@marxbiotech/signet-integration 0.1.0

package/dist/testing/signet-token.d.ts

@@ -0,0 +1,18 @@
+import { type JSONWebKeySet, type JWTPayload } from 'jose';
+import { type JwksServer } from './jwks-server';
+export interface TestIssuer {
+    readonly close: () => Promise<void>;
+    readonly jwks: JSONWebKeySet;
+    readonly keys: JwksServer;
+    readonly sign: (payload: JWTPayload, header?: {
+        typ?: string;
+    }) => Promise<string>;
+    readonly signSignetToken: (input: {
+        audience: string;
+        clientId: string;
+        issuer: string;
+        scopes: readonly string[];
+        subject: string;
+    }) => Promise<string>;
+}
+export declare function startTestIssuer(): Promise<TestIssuer>;

package/dist/testing/signet-token.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startTestIssuer = startTestIssuer;
+const jose_1 = require("jose");
+const jwks_server_1 = require("./jwks-server");
+async function startTestIssuer() {
+    const pair = await (0, jose_1.generateKeyPair)('ES256');
+    const signingKey = pair.privateKey;
+    const jwks = {
+        keys: [{ ...(await (0, jose_1.exportJWK)(pair.publicKey)), alg: 'ES256', kid: 'k1' }],
+    };
+    const keys = await (0, jwks_server_1.startJwksServer)(jwks);
+    const sign = (payload, header = {}) => new jose_1.SignJWT(payload)
+        .setProtectedHeader({ alg: 'ES256', kid: 'k1', ...header })
+        .setExpirationTime('5m')
+        .sign(signingKey);
+    return {
+        close: () => keys.close(),
+        jwks,
+        keys,
+        sign,
+        signSignetToken: ({ audience, clientId, issuer, scopes, subject }) => sign({
+            aud: [audience],
+            client_id: clientId,
+            iss: issuer,
+            scp: [...scopes],
+            sub: subject,
+        }),
+    };
+}
+//# sourceMappingURL=signet-token.js.map

package/dist/testing/signet-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signet-token.js","sourceRoot":"","sources":["../../src/testing/signet-token.ts"],"names":[],"mappings":";;AAgCA,0CA0BC;AA1DD,+BAOc;AAEd,+CAAiE;AAuB1D,KAAK,UAAU,eAAe;IACnC,MAAM,IAAI,GAAG,MAAM,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAY,IAAI,CAAC,UAAU,CAAC;IAC5C,MAAM,IAAI,GAAkB;QAC1B,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KAC1E,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAE,SAA2B,EAAE,EAAE,EAAE,CAClE,IAAI,cAAO,CAAC,OAAO,CAAC;SACjB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;SAC1D,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE;QACzB,IAAI;QACJ,IAAI;QACJ,IAAI;QACJ,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CACnE,IAAI,CAAC;YACH,GAAG,EAAE,CAAC,QAAQ,CAAC;YACf,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE,MAAM;YACX,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC;YAChB,GAAG,EAAE,OAAO;SACb,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/validate-options.d.ts

@@ -0,0 +1,8 @@
+import { type SignetIntegrationOptions } from './options';
+/**
+ * Checks the invariants the mechanism relies on and the comments state, once,
+ * at construction (`SignetIntegrationModule.forRoot`). Every rule here is one
+ * a second consumer could break by mistake without any type error; each
+ * throws with the field named. Returns the options for chaining.
+ */
+export declare function validateSignetIntegrationOptions<E extends string>(options: SignetIntegrationOptions<E>): SignetIntegrationOptions<E>;

