@mondart/nestjs-common-module-iam 3.2.13 → 3.2.15

package/README.md

@@ -72,9 +72,10 @@ findAll() { ... }
 ```
 
 An agent needs every listed key in its `permissions` claim (client roles of
-the back-office `permissions` client, assigned through IAM groups). An agent
-in a group whose path ends with `/super-admin` passes every check. Users and
-guests are rejected on these routes.
+the back-office `permissions` client, bundled into IAM roles that groups
+grant), or its service's wildcard: `order:*` covers every `order:` key. An
+agent in a group whose path ends with `/super-admin` passes every check.
+Users and guests are rejected on these routes.
 
 ```ts
 IamContextModule.forRoot({
@@ -84,10 +85,42 @@ IamContextModule.forRoot({
 
 - `service`: key prefix of this service. On boot every declared key is sent to
   IAM as `iam.permission.sync`, so IAM can create the roles.
-- `kafkaClient`: injection token of a `ClientKafka`. Offline tokens carry no
-  `permissions` claim, so they are resolved with `iam.agent.permissions.find`
-  (cached 60 s per agent). Call
-  `client.subscribeToResponseOf('iam.agent.permissions.find')` on it.
+- `kafkaClient`: injection token of the `ClientKafka` that sends the sync event.
+- `extraKeys`: keys checked in code with `IamPermissionService.hasPermissions`
+  (e.g. on a route users share) instead of `@RequirePermission()`. They are
+  synced with the decorated ones, so IAM doesn't mark them deprecated.
+
+## Verifying tokens in the service
+
+The gateway introspects the token and forwards its claims as the
+`injectedpayload` header. Anyone who can reach the service directly can forge
+that header, so each service can verify the Bearer token itself:
+
+```ts
+IamContextModule.forRootAsync({
+  inject: [ConfigService],
+  useFactory: (config: ConfigService) => ({
+    tokenVerification: {
+      issuers: config.get<string[]>('keycloak.issuers'), // https://auth.example.com/realms/back-office, ...
+      jwksBaseUrl: config.get('keycloak.internalUrl'), // optional, e.g. http://keycloak:8080
+    },
+  }),
+});
+```
+
+With `tokenVerification` set, the guard runs on every HTTP request, before
+the controller filter:
+
+- The access token's RS256 signature is checked against the realm's JWKS
+  (cached, refetched on key rotation), along with expiry and an allowed issuer.
+- `injectedpayload` is replaced with the verified claims, so `@IamContext()`,
+  `@GetAgent()` and `@GetUser()` only ever see verified data. A forwarded
+  payload whose `sub` differs from the token is logged.
+- A missing token removes `injectedpayload`: the caller is anonymous.
+- An invalid token, a foreign issuer, or anything other than an access token
+  (`typ: Bearer`) gets 401. That includes offline tokens; exchange them for an
+  access token first. `@PublicIam()` routes treat such callers as anonymous
+  instead.
 
 ## Entity access rules
 

package/dist/constants/iam-decorator-key.const.d.ts

@@ -2,7 +2,6 @@ export declare const IAM_PUBLIC_ROUTE = "iam_public_route";
 export declare const IAM_ROUTE_USER_TYPE = "iam_route_user_type";
 export declare const IAM_ROUTE_PERMISSIONS = "iam_route_permissions";
 export declare const IAM_PERMISSION_SYNC_TOPIC = "iam.permission.sync";
-export declare const IAM_AGENT_PERMISSIONS_FIND_TOPIC = "iam.agent.permissions.find";
 export declare const IAM_SUPER_ADMIN_GROUP_SUFFIX = "/super-admin";
 export declare const IAM_ENTITY_ACCESS_KEY = "iam_entity_access";
 export declare const IAM_ENTITY_SCOPE_KEY = "iam_entity_scope";

package/dist/constants/iam-decorator-key.const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAG7E,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}
+{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAG/D,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}

package/dist/constants/iam-decorator-key.const.js

@@ -1,11 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_AGENT_PERMISSIONS_FIND_TOPIC = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
+exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
 exports.IAM_PUBLIC_ROUTE = 'iam_public_route';
 exports.IAM_ROUTE_USER_TYPE = 'iam_route_user_type';
 exports.IAM_ROUTE_PERMISSIONS = 'iam_route_permissions';
 exports.IAM_PERMISSION_SYNC_TOPIC = 'iam.permission.sync';
-exports.IAM_AGENT_PERMISSIONS_FIND_TOPIC = 'iam.agent.permissions.find';
 exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = '/super-admin';
 exports.IAM_ENTITY_ACCESS_KEY = 'iam_entity_access';
 exports.IAM_ENTITY_SCOPE_KEY = 'iam_entity_scope';

package/dist/constants/iam-decorator-key.const.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAClD,QAAA,gCAAgC,GAAG,4BAA4B,CAAC;AAGhE,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE9C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}
+{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAGlD,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE9C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}

