strategy = await provider.createStrategy(this.auth.authProviderContext());
+            // Namespaced: Passport's registry is process-global, and a provider id
+            // must never replace another strategy (for example `jwt`).
+            passport_2.default.use((0, auth_provider_registry_1.authProviderStrategyName)(provider.id), strategy);
+            let delegate = this.delegates.get(provider.id);
+            if (!delegate) {
+                delegate = new (createPassportProviderGuard((0, auth_provider_registry_1.authProviderStrategyName)(provider.id)))();
+                this.delegates.set(provider.id, delegate);
+            }
+            return delegate;
+        }
+        let delegate = this.delegates.get(provider.id);
+        if (!delegate) {
+            if (!provider.guard) {
+                this.logger.error(`Sign-in provider "${provider.id}" has neither createStrategy nor a guard`);
+                throw new common_1.NotFoundException(UNKNOWN_PROVIDER);
+            }
+            delegate = await this.moduleRef.create(provider.guard);
+            this.delegates.set(provider.id, delegate);
+        }
+        return delegate;
+    }
+};
+exports.ExternalProviderGuard = ExternalProviderGuard;
+exports.ExternalProviderGuard = ExternalProviderGuard = ExternalProviderGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        core_1.ModuleRef])
+], ExternalProviderGuard);
+//# sourceMappingURL=external-provider.guard.js.map

package/dist/identity/auth/guards/external-provider.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-provider.guard.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/external-provider.guard.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,iFAAiF;AACjF,gFAAgF;AAChF,wEAAwE;AACxE,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,sEAAsE;AACtE,gFAAgF;AAChF,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;;;;;;;;;;;;;AAmChF,kEAkDC;AAnFD,2CAOwB;AACxB,uCAAyC;AACzC,+CAA6C;AAC7C,wDAAgC;AAEhC,0DAA+D;AAC/D,kDAA8C;AAC9C,gFAI6C;AAE7C,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CAAC,YAAoB;IAE9D,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,IAAA,oBAAS,EAAC,YAAY,CAAC;QACzD,UAAU,CAAC,OAAyB;YAClC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;YACnC,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC1E,6EAA6E;YAC7E,6CAA6C;YAC7C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC;YACjG,oEAAoE;YACpE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,WAAW,CAAC,OAAyB;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,mEAAmE;YACnE,OAAO,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC;QAClC,CAAC;QAED,aAAa,CAAkB,GAAiB,EAAE,IAAmB,EAAE,KAAc,EAAE,OAAyB;YAC9G,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,GAAoD,CAAC;YACrG,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;YACnD,IAAI,GAAG,EAAE,oBAAoB,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACzE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YAEnB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,yEAAyE;gBACzE,wEAAwE;gBACxE,kCAAkC;gBAClC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,KAA4C,CAAC;gBAChG,IAAI,KAAK,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,2CAAwB,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;gBACzF,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,6EAA6E;YAC7E,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAA;IA9CK,qBAAqB;QAD1B,IAAA,mBAAU,GAAE;OACP,qBAAqB,CA8C1B;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAKb;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE5D,YACmB,IAAiB,EACjB,SAAoB;QADpB,SAAI,GAAJ,IAAI,CAAa;QACjB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,EAAE,GAAY,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC;QAChD,MAAM,QAAQ,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,6CAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnF,IACE,CAAC,QAAQ;YACT,CAAC,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,UAAU;YAC5C,OAAO,QAAQ,CAAC,UAAU,KAAK,UAAU;YACzC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAA+B,CAAC;IAC/F,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAgC;QACxD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,oEAAoE;YACpE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;YAChF,uEAAuE;YACvE,2DAA2D;YAC3D,kBAAQ,CAAC,GAAG,CAAC,IAAA,iDAAwB,EAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAA,iDAAwB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,EAAE,0CAA0C,CAAC,CAAC;gBAC9F,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,CAAC,CAAC;YAChD,CAAC;YACD,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAA;AArDY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAMc,0BAAW;QACN,gBAAS;GAN5B,qBAAqB,CAqDjC"}

