@marxbiotech/signet-integration 0.1.0

package/dist/guard.js

@@ -0,0 +1,210 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetBearerGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const bearer_challenge_1 = require("./bearer-challenge");
+const deployment_profile_1 = require("./deployment-profile");
+const log_sanitise_1 = require("./log-sanitise");
+const options_1 = require("./options");
+const principal_resolver_1 = require("./principal-resolver");
+const public_decorator_1 = require("./public.decorator");
+const strategy_1 = require("./strategy");
+// The decision line's own keys. A resolver's `logFields` may not reuse them:
+// a second `metric=` or `clientId=` on one line is whichever copy the log
+// parser keeps, and operators alert on these.
+const RESERVED_LOG_KEYS = new Set([
+    'metric',
+    'reason',
+    'clientId',
+    'environment',
+]);
+// Nest's OPTIONAL_DEPS_METADATA. `@nestjs/common` does not re-export it.
+const OPTIONAL_PARAMTYPES = 'optional:paramtypes';
+// AuthGuard's mixin marks its constructor parameter 0 `@Optional()`.
+// `Reflect.getMetadata` walks the constructor prototype chain, so a subclass
+// that never writes its own list treats ITS parameter 0 — the principal
+// resolver — as optional. `@Optional()` on a later parameter copies that
+// inherited list onto this constructor before appending its own index.
+// Parameter decorators run before this one, so the copy is already own
+// metadata by the time this drops index 0 (and writes a list when absent).
+function requirePrincipalResolver() {
+    return (target) => {
+        const own = Reflect.getOwnMetadata(OPTIONAL_PARAMTYPES, target);
+        const optionalIndexes = Array.isArray(own)
+            ? own.filter((index) => index !== 0)
+            : [];
+        Reflect.defineMetadata(OPTIONAL_PARAMTYPES, optionalIndexes, target);
+    };
+}
+// The Bearer channel's guard: Passport dispatches SignetJwtStrategy, and a
+// false from it is a uniform 401. A route marked `@Public()` (on the handler
+// or its class) is let through first, so the guard can be an APP_GUARD on
+// its own; a consumer with a credential dispatcher of its own decides
+// `@Public()` there and never hands a public route to this guard. What
+// follows is the layer on top:
+//
+//   token lacks the admission scope         → 403 (service scope), with an
+//                                             insufficient_scope challenge
+//   resolver says { ok: false }             → 403, bare
+//   resolver throws PrincipalStoreUnavailableError → 503, fail closed
+//   resolver throws an HttpException        → its own status
+//   resolver throws anything else           → 500, the error under its own name
+//   Passport passed but attached no user    → 500, programming error
+//
+// None of these are 401: the token was valid. The 403 messages distinguish
+// "get a token with the right scope" from "ask an administrator" without
+// naming what the caller does not hold. The 500 is deliberately NOT a 503:
+// a bug in the resolver must not send the operator to check the database.
+let SignetBearerGuard = class SignetBearerGuard extends (0, passport_1.AuthGuard)(strategy_1.SIGNET_JWT_STRATEGY) {
+    resolver;
+    profiles;
+    signetOptions;
+    reflector;
+    // The subclass's name when a consumer subclasses this guard, so its log
+    // `context` keeps the name the consumer's operators filter on.
+    logger = new common_1.Logger(this.constructor.name);
+    constructor(resolver, profiles, signetOptions, reflector) {
+        super();
+        this.resolver = resolver;
+        this.profiles = profiles;
+        this.signetOptions = signetOptions;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        if (this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_ROUTE, [
+            context.getHandler(),
+            context.getClass(),
+        ]) === true) {
+            return true;
+        }
+        // Typed unknown: the base declares boolean | Promise<boolean> |
+        // Observable<boolean>, and anything other than a literal true is treated
+        // as "did not pass".
+        let passed;
+        try {
+            passed = await super.canActivate(context);
+        }
+        catch (error) {
+            // Passport's own UnauthorizedException carries a message; the contract
+            // is one indistinguishable 401. Anything else is a programming error
+            // and must not be dressed up as an authentication failure.
+            if (error instanceof common_1.UnauthorizedException) {
+                throw new common_1.UnauthorizedException();
+            }
+            throw error;
+        }
+        const request = context.switchToHttp().getRequest();
+        const identity = request.user;
+        if (passed !== true || identity === undefined) {
+            this.logFailure('signet strategy did not pass cleanly', 'signet_identity_missing', 'none');
+            throw new common_1.InternalServerErrorException('signet strategy did not pass cleanly');
+        }
+        const { admissionScope } = this.signetOptions;
+        if (!identity.scopes.includes(admissionScope)) {
+            this.logger.warn(`signet token lacks service scope: metric=signet_scope_missing source=${(0, log_sanitise_1.sanitiseLogToken)(request.ip ?? 'none')}`);
+            // A 403 a client CAN fix by re-authorising (RFC 6750 §3.1); the
+            // resolver's refusals below stay bare, because a wider OAuth scope
+            // would not supply a missing local authorization.
+            throw new bearer_challenge_1.InsufficientScopeException(admissionScope);
+        }
+        const environment = this.profiles.profile.environment;
+        let resolution;
+        try {
+            resolution = await this.resolver.resolve(identity);
+        }
+        catch (error) {
+            // An HttpException is a decision already taken below us; it is neither
+            // the store nor a bug, and it must reach the caller with its own status.
