@mondart/nestjs-common-module-iam 3.2.12 → 3.2.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +56 -0
- package/dist/constants/iam-decorator-key.const.d.ts +3 -0
- package/dist/constants/iam-decorator-key.const.d.ts.map +1 -1
- package/dist/constants/iam-decorator-key.const.js +4 -1
- package/dist/constants/iam-decorator-key.const.js.map +1 -1
- package/dist/decorators/get-agent.decorator.d.ts +2 -0
- package/dist/decorators/get-agent.decorator.d.ts.map +1 -0
- package/dist/decorators/get-agent.decorator.js +27 -0
- package/dist/decorators/get-agent.decorator.js.map +1 -0
- package/dist/decorators/get-user.decorator.d.ts +2 -0
- package/dist/decorators/get-user.decorator.d.ts.map +1 -0
- package/dist/decorators/get-user.decorator.js +24 -0
- package/dist/decorators/get-user.decorator.js.map +1 -0
- package/dist/decorators/iam-context.decorator.d.ts +4 -0
- package/dist/decorators/iam-context.decorator.d.ts.map +1 -0
- package/dist/decorators/iam-context.decorator.js +62 -0
- package/dist/decorators/iam-context.decorator.js.map +1 -0
- package/dist/decorators/require-permission.decorator.d.ts +6 -0
- package/dist/decorators/require-permission.decorator.d.ts.map +1 -0
- package/dist/decorators/require-permission.decorator.js +8 -0
- package/dist/decorators/require-permission.decorator.js.map +1 -0
- package/dist/dto/iam-context.dto.d.ts +14 -0
- package/dist/dto/iam-context.dto.d.ts.map +1 -0
- package/dist/dto/iam-context.dto.js +68 -0
- package/dist/dto/iam-context.dto.js.map +1 -0
- package/dist/guards/iam-context.guard.d.ts +5 -1
- package/dist/guards/iam-context.guard.d.ts.map +1 -1
- package/dist/guards/iam-context.guard.js +29 -6
- package/dist/guards/iam-context.guard.js.map +1 -1
- package/dist/iam-context.module.d.ts +3 -1
- package/dist/iam-context.module.d.ts.map +1 -1
- package/dist/iam-context.module.js +39 -28
- package/dist/iam-context.module.js.map +1 -1
- package/dist/index.d.ts +9 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +9 -0
- package/dist/index.js.map +1 -1
- package/dist/interfaces/get-agent.interface.d.ts +9 -0
- package/dist/interfaces/get-agent.interface.d.ts.map +1 -0
- package/dist/interfaces/get-agent.interface.js +3 -0
- package/dist/interfaces/get-agent.interface.js.map +1 -0
- package/dist/interfaces/get-user.interface.d.ts +7 -0
- package/dist/interfaces/get-user.interface.d.ts.map +1 -0
- package/dist/interfaces/get-user.interface.js +3 -0
- package/dist/interfaces/get-user.interface.js.map +1 -0
- package/dist/interfaces/iam-context-options.interface.d.ts +13 -0
- package/dist/interfaces/iam-context-options.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.js.map +1 -1
- package/dist/pipes/iam-find-one-query-scope.pipe.js +2 -2
- package/dist/pipes/iam-find-one-query-scope.pipe.js.map +1 -1
- package/dist/pipes/iam-paginate-query-scope.pipe.js +2 -2
- package/dist/pipes/iam-paginate-query-scope.pipe.js.map +1 -1
- package/dist/services/iam-entity-access.service.d.ts.map +1 -1
- package/dist/services/iam-entity-access.service.js +3 -1
- package/dist/services/iam-entity-access.service.js.map +1 -1
- package/dist/services/iam-permission.service.d.ts +18 -0
- package/dist/services/iam-permission.service.d.ts.map +1 -0
- package/dist/services/iam-permission.service.js +97 -0
- package/dist/services/iam-permission.service.js.map +1 -0
- package/dist/services/iam-token-verifier.service.d.ts +15 -0
- package/dist/services/iam-token-verifier.service.d.ts.map +1 -0
- package/dist/services/iam-token-verifier.service.js +101 -0
- package/dist/services/iam-token-verifier.service.js.map +1 -0
- package/package.json +3 -2
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,13 @@
|
|
|
1
1
|
export * from './decorators/public-iam.decorators';
|
|
2
2
|
export * from './decorators/iam-entity-access.decorator';
|
|
3
3
|
export * from './decorators/allow-iam.decorator';
|
|
4
|
+
export * from './decorators/iam-context.decorator';
|
|
5
|
+
export * from './decorators/get-agent.decorator';
|
|
6
|
+