package/dist/guards/iam-context.guard.d.ts

@@ -1,14 +1,16 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { IamPermissionService } from '../services/iam-permission.service';
+import { IamTokenVerifierService } from '../services/iam-token-verifier.service';
 import { IamEntityAccessService } from '../services/iam-entity-access.service';
 import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
 export declare class IamContextGuard implements CanActivate {
     private readonly reflector;
     private readonly iamEntityAccessService;
     private readonly iamPermissionService;
+    private readonly iamTokenVerifierService;
     private readonly moduleOptions;
-    constructor(reflector: Reflector, iamEntityAccessService: IamEntityAccessService, iamPermissionService: IamPermissionService, moduleOptions: IamContextModuleOptions);
+    constructor(reflector: Reflector, iamEntityAccessService: IamEntityAccessService, iamPermissionService: IamPermissionService, iamTokenVerifierService: IamTokenVerifierService, moduleOptions: IamContextModuleOptions);
     canActivate(context: ExecutionContext): Promise<boolean>;
     private shouldIgnoreController;
     private matchController;

package/dist/guards/iam-context.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAGrC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBALb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAG1C,aAAa,EAAE,uBAAuB;IAUnD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA0G9D,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,0BAA0B;IAkBlC,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,WAAW;CAkBpB"}
+{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGxC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAGhD,aAAa,EAAE,uBAAuB;IAYnD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqH9D,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,0BAA0B;IAkBlC,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,WAAW;CAkBpB"}

package/dist/guards/iam-context.guard.js

@@ -18,23 +18,35 @@ const core_1 = require("@nestjs/core");
 const iam_context_decorator_1 = require("../decorators/iam-context.decorator");
 const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
 const iam_permission_service_1 = require("../services/iam-permission.service");
+const iam_token_verifier_service_1 = require("../services/iam-token-verifier.service");
 const iam_user_type_enum_1 = require("../enums/iam-user-type.enum");
 const iam_entity_access_service_1 = require("../services/iam-entity-access.service");
 const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
 let IamContextGuard = class IamContextGuard {
-    constructor(reflector, iamEntityAccessService, iamPermissionService, moduleOptions) {
+    constructor(reflector, iamEntityAccessService, iamPermissionService, iamTokenVerifierService, moduleOptions) {
         this.reflector = reflector;
         this.iamEntityAccessService = iamEntityAccessService;
         this.iamPermissionService = iamPermissionService;
+        this.iamTokenVerifierService = iamTokenVerifierService;
         this.moduleOptions = moduleOptions;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
+        const isPublicRoute = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_PUBLIC_ROUTE, [context.getHandler(), context.getClass()]);
+        if (context.getType() === 'http' && this.iamTokenVerifierService.enabled) {
+            try {
+                await this.iamTokenVerifierService.verifyRequest(request);
+            }
+            catch (error) {
+                if (!isPublicRoute)
+                    throw error;
+                delete request.headers?.['injectedpayload'];
+            }
+        }
         const controller = context.getClass();
         if (this.shouldIgnoreController(controller)) {
             return true;
         }
-        const isPublicRoute = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_PUBLIC_ROUTE, [context.getHandler(), context.getClass()]);
         if (isPublicRoute) {
             return true;
         }
@@ -56,7 +68,7 @@ let IamContextGuard = class IamContextGuard {
         const requiredPermissions = this.reflector.getAllAndMerge(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, [context.getHandler(), context.getClass()]);
         if (requiredPermissions.length &&
             (currentUserType !== iam_user_type_enum_1.IamUserTypeEnum.AGENT ||
-                !(await this.iamPermissionService.hasPermissions(iamContext.agent, requiredPermissions.map(({ key }) => key))))) {
+                !this.iamPermissionService.hasPermissions(iamContext.agent, requiredPermissions.map(({ key }) => key)))) {
             throw new common_1.ForbiddenException('Missing permission');
         }
         const rawScopeOptions = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_ENTITY_SCOPE_KEY, [context.getHandler(), context.getClass()]);
@@ -133,9 +145,10 @@ let IamContextGuard = class IamContextGuard {
 exports.IamContextGuard = IamContextGuard;
 exports.IamContextGuard = IamContextGuard = __decorate([
     (0, common_1.Injectable)(),
-    __param(3, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
+    __param(4, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
     __metadata("design:paramtypes", [core_1.Reflector,
         iam_entity_access_service_1.IamEntityAccessService,
-        iam_permission_service_1.IamPermissionService, Object])
+        iam_permission_service_1.IamPermissionService,
+        iam_token_verifier_service_1.IamTokenVerifierService, Object])
 ], IamContextGuard);
 //# sourceMappingURL=iam-context.guard.js.map

