@mondart/nestjs-common-module-iam 3.2.14 → 3.2.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -23
- package/dist/constants/iam-decorator-key.const.d.ts +1 -0
- package/dist/constants/iam-decorator-key.const.d.ts.map +1 -1
- package/dist/constants/iam-decorator-key.const.js +2 -1
- package/dist/constants/iam-decorator-key.const.js.map +1 -1
- package/dist/guards/iam-context.guard.d.ts.map +1 -1
- package/dist/guards/iam-context.guard.js.map +1 -1
- package/dist/interfaces/iam-context-options.interface.d.ts +6 -2
- package/dist/interfaces/iam-context-options.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.js.map +1 -1
- package/dist/services/iam-permission.service.d.ts.map +1 -1
- package/dist/services/iam-permission.service.js +8 -9
- package/dist/services/iam-permission.service.js.map +1 -1
- package/dist/services/iam-token-verifier.service.d.ts +22 -5
- package/dist/services/iam-token-verifier.service.d.ts.map +1 -1
- package/dist/services/iam-token-verifier.service.js +192 -24
- package/dist/services/iam-token-verifier.service.js.map +1 -1
- package/package.json +5 -2
package/README.md
CHANGED
|
@@ -72,9 +72,10 @@ findAll() { ... }
|
|
|
72
72
|
```
|
|
73
73
|
|
|
74
74
|
An agent needs every listed key in its `permissions` claim (client roles of
|
|
75
|
-
the back-office `permissions` client,
|
|
76
|
-
|
|
77
|
-
|
|
75
|
+
the back-office `permissions` client, bundled into IAM roles that groups
|
|
76
|
+
grant), or its service's wildcard: `order:*` covers every `order:` key. An
|
|
77
|
+
agent in a group whose path ends with `/super-admin` passes every check.
|
|
78
|
+
Users and guests are rejected on these routes.
|
|
78
79
|
|
|
79
80
|
```ts
|
|
80
81
|
IamContextModule.forRoot({
|
|
@@ -85,39 +86,47 @@ IamContextModule.forRoot({
|
|
|
85
86
|
- `service`: key prefix of this service. On boot every declared key is sent to
|
|
86
87
|
IAM as `iam.permission.sync`, so IAM can create the roles.
|
|
87
88
|
- `kafkaClient`: injection token of the `ClientKafka` that sends the sync event.
|
|
89
|
+
- `extraKeys`: keys checked in code with `IamPermissionService.hasPermissions`
|
|
90
|
+
(e.g. on a route users share) instead of `@RequirePermission()`. They are
|
|
91
|
+
synced with the decorated ones, so IAM doesn't mark them deprecated.
|
|
88
92
|
|
|
89
93
|
## Verifying tokens in the service
|
|
90
94
|
|
|
91
95
|
The gateway introspects the token and forwards its claims as the
|
|
92
96
|
`injectedpayload` header. Anyone who can reach the service directly can forge
|
|
93
|
-
that header, so each service
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
```
|
|
106
|
-
|
|
107
|
-
With `tokenVerification` set, the guard runs on every HTTP request, before
|
|
108
|
-
the controller filter:
|
|
109
|
-
|
|
110
|
-
- The access token's RS256 signature is checked against the realm's JWKS
|
|
111
|
-
(cached, refetched on key rotation), along with expiry and an allowed issuer.
|
|
97
|
+
that header, so each service verifies the Bearer token itself. It needs no
|
|
98
|
+
Keycloak config: the realms' issuers and public keys come from IAM over Kafka
|
|
99
|
+
(`iam.token.keys`, request/reply), through a client cloned from
|
|
100
|
+
`permissions.kafkaClient`. Verification is on whenever that client is set.
|
|
101
|
+
|
|
102
|
+
Once the keys are loaded, the guard runs on every HTTP request, before the
|
|
103
|
+
controller filter:
|
|
104
|
+
|
|
105
|
+
- The access token's RS256 signature is checked against its realm's keys,
|
|
106
|
+
along with expiry and an issuer IAM knows. A token from a realm or key not
|
|
107
|
+
loaded yet makes it ask IAM again (at most once a minute); keys are also
|
|
108
|
+
reloaded every hour.