+            if (error instanceof common_1.HttpException)
+                throw error;
+            if (error instanceof principal_resolver_1.PrincipalStoreUnavailableError) {
+                // The line names what actually failed (the cause's class), not the
+                // wrapper; the driver's message travels in the stack, never on the
+                // key=value line.
+                this.logFailure('authorization store unavailable', 'auth_store_unavailable', error.causeName, error.causeStack);
+                throw new common_1.ServiceUnavailableException('authorization store unavailable');
+            }
+            const errorName = error instanceof Error && error.name ? error.name : typeof error;
+            const stack = error instanceof Error ? error.stack : undefined;
+            // A bug: rethrow unchanged so Nest answers 500 and the error keeps its
+            // own name in the exception filter.
+            this.logFailure('authorization load failed', 'auth_store_error', errorName, stack);
+            throw error;
+        }
+        if (!resolution.ok) {
+            // The reason is logged for the operator and NOT returned.
+            this.logDecision('refused', identity.clientId, environment, resolution);
+            throw new common_1.ForbiddenException(this.signetOptions.principalRefusalMessage ??
+                'this identity holds no authorization in this service');
+        }
+        this.logDecision('authorized', identity.clientId, environment, resolution);
+        request[this.signetOptions.requestPrincipalKey] = resolution.principal;
+        return true;
+    }
+    // The one rendering of this guard's authorization DECISION: the line that
+    // lets a request through and the line that refuses one, so their field set
+    // and its order cannot drift apart -- metric, reason, the resolver's
+    // logFields in the order given, clientId, environment.
+    //
+    // What these lines disclose about the caller: the client id (software, not
+    // a person; a registration identifier, not a credential) and whatever the
+    // resolver chose to put in `logFields`. No `sub`, no issuer.
+    //
+    // Levels: a refusal is a `warn`, an authorization a `log` (info). One line
+    // per authorized request is the price of having any record of which client
+    // acted; it is paid deliberately, because the alternative is no record.
+    logDecision(outcome, clientId, environment, resolution) {
+        const consumerFields = Object.entries(resolution.logFields ?? {});
+        for (const [key] of consumerFields) {
+            if (RESERVED_LOG_KEYS.has(key)) {
+                // A programming error in the resolver, not a decision: surfaces as
+                // a 500 under its own name rather than a forged log line.
+                throw new Error(`resolver logFields must not use the reserved key ${key}`);
+            }
+        }
+        const pairs = [
+            ['reason', resolution.ok ? 'none' : resolution.reason],
+            ...consumerFields,
+            ['clientId', clientId],
+            ['environment', environment],
+        ];
+        const rendered = pairs
+            .map(([key, value]) => `${(0, log_sanitise_1.sanitiseLogToken)(key)}=${(0, log_sanitise_1.sanitiseLogToken)(value)}`)
+            .join(' ');
+        if (outcome === 'refused') {
+            this.logger.warn(`signet principal refused: metric=signet_principal_refused ${rendered}`);
+            return;
+        }
+        this.logger.log(`signet principal authorized: metric=signet_principal_authorized ${rendered}`);
+    }
+    // The one rendering of this guard's failure lines. Only the error's class
+    // name goes into the key=value line: the driver's message can carry the
+    // DSN or the SQL, so it travels in the stack as the SECOND argument, where
+    // a structured logger renders it after the filterable fields.
+    logFailure(message, metric, errorName, stack) {
+        this.logger.error(`${message}: metric=${metric} errorName=${(0, log_sanitise_1.sanitiseLogToken)(errorName)}`, stack);
+    }
+};
+exports.SignetBearerGuard = SignetBearerGuard;
+exports.SignetBearerGuard = SignetBearerGuard = __decorate([
+    (0, common_1.Injectable)(),
+    requirePrincipalResolver(),
+    __param(0, (0, common_1.Inject)(principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER)),
+    __param(2, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, deployment_profile_1.SignetDeploymentProfileService, Object, core_1.Reflector])
+], SignetBearerGuard);