package/dist/guards/iam-context.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAG1C,aAAsC;QALtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAG1C,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IASJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAEhE,6CAAmB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEnE,MAAM,gBAAgB,GACpB,yBAAyB;YACzB,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAC1C,EAAE,CAAC;QAEL,IACE,CAAC,yBAAyB;YAC1B,CAAC,IAAI,CAAC,aAAa,CAAC,8BAA8B;YAClD,CAAC,gBAAgB,CAAC,MAAM,EACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,UAAU,EACV,gBAAgB,CACjB,CAAC;QAEF,OAAO,CAAC,mDAAyB,CAAC,GAAG,eAAe,CAAC;QAErD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAEvD,+CAAqB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErE,IACE,mBAAmB,CAAC,MAAM;YAC1B,CAAC,eAAe,KAAK,oCAAe,CAAC,KAAK;gBACxC,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAC9C,UAAU,CAAC,KAAK,EAChB,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAC1C,CAAC,CAAC,EACL,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,eAAe,GACnB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,8CAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,8DAAoC,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,sBAAsB,GAC1B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,+CAAqB,EACrB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CACzD,sBAAsB,CACvB,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAC1B,kCACE,mBAAmB,CAAC,YAAY,IAAI,UACtC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,UAAyB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAE5D,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CACrB,UAAyB,EACzB,QAAgC;QAEhC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC;YAED,OAAO,OAAO,KAAK,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAChC,gBAAkD;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,GAAG,gBAAgB;YAEnB,YAAY,EAAE,gBAAgB,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY;YAEnE,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB,CACzB,gBAA+C;QAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM;YACpC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY;YAChD,GAAG,MAAM,EAAE,KAAK;YAChB,GAAG,gBAAgB;YAEnB,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EACvC,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,MAAuB;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;QAClC,CAAC,CAAyC,CAAC;IAC7C,CAAC;IAEO,WAAW,CACjB,YAAoC,EACpC,YAAoC,EACpC,eAAuC;QAEvC,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,eAAe,EAAE,KAAK;aAC1B;YAED,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI;YAEvE,KAAK,EACH,eAAe,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK;SACvE,CAAC;IACJ,CAAC;CACF,CAAA;AAvNY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;qCAJP,gBAAS;QACI,kDAAsB;QACxB,6CAAoB;GAJlD,eAAe,CAuN3B"}
+{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,uFAAiF;AACjF,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAGhD,aAAsC;QANtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAGhD,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IAWJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAIF,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa;oBAAE,MAAM,KAAK,CAAC;gBAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAEhE,6CAAmB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEnE,MAAM,gBAAgB,GACpB,yBAAyB;YACzB,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAC1C,EAAE,CAAC;QAEL,IACE,CAAC,yBAAyB;YAC1B,CAAC,IAAI,CAAC,aAAa,CAAC,8BAA8B;YAClD,CAAC,gBAAgB,CAAC,MAAM,EACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,UAAU,EACV,gBAAgB,CACjB,CAAC;QAEF,OAAO,CAAC,mDAAyB,CAAC,GAAG,eAAe,CAAC;QAErD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAEvD,+CAAqB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErE,IACE,mBAAmB,CAAC,MAAM;YAC1B,CAAC,eAAe,KAAK,oCAAe,CAAC,KAAK;gBACxC,CAAC,IAAI,CAAC,oBAAoB,CAAC,cAAc,CACvC,UAAU,CAAC,KAAK,EAChB,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAC1C,CAAC,EACJ,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,eAAe,GACnB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,8CAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,8DAAoC,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,sBAAsB,GAC1B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,+CAAqB,EACrB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CACzD,sBAAsB,CACvB,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAC1B,kCACE,mBAAmB,CAAC,YAAY,IAAI,UACtC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,UAAyB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAE5D,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CACrB,UAAyB,EACzB,QAAgC;QAEhC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC;YAED,OAAO,OAAO,KAAK,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAChC,gBAAkD;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,GAAG,gBAAgB;YAEnB,YAAY,EAAE,gBAAgB,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY;YAEnE,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB,CACzB,gBAA+C;QAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM;YACpC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY;YAChD,GAAG,MAAM,EAAE,KAAK;YAChB,GAAG,gBAAgB;YAEnB,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EACvC,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,MAAuB;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;QAClC,CAAC,CAAyC,CAAC;IAC7C,CAAC;IAEO,WAAW,CACjB,YAAoC,EACpC,YAAoC,EACpC,eAAuC;QAEvC,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,eAAe,EAAE,KAAK;aAC1B;YAED,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI;YAEvE,KAAK,EACH,eAAe,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK;SACvE,CAAC;IACJ,CAAC;CACF,CAAA;AArOY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;qCALP,gBAAS;QACI,kDAAsB;QACxB,6CAAoB;QACjB,oDAAuB;GALxD,eAAe,CAqO3B"}