export * from './decorators/get-user.decorator';
|
|
7
|
+
export * from './dto/iam-context.dto';
|
|
8
|
+
export * from './interfaces/get-agent.interface';
|
|
9
|
+
export * from './interfaces/get-user.interface';
|
|
10
|
+
export * from './decorators/require-permission.decorator';
|
|
4
11
|
export * from './enums/iam-user-type.enum';
|
|
5
12
|
export * from './guards/iam-context.guard';
|
|
6
13
|
export * from './helpers/user-owner.helper';
|
|
@@ -10,6 +17,8 @@ export * from './types/iam-entity-access.type';
|
|
|
10
17
|
export * from './pipes/iam-paginate-query-scope.pipe';
|
|
11
18
|
export * from './pipes/iam-find-one-query-scope.pipe';
|
|
12
19
|
export * from './services/iam-entity-access.service';
|
|
20
|
+
export * from './services/iam-permission.service';
|
|
21
|
+
export * from './services/iam-token-verifier.service';
|
|
13
22
|
export * from './iam-context.module';
|
|
14
23
|
export * from './constants/iam-decorator-key.const';
|
|
15
24
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -17,6 +17,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
17
17
|
__exportStar(require("./decorators/public-iam.decorators"), exports);
|
|
18
18
|
__exportStar(require("./decorators/iam-entity-access.decorator"), exports);
|
|
19
19
|
__exportStar(require("./decorators/allow-iam.decorator"), exports);
|
|
20
|
+
__exportStar(require("./decorators/iam-context.decorator"), exports);
|
|
21
|
+
__exportStar(require("./decorators/get-agent.decorator"), exports);
|
|
22
|
+
__exportStar(require("./decorators/get-user.decorator"), exports);
|
|
23
|
+
__exportStar(require("./dto/iam-context.dto"), exports);
|
|
24
|
+
__exportStar(require("./interfaces/get-agent.interface"), exports);
|
|
25
|
+
__exportStar(require("./interfaces/get-user.interface"), exports);
|
|
26
|
+
__exportStar(require("./decorators/require-permission.decorator"), exports);
|
|
20
27
|
__exportStar(require("./enums/iam-user-type.enum"), exports);
|
|
21
28
|
__exportStar(require("./guards/iam-context.guard"), exports);
|
|
22
29
|
__exportStar(require("./helpers/user-owner.helper"), exports);
|
|
@@ -26,6 +33,8 @@ __exportStar(require("./types/iam-entity-access.type"), exports);
|
|
|
26
33
|
__exportStar(require("./pipes/iam-paginate-query-scope.pipe"), exports);
|
|
27
34
|
__exportStar(require("./pipes/iam-find-one-query-scope.pipe"), exports);
|
|
28
35
|
__exportStar(require("./services/iam-entity-access.service"), exports);
|
|
36
|
+
__exportStar(require("./services/iam-permission.service"), exports);
|
|
37
|
+
__exportStar(require("./services/iam-token-verifier.service"), exports);
|
|
29
38
|
__exportStar(require("./iam-context.module"), exports);
|
|
30
39
|
__exportStar(require("./constants/iam-decorator-key.const"), exports);
|
|
31
40
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,uDAAqC;AACrC,sEAAoD"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,qEAAmD;AACnD,mEAAiD;AACjD,kEAAgD;AAChD,wDAAsC;AACtC,mEAAiD;AACjD,kEAAgD;AAChD,4EAA0D;AAC1D,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,oEAAkD;AAClD,wEAAsD;AACtD,uDAAqC;AACrC,sEAAoD"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-agent.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/get-agent.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-agent.interface.js","sourceRoot":"","sources":["../../src/interfaces/get-agent.interface.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-user.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/get-user.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"get-user.interface.js","sourceRoot":"","sources":["../../src/interfaces/get-user.interface.ts"],"names":[],"mappings":""}
|
|
@@ -17,12 +17,25 @@ export interface IamContextModuleOptions {
|
|
|
17
17
|
select?: IamControllerMatcher[];
|
|
18
18
|
ignore?: IamControllerMatcher[];
|
|
19
19
|
};
|
|
20
|
+
permissions?: {
|
|
21
|
+
service?: string;
|
|
22
|
+
kafkaClient?: string | symbol;
|
|
23
|
+
};
|
|
24
|
+
tokenVerification?: {
|
|
25
|
+
issuers: string[];
|
|
26
|
+
jwksBaseUrl?: string;