|
|
112
109
|
- `injectedpayload` is replaced with the verified claims, so `@IamContext()`,
|
|
113
110
|
`@GetAgent()` and `@GetUser()` only ever see verified data. A forwarded
|
|
114
111
|
payload whose `sub` differs from the token is logged.
|
|
115
112
|
- A missing token removes `injectedpayload`: the caller is anonymous.
|
|
116
|
-
- An invalid token,
|
|
113
|
+
- An invalid token, an unknown issuer, or anything other than an access token
|
|
117
114
|
(`typ: Bearer`) gets 401. That includes offline tokens; exchange them for an
|
|
118
115
|
access token first. `@PublicIam()` routes treat such callers as anonymous
|
|
119
116
|
instead.
|
|
120
117
|
|
|
118
|
+
When IAM can't be reached:
|
|
119
|
+
|
|
120
|
+
| Mode | Boot | Requests until IAM answers |
|
|
121
|
+
|---|---|---|
|
|
122
|
+
| default | not delayed; retries every 30 s | `injectedpayload` is trusted as before |
|
|
123
|
+
| `IAM_TOKEN_VERIFICATION_REQUIRED=true` (or `tokenVerification.required`) | waits for IAM | 503 |
|
|
124
|
+
|
|
125
|
+
Either way the failure is logged and sent to Sentry once per outage. Keys
|
|
126
|
+
already loaded stay in use while IAM is down.
|
|
127
|
+
|
|
128
|
+
IAM itself passes `tokenVerification.loadKeys` to read the keys without Kafka.
|
|
129
|
+
|
|
121
130
|
## Entity access rules
|
|
122
131
|
|
|
123
132
|
Access rules describe, per user type, which field(s) on the entity must
|
|
@@ -2,6 +2,7 @@ export declare const IAM_PUBLIC_ROUTE = "iam_public_route";
|
|
|
2
2
|
export declare const IAM_ROUTE_USER_TYPE = "iam_route_user_type";
|
|
3
3
|
export declare const IAM_ROUTE_PERMISSIONS = "iam_route_permissions";
|
|
4
4
|
export declare const IAM_PERMISSION_SYNC_TOPIC = "iam.permission.sync";
|
|
5
|
+
export declare const IAM_TOKEN_KEYS_TOPIC = "iam.token.keys";
|
|
5
6
|
export declare const IAM_SUPER_ADMIN_GROUP_SUFFIX = "/super-admin";
|
|
6
7
|
export declare const IAM_ENTITY_ACCESS_KEY = "iam_entity_access";
|
|
7
8
|
export declare const IAM_ENTITY_SCOPE_KEY = "iam_entity_scope";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAGrD,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
3
|
+
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_TOKEN_KEYS_TOPIC = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
4
4
|
exports.IAM_PUBLIC_ROUTE = 'iam_public_route';
|
|
5
5
|
exports.IAM_ROUTE_USER_TYPE = 'iam_route_user_type';
|
|
6
6
|
exports.IAM_ROUTE_PERMISSIONS = 'iam_route_permissions';
|
|
7
7
|
exports.IAM_PERMISSION_SYNC_TOPIC = 'iam.permission.sync';
|
|
8
|
+
exports.IAM_TOKEN_KEYS_TOPIC = 'iam.token.keys';
|
|
8
9
|
exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = '/super-admin';
|
|
9
10
|
exports.IAM_ENTITY_ACCESS_KEY = 'iam_entity_access';
|
|
10
11
|
exports.IAM_ENTITY_SCOPE_KEY = 'iam_entity_scope';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAElD,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAGxC,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE9C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGxC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAGhD,aAAa,EAAE,uBAAuB;
|
|
1
|
+
{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGxC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAGhD,aAAa,EAAE,uBAAuB;IAcnD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqH9D,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,0BAA0B;IAkBlC,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,WAAW;CAkBpB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,uFAAiF;AACjF,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAGhD,aAAsC;QANtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAGhD,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,uFAAiF;AACjF,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAGhD,aAAsC;QANtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAGhD,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IAaJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAIF,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa;oBAAE,MAAM,KAAK,CAAC;gBAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAEhE,6CAAmB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEnE,MAAM,gBAAgB,GACpB,yBAAyB;YACzB,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAC1C,EAAE,CAAC;QAEL,IACE,CAAC,yBAAyB;YAC1B,CAAC,IAAI,CAAC,aAAa,CAAC,8BAA8B;YAClD,CAAC,gBAAgB,CAAC,MAAM,EACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