package/dist/iam-context.module.d.ts

@@ -1,6 +1,8 @@
 import { DynamicModule } from '@nestjs/common';
-import { IamContextModuleOptions } from './interfaces/iam-context-options.interface';
+import { IamContextModuleAsyncOptions, IamContextModuleOptions } from './interfaces/iam-context-options.interface';
 export declare class IamContextModule {
     static forRoot(options?: IamContextModuleOptions): DynamicModule;
+    static forRootAsync(options: IamContextModuleAsyncOptions): DynamicModule;
+    private static create;
 }
 //# sourceMappingURL=iam-context.module.d.ts.map

package/dist/iam-context.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAC;AAQ/D,OAAO,EAGL,uBAAuB,EACxB,MAAM,4CAA4C,CAAC;AAMpD,qBAEa,gBAAgB;IAK3B,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,uBAA4B,GAAG,aAAa;CAsCrE"}
+{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AASzE,OAAO,EAGL,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,4CAA4C,CAAC;AA8BpD,qBAEa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,uBAA4B,GAAG,aAAa;IAQpE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,4BAA4B,GAAG,aAAa;IASzE,OAAO,CAAC,MAAM,CAAC,MAAM;CAetB"}

package/dist/iam-context.module.js

@@ -13,46 +13,53 @@ const core_1 = require("@nestjs/core");
 const iam_context_guard_1 = require("./guards/iam-context.guard");
 const iam_entity_access_service_1 = require("./services/iam-entity-access.service");
 const iam_permission_service_1 = require("./services/iam-permission.service");
+const iam_token_verifier_service_1 = require("./services/iam-token-verifier.service");
 const iam_find_one_query_scope_pipe_1 = require("./pipes/iam-find-one-query-scope.pipe");
 const iam_paginate_query_scope_pipe_1 = require("./pipes/iam-paginate-query-scope.pipe");
 const iam_context_options_interface_1 = require("./interfaces/iam-context-options.interface");
+const services = [
+    iam_entity_access_service_1.IamEntityAccessService,
+    iam_permission_service_1.IamPermissionService,
+    iam_token_verifier_service_1.IamTokenVerifierService,
+    iam_find_one_query_scope_pipe_1.IamFindOneQueryScopePipe,
+    iam_paginate_query_scope_pipe_1.IamPaginateQueryScopePipe,
+];
+const mergeOptions = (options = {}) => ({
+    ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS,
+    ...options,
+    controllers: {
+        ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS.controllers,
+        ...options.controllers,
+    },
+    entityAccess: {
+        ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS.entityAccess,
+        ...options.entityAccess,
+    },
+});
 let IamContextModule = IamContextModule_1 = class IamContextModule {
     static forRoot(options = {}) {
+        return IamContextModule_1.create([], {
+            provide: iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS,
+            useValue: mergeOptions(options),
+        });
+    }
+    static forRootAsync(options) {
+        return IamContextModule_1.create(options.imports ?? [], {
+            provide: iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS,
+            inject: options.inject ?? [],
+            useFactory: async (...args) => mergeOptions(await options.useFactory(...args)),
+        });
+    }
+    static create(imports, optionsProvider) {
         return {
             module: IamContextModule_1,
-            imports: [core_1.DiscoveryModule],
+            imports: [core_1.DiscoveryModule, ...imports],
             providers: [
-                {
-                    provide: iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS,
-                    useValue: {
-                        ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS,
-                        ...options,
-                        controllers: {
-                            ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS.controllers,
-                            ...options.controllers,
-                        },
-                        entityAccess: {
-                            ...iam_context_options_interface_1.DEFAULT_IAM_CONTEXT_MODULE_OPTIONS.entityAccess,
-                            ...options.entityAccess,
-                        },
-                    },
-                },
-                iam_entity_access_service_1.IamEntityAccessService,
-                iam_permission_service_1.IamPermissionService,
-                iam_find_one_query_scope_pipe_1.IamFindOneQueryScopePipe,
-                iam_paginate_query_scope_pipe_1.IamPaginateQueryScopePipe,
-                {
-                    provide: core_1.APP_GUARD,
-                    useClass: iam_context_guard_1.IamContextGuard,
-                },
-            ],
-            exports: [
-                iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS,
-                iam_entity_access_service_1.IamEntityAccessService,
-                iam_permission_service_1.IamPermissionService,
-                iam_find_one_query_scope_pipe_1.IamFindOneQueryScopePipe,
-                iam_paginate_query_scope_pipe_1.IamPaginateQueryScopePipe,
+                optionsProvider,
+                ...services,
+                { provide: core_1.APP_GUARD, useClass: iam_context_guard_1.IamContextGuard },
             ],
+            exports: [iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS, ...services],
         };
     }
 };