|
|
27
|
+
};
|
|
20
28
|
entityAccess?: {
|
|
21
29
|
defaultAccess?: EntityAccessByRole<any>;
|
|
22
30
|
defaultScope?: Partial<ApplyIamEntityScopeOptions<any>>;
|
|
23
31
|
presets?: IamEntityAccessPreset<any>[];
|
|
24
32
|
};
|
|
25
33
|
}
|
|
34
|
+
export interface IamContextModuleAsyncOptions {
|
|
35
|
+
imports?: any[];
|
|
36
|
+
inject?: any[];
|
|
37
|
+
useFactory: (...args: any[]) => IamContextModuleOptions | Promise<IamContextModuleOptions>;
|
|
38
|
+
}
|
|
26
39
|
export declare const IAM_CONTEXT_MODULE_OPTIONS: unique symbol;
|
|
27
40
|
export declare const DEFAULT_IAM_CONTEXT_MODULE_OPTIONS: Required<Pick<IamContextModuleOptions, 'defaultAllowedUserTypes' | 'allowRoutesWithoutIamDecorator'>> & Omit<IamContextModuleOptions, 'defaultAllowedUserTypes' | 'allowRoutesWithoutIamDecorator'>;
|
|
28
41
|
//# sourceMappingURL=iam-context-options.interface.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAYF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;IAcF,iBAAiB,CAAC,EAAE;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AA+Ga,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
|
|
@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.IamFindOneQueryScopePipe = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const core_1 = require("@nestjs/core");
|
|
18
|
-
const
|
|
18
|
+
const iam_context_decorator_1 = require("../decorators/iam-context.decorator");
|
|
19
19
|
const iam_entity_access_service_1 = require("../services/iam-entity-access.service");
|
|
20
20
|
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
21
21
|
let IamFindOneQueryScopePipe = class IamFindOneQueryScopePipe {
|
|
@@ -29,7 +29,7 @@ let IamFindOneQueryScopePipe = class IamFindOneQueryScopePipe {
|
|
|
29
29
|
if (!scopeOptions) {
|
|
30
30
|
return query;
|
|
31
31
|
}
|
|
32
|
-
const iamContext = (0,
|
|
32
|
+
const iamContext = (0, iam_context_decorator_1.getIamContext)(this.request);
|
|
33
33
|
const currentUserType = this.request[iam_decorator_key_const_1.IAM_REQUEST_USER_TYPE_KEY];
|
|
34
34
|
const scopeWhere = this.iamEntityAccessService.buildScopeWhere(scopeOptions, this.request, iamContext, currentUserType);
|
|
35
35
|
query[iam_decorator_key_const_1.IAM_QUERY_SCOPE_WHERE_KEY] = scopeWhere;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-find-one-query-scope.pipe.js","sourceRoot":"","sources":["../../src/pipes/iam-find-one-query-scope.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,uCAAuC;AACvC
|
|
1
|
+
{"version":3,"file":"iam-find-one-query-scope.pipe.js","sourceRoot":"","sources":["../../src/pipes/iam-find-one-query-scope.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,uCAAuC;AACvC,+EAAoE;AAEpE,qFAA+E;AAG/E,kFAI8C;AASvC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAInC,YAEmB,OAAY,EACZ,sBAA8C;QAD9C,YAAO,GAAP,OAAO,CAAK;QACZ,2BAAsB,GAAtB,sBAAsB,CAAwB;IAC9D,CAAC;IAOJ,SAAS,CAAC,KAA0B;QAClC,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAA6B,CAAC;QAExD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,8DAAoC,CAC3B,CAAC;QAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAClC,mDAAyB,CACP,CAAC;QAErB,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAC5D,YAAY,EACZ,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,KAAK,CAAC,mDAAyB,CAAC,GAAG,UAAU,CAAC;QAE9C,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AA1CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAMhC,WAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;6CAEyB,kDAAsB;GAPtD,wBAAwB,CA0CpC"}
|
|
@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.IamPaginateQueryScopePipe = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const core_1 = require("@nestjs/core");
|
|
18
|
-
const
|
|
18
|
+
const iam_context_decorator_1 = require("../decorators/iam-context.decorator");
|
|
19
19
|
const iam_entity_access_service_1 = require("../services/iam-entity-access.service");
|
|
20
20
|
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
21
21
|
let IamPaginateQueryScopePipe = class IamPaginateQueryScopePipe {
|
|
