@mereb/shared-packages 0.0.41 → 0.0.43

package/dist/auth/jwks.d.ts

@@ -1,5 +1,8 @@
 import { type JWTPayload } from 'jose';
 import type { IncomingHttpHeaders } from 'node:http';
+export declare const FULL_ADMIN_ROLES: readonly ["admin", "mereb.admin", "realm-admin"];
+export declare const LIMITED_ADMIN_ROLES: readonly ["moderator", "support", "admin.viewer", "mereb.staff"];
+export declare const READ_ONLY_ADMIN_ROLES: readonly ["admin", "mereb.admin", "realm-admin", "moderator", "support", "admin.viewer", "mereb.staff"];
 export interface VerifyJwtOptions {
     issuer: string;
     audience?: string | string[];
@@ -8,5 +11,9 @@ export interface VerifyJwtOptions {
 export declare function initJwks(issuer: string): Promise<void>;
 export declare function verifyJwt(token: string, { issuer, audience }: VerifyJwtOptions): Promise<JWTPayload>;
 export declare function extractUserId(payload: JWTPayload): string | undefined;
+export declare function extractJwtRoles(payload: JWTPayload): string[];
+export declare function hasAnyRole(roles: readonly string[] | undefined, allowedRoles: readonly string[]): boolean;
+export declare function hasAdminReadAccess(roles: readonly string[] | undefined): boolean;
+export declare function hasFullAdminAccess(roles: readonly string[] | undefined): boolean;
 export declare function parseAuthHeader(headers: IncomingHttpHeaders): string | undefined;
 //# sourceMappingURL=jwks.d.ts.map

package/dist/auth/jwks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/auth/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAIrD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,iBAI5C;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,gBAAgB,uBAYvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,sBAEhD;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAMpB"}
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/auth/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAIrD,eAAO,MAAM,gBAAgB,kDAAmD,CAAC;AACjF,eAAO,MAAM,mBAAmB,kEAKtB,CAAC;AACX,eAAO,MAAM,qBAAqB,yGAAyD,CAAC;AAE5F,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,MAAM,iBAI5C;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,gBAAgB,uBAYvC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,sBAEhD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,CAS7D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAKzG;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAMpB"}

package/dist/auth/jwks.js

@@ -1,5 +1,13 @@
 import { createRemoteJWKSet, jwtVerify } from 'jose';
 let jwks;
+export const FULL_ADMIN_ROLES = ['admin', 'mereb.admin', 'realm-admin'];
+export const LIMITED_ADMIN_ROLES = [
+    'moderator',
+    'support',
+    'admin.viewer',
+    'mereb.staff'
+];
+export const READ_ONLY_ADMIN_ROLES = [...FULL_ADMIN_ROLES, ...LIMITED_ADMIN_ROLES];
 export async function initJwks(issuer) {
     jwks = createRemoteJWKSet(new URL(`${issuer.replace(/\/$/, '')}/protocol/openid-connect/certs`));
 }
@@ -16,6 +24,25 @@ export async function verifyJwt(token, { issuer, audience }) {
 export function extractUserId(payload) {
     return typeof payload.sub === 'string' ? payload.sub : undefined;
 }
+export function extractJwtRoles(payload) {
+    const realmRoles = Array.isArray(payload.realm_access?.roles)
+        ? (payload.realm_access?.roles ?? [])
+        : [];
+    const resourceRoles = Object.values(payload.resource_access ?? {}).flatMap((access) => (Array.isArray(access?.roles) ? access.roles.filter((role) => typeof role === 'string') : []));
+    return Array.from(new Set([...realmRoles, ...resourceRoles]));
+}
+export function hasAnyRole(roles, allowedRoles) {
+    if (!roles || roles.length === 0) {
+        return false;
+    }
+    return roles.some((role) => allowedRoles.includes(role));
+}
+export function hasAdminReadAccess(roles) {
+    return hasAnyRole(roles, READ_ONLY_ADMIN_ROLES);
+}
+export function hasFullAdminAccess(roles) {
+    return hasAnyRole(roles, FULL_ADMIN_ROLES);
+}
 export function parseAuthHeader(headers) {
     const auth = headers.authorization;
     if (!auth || !auth.startsWith('Bearer ')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mereb/shared-packages",
-  "version": "0.0.41",
+  "version": "0.0.43",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",