package/dist/iam-context.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA+D;AAC/D,uCAA0D;AAE1D,kEAA6D;AAC7D,oFAA8E;AAC9E,8EAAyE;AACzE,yFAAiF;AACjF,yFAAkF;AAClF,8FAIoD;AAQ7C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAK3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,OAAO;YACL,MAAM,EAAE,kBAAgB;YACxB,OAAO,EAAE,CAAC,sBAAe,CAAC;YAC1B,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,0DAA0B;oBACnC,QAAQ,EAAE;wBACR,GAAG,kEAAkC;wBACrC,GAAG,OAAO;wBACV,WAAW,EAAE;4BACX,GAAG,kEAAkC,CAAC,WAAW;4BACjD,GAAG,OAAO,CAAC,WAAW;yBACvB;wBACD,YAAY,EAAE;4BACZ,GAAG,kEAAkC,CAAC,YAAY;4BAClD,GAAG,OAAO,CAAC,YAAY;yBACxB;qBACF;iBACF;gBACD,kDAAsB;gBACtB,6CAAoB;gBACpB,wDAAwB;gBACxB,yDAAyB;gBACzB;oBACE,OAAO,EAAE,gBAAS;oBAClB,QAAQ,EAAE,mCAAe;iBAC1B;aACF;YACD,OAAO,EAAE;gBACP,0DAA0B;gBAC1B,kDAAsB;gBACtB,6CAAoB;gBACpB,wDAAwB;gBACxB,yDAAyB;aAC1B;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA3CY,4CAAgB;2BAAhB,gBAAgB;IAF5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CA2C5B"}
+{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,uCAA0D;AAE1D,kEAA6D;AAC7D,oFAA8E;AAC9E,8EAAyE;AACzE,sFAAgF;AAChF,yFAAiF;AACjF,yFAAkF;AAClF,8FAKoD;AAEpD,MAAM,QAAQ,GAAG;IACf,kDAAsB;IACtB,6CAAoB;IACpB,oDAAuB;IACvB,wDAAwB;IACxB,yDAAyB;CAC1B,CAAC;AAGF,MAAM,YAAY,GAAG,CACnB,UAAmC,EAAE,EACZ,EAAE,CAAC,CAAC;IAC7B,GAAG,kEAAkC;IACrC,GAAG,OAAO;IACV,WAAW,EAAE;QACX,GAAG,kEAAkC,CAAC,WAAW;QACjD,GAAG,OAAO,CAAC,WAAW;KACvB;IACD,YAAY,EAAE;QACZ,GAAG,kEAAkC,CAAC,YAAY;QAClD,GAAG,OAAO,CAAC,YAAY;KACxB;CACF,CAAC,CAAC;AAQI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,OAAO,kBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE;YACjC,OAAO,EAAE,0DAA0B;YACnC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,OAAqC;QACvD,OAAO,kBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;YACpD,OAAO,EAAE,0DAA0B;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE,CACnC,YAAY,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,MAAM,CACnB,OAAc,EACd,eAAyB;QAEzB,OAAO;YACL,MAAM,EAAE,kBAAgB;YACxB,OAAO,EAAE,CAAC,sBAAe,EAAE,GAAG,OAAO,CAAC;YACtC,SAAS,EAAE;gBACT,eAAe;gBACf,GAAG,QAAQ;gBACX,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,mCAAe,EAAE;aAClD;YACD,OAAO,EAAE,CAAC,0DAA0B,EAAE,GAAG,QAAQ,CAAC;SACnD,CAAC;IACJ,CAAC;CACF,CAAA;AAjCY,4CAAgB;2BAAhB,gBAAgB;IAF5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CAiC5B"}

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export * from './pipes/iam-paginate-query-scope.pipe';
 export * from './pipes/iam-find-one-query-scope.pipe';
 export * from './services/iam-entity-access.service';
 export * from './services/iam-permission.service';
+export * from './services/iam-token-verifier.service';
 export * from './iam-context.module';
 export * from './constants/iam-decorator-key.const';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -34,6 +34,7 @@ __exportStar(require("./pipes/iam-paginate-query-scope.pipe"), exports);
 __exportStar(require("./pipes/iam-find-one-query-scope.pipe"), exports);
 __exportStar(require("./services/iam-entity-access.service"), exports);
 __exportStar(require("./services/iam-permission.service"), exports);
+__exportStar(require("./services/iam-token-verifier.service"), exports);
 __exportStar(require("./iam-context.module"), exports);
 __exportStar(require("./constants/iam-decorator-key.const"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,qEAAmD;AACnD,mEAAiD;AACjD,kEAAgD;AAChD,wDAAsC;AACtC,mEAAiD;AACjD,kEAAgD;AAChD,4EAA0D;AAC1D,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,oEAAkD;AAClD,uDAAqC;AACrC,sEAAoD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,qEAAmD;AACnD,mEAAiD;AACjD,kEAAgD;AAChD,wDAAsC;AACtC,mEAAiD;AACjD,kEAAgD;AAChD,4EAA0D;AAC1D,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,oEAAkD;AAClD,wEAAsD;AACtD,uDAAqC;AACrC,sEAAoD"}