+//# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uCAAyC;AACzC,+CAA6C;AAG7C,yDAAgE;AAChE,6DAAsE;AAEtE,iDAAkD;AAClD,uCAGmB;AACnB,6DAK8B;AAC9B,yDAAqD;AACrD,yCAAiD;AAEjD,6EAA6E;AAC7E,0EAA0E;AAC1E,8CAA8C;AAC9C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,SAAS,wBAAwB;IAC/B,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,GAAG,GAAY,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAUD,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wDAAwD;AACxD,sEAAsE;AACtE,6DAA6D;AAC7D,gFAAgF;AAChF,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAGnE,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,8BAAmB,CAAC;IAOhD;IACA;IAKA;IACA;IAbnB,wEAAwE;IACxE,+DAA+D;IAC9C,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAE5D,YAEmB,QAAiC,EACjC,QAAwC,EAKxC,aAAuC,EACvC,SAAoB;QAErC,KAAK,EAAE,CAAC;QATS,aAAQ,GAAR,QAAQ,CAAyB;QACjC,aAAQ,GAAR,QAAQ,CAAgC;QAKxC,kBAAa,GAAb,aAAa,CAA0B;QACvC,cAAS,GAAT,SAAS,CAAW;IAGvC,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAClD,IACE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kCAAe,EAAE;YACzD,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,EACX,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gEAAgE;QAChE,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAiB,CAAC;QACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,CACb,sCAAsC,EACtC,yBAAyB,EACzB,MAAM,CACP,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,IAAA,+BAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CACjH,CAAC;YACF,gEAAgE;YAChE,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,IAAI,6CAA0B,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACtD,IAAI,UAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,KAAK,YAAY,sBAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,IAAI,KAAK,YAAY,mDAA8B,EAAE,CAAC;gBACpD,mEAAmE;gBACnE,mEAAmE;gBACnE,kBAAkB;gBAClB,IAAI,CAAC,UAAU,CACb,iCAAiC,EACjC,wBAAwB,EACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;gBACF,MAAM,IAAI,oCAA2B,CACnC,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,uEAAuE;YACvE,oCAAoC;YACpC,IAAI,CAAC,UAAU,CACb,2BAA2B,EAC3B,kBAAkB,EAClB,SAAS,EACT,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,0DAA0D;YAC1D,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YACxE,MAAM,IAAI,2BAAkB,CAC1B,IAAI,CAAC,aAAa,CAAC,uBAAuB;gBACxC,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,uDAAuD;IACvD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IAChE,WAAW,CACjB,OAAiC,EACjC,QAAgB,EAChB,WAAmB,EACnB,UAAwC;QAExC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,mEAAmE;gBACnE,0DAA0D;gBAC1D,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAuB;YAChC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,GAAG,cAAc;YACjB,CAAC,UAAU,EAAE,QAAQ,CAAC;YACtB,CAAC,aAAa,EAAE,WAAW,CAAC;SAC7B,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK;aACnB,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,IAAI,IAAA,+BAAgB,EAAC,KAAK,CAAC,EAAE,CACxE;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA6D,QAAQ,EAAE,CACxE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mEAAmE,QAAQ,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,8DAA8D;IACtD,UAAU,CAChB,OAAe,EACf,MAC2E,EAC3E,SAAiB,EACjB,KAAc;QAEd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,OAAO,YAAY,MAAM,cAAc,IAAA,+BAAgB,EAAC,SAAS,CAAC,EAAE,EACvE,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AArLY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,mBAAU,GAAE;IACZ,wBAAwB,EAAE;IAOtB,WAAA,IAAA,eAAM,EAAC,8CAAyB,CAAC,CAAA;IAMjC,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;6CAJR,mDAA8B,UAM7B,gBAAS;GAd5B,iBAAiB,CAqL7B"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { bearerChallenge, carriesScopeChallenge, type ChallengeDecision, challengeFor, insufficientScopeChallenge, InsufficientScopeException, isResourceRequest, protectedResourceMetadataPath, protectedResourceMetadataUrl, type ScopeChallengeCarrier, } from './bearer-challenge';
+export { BearerChallengeFilter } from './bearer-challenge.filter';
+export { type ChannelFlags, type JwtSettings, readChannelFlags, readSignetAuthConfig, type SignetAuthConfig, type SignetEnvOptions, } from './config';
+export { type DeploymentProfile, type DeploymentProfileInput, type DeploymentProfileResolution, resolveDeploymentProfile, SignetDeploymentProfileService, } from './deployment-profile';
+export { SignetBearerGuard } from './guard';
+export { type JwtRejection, JwtRejectionEnum, JwtVerifier, REMOTE_JWKS_OPTIONS, type VerifiedSignetIdentity, type VerifyResult, } from './jwt-verifier';
+export { type ResolverProvider, SignetIntegrationModule, type SignetIntegrationModuleOptions, } from './module';
+export { DEVELOPMENT_ENVIRONMENT, SIGNET_INTEGRATION_OPTIONS, type SignetDeployedProfile, type SignetDevelopmentProfile, type SignetEnvNames, type SignetIntegrationOptions, } from './options';
+export { createSignetPrincipalDecorator } from './principal.decorator';
+export { type PrincipalResolution, PrincipalStoreUnavailableError, SIGNET_PRINCIPAL_RESOLVER, type SignetPrincipalResolver, } from './principal-resolver';
+export { createProtectedResourceController, type ProtectedResourceMetadata, } from './protected-resource.controller';