@@ -29,7 +29,7 @@ let IamPaginateQueryScopePipe = class IamPaginateQueryScopePipe {
|
|
|
29
29
|
if (!scopeOptions) {
|
|
30
30
|
return query;
|
|
31
31
|
}
|
|
32
|
-
const iamContext = (0,
|
|
32
|
+
const iamContext = (0, iam_context_decorator_1.getIamContext)(this.request);
|
|
33
33
|
const currentUserType = this.request[iam_decorator_key_const_1.IAM_REQUEST_USER_TYPE_KEY];
|
|
34
34
|
query[iam_decorator_key_const_1.IAM_QUERY_SCOPE_WHERE_KEY] =
|
|
35
35
|
this.iamEntityAccessService.buildScopeWhere(scopeOptions, this.request, iamContext, currentUserType);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-paginate-query-scope.pipe.js","sourceRoot":"","sources":["../../src/pipes/iam-paginate-query-scope.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,uCAAuC;AAEvC
|
|
1
|
+
{"version":3,"file":"iam-paginate-query-scope.pipe.js","sourceRoot":"","sources":["../../src/pipes/iam-paginate-query-scope.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,uCAAuC;AAEvC,+EAAoE;AAEpE,qFAA+E;AAG/E,kFAI8C;AASvC,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAIpC,YAEmB,OAAY,EACZ,sBAA8C;QAD9C,YAAO,GAAP,OAAO,CAAK;QACZ,2BAAsB,GAAtB,sBAAsB,CAAwB;IAC9D,CAAC;IAOJ,SAAS,CAAC,KAAoB;QAC5B,MAAM,KAAK,GAAG,KAAkC,CAAC;QAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,8DAAoC,CAC3B,CAAC;QAE5C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAClC,mDAAyB,CACP,CAAC;QAErB,KAAK,CAAC,mDAAyB,CAAC;YAC9B,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACzC,YAAY,EACZ,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,eAAe,CAChB,CAAC;QAEJ,IAAI,OAAO,YAAY,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAClD,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC/C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AA7CY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAMhC,WAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;6CAEyB,kDAAsB;GAPtD,yBAAyB,CA6CrC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-entity-access.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-entity-access.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"iam-entity-access.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-entity-access.service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAU,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAE1B,6BAA6B,EAC9B,MAAM,2CAA2C,CAAC;AAYnD,qBACa,sBAAsB;IAK/B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAOzC,eAAe,CACb,UAAU,EAAE,GAAG,EACf,gBAAgB,EAAE,eAAe,EAAE,GAClC,eAAe;IAiCZ,eAAe,CAAC,CAAC,EACrB,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC,EACzC,GAAG,EAAE,GAAG,EACR,UAAU,EAAE,GAAG,EACf,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,OAAO,CAAC;IA0DnB,eAAe,CAAC,CAAC,EACf,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,EACtC,GAAG,EAAE,GAAG,EACR,UAAU,GAAE,GAAwB,EACpC,QAAQ,CAAC,EAAE,eAAe,GACzB,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS;IAQ1D,OAAO,CAAC,gBAAgB;IAmExB,OAAO,CAAC,sBAAsB;IAyC9B,OAAO,CAAC,kBAAkB;IAqC1B,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,kBAAkB;IAuB1B,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,SAAS;IAiCjB,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,QAAQ;CAGjB"}
|
|
@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.IamEntityAccessService = void 0;
|
|
16
16
|
const common_1 = require("@nestjs/common");
|
|
17
17
|
const nestjs_common_module_core_1 = require("@mondart/nestjs-common-module-core");
|
|
18
|
+
const iam_context_decorator_1 = require("../decorators/iam-context.decorator");
|
|
18
19
|
const typeorm_1 = require("@nestjs/typeorm");
|
|
19
20
|
const typeorm_2 = require("typeorm");
|
|
20
21
|
const iam_user_type_enum_1 = require("../enums/iam-user-type.enum");
|
|
@@ -69,7 +70,7 @@ let IamEntityAccessService = class IamEntityAccessService {
|
|
|
69
70
|
where: scopedWhere,
|
|
70
71
|
});
|
|
71
72
|
}
|
|
72
|
-
buildScopeWhere(options, req, iamContext = (0,
|
|
73
|
+
buildScopeWhere(options, req, iamContext = (0, iam_context_decorator_1.getIamContext)(req), userType) {
|
|
73
74
|
const resolvedUserType = userType ??