package/dist/interfaces/iam-context-options.interface.d.ts

@@ -1,6 +1,7 @@
 import { Type } from '@nestjs/common';
 import { EntityTarget } from 'typeorm';
 import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
+import type { IamPermissionDefinition } from '../decorators/require-permission.decorator';
 import { ApplyIamEntityScopeOptions, EntityAccessByRole } from './iam-entity-access.interface';
 export type IamControllerClass = Type<unknown>;
 export type IamControllerMatcher = string | IamControllerClass;
@@ -20,6 +21,11 @@ export interface IamContextModuleOptions {
     permissions?: {
         service?: string;
         kafkaClient?: string | symbol;
+        extraKeys?: IamPermissionDefinition[];
+    };
+    tokenVerification?: {
+        issuers: string[];
+        jwksBaseUrl?: string;
     };
     entityAccess?: {
         defaultAccess?: EntityAccessByRole<any>;
@@ -27,6 +33,11 @@ export interface IamContextModuleOptions {
         presets?: IamEntityAccessPreset<any>[];
     };
 }
+export interface IamContextModuleAsyncOptions {
+    imports?: any[];
+    inject?: any[];
+    useFactory: (...args: any[]) => IamContextModuleOptions | Promise<IamContextModuleOptions>;
+}
 export declare const IAM_CONTEXT_MODULE_OPTIONS: unique symbol;
 export declare const DEFAULT_IAM_CONTEXT_MODULE_OPTIONS: Required<Pick<IamContextModuleOptions, 'defaultAllowedUserTypes' | 'allowRoutesWithoutIamDecorator'>> & Omit<IamContextModuleOptions, 'defaultAllowedUserTypes' | 'allowRoutesWithoutIamDecorator'>;
 //# sourceMappingURL=iam-context-options.interface.d.ts.map

package/dist/interfaces/iam-context-options.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAcF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC/B,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
+{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAgBF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;KACvC,CAAC;IAcF,iBAAiB,CAAC,EAAE;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}

package/dist/interfaces/iam-context-options.interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AAwFa,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
+{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AAqHa,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}

package/dist/services/iam-permission.service.d.ts

@@ -9,12 +9,10 @@ export declare class IamPermissionService implements OnApplicationBootstrap {
     private readonly metadataScanner;
     private readonly moduleRef;
     private readonly logger;
-    private readonly cache;
     constructor(moduleOptions: IamContextModuleOptions, discoveryService: DiscoveryService, metadataScanner: MetadataScanner, moduleRef: ModuleRef);
-    hasPermissions(agent: GetAgentInterface | undefined, required: string[]): Promise<boolean>;
+    hasPermissions(agent: GetAgentInterface | undefined, required: string[]): boolean;
     onApplicationBootstrap(): Promise<void>;
     collectPermissions(): IamPermissionDefinition[];
-    private findAgentPermissions;
     private getKafkaClient;
 }
 //# sourceMappingURL=iam-permission.service.d.ts.map

package/dist/services/iam-permission.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAQtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAqBrD,qBACa,oBAAqB,YAAW,sBAAsB;IAU/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAZ5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;gBAIe,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;IAQjC,cAAc,CAClB,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,OAAO,CAAC;IAuBb,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB7C,kBAAkB,IAAI,uBAAuB,EAAE;YAyBjC,oBAAoB;IAyBlC,OAAO,CAAC,cAAc;CAOvB"}
+{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;IAQvC,cAAc,CACZ,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO;IAoBJ,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB7C,kBAAkB,IAAI,uBAAuB,EAAE;IAyB/C,OAAO,CAAC,cAAc;CAOvB"}