+export { IS_PUBLIC_ROUTE, Public } from './public.decorator';
+export { createScopeVocabulary, type ScopeVocabulary, type ScopeVocabularyInput, type TokenScopeRead, } from './scope-vocabulary';
+export { bearerToken, SIGNET_JWT_STRATEGY, SignetJwtStrategy, } from './strategy';
+export { validateSignetIntegrationOptions } from './validate-options';

package/dist/index.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSignetIntegrationOptions = exports.SignetJwtStrategy = exports.SIGNET_JWT_STRATEGY = exports.bearerToken = exports.createScopeVocabulary = exports.Public = exports.IS_PUBLIC_ROUTE = exports.createProtectedResourceController = exports.SIGNET_PRINCIPAL_RESOLVER = exports.PrincipalStoreUnavailableError = exports.createSignetPrincipalDecorator = exports.SIGNET_INTEGRATION_OPTIONS = exports.DEVELOPMENT_ENVIRONMENT = exports.SignetIntegrationModule = exports.REMOTE_JWKS_OPTIONS = exports.JwtVerifier = exports.JwtRejectionEnum = exports.SignetBearerGuard = exports.SignetDeploymentProfileService = exports.resolveDeploymentProfile = exports.readSignetAuthConfig = exports.readChannelFlags = exports.BearerChallengeFilter = exports.protectedResourceMetadataUrl = exports.protectedResourceMetadataPath = exports.isResourceRequest = exports.InsufficientScopeException = exports.insufficientScopeChallenge = exports.challengeFor = exports.carriesScopeChallenge = exports.bearerChallenge = void 0;
+var bearer_challenge_1 = require("./bearer-challenge");
+Object.defineProperty(exports, "bearerChallenge", { enumerable: true, get: function () { return bearer_challenge_1.bearerChallenge; } });
+Object.defineProperty(exports, "carriesScopeChallenge", { enumerable: true, get: function () { return bearer_challenge_1.carriesScopeChallenge; } });
+Object.defineProperty(exports, "challengeFor", { enumerable: true, get: function () { return bearer_challenge_1.challengeFor; } });
+Object.defineProperty(exports, "insufficientScopeChallenge", { enumerable: true, get: function () { return bearer_challenge_1.insufficientScopeChallenge; } });
+Object.defineProperty(exports, "InsufficientScopeException", { enumerable: true, get: function () { return bearer_challenge_1.InsufficientScopeException; } });
+Object.defineProperty(exports, "isResourceRequest", { enumerable: true, get: function () { return bearer_challenge_1.isResourceRequest; } });
+Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return bearer_challenge_1.protectedResourceMetadataPath; } });
+Object.defineProperty(exports, "protectedResourceMetadataUrl", { enumerable: true, get: function () { return bearer_challenge_1.protectedResourceMetadataUrl; } });
+var bearer_challenge_filter_1 = require("./bearer-challenge.filter");
+Object.defineProperty(exports, "BearerChallengeFilter", { enumerable: true, get: function () { return bearer_challenge_filter_1.BearerChallengeFilter; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "readChannelFlags", { enumerable: true, get: function () { return config_1.readChannelFlags; } });
+Object.defineProperty(exports, "readSignetAuthConfig", { enumerable: true, get: function () { return config_1.readSignetAuthConfig; } });
+var deployment_profile_1 = require("./deployment-profile");
+Object.defineProperty(exports, "resolveDeploymentProfile", { enumerable: true, get: function () { return deployment_profile_1.resolveDeploymentProfile; } });
+Object.defineProperty(exports, "SignetDeploymentProfileService", { enumerable: true, get: function () { return deployment_profile_1.SignetDeploymentProfileService; } });
+var guard_1 = require("./guard");
+Object.defineProperty(exports, "SignetBearerGuard", { enumerable: true, get: function () { return guard_1.SignetBearerGuard; } });
+var jwt_verifier_1 = require("./jwt-verifier");
+Object.defineProperty(exports, "JwtRejectionEnum", { enumerable: true, get: function () { return jwt_verifier_1.JwtRejectionEnum; } });
+Object.defineProperty(exports, "JwtVerifier", { enumerable: true, get: function () { return jwt_verifier_1.JwtVerifier; } });
+Object.defineProperty(exports, "REMOTE_JWKS_OPTIONS", { enumerable: true, get: function () { return jwt_verifier_1.REMOTE_JWKS_OPTIONS; } });
+var module_1 = require("./module");
+Object.defineProperty(exports, "SignetIntegrationModule", { enumerable: true, get: function () { return module_1.SignetIntegrationModule; } });
+var options_1 = require("./options");
+Object.defineProperty(exports, "DEVELOPMENT_ENVIRONMENT", { enumerable: true, get: function () { return options_1.DEVELOPMENT_ENVIRONMENT; } });
+Object.defineProperty(exports, "SIGNET_INTEGRATION_OPTIONS", { enumerable: true, get: function () { return options_1.SIGNET_INTEGRATION_OPTIONS; } });
+var principal_decorator_1 = require("./principal.decorator");