|
|
74
75
|
this.resolveUserType(iamContext, Object.values(iam_user_type_enum_1.IamUserTypeEnum));
|
|
75
76
|
return this.buildScopedWhere(options, req, iamContext, resolvedUserType);
|
|
@@ -244,6 +245,7 @@ let IamEntityAccessService = class IamEntityAccessService {
|
|
|
244
245
|
exports.IamEntityAccessService = IamEntityAccessService;
|
|
245
246
|
exports.IamEntityAccessService = IamEntityAccessService = __decorate([
|
|
246
247
|
(0, common_1.Injectable)(),
|
|
248
|
+
__param(0, (0, common_1.Optional)()),
|
|
247
249
|
__param(0, (0, typeorm_1.InjectDataSource)()),
|
|
248
250
|
__metadata("design:paramtypes", [typeorm_2.DataSource])
|
|
249
251
|
], IamEntityAccessService);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-entity-access.service.js","sourceRoot":"","sources":["../../src/services/iam-entity-access.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"iam-entity-access.service.js","sourceRoot":"","sources":["../../src/services/iam-entity-access.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kFAG4C;AAC5C,+EAAoE;AACpE,6CAAmD;AACnD,qCAA+D;AAC/D,oEAA8D;AAkBvD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAImB,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAMJ,eAAe,CACb,UAAe,EACf,gBAAmC;QAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;YAC9D,OAAO,oCAAe,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,IAAI,EAAE,CAAC;YAC1D,OAAO,oCAAe,CAAC,IAAI,CAAC;QAC9B,CAAC;QAED,IACE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,EACpC,CAAC;YACD,OAAO,oCAAe,CAAC,KAAK,CAAC;QAC/B,CAAC;QAKD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,oCAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO,oCAAe,CAAC,KAAK,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,8BAAqB,EAAE,CAAC;IACpC,CAAC;IASD,KAAK,CAAC,eAAe,CACnB,OAAyC,EACzC,GAAQ,EACR,UAAe,EACf,QAAyB;QAEzB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE;YACpE,GAAG;YACH,UAAU;YACV,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAErD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG;YAChB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ;SACR,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0BAAiB,CACzB,4CAAgB,CAAC,OAAO,CACtB,0CAAc,CAAC,kBAAkB,EACjC,OAAO,CAAC,YAAY,IAAI,UAAU,CACnC,CACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CACvC,OAAO,EACP,GAAG,EACH,UAAU,EACV,QAAQ,EACR;YACE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YACjC,QAAQ;SACT,CACF,CAAC;QAEF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;IACL,CAAC;IAQD,eAAe,CACb,OAAsC,EACtC,GAAQ,EACR,aAAkB,IAAA,qCAAa,EAAC,GAAG,CAAC,EACpC,QAA0B;QAE1B,MAAM,gBAAgB,GACpB,QAAQ;YACR,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,oCAAe,CAAC,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAEO,gBAAgB,CACtB,OAAyE,EACzE,GAAQ,EACR,UAAe,EACf,QAAyB,EACzB,MAGC;QAED,IAAI,QAAQ,KAAK,oCAAe,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;YAE1C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAI;gBAC3C,QAAQ,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBACjC,GAAG;gBACH,UAAU;gBACV,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,IAAI,2BAAkB,EAAE,CAAC;YACjC,CAAC;YAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,QAAQ,KAAK,oCAAe,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAI;gBAC3C,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;gBAC3C,GAAG;gBACH,UAAU;gBACV,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,IAAI,2BAAkB,EAAE,CAAC;YACjC,CAAC;YAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,IAAI,QAAQ,KAAK,oCAAe,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAI;gBAC3C,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;gBAC5C,GAAG;gBACH,UAAU;gBACV,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,IAAI,2BAAkB,EAAE,CAAC;YACjC,CAAC;YAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,2BAAkB,EAAE,CAAC;IACjC,CAAC;IAEO,sBAAsB,CAAI,MASjC;QACC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE/D,OAAO,QAAQ,CAAC,MAAM,CAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9D,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,oBAAoB,CAAI,MAAM,CAAC,UAAsB,EAAE,MAAM,CAAC,CACpE,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAI;oBACvC,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,GAAG;oBACH,UAAU;oBACV,QAAQ;oBACR,MAAM;iBACP,CAAC,CAAC;gBAEH,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC;IAEO,kBAAkB,CAAI,MAS7B;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAE9D,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAI,MAAM,CAAC,CAAC;QAE7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE;gBACxD,GAAG;gBACH,UAAU;gBACV,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAY,CAAC;QACpC,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAC1B,MAAgB,EAChB,MAGC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACpC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAA,gBAAM,GAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC,EAAE,IAAI,CAAC,cAAc,CAAI,MAAM,CAAC,CAAC,CAAC;IACrC,CAAC;IAEO,cAAc,CAAI,MAGzB;QACC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAyB,CAAC;QACnC,CAAC;QAED,OAAO;YACL,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,QAAQ;SACf,CAAC;IAC3B,CAAC;IAEO,oBAAoB,CAC1B,KAA4B;QAE5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,kBAAkB,CACxB,MAAyB,EACzB,OAIC;QAED,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,cAAc,CAAC,MAAW,EAAE,IAAY;QAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;YAC7C,OAAO,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC;IAEO,SAAS,CAAC,KAAc,EAAE,IAAsB;QACtD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7D,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,QAAQ,CAAC,KAAc;QAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC;CACF,CAAA;AAlYY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,0BAAgB,GAAE,CAAA;qCACU,oBAAU;GAL9B,sBAAsB,CAkYlC"}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import { OnApplicationBootstrap } from '@nestjs/common';
|
|
2
|
+
import { DiscoveryService, MetadataScanner, ModuleRef } from '@nestjs/core';
|
|
3
|
+
import { GetAgentInterface } from '../interfaces/get-agent.interface';
|
|
4
|
+
import { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
5
|
+
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
6
|
+
export declare class IamPermissionService implements OnApplicationBootstrap {
|
|
7
|
+
private readonly moduleOptions;
|
|
8
|
+
private readonly discoveryService;
|
|
9
|
+
private readonly metadataScanner;
|
|
10
|
+
private readonly moduleRef;
|
|
11
|
+
private readonly logger;
|
|
12
|
+
constructor(moduleOptions: IamContextModuleOptions, discoveryService: DiscoveryService, metadataScanner: MetadataScanner, moduleRef: ModuleRef);
|
|
13
|
+
hasPermissions(agent: GetAgentInterface | undefined, required: string[]): boolean;
|
|
14
|
+
onApplicationBootstrap(): Promise<void>;
|
|
15
|
+
collectPermissions(): IamPermissionDefinition[];
|
|
16
|
+
private getKafkaClient;
|
|
17
|
+
}
|
|
18
|
+
//# sourceMappingURL=iam-permission.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;IAOvC,cAAc,CACZ,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO;IAkBJ,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB7C,kBAAkB,IAAI,uBAAuB,EAAE;IAyB/C,OAAO,CAAC,cAAc;CAOvB"}
|
|
@@ -0,0 +1,97 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
|
+
};
|
|
8
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
|
+
};
|
|
11
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
|
+
};
|
|
14
|
+
var IamPermissionService_1;
|
|
15
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
+
exports.IamPermissionService = void 0;
|
|
17
|
+
const common_1 = require("@nestjs/common");
|
|
18
|
+
const core_1 = require("@nestjs/core");
|
|
19
|
+
const rxjs_1 = require("rxjs");
|
|
20
|
+
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
21
|
+
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
22
|
+
const KAFKA_TIMEOUT_MS = 5_000;
|
|
23
|
+
let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
24
|
+
constructor(moduleOptions, discoveryService, metadataScanner, moduleRef) {
|
|
25
|
+
this.moduleOptions = moduleOptions;
|
|
26
|
+
this.discoveryService = discoveryService;
|
|
27
|
+
this.metadataScanner = metadataScanner;
|
|
28
|
+
this.moduleRef = moduleRef;
|
|
29
|
+
this.logger = new common_1.Logger(IamPermissionService_1.name);
|
|
30
|
+
}
|
|
31
|
+
hasPermissions(agent, required) {
|
|
32
|
+
if (!agent?.agentId)
|
|
33
|
+
return false;
|
|
34
|
+
const { permissions, groupsMembership } = agent;
|
|
35
|
+
if (groupsMembership?.some((path) => path.endsWith(iam_decorator_key_const_1.IAM_SUPER_ADMIN_GROUP_SUFFIX))) {
|
|
36
|
+
return true;
|
|
37
|
+
}
|
|
38
|
+
const granted = new Set(permissions ?? []);
|
|
39
|
+
return required.every((key) => granted.has(key));
|
|
40
|
+
}
|
|
41
|
+
async onApplicationBootstrap() {
|
|
42
|
+
const service = this.moduleOptions.permissions?.service;
|
|
43
|
+
if (!service)
|
|
44
|
+
return;
|
|
45
|
+
const permissions = this.collectPermissions();
|
|
46
|
+
try {
|
|
47
|
+
await (0, rxjs_1.firstValueFrom)(this.getKafkaClient()
|
|
48
|
+
.emit(iam_decorator_key_const_1.IAM_PERMISSION_SYNC_TOPIC, {
|
|
49
|
+
event_source: service,
|
|
50
|
+
data: { service, permissions },
|
|
51
|
+
})
|
|
52
|
+
.pipe((0, rxjs_1.timeout)(KAFKA_TIMEOUT_MS)));
|
|
53
|
+
this.logger.log(`Synced ${permissions.length} permissions to IAM`);
|
|
54