package/dist/services/iam-permission.service.js

@@ -19,8 +19,6 @@ const core_1 = require("@nestjs/core");
 const rxjs_1 = require("rxjs");
 const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
 const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
-const OFFLINE_TOKEN_TYPE = 'Offline';
-const CACHE_TTL_MS = 60_000;
 const KAFKA_TIMEOUT_MS = 5_000;
 let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
     constructor(moduleOptions, discoveryService, metadataScanner, moduleRef) {
@@ -29,20 +27,16 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
         this.metadataScanner = metadataScanner;
         this.moduleRef = moduleRef;
         this.logger = new common_1.Logger(IamPermissionService_1.name);
-        this.cache = new Map();
     }
-    async hasPermissions(agent, required) {
+    hasPermissions(agent, required) {
         if (!agent?.agentId)
             return false;
-        let { permissions, groupsMembership } = agent;
-        if (!permissions && agent.tokenType === OFFLINE_TOKEN_TYPE) {
-            ({ permissions, groupsMembership } = await this.findAgentPermissions(agent.agentId));
-        }
+        const { permissions, groupsMembership } = agent;
         if (groupsMembership?.some((path) => path.endsWith(iam_decorator_key_const_1.IAM_SUPER_ADMIN_GROUP_SUFFIX))) {
             return true;
         }
         const granted = new Set(permissions ?? []);
-        return required.every((key) => granted.has(key));
+        return required.every((key) => granted.has(key) || granted.has(`${key.split(':')[0]}:*`));
     }
     async onApplicationBootstrap() {
         const service = this.moduleOptions.permissions?.service;
@@ -64,14 +58,12 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
     }
     collectPermissions() {
         const byKey = new Map();
-        const add = (target) => {
-            const definitions = Reflect.getMetadata(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, target) ?? [];
-            definitions.forEach((definition) => {
-                if (!byKey.get(definition.key)?.description) {
-                    byKey.set(definition.key, definition);
-                }
-            });
-        };
+        const addAll = (definitions) => definitions.forEach((definition) => {
+            if (!byKey.get(definition.key)?.description) {
+                byKey.set(definition.key, definition);
+            }
+        });
+        const add = (target) => addAll(Reflect.getMetadata(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, target) ?? []);
         for (const wrapper of this.discoveryService.getControllers()) {
             const { instance, metatype } = wrapper;
             if (!instance || !metatype)
@@ -82,26 +74,9 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
                 .getAllMethodNames(prototype)
                 .forEach((name) => add(prototype[name]));
         }
+        addAll(this.moduleOptions.permissions?.extraKeys ?? []);
         return [...byKey.values()];
     }
-    async findAgentPermissions(agentId) {
-        const cached = this.cache.get(agentId);
-        if (cached && cached.expiresAt > Date.now())
-            return cached.value;
-        const response = await (0, rxjs_1.firstValueFrom)(this.getKafkaClient()
-            .send(iam_decorator_key_const_1.IAM_AGENT_PERMISSIONS_FIND_TOPIC, {
-            event_source: this.moduleOptions.permissions?.service,
-            data: { id: agentId },
-        })
-            .pipe((0, rxjs_1.timeout)(KAFKA_TIMEOUT_MS)));
-        const parsed = typeof response === 'string' ? JSON.parse(response) : response;
-        const value = {
-            permissions: parsed?.data?.permissions ?? [],
-            groupsMembership: parsed?.data?.groupsMembership ?? [],
-        };
-        this.cache.set(agentId, { value, expiresAt: Date.now() + CACHE_TTL_MS });
-        return value;
-    }
     getKafkaClient() {
         const token = this.moduleOptions.permissions?.kafkaClient;
         if (!token) {

package/dist/services/iam-permission.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAK8C;AAE9C,+FAGqD;AAarD,MAAM,kBAAkB,GAAG,SAAS,CAAC;AACrC,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAQ/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAZtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAE/C,UAAK,GAAG,IAAI,GAAG,EAG7B,CAAC;IAQD,CAAC;IAOJ,KAAK,CAAC,cAAc,CAClB,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,EAAE,CAAC;YAC3D,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAClE,KAAK,CAAC,OAAO,CACd,CAAC,CAAC;QACL,CAAC;QAGD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAGD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE;YAC7B,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;oBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,OAAe;QAEf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QAEjE,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,cAAc,EAAE;aAClB,IAAI,CAAC,0DAAgC,EAAE;YACtC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO;YACrD,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;SACtB,CAAC;aACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;QACF,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,KAAK,GAAqB;YAC9B,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;YAC5C,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE;SACvD,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA7HY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;GAb5B,oBAAoB,CA6HhC"}
+{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;IAOJ,cAAc,CACZ,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAGhD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAMD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,WAAsC,EAAE,EAAE,CACxD,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA/FY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;GAR5B,oBAAoB,CA+FhC"}

package/dist/services/iam-token-verifier.service.d.ts

@@ -0,0 +1,15 @@
+import { JWTPayload } from 'jose';
+import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
+export declare class IamTokenVerifierService {
+    private readonly moduleOptions;
+    private readonly logger;
+    private readonly jwks;
+    constructor(moduleOptions: IamContextModuleOptions);
+    get enabled(): boolean;
+    verifyRequest(request: any): Promise<void>;
+    verify(token: string): Promise<JWTPayload>;
+    private getJwks;
+    private jwksUrl;
+    private forwardedSubject;
+}
+//# sourceMappingURL=iam-token-verifier.service.d.ts.map

package/dist/services/iam-token-verifier.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAiC,UAAU,EAAa,MAAM,MAAM,CAAC;AAC5E,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAWrD,qBACa,uBAAuB;IAShC,OAAO,CAAC,QAAQ,CAAC,aAAa;IARhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAGjB;gBAIe,aAAa,EAAE,uBAAuB;IAGzD,IAAI,OAAO,IAAI,OAAO,CAErB;IASK,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA2BhD,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/services/iam-token-verifier.service.js