+Object.defineProperty(exports, "createSignetPrincipalDecorator", { enumerable: true, get: function () { return principal_decorator_1.createSignetPrincipalDecorator; } });
+var principal_resolver_1 = require("./principal-resolver");
+Object.defineProperty(exports, "PrincipalStoreUnavailableError", { enumerable: true, get: function () { return principal_resolver_1.PrincipalStoreUnavailableError; } });
+Object.defineProperty(exports, "SIGNET_PRINCIPAL_RESOLVER", { enumerable: true, get: function () { return principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER; } });
+var protected_resource_controller_1 = require("./protected-resource.controller");
+Object.defineProperty(exports, "createProtectedResourceController", { enumerable: true, get: function () { return protected_resource_controller_1.createProtectedResourceController; } });
+var public_decorator_1 = require("./public.decorator");
+Object.defineProperty(exports, "IS_PUBLIC_ROUTE", { enumerable: true, get: function () { return public_decorator_1.IS_PUBLIC_ROUTE; } });
+Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return public_decorator_1.Public; } });
+var scope_vocabulary_1 = require("./scope-vocabulary");
+Object.defineProperty(exports, "createScopeVocabulary", { enumerable: true, get: function () { return scope_vocabulary_1.createScopeVocabulary; } });
+var strategy_1 = require("./strategy");
+Object.defineProperty(exports, "bearerToken", { enumerable: true, get: function () { return strategy_1.bearerToken; } });
+Object.defineProperty(exports, "SIGNET_JWT_STRATEGY", { enumerable: true, get: function () { return strategy_1.SIGNET_JWT_STRATEGY; } });
+Object.defineProperty(exports, "SignetJwtStrategy", { enumerable: true, get: function () { return strategy_1.SignetJwtStrategy; } });
+var validate_options_1 = require("./validate-options");
+Object.defineProperty(exports, "validateSignetIntegrationOptions", { enumerable: true, get: function () { return validate_options_1.validateSignetIntegrationOptions; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uDAW4B;AAV1B,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AAErB,gHAAA,YAAY,OAAA;AACZ,8HAAA,0BAA0B,OAAA;AAC1B,8HAAA,0BAA0B,OAAA;AAC1B,qHAAA,iBAAiB,OAAA;AACjB,iIAAA,6BAA6B,OAAA;AAC7B,gIAAA,4BAA4B,OAAA;AAG9B,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,mCAOkB;AAJhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AAItB,2DAM8B;AAF5B,8HAAA,wBAAwB,OAAA;AACxB,oIAAA,8BAA8B,OAAA;AAEhC,iCAA4C;AAAnC,0GAAA,iBAAiB,OAAA;AAC1B,+CAOwB;AALtB,gHAAA,gBAAgB,OAAA;AAChB,2GAAA,WAAW,OAAA;AACX,mHAAA,mBAAmB,OAAA;AAIrB,mCAIkB;AAFhB,iHAAA,uBAAuB,OAAA;AAGzB,qCAOmB;AANjB,kHAAA,uBAAuB,OAAA;AACvB,qHAAA,0BAA0B,OAAA;AAM5B,6DAAuE;AAA9D,qIAAA,8BAA8B,OAAA;AACvC,2DAK8B;AAH5B,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AAG3B,iFAGyC;AAFvC,kJAAA,iCAAiC,OAAA;AAGnC,uDAA6D;AAApD,mHAAA,eAAe,OAAA;AAAE,0GAAA,MAAM,OAAA;AAChC,uDAK4B;AAJ1B,yHAAA,qBAAqB,OAAA;AAKvB,uCAIoB;AAHlB,uGAAA,WAAW,OAAA;AACX,+GAAA,mBAAmB,OAAA;AACnB,6GAAA,iBAAiB,OAAA;AAEnB,uDAAsE;AAA7D,oIAAA,gCAAgC,OAAA"}

package/dist/jwt-verifier.d.ts

@@ -0,0 +1,36 @@
+import { type JWTPayload } from 'jose';
+import { type JwtSettings } from './config';
+export declare const REMOTE_JWKS_OPTIONS: {
+    readonly cacheMaxAge: 600000;
+    readonly cooldownDuration: 30000;
+    readonly timeoutDuration: 3000;
+};
+export interface VerifiedSignetIdentity {
+    readonly claims: Readonly<JWTPayload>;
+    readonly clientId: string;
+    readonly issuer: string;
+    readonly scopes: readonly string[];
+    readonly subject: string;
+}
+export declare const JwtRejectionEnum: {
+    readonly BAD_SCOPE: "ERR_JWT_BAD_SCOPE";
+    readonly JWKS_PARSE: "ERR_JOSE_GENERIC:jwks_parse";
+    readonly JWKS_STATUS: "ERR_JOSE_GENERIC:jwks_status";
+    readonly NO_CLIENT_ID: "ERR_JWT_NO_CLIENT_ID";
+    readonly NO_EXP: "ERR_JWT_NO_EXP";
+    readonly NO_SUB: "ERR_JWT_NO_SUB";
+};
+export type JwtRejection = (typeof JwtRejectionEnum)[keyof typeof JwtRejectionEnum];
+export type VerifyResult = {
+    ok: false;
+    reason: string;
+} | {
+    ok: true;
+    identity: VerifiedSignetIdentity;
+};
+export declare class JwtVerifier {
+    private readonly settings;
+    private readonly keys;
+    constructor(settings: JwtSettings);
+    verify(token: string): Promise<VerifyResult>;
+}

package/dist/jwt-verifier.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtVerifier = exports.JwtRejectionEnum = exports.REMOTE_JWKS_OPTIONS = void 0;
+const jose_1 = require("jose");
+// Asymmetric signatures only. Allowing HS* opens alg confusion: an attacker
+// signs with our PUBLIC key bytes as the HMAC secret, and a verifier that
+// follows the header's alg accepts it. jose's JWKS path already refuses
+// non-RS/PS/ES/Ed algorithms and only imports public keys, but the keys
+// arrive from a remote endpoint rather than from configuration we read, so
+// the explicit allowlist stays as the second, stated line.