package/dist/validate-options.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSignetIntegrationOptions = validateSignetIntegrationOptions;
+const options_1 = require("./options");
+/**
+ * Request properties Express and Nest already use; a principal written there
+ * would overwrite them.
+ */
+const RESERVED_REQUEST_KEYS = new Set([
+    'app',
+    'body',
+    'cookies',
+    'headers',
+    'hostname',
+    'ip',
+    'ips',
+    'method',
+    'originalUrl',
+    'params',
+    'path',
+    'protocol',
+    'query',
+    'rawHeaders',
+    'res',
+    'route',
+    'signedCookies',
+    'url',
+]);
+/**
+ * Characters that would break out of the quoted value in a
+ * `WWW-Authenticate` parameter (RFC 7235 quoted-string).
+ */
+const QUOTE_BREAKERS = /["\\\r\n]/;
+/**
+ * Checks the invariants the mechanism relies on and the comments state, once,
+ * at construction (`SignetIntegrationModule.forRoot`). Every rule here is one
+ * a second consumer could break by mistake without any type error; each
+ * throws with the field named. Returns the options for chaining.
+ */
+function validateSignetIntegrationOptions(options) {
+    const fail = (reason) => {
+        throw new Error(`invalid SignetIntegrationOptions: ${reason}`);
+    };
+    if (options.admissionScope === '' ||
+        QUOTE_BREAKERS.test(options.admissionScope)) {
+        fail('admissionScope must be non-empty and contain no quote, backslash or newline');
+    }
+    if (options.realm === '' || QUOTE_BREAKERS.test(options.realm)) {
+        fail('realm must be non-empty and contain no quote, backslash or newline');
+    }
+    if (!options.scopesSupported.includes(options.admissionScope)) {
+        fail(`scopesSupported must include the admission scope ${options.admissionScope}`);
+    }
+    if (RESERVED_REQUEST_KEYS.has(options.requestPrincipalKey)) {
+        fail(`requestPrincipalKey ${options.requestPrincipalKey} is a request property Express or Nest already uses`);
+    }
+    const profiles = Object.entries(options.deployedProfiles);
+    if (profiles.length === 0)
+        fail('deployedProfiles must name at least one environment');
+    if (profiles.some(([e]) => e === options_1.DEVELOPMENT_ENVIRONMENT)) {
+        fail(`deployedProfiles must not contain ${options_1.DEVELOPMENT_ENVIRONMENT}; the resolver stamps it`);
+    }
+    const namespaces = new Set(profiles.map(([, p]) => p.namespace));
+    if (namespaces.size !== profiles.length)
+        fail('deployedProfiles namespaces must be unique');
+    const hosts = new Set(profiles.map(([, p]) => p.host));
+    if (hosts.size !== profiles.length)
+        fail('deployedProfiles hosts must be unique');
+    // Every canonical resource -- deployed and development -- must carry the
+    // same path with no query or fragment: the metadata route is mounted once,
+    // on that path, and the challenge points at it.
+    const resourcePath = (resource, label) => {
+        const url = new URL(resource);
+        if (url.search !== '' || url.hash !== '') {
+            fail(`${label} must not carry a query or fragment: ${resource}`);
+        }
+        return url.pathname;
+    };
+    const developmentPath = resourcePath(options.developmentProfile.canonicalResource, 'developmentProfile.canonicalResource');
+    for (const [environment, { host }] of profiles) {
+        const path = resourcePath(options.canonicalResourceFor(host), `canonicalResourceFor(${host})`);
+        if (path !== developmentPath) {
+            fail(`canonicalResourceFor(${host}) has path ${path} but developmentProfile has ${developmentPath} (environment ${environment}); every profile must share one resource path`);
+        }
+    }
+    return options;
+}
+//# sourceMappingURL=validate-options.js.map