|
+
}
|
|
55
|
+
catch (error) {
|
|
56
|
+
this.logger.warn(`Permission sync to IAM failed: ${error}`);
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
collectPermissions() {
|
|
60
|
+
const byKey = new Map();
|
|
61
|
+
const add = (target) => {
|
|
62
|
+
const definitions = Reflect.getMetadata(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, target) ?? [];
|
|
63
|
+
definitions.forEach((definition) => {
|
|
64
|
+
if (!byKey.get(definition.key)?.description) {
|
|
65
|
+
byKey.set(definition.key, definition);
|
|
66
|
+
}
|
|
67
|
+
});
|
|
68
|
+
};
|
|
69
|
+
for (const wrapper of this.discoveryService.getControllers()) {
|
|
70
|
+
const { instance, metatype } = wrapper;
|
|
71
|
+
if (!instance || !metatype)
|
|
72
|
+
continue;
|
|
73
|
+
add(metatype);
|
|
74
|
+
const prototype = Object.getPrototypeOf(instance);
|
|
75
|
+
this.metadataScanner
|
|
76
|
+
.getAllMethodNames(prototype)
|
|
77
|
+
.forEach((name) => add(prototype[name]));
|
|
78
|
+
}
|
|
79
|
+
return [...byKey.values()];
|
|
80
|
+
}
|
|
81
|
+
getKafkaClient() {
|
|
82
|
+
const token = this.moduleOptions.permissions?.kafkaClient;
|
|
83
|
+
if (!token) {
|
|
84
|
+
throw new Error('IamContextModule permissions.kafkaClient is not set');
|
|
85
|
+
}
|
|
86
|
+
return this.moduleRef.get(token, { strict: false });
|
|
87
|
+
}
|
|
88
|
+
};
|
|
89
|
+
exports.IamPermissionService = IamPermissionService;
|
|
90
|
+
exports.IamPermissionService = IamPermissionService = IamPermissionService_1 = __decorate([
|
|
91
|
+
(0, common_1.Injectable)(),
|
|
92
|
+
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
93
|
+
__metadata("design:paramtypes", [Object, core_1.DiscoveryService,
|
|
94
|
+
core_1.MetadataScanner,
|
|
95
|
+
core_1.ModuleRef])
|
|
96
|
+
], IamPermissionService);
|
|
97
|
+
//# sourceMappingURL=iam-permission.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;IAMJ,cAAc,CACZ,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAGhD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAGD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE;YAC7B,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;oBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAzFY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;GAR5B,oBAAoB,CAyFhC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
import { JWTPayload } from 'jose';
|
|
2
|
+
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
3
|
+
export declare class IamTokenVerifierService {
|
|
4
|
+
private readonly moduleOptions;
|
|
5
|
+
private readonly logger;
|
|
6
|
+
private readonly jwks;
|
|
7
|
+
constructor(moduleOptions: IamContextModuleOptions);
|
|
8
|
+
get enabled(): boolean;
|
|
9
|
+
verifyRequest(request: any): Promise<void>;
|
|
10
|
+
verify(token: string): Promise<JWTPayload>;
|
|
11
|
+
private getJwks;
|
|
12
|
+
private jwksUrl;
|
|
13
|
+
private forwardedSubject;
|
|
14
|
+
}
|
|
15
|
+
//# sourceMappingURL=iam-token-verifier.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiC,UAAU,EAAa,MAAM,MAAM,CAAC;AAC5E,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAWrD,qBACa,uBAAuB;IAShC,OAAO,CAAC,QAAQ,CAAC,aAAa;IARhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAGjB;gBAIe,aAAa,EAAE,uBAAuB;IAGzD,IAAI,OAAO,IAAI,OAAO,CAErB;IASK,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BhD,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,gBAAgB;CAOzB"}
|
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
|
+
};
|
|
8
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
|
+
};
|
|
11
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
|
+
};
|
|
14
|
+
var IamTokenVerifierService_1;
|
|
15
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
|
+
exports.IamTokenVerifierService = void 0;
|
|
17
|
+
const common_1 = require("@nestjs/common");
|
|
18
|
+
const jose_1 = require("jose");
|
|
19
|
+
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
20
|
+
const BEARER_PREFIX = /^Bearer\s+/i;
|
|
21
|
+
const ACCESS_TOKEN_TYPE = 'Bearer';
|
|
22
|
+
const CLOCK_TOLERANCE_SECONDS = 30;
|
|
23
|
+
let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifierService {
|
|
24
|
+
constructor(moduleOptions) {
|
|
25
|
+
this.moduleOptions = moduleOptions;
|
|
26
|
+
this.logger = new common_1.Logger(IamTokenVerifierService_1.name);
|
|
27
|
+
this.jwks = new Map();
|
|
28
|
+
}
|
|
29
|
+
get enabled() {
|
|
30
|
+
return !!this.moduleOptions.tokenVerification?.issuers?.length;
|
|
31
|
+
}
|
|
32
|
+
async verifyRequest(request) {
|
|
33
|
+
const headers = request.headers ?? {};
|
|
34
|
+
const authorization = headers['authorization'];
|
|
35
|
+
const forwarded = headers['injectedpayload'];