+const ASYMMETRIC_ALGORITHMS = [
+    'RS256',
+    'RS384',
+    'RS512',
+    'PS256',
+    'PS384',
+    'PS512',
+    'ES256',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
+// The remote JWKS options, spelled out rather than left to jose's defaults so
+// the contract is fixed. A longer cooldownDuration only delays the refetch an
+// unknown kid triggers after a rotation, and buys no failure backoff -- a
+// failed fetch clears the pending fetch and the next request tries again
+// regardless.
+exports.REMOTE_JWKS_OPTIONS = {
+    cacheMaxAge: 600_000,
+    cooldownDuration: 30_000,
+    timeoutDuration: 3_000,
+};
+// This package's own rejection codes, alongside the ERR_* codes jose throws.
+exports.JwtRejectionEnum = {
+    BAD_SCOPE: 'ERR_JWT_BAD_SCOPE',
+    JWKS_PARSE: 'ERR_JOSE_GENERIC:jwks_parse',
+    JWKS_STATUS: 'ERR_JOSE_GENERIC:jwks_status',
+    NO_CLIENT_ID: 'ERR_JWT_NO_CLIENT_ID',
+    NO_EXP: 'ERR_JWT_NO_EXP',
+    NO_SUB: 'ERR_JWT_NO_SUB',
+};
+// jose reports both JWKS transport failures -- a non-200 status and an
+// unparseable body -- as JOSEError with the same ERR_JOSE_GENERIC code; only
+// the message tells them apart, and an operator reading logs during an
+// outage needs to.
+function joseRejection(error) {
+    if (error.code !== 'ERR_JOSE_GENERIC')
+        return error.code;
+    if (error.message.includes('Expected 200 OK')) {
+        return exports.JwtRejectionEnum.JWKS_STATUS;
+    }
+    if (error.message.includes('Failed to parse')) {
+        return exports.JwtRejectionEnum.JWKS_PARSE;
+    }
+    return error.code;
+}
+// Hydra's JWT access tokens carry the granted scopes as `scp` (an array);
+// RFC 9068 §2.2.3 spells the same thing `scope` (a space-delimited string).
+// Both are read. Neither present is an EMPTY scope set, which the guard
+// refuses with a 403 for lacking the admission scope; either present with the
+// wrong shape is null, a contract violation the caller answers with 401.
+function scopesOf(payload) {
+    const { scope, scp } = payload;
+    const scopes = [];
+    if (scope !== undefined) {
+        if (typeof scope !== 'string')
+            return null;
+        scopes.push(...scope.split(' ').filter((value) => value !== ''));
+    }
+    if (scp !== undefined) {
+        if (!Array.isArray(scp))
+            return null;
+        for (const value of scp) {
+            if (typeof value !== 'string')
+                return null;
+            scopes.push(value);
+        }
+    }
+    return scopes;
+}
+// Verifies a Signet access token against the trusted issuer's JWKS and the
+// deployment's canonical resource.
+//
+// Returns a result rather than throwing: the caller logs the reason and
+// answers a uniform 401, so a rejection never tells the client WHICH check
+// failed. Key fetch failures land in the same catch -- unreachable JWKS
+// refuses, never admits.
+//
+// One instance for the life of the process: the remote key set's cache,
+// cooldown and pending-fetch state live on it, so constructing one per
+// request would refetch the whole JWKS on every request and defeat the
+// cache.
+class JwtVerifier {
+    settings;
+    keys;
+    constructor(settings) {
+        this.settings = settings;
+        this.keys = (0, jose_1.createRemoteJWKSet)(new URL(settings.jwksUri), exports.REMOTE_JWKS_OPTIONS);
+    }
+    async verify(token) {
+        let payload;
+        try {
+            // issuer / audience / exp / nbf are jose's. audience accepts a string
+            // or an array containing the expected value; the issuer's fixed client
+            // policy is what keeps a token single-audience.
+            ({ payload } = await (0, jose_1.jwtVerify)(token, this.keys, {
+                algorithms: ASYMMETRIC_ALGORITHMS,
+                audience: this.settings.audience,
+                clockTolerance: this.settings.clockToleranceS,
+                issuer: this.settings.issuer,
+            }));
+        }
+        catch (error) {
+            if (error instanceof jose_1.errors.JOSEError) {
+                return { ok: false, reason: joseRejection(error) };
+            }
+            // Errors from the JWKS fetch that are not jose's own -- Node system
+            // errors (ECONNREFUSED, ENOTFOUND, ETIMEDOUT, ...) and a key that Node
+            // cannot import (crypto's ERR_CRYPTO_* codes) -- carry a string code and
+            // refuse like any other unusable issuer. Matched by shape: Node creates
+            // them outside a test runner's vm realm, where instanceof Error is
+            // false.
+            const { code } = (error ?? {});
+            if (typeof code === 'string')
+                return { ok: false, reason: code };
+            // Anything else is a defect in this process, not a bad token: it must
+            // surface as a 500, not hide behind a 401.
+            throw error;
+        }
+        // jose does not require exp: a token without one never expires, which
+        // is a long-lived credential minted by omission.