package/dist/validate-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-options.js","sourceRoot":"","sources":["../src/validate-options.ts"],"names":[],"mappings":";;AA2CA,4EA0EC;AArHD,uCAImB;AAEnB;;;GAGG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,KAAK;IACL,MAAM;IACN,SAAS;IACT,SAAS;IACT,UAAU;IACV,IAAI;IACJ,KAAK;IACL,QAAQ;IACR,aAAa;IACb,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,YAAY;IACZ,KAAK;IACL,OAAO;IACP,eAAe;IACf,KAAK;CACN,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC;;;;;GAKG;AACH,SAAgB,gCAAgC,CAC9C,OAAoC;IAEpC,MAAM,IAAI,GAAG,CAAC,MAAc,EAAS,EAAE;QACrC,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;IACF,IACE,OAAO,CAAC,cAAc,KAAK,EAAE;QAC7B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAC3C,CAAC;QACD,IAAI,CACF,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,oEAAoE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,IAAI,CACF,oDAAoD,OAAO,CAAC,cAAc,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC3D,IAAI,CACF,uBAAuB,OAAO,CAAC,mBAAmB,qDAAqD,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAGrD,CAAC;IACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QACvB,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAC9D,IACG,QAA8C,CAAC,IAAI,CAClD,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,iCAAuB,CACvC,EACD,CAAC;QACD,IAAI,CACF,qCAAqC,iCAAuB,0BAA0B,CACvF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACrC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAChC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAChD,yEAAyE;IACzE,2EAA2E;IAC3E,gDAAgD;IAChD,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAU,EAAE;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,KAAK,wCAAwC,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,YAAY,CAClC,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,EAC5C,sCAAsC,CACvC,CAAC;IACF,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,YAAY,CACvB,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAClC,wBAAwB,IAAI,GAAG,CAChC,CAAC;QACF,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7B,IAAI,CACF,wBAAwB,IAAI,cAAc,IAAI,+BAA+B,eAAe,iBAAiB,WAAW,+CAA+C,CACxK,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,93 @@
+{
+  "name": "@marxbiotech/signet-integration",
+  "version": "0.1.0",
+  "description": "Signet (OAuth 2.1 / OIDC) resource-server integration for NestJS: Bearer verification, RFC 6750 challenges, RFC 9728 metadata, deployment profile.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/marxbiotech/ordersync-marxbio-tech.git",
+    "directory": "packages/signet-integration"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "testing": [
+        "dist/testing/index.d.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build",
+    "dev": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
+    "lint": "eslint \"src/**/*.ts\" --max-warnings=0",
+    "test": "TZ=UTC jest",
+    "test:cov": "TZ=UTC jest --coverage --runInBand",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^10.0.0 || ^11.0.0",
+    "@nestjs/config": "^3.0.0 || ^4.0.0",
+    "@nestjs/core": "^10.0.0 || ^11.0.0",
+    "@nestjs/passport": "^10.0.0 || ^11.0.0",
+    "@nestjs/swagger": "^8.0.0 || ^11.0.0",
+    "@nestjs/throttler": "^6.0.0",
+    "@types/express": "^4.17.0 || ^5.0.0",
+    "jose": "^5.10.0",
+    "passport-custom": "^1.1.1",
+    "reflect-metadata": "^0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@types/express": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nestjs/common": "^10.4.15",
+    "@nestjs/config": "^3.3.0",
+    "@nestjs/core": "^10.4.15",
+    "@nestjs/passport": "^10.0.3",
+    "@nestjs/platform-express": "^10.4.15",
+    "@nestjs/swagger": "^8.1.1",
+    "@nestjs/testing": "^10.4.15",
+    "@nestjs/throttler": "^6.5.0",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.10.7",
+    "@types/passport": "^1.0.16",
+    "@typescript-eslint/eslint-plugin": "^8.20.0",
+    "@typescript-eslint/parser": "^8.20.0",
+    "eslint": "^8.57.1",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.3",
+    "eslint-plugin-simple-import-sort": "^12.1.1",
+    "express": "^5.0.0",
+    "jest": "^29.7.0",
+    "jose": "5.10.0",
+    "passport": "^0.7.0",
+    "passport-custom": "^1.1.1",
+    "prettier": "^3.4.2",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.7.3"
+  }
+}