@@ -0,0 +1,101 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var IamTokenVerifierService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IamTokenVerifierService = void 0;
+const common_1 = require("@nestjs/common");
+const jose_1 = require("jose");
+const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
+const BEARER_PREFIX = /^Bearer\s+/i;
+const ACCESS_TOKEN_TYPE = 'Bearer';
+const CLOCK_TOLERANCE_SECONDS = 30;
+let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifierService {
+    constructor(moduleOptions) {
+        this.moduleOptions = moduleOptions;
+        this.logger = new common_1.Logger(IamTokenVerifierService_1.name);
+        this.jwks = new Map();
+    }
+    get enabled() {
+        return !!this.moduleOptions.tokenVerification?.issuers?.length;
+    }
+    async verifyRequest(request) {
+        const headers = request.headers ?? {};
+        const authorization = headers['authorization'];
+        const forwarded = headers['injectedpayload'];
+        if (!authorization || !BEARER_PREFIX.test(authorization)) {
+            if (forwarded) {
+                this.logger.warn('Dropped injectedpayload sent without a Bearer token');
+            }
+            delete headers['injectedpayload'];
+            return;
+        }
+        const payload = await this.verify(authorization.replace(BEARER_PREFIX, ''));
+        if (forwarded && this.forwardedSubject(forwarded) !== payload.sub) {
+            this.logger.warn(`injectedpayload does not match the verified token (sub ${payload.sub})`);
+        }
+        headers['injectedpayload'] = JSON.stringify(payload);
+    }
+    async verify(token) {
+        let payload;
+        try {
+            const { iss } = (0, jose_1.decodeJwt)(token);
+            if (!iss || !this.moduleOptions.tokenVerification.issuers.includes(iss)) {
+                throw new Error('issuer not allowed');
+            }
+            ({ payload } = await (0, jose_1.jwtVerify)(token, this.getJwks(iss), {
+                issuer: iss,
+                algorithms: ['RS256'],
+                clockTolerance: CLOCK_TOLERANCE_SECONDS,
+            }));
+        }
+        catch (error) {
+            throw new common_1.UnauthorizedException(`Invalid token: ${error?.code ?? error?.message ?? error}`);
+        }
+        if (payload.typ !== ACCESS_TOKEN_TYPE) {
+            throw new common_1.UnauthorizedException('Only access tokens are accepted');
+        }
+        return payload;
+    }
+    getJwks(issuer) {
+        let jwks = this.jwks.get(issuer);
+        if (!jwks) {
+            jwks = (0, jose_1.createRemoteJWKSet)(new URL(this.jwksUrl(issuer)));
+            this.jwks.set(issuer, jwks);
+        }
+        return jwks;
+    }
+    jwksUrl(issuer) {
+        const internal = this.moduleOptions.tokenVerification.jwksBaseUrl;
+        const realmPath = new URL(issuer).pathname;
+        const base = internal
+            ? `${internal.replace(/\/$/, '')}${realmPath}`
+            : issuer;
+        return `${base}/protocol/openid-connect/certs`;
+    }
+    forwardedSubject(forwarded) {
+        try {
+            return JSON.parse(forwarded)?.sub;
+        }
+        catch {
+            return undefined;
+        }
+    }
+};
+exports.IamTokenVerifierService = IamTokenVerifierService;
+exports.IamTokenVerifierService = IamTokenVerifierService = IamTokenVerifierService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], IamTokenVerifierService);
+//# sourceMappingURL=iam-token-verifier.service.js.map

package/dist/services/iam-token-verifier.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,+BAA4E;AAC5E,+FAGqD;AAErD,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAQ5B,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAOlC,YAEE,aAAuD;QAAtC,kBAAa,GAAb,aAAa,CAAyB;QARxC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAClD,SAAI,GAAG,IAAI,GAAG,EAG5B,CAAC;IAKD,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC;IACjE,CAAC;IASD,KAAK,CAAC,aAAa,CAAC,OAAY;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,aAAa,GAAuB,OAAO,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAuB,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,OAAO,CAAC,GAAG,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YACD,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;gBACvD,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;QAID,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,OAAO,CAAC,MAAc;QAC5B,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGO,OAAO,CAAC,MAAc;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,WAAW,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC3C,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,SAAS,EAAE;YAC9C,CAAC,CAAC,MAAM,CAAC;QACX,OAAO,GAAG,IAAI,gCAAgC,CAAC;IACjD,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAnGY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;;GAR1B,uBAAuB,CAmGnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondart/nestjs-common-module-iam",
-  "version": "3.2.13",
+  "version": "3.2.15",
   "description": "Reusable IAM (Identity and Access Management) utilities for NestJS.",
   "author": {
     "name": "Mondart"
@@ -21,7 +21,8 @@
     "test:debug": "node --inspect-brk -r ts-node/register ./node_modules/.bin/jest --runInBand"
   },
   "dependencies": {
-    "@mondart/nestjs-common-module-core": "3.2.12"
+    "@mondart/nestjs-common-module-core": "3.2.12",
+    "jose": "5.10.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.1.10",