+        if (typeof payload.exp !== 'number') {
+            return { ok: false, reason: exports.JwtRejectionEnum.NO_EXP };
+        }
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+            return { ok: false, reason: exports.JwtRejectionEnum.NO_SUB };
+        }
+        // RFC 9068 §2.2 makes client_id a required claim of a JWT access token
+        // and Signet issues it on every token, dynamically registered clients
+        // included -- so a token without one is not the shape this contract
+        // accepts, and its absence is an access-token contract failure (401). It
+        // is NOT a lookup key: the guard logs it as the software that presented
+        // the credential.
+        if (typeof payload.client_id !== 'string' || payload.client_id === '') {
+            return { ok: false, reason: exports.JwtRejectionEnum.NO_CLIENT_ID };
+        }
+        const scopes = scopesOf(payload);
+        if (scopes === null) {
+            return { ok: false, reason: exports.JwtRejectionEnum.BAD_SCOPE };
+        }
+        // iat is deliberately not required and no maxTokenAge is applied.
+        // Business roles the token might carry are ignored here: authorization
+        // is the consumer's resolver's alone.
+        return {
+            identity: {
+                claims: Object.freeze(payload),
+                clientId: payload.client_id,
+                issuer: this.settings.issuer,
+                scopes,
+                subject: payload.sub,
+            },
+            ok: true,
+        };
+    }
+}
+exports.JwtVerifier = JwtVerifier;
+//# sourceMappingURL=jwt-verifier.js.map

package/dist/jwt-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verifier.js","sourceRoot":"","sources":["../src/jwt-verifier.ts"],"names":[],"mappings":";;;AAAA,+BAMc;AAId,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,MAAM,qBAAqB,GAAG;IAC5B,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC;AAEF,8EAA8E;AAC9E,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,cAAc;AACD,QAAA,mBAAmB,GAAG;IACjC,WAAW,EAAE,OAAO;IACpB,gBAAgB,EAAE,MAAM;IACxB,eAAe,EAAE,KAAK;CACgB,CAAC;AAkBzC,6EAA6E;AAChE,QAAA,gBAAgB,GAAG;IAC9B,SAAS,EAAE,mBAAmB;IAC9B,UAAU,EAAE,6BAA6B;IACzC,WAAW,EAAE,8BAA8B;IAC3C,YAAY,EAAE,sBAAsB;IACpC,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;CAChB,CAAC;AAUX,uEAAuE;AACvE,6EAA6E;AAC7E,uEAAuE;AACvE,mBAAmB;AACnB,SAAS,aAAa,CAAC,KAAuB;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,OAAO,wBAAgB,CAAC,WAAW,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,OAAO,wBAAgB,CAAC,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,8EAA8E;AAC9E,yEAAyE;AACzE,SAAS,QAAQ,CAAC,OAAmB;IACnC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,mCAAmC;AACnC,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,wEAAwE;AACxE,yBAAyB;AACzB,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,SAAS;AACT,MAAa,WAAW;IAGO;IAFZ,IAAI,CAAwC;IAE7D,YAA6B,QAAqB;QAArB,aAAQ,GAAR,QAAQ,CAAa;QAChD,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAC5B,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EACzB,2BAAmB,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACH,sEAAsE;YACtE,uEAAuE;YACvE,gDAAgD;YAChD,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC/C,UAAU,EAAE,qBAAqB;gBACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAChC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;gBAC7C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;aAC7B,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAM,CAAC,SAAS,EAAE,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,CAAC;YACD,oEAAoE;YACpE,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,mEAAmE;YACnE,SAAS;YACT,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuB,CAAC;YACrD,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACjE,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;QAED,sEAAsE;QACtE,iDAAiD;QACjD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAgB,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAgB,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,wEAAwE;QACxE,kBAAkB;QAClB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAgB,CAAC,YAAY,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAgB,CAAC,SAAS,EAAE,CAAC;QAC3D,CAAC;QACD,kEAAkE;QAClE,uEAAuE;QACvE,sCAAsC;QACtC,OAAO;YACL,QAAQ,EAAE;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC9B,QAAQ,EAAE,OAAO,CAAC,SAAS;gBAC3B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;gBAC5B,MAAM;gBACN,OAAO,EAAE,OAAO,CAAC,GAAG;aACrB;YACD,EAAE,EAAE,IAAI;SACT,CAAC;IACJ,CAAC;CACF;AA1ED,kCA0EC"}

package/dist/log-sanitise.d.ts

@@ -0,0 +1,3 @@
+export declare function sanitiseLogToken(value: string): string;
+export declare const REFUSAL_ROUTE_MAX = 300;
+export declare function truncate(value: string, max: number): string;

package/dist/log-sanitise.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSAL_ROUTE_MAX = void 0;
+exports.sanitiseLogToken = sanitiseLogToken;
+exports.truncate = truncate;
+// Strip everything that could break OUT of one field of an unquoted
+// "key=value key=value" log record: C0 controls and DEL, all whitespace (the
+// field separator), "=" (the key/value separator), and the double quote and
+// backslash that consumers which do parse quoted values use for grouping and
+// escaping. Applied to the values a caller chose or could influence --
+// reasons, client ids, routes.
+function sanitiseLogToken(value) {
+    // eslint-disable-next-line no-control-regex
+    return value.replace(/[\s\x00-\x1f\x7f="\\]/g, '_');
+}
+// Longest `route=` a refusal line will carry.