|
|
36
|
+
if (!authorization || !BEARER_PREFIX.test(authorization)) {
|
|
37
|
+
if (forwarded) {
|
|
38
|
+
this.logger.warn('Dropped injectedpayload sent without a Bearer token');
|
|
39
|
+
}
|
|
40
|
+
delete headers['injectedpayload'];
|
|
41
|
+
return;
|
|
42
|
+
}
|
|
43
|
+
const payload = await this.verify(authorization.replace(BEARER_PREFIX, ''));
|
|
44
|
+
if (forwarded && this.forwardedSubject(forwarded) !== payload.sub) {
|
|
45
|
+
this.logger.warn(`injectedpayload does not match the verified token (sub ${payload.sub})`);
|
|
46
|
+
}
|
|
47
|
+
headers['injectedpayload'] = JSON.stringify(payload);
|
|
48
|
+
}
|
|
49
|
+
async verify(token) {
|
|
50
|
+
let payload;
|
|
51
|
+
try {
|
|
52
|
+
const { iss } = (0, jose_1.decodeJwt)(token);
|
|
53
|
+
if (!iss || !this.moduleOptions.tokenVerification.issuers.includes(iss)) {
|
|
54
|
+
throw new Error('issuer not allowed');
|
|
55
|
+
}
|
|
56
|
+
({ payload } = await (0, jose_1.jwtVerify)(token, this.getJwks(iss), {
|
|
57
|
+
issuer: iss,
|
|
58
|
+
algorithms: ['RS256'],
|
|
59
|
+
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
60
|
+
}));
|
|
61
|
+
}
|
|
62
|
+
catch (error) {
|
|
63
|
+
throw new common_1.UnauthorizedException(`Invalid token: ${error?.code ?? error?.message ?? error}`);
|
|
64
|
+
}
|
|
65
|
+
if (payload.typ !== ACCESS_TOKEN_TYPE) {
|
|
66
|
+
throw new common_1.UnauthorizedException('Only access tokens are accepted');
|
|
67
|
+
}
|
|
68
|
+
return payload;
|
|
69
|
+
}
|
|
70
|
+
getJwks(issuer) {
|
|
71
|
+
let jwks = this.jwks.get(issuer);
|
|
72
|
+
if (!jwks) {
|
|
73
|
+
jwks = (0, jose_1.createRemoteJWKSet)(new URL(this.jwksUrl(issuer)));
|
|
74
|
+
this.jwks.set(issuer, jwks);
|
|
75
|
+
}
|
|
76
|
+
return jwks;
|
|
77
|
+
}
|
|
78
|
+
jwksUrl(issuer) {
|
|
79
|
+
const internal = this.moduleOptions.tokenVerification.jwksBaseUrl;
|
|
80
|
+
const realmPath = new URL(issuer).pathname;
|
|
81
|
+
const base = internal
|
|
82
|
+
? `${internal.replace(/\/$/, '')}${realmPath}`
|
|
83
|
+
: issuer;
|
|
84
|
+
return `${base}/protocol/openid-connect/certs`;
|
|
85
|
+
}
|
|
86
|
+
forwardedSubject(forwarded) {
|
|
87
|
+
try {
|
|
88
|
+
return JSON.parse(forwarded)?.sub;
|
|
89
|
+
}
|
|
90
|
+
catch {
|
|
91
|
+
return undefined;
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
};
|
|
95
|
+
exports.IamTokenVerifierService = IamTokenVerifierService;
|
|
96
|
+
exports.IamTokenVerifierService = IamTokenVerifierService = IamTokenVerifierService_1 = __decorate([
|
|
97
|
+
(0, common_1.Injectable)(),
|
|
98
|
+
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
99
|
+
__metadata("design:paramtypes", [Object])
|
|
100
|
+
], IamTokenVerifierService);
|
|
101
|
+
//# sourceMappingURL=iam-token-verifier.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,+BAA4E;AAC5E,+FAGqD;AAErD,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQ5B,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAOlC,YAEE,aAAuD;QAAtC,kBAAa,GAAb,aAAa,CAAyB;QARxC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAClD,SAAI,GAAG,IAAI,GAAG,EAG5B,CAAC;IAKD,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC;IACjE,CAAC;IASD,KAAK,CAAC,aAAa,CAAC,OAAY;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,aAAa,GAAuB,OAAO,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAuB,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,OAAO,CAAC,GAAG,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YACD,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACvD,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;QAID,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,MAAc;QAC5B,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGO,OAAO,CAAC,MAAc;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,SAAS,EAAE;YAC9C,CAAC,CAAC,MAAM,CAAC;QACX,OAAO,GAAG,IAAI,gCAAgC,CAAC;IACjD,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAnGY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;;GAR1B,uBAAuB,CAmGnC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mondart/nestjs-common-module-iam",
|
|
3
|
-
"version": "3.2.
|
|
3
|
+
"version": "3.2.14",
|
|
4
4
|
"description": "Reusable IAM (Identity and Access Management) utilities for NestJS.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Mondart"
|
|
@@ -21,7 +21,8 @@
|
|
|
21
21
|
"test:debug": "node --inspect-brk -r ts-node/register ./node_modules/.bin/jest --runInBand"
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@mondart/nestjs-common-module-core": "3.2.
|
|
24
|
+
"@mondart/nestjs-common-module-core": "3.2.12",
|
|
25
|
+
"jose": "5.10.0"
|
|
25
26
|
},
|
|
26
27
|
"peerDependencies": {
|
|
27
28
|
"@nestjs/common": "^11.1.10",
|