package/dist/identity/auth/guards/google-oauth.guard.d.ts

@@ -0,0 +1,70 @@
+import { ExecutionContext } from '@nestjs/common';
+/**
+ * Per-request `passport.authenticate` options of {@link GoogleOAuthGuard}.
+ *
+ * @stability stable
+ */
+export interface GoogleAuthenticateOptions {
+    /** `select_account`: show Google's account chooser. */
+    prompt: 'select_account';
+}
+declare const GoogleOAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * Google OAuth guard for Fastify
+ *
+ * Initiates the Google OAuth flow when applied to a route.
+ * Used on both the initial OAuth endpoint and the callback endpoint.
+ *
+ * Note: Passport OAuth strategies expect Express-style request/response objects.
+ * This guard overrides getRequest/getResponse to return raw Node.js http objects
+ * that Passport can work with. After authentication, it copies the user back
+ * to the Fastify request so controllers can access req.user normally.
+ *
+ * The guard of the `google` sign-in provider (`registerAuthProvider`).
+ *
+ * @stability stable
+ */
+export declare class GoogleOAuthGuard extends GoogleOAuthGuard_base {
+    /**
+     * The raw Node.js request, for Passport.
+     *
+     * @param context - the execution context.
+     * @returns the raw request.
+     */
+    getRequest(context: ExecutionContext): any;
+    /**
+     * Per-request options for `passport.authenticate` (#652).
+     *
+     * `GET /auth/google?select_account=1` forwards `prompt=select_account`, so
+     * Google shows its account chooser instead of silently re-using the signed-in
+     * account. That is the way out for someone who was refused with one account and
+     * wants to try another. Anything else leaves the behaviour unchanged.
+     *
+     * The query is read from the FASTIFY request: `getRequest` above returns the
+     * raw `IncomingMessage`, which has no parsed `query`.
+     *
+     * @param context - the execution context.
+     * @returns the options, or `undefined`.
+     */
+    getAuthenticateOptions(context: ExecutionContext): GoogleAuthenticateOptions | undefined;
+    /**
+     * The raw Node.js response, for Passport.
+     *
+     * @param context - the execution context.
+     * @returns the raw response.
+     */
+    getResponse(context: ExecutionContext): any;
+    /**
+     * Turns a consent denial into `AuthLoginDeniedException('access_denied')`,
+     * rethrows any other error, and returns the profile.
+     *
+     * @param err - Passport's error.
+     * @param user - the profile, or `false`.
+     * @param _info - Passport's info.
+     * @param context - the execution context.
+     * @returns the profile.
+     */
+    handleRequest<TUser = unknown>(err: Error | null, user: TUser | false, _info: unknown, context: ExecutionContext): TUser;
+}
+export {};
+//# sourceMappingURL=google-oauth.guard.d.ts.map

package/dist/identity/auth/guards/google-oauth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-oauth.guard.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/google-oauth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAI9D;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,uDAAuD;IACvD,MAAM,EAAE,gBAAgB,CAAC;CAC1B;;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,gBAAiB,SAAQ,qBAAmB;IACvD;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,gBAAgB;IAMpC;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,yBAAyB,GAAG,SAAS;IAUxF;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE,gBAAgB;IAMrC;;;;;;;;;OASG;IACH,aAAa,CAAC,KAAK,GAAG,OAAO,EAC3B,GAAG,EAAE,KAAK,GAAG,IAAI,EACjB,IAAI,EAAE,KAAK,GAAG,KAAK,EACnB,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,gBAAgB,GACxB,KAAK;CAgCT"}