+exports.REFUSAL_ROUTE_MAX = 300;
+// Clips a value to `max` characters and MARKS THE CUT, so a clipped value
+// cannot be read as a whole one.
+function truncate(value, max) {
+    return value.length <= max ? value : `${value.slice(0, max)}…(truncated)`;
+}
+//# sourceMappingURL=log-sanitise.js.map

package/dist/log-sanitise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-sanitise.js","sourceRoot":"","sources":["../src/log-sanitise.ts"],"names":[],"mappings":";;;AAMA,4CAGC;AAOD,4BAEC;AAlBD,oEAAoE;AACpE,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,+BAA+B;AAC/B,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,4CAA4C;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,8CAA8C;AACjC,QAAA,iBAAiB,GAAG,GAAG,CAAC;AAErC,0EAA0E;AAC1E,iCAAiC;AACjC,SAAgB,QAAQ,CAAC,KAAa,EAAE,GAAW;IACjD,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,cAAc,CAAC;AAC5E,CAAC"}

package/dist/module.d.ts

@@ -0,0 +1,12 @@
+import { type DynamicModule, type ExistingProvider, type FactoryProvider, type Type, type ValueProvider } from '@nestjs/common';
+import { type SignetIntegrationOptions } from './options';
+import { type SignetPrincipalResolver } from './principal-resolver';
+export type ResolverProvider = Omit<ExistingProvider<SignetPrincipalResolver>, 'provide'> | Omit<FactoryProvider<SignetPrincipalResolver>, 'provide'> | Omit<ValueProvider<SignetPrincipalResolver>, 'provide'> | Type<SignetPrincipalResolver>;
+export interface SignetIntegrationModuleOptions {
+    readonly imports?: DynamicModule['imports'];
+    readonly options: SignetIntegrationOptions;
+    readonly resolver: ResolverProvider;
+}
+export declare class SignetIntegrationModule {
+    static forRoot(input: SignetIntegrationModuleOptions): DynamicModule;
+}

package/dist/module.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var SignetIntegrationModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetIntegrationModule = void 0;
+const common_1 = require("@nestjs/common");
+const deployment_profile_1 = require("./deployment-profile");
+const guard_1 = require("./guard");
+const options_1 = require("./options");
+const principal_resolver_1 = require("./principal-resolver");
+const strategy_1 = require("./strategy");
+const validate_options_1 = require("./validate-options");
+// Wires the Bearer channel: options behind their token, the consumer's
+// resolver behind its token, the deployment profile, the Passport strategy
+// (which registers itself by name in its constructor, so it must be a
+// provider) and the guard. Exports everything a consumer's own auth module
+// re-exports or a dispatcher injects.
+//
+// NOT here: the metadata controller (createProtectedResourceController --
+// the consumer declares it in the module of the process that serves the
+// resource), the exception filter (BearerChallengeFilter as APP_FILTER, or
+// the consumer's own filter calling challengeFor), and the guard's mounting
+// (APP_GUARD, or inside a consumer's credential dispatcher).
+let SignetIntegrationModule = SignetIntegrationModule_1 = class SignetIntegrationModule {
+    static forRoot(input) {
+        const resolver = typeof input.resolver === 'function'
+            ? { provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER, useClass: input.resolver }
+            : { ...input.resolver, provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER };
+        return {
+            exports: [
+                options_1.SIGNET_INTEGRATION_OPTIONS,
+                principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER,
+                guard_1.SignetBearerGuard,
+                deployment_profile_1.SignetDeploymentProfileService,
+                strategy_1.SignetJwtStrategy,
+            ],
+            imports: input.imports ?? [],
+            module: SignetIntegrationModule_1,
+            providers: [
+                {
+                    provide: options_1.SIGNET_INTEGRATION_OPTIONS,
+                    useValue: (0, validate_options_1.validateSignetIntegrationOptions)(input.options),
+                },
+                resolver,
+                guard_1.SignetBearerGuard,
+                deployment_profile_1.SignetDeploymentProfileService,
+                strategy_1.SignetJwtStrategy,
+            ],
+        };
+    }
+};
+exports.SignetIntegrationModule = SignetIntegrationModule;
+exports.SignetIntegrationModule = SignetIntegrationModule = SignetIntegrationModule_1 = __decorate([
+    (0, common_1.Module)({})
+], SignetIntegrationModule);
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAQwB;AAExB,6DAAsE;AACtE,mCAA4C;AAC5C,uCAGmB;AACnB,6DAG8B;AAC9B,yCAA+C;AAC/C,yDAAsE;AAoBtE,uEAAuE;AACvE,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,6DAA6D;AAEtD,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,KAAqC;QAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,8CAAyB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,8CAAyB,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE;gBACP,oCAA0B;gBAC1B,8CAAyB;gBACzB,yBAAiB;gBACjB,mDAA8B;gBAC9B,4BAAiB;aAClB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,MAAM,EAAE,yBAAuB;YAC/B,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,oCAA0B;oBACnC,QAAQ,EAAE,IAAA,mDAAgC,EAAC,KAAK,CAAC,OAAO,CAAC;iBAC1D;gBACD,QAAQ;gBACR,yBAAiB;gBACjB,mDAA8B;gBAC9B,4BAAiB;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA5BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CA4BnC"}