package/dist/identity/auth/guards/google-oauth.guard.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleOAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const auth_error_codes_1 = require("../auth-error-codes");
+/**
+ * Google OAuth guard for Fastify
+ *
+ * Initiates the Google OAuth flow when applied to a route.
+ * Used on both the initial OAuth endpoint and the callback endpoint.
+ *
+ * Note: Passport OAuth strategies expect Express-style request/response objects.
+ * This guard overrides getRequest/getResponse to return raw Node.js http objects
+ * that Passport can work with. After authentication, it copies the user back
+ * to the Fastify request so controllers can access req.user normally.
+ *
+ * The guard of the `google` sign-in provider (`registerAuthProvider`).
+ *
+ * @stability stable
+ */
+let GoogleOAuthGuard = class GoogleOAuthGuard extends (0, passport_1.AuthGuard)('google') {
+    /**
+     * The raw Node.js request, for Passport.
+     *
+     * @param context - the execution context.
+     * @returns the raw request.
+     */
+    getRequest(context) {
+        const request = context.switchToHttp().getRequest();
+        // Return the raw Node.js IncomingMessage for Passport compatibility
+        return request.raw || request;
+    }
+    /**
+     * Per-request options for `passport.authenticate` (#652).
+     *
+     * `GET /auth/google?select_account=1` forwards `prompt=select_account`, so
+     * Google shows its account chooser instead of silently re-using the signed-in
+     * account. That is the way out for someone who was refused with one account and
+     * wants to try another. Anything else leaves the behaviour unchanged.
+     *
+     * The query is read from the FASTIFY request: `getRequest` above returns the
+     * raw `IncomingMessage`, which has no parsed `query`.
+     *
+     * @param context - the execution context.
+     * @returns the options, or `undefined`.
+     */
+    getAuthenticateOptions(context) {
+        const query = context.switchToHttp().getRequest()?.query;
+        return query?.select_account === '1'
+            ? { prompt: 'select_account' }
+            : undefined;
+    }
+    /**
+     * The raw Node.js response, for Passport.
+     *
+     * @param context - the execution context.
+     * @returns the raw response.
+     */
+    getResponse(context) {
+        const response = context.switchToHttp().getResponse();
+        // Return the raw Node.js ServerResponse for Passport compatibility
+        return response.raw || response;
+    }
+    /**
+     * Turns a consent denial into `AuthLoginDeniedException('access_denied')`,
+     * rethrows any other error, and returns the profile.
+     *
+     * @param err - Passport's error.
+     * @param user - the profile, or `false`.
+     * @param _info - Passport's info.
+     * @param context - the execution context.
+     * @returns the profile.
+     */
+    handleRequest(err, user, _info, context) {
+        if (err) {
+            throw err;
+        }
+        if (!user) {
+            // `passport-oauth2` reports `?error=access_denied` (the person cancelled
+            // or denied consent at Google) through `fail()`, not `error()`, so it
+            // arrives here as `!user` with no `err`. Name it, so the callback can
+            // redirect with `error=access_denied` instead of a generic failure (#652).
+            // The query is Google-supplied, so only its code is read, never its
+            // `error_description`.
+            const query = context.switchToHttp().getRequest()?.query;
+            if (query?.error === 'access_denied') {
+                throw new auth_error_codes_1.AuthLoginDeniedException('access_denied', 'Google sign-in was cancelled or denied');
+            }
+            throw new Error('Authentication failed');
+        }
+        // Copy user from raw request to Fastify request so controllers can access it
+        const fastifyRequest = context.switchToHttp().getRequest();
+        fastifyRequest.user = user;
+        return user;
+    }
+};
+exports.GoogleOAuthGuard = GoogleOAuthGuard;
+exports.GoogleOAuthGuard = GoogleOAuthGuard = __decorate([
+    (0, common_1.Injectable)()
+], GoogleOAuthGuard);
+//# sourceMappingURL=google-oauth.guard.js.map

package/dist/identity/auth/guards/google-oauth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-oauth.guard.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/google-oauth.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA8D;AAC9D,+CAA6C;AAC7C,0DAA+D;AAY/D;;;;;;;;;;;;;;GAcG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,IAAA,oBAAS,EAAC,QAAQ,CAAC;IACvD;;;;;OAKG;IACH,UAAU,CAAC,OAAyB;QAClC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,oEAAoE;QACpE,OAAO,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,sBAAsB,CAAC,OAAyB;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,KAEtC,CAAC;QAEd,OAAO,KAAK,EAAE,cAAc,KAAK,GAAG;YAClC,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE;YAC9B,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,mEAAmE;QACnE,OAAO,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC;IAClC,CAAC;IAED;;;;;;;;;OASG;IACH,aAAa,CACX,GAAiB,EACjB,IAAmB,EACnB,KAAc,EACd,OAAyB;QAEzB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,2EAA2E;YAC3E,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,KAEtC,CAAC;YAEd,IAAI,KAAK,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;gBACrC,MAAM,IAAI,2CAAwB,CAChC,eAAe,EACf,wCAAwC,CACzC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,6EAA6E;QAC7E,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAC3D,cAAc,CAAC,IAAI,GAAG,IAAI,CAAC;QAE3B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhGY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAgG5B"}

package/dist/identity/auth/guards/index.d.ts

@@ -0,0 +1,5 @@
+export * from './google-oauth.guard';
+export * from './jwt-auth.guard';
+export * from './permissions.guard';
+export * from './roles.guard';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/auth/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,eAAe,CAAC"}

package/dist/identity/auth/guards/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./google-oauth.guard"), exports);
+__exportStar(require("./jwt-auth.guard"), exports);
+__exportStar(require("./permissions.guard"), exports);
+__exportStar(require("./roles.guard"), exports);
+//# sourceMappingURL=index.js.map

package/dist/identity/auth/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/identity/auth/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,mDAAiC;AACjC,sDAAoC;AACpC,gDAA8B"}

package/dist/identity/auth/guards/jwt-auth.guard.d.ts

@@ -0,0 +1,85 @@
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PatService } from '../../pat/pat.service';
+import { type IdentityNodeCredentials } from '../../ports';
+/**
+ * The one route prefix a `nod_` credential may reach. No trailing slash.
+ *
+ * @stability stable
+ */
+export declare const NODE_ROUTE_PREFIX = "/api/nodes";
+declare const JwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * JWT authentication guard.
+ *
+ * Validates JWT tokens on protected routes. Routes marked `@Public()` are
+ * skipped. Two opaque bearer families are recognized before Passport is ever
+ * reached:
+ *
+ *   * `Bearer pat_…` — a personal access token, accepted on EVERY
+ *     authenticated route with the owner's full authority. That universality
+ *     is a documented promise of this API (`openapi/description.ts`) and is
+ *     proven by `test/auth/pat-universality.integration.spec.ts`.
+ *
+ *   * `Bearer nod_…` — a worker-node credential, confined to
+ *     {@link NODE_ROUTE_PREFIX}. Everything else is a 403. See the block
+ *     comment above and docs/specs/worker-nodes.md.
+ *
+ * The two branches are intentionally asymmetric, and the asymmetry IS the
+ * security model: a PAT is a human deliberately delegating their own
+ * authority to a script they control, while a node credential is authority
+ * handed to an unattended process on a machine the deployment may not own.
+ *
+ * @stability stable
+ */
+export declare class JwtAuthGuard extends JwtAuthGuard_base {
+    private reflector;
+    private patService;
+    private nodeCredentialService;
+    constructor(reflector: Reflector, patService: PatService, nodeCredentialService: IdentityNodeCredentials);
+    /**
+     * Determines if the route requires authentication.
+     *
+     * Order: `@Public()` first, then the two opaque bearer families, then
+     * Passport. Note that a `@Public()` route short-circuits BEFORE either
+     * opaque branch, so a public endpoint never pays for a credential lookup
+     * and a `nod_` token is never 403'd on a route that needs no
+     * authentication at all.
+     */
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * Sets `request.principal` (ADR 0001, #724) beside `request.user`: the
+     * same graph, bound to the org the credential path validated, with the
+     * credential kind this branch admitted. A node principal has no
+     * `activeOrgId`. Skipped for a `request.user` that is not a loaded graph
+     * (a unit test's stub), which then has no principal.
+     */
+    private attachPrincipal;
+    /**
+     * Whether this request targets a route a `nod_` credential may reach.
+     *
+     * READS THE RAW URL, NOT NEST'S ROUTE METADATA. `context.getHandler()` /
+     * `getClass()` would tell us which controller Nest matched, and gating on
+     * "is this the nodes controller" is the tempting version. It is the wrong
+     * version: the answer would then depend on decorators #268 has not written
+     * yet, and any new controller that forgot the marker would silently be
+     * either open or closed depending on which default we picked. A path is a
+     * fact about the request that exists before routing and cannot be
+     * accidentally omitted.
+     *
+     * `originalUrl ?? url` covers both adapters: Fastify (this application's)
+     * exposes the full path on `url`, Express rewrites `url` when a router is
+     * mounted and preserves the real path on `originalUrl`. Taking
+     * `originalUrl` first means a future adapter change cannot quietly narrow
+     * what this function is looking at.
+     *
+     * The query string is stripped because it is not part of route identity:
+     * `/api/nodes?x=1` is the nodes collection and must match, while nothing
+     * after `?` may be allowed to influence the decision — a caller who could
+     * append `?/api/nodes` to a forbidden path and pass would have found a
+     * complete bypass.
+     */
+    private isNodeRoute;
+}
+export {};
+//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/identity/auth/guards/jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAA6B,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAgDtF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,eAAe,CAAC;;AAS9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,UAAU;IACiB,OAAO,CAAC,qBAAqB;gBAFxD,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,UAAU,EACa,qBAAqB,EAAE,uBAAuB;IAK3F;;;;;;;;OAQG;IACG,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmF9D;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,WAAW;CAgBpB"}