,UAAU,EACV,gBAAgB,CACjB,CAAC;QAEF,OAAO,CAAC,mDAAyB,CAAC,GAAG,eAAe,CAAC;QAErD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAEvD,+CAAqB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErE,IACE,mBAAmB,CAAC,MAAM;YAC1B,CAAC,eAAe,KAAK,oCAAe,CAAC,KAAK;gBACxC,CAAC,IAAI,CAAC,oBAAoB,CAAC,cAAc,CACvC,UAAU,CAAC,KAAK,EAChB,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAC1C,CAAC,EACJ,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,eAAe,GACnB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,8CAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,8DAAoC,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,sBAAsB,GAC1B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,+CAAqB,EACrB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CACzD,sBAAsB,CACvB,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAC1B,kCACE,mBAAmB,CAAC,YAAY,IAAI,UACtC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,UAAyB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAE5D,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CACrB,UAAyB,EACzB,QAAgC;QAEhC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC;YAED,OAAO,OAAO,KAAK,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAChC,gBAAkD;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,GAAG,gBAAgB;YAEnB,YAAY,EAAE,gBAAgB,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY;YAEnE,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB,CACzB,gBAA+C;QAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM;YACpC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY;YAChD,GAAG,MAAM,EAAE,KAAK;YAChB,GAAG,gBAAgB;YAEnB,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EACvC,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,MAAuB;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;QAClC,CAAC,CAAyC,CAAC;IAC7C,CAAC;IAEO,WAAW,CACjB,YAAoC,EACpC,YAAoC,EACpC,eAAuC;QAEvC,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,eAAe,EAAE,KAAK;aAC1B;YAED,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI;YAEvE,KAAK,EACH,eAAe,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK;SACvE,CAAC;IACJ,CAAC;CACF,CAAA;AAvOY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;qCALP,gBAAS;QACI,kDAAsB;QACxB,6CAAoB;QACjB,oDAAuB;GALxD,eAAe,CAuO3B"}
|
|
@@ -1,7 +1,10 @@
|
|
|
1
1
|
import { Type } from '@nestjs/common';
|
|
2
|
+
import type { JSONWebKeySet } from 'jose';
|
|
2
3
|
import { EntityTarget } from 'typeorm';
|
|
3
4
|
import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
|
|
5
|
+
import type { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
4
6
|
import { ApplyIamEntityScopeOptions, EntityAccessByRole } from './iam-entity-access.interface';
|
|
7
|
+
export type IamTokenKeys = Record<string, JSONWebKeySet>;
|
|
5
8
|
export type IamControllerClass = Type<unknown>;
|
|
6
9
|
export type IamControllerMatcher = string | IamControllerClass;
|
|
7
10
|
export interface IamEntityAccessPreset<T = any> {
|
|
@@ -20,10 +23,11 @@ export interface IamContextModuleOptions {
|
|
|
20
23
|
permissions?: {
|
|
21
24
|
service?: string;
|
|
22
25
|
kafkaClient?: string | symbol;
|
|
26
|
+
extraKeys?: IamPermissionDefinition[];
|
|
23
27
|
};
|
|
24
28
|
tokenVerification?: {
|
|
25
|
-
|
|
26
|
-
|
|
29
|
+
required?: boolean;
|
|
30
|
+
loadKeys?: () => Promise<IamTokenKeys>;
|
|
27
31
|
};
|
|
28
32
|
entityAccess?: {
|
|
29
33
|
defaultAccess?: EntityAccessByRole<any>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAGvC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAgBF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;KACvC,CAAC;IAiBF,iBAAiB,CAAC,EAAE;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;KACxC,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AA4Ha,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;
|
|
1
|
+
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AAarD,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS;IAQvC,cAAc,CACZ,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO;IAoBJ,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB7C,kBAAkB,IAAI,uBAAuB,EAAE;IAyB/C,OAAO,CAAC,cAAc;CAOvB"}
|
|
@@ -36,7 +36,7 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
36
36
|
return true;
|
|
37
37
|
}
|
|
38
38
|
const granted = new Set(permissions ?? []);
|
|
39
|
-
return required.every((key) => granted.has(key));
|
|
39
|
+
return required.every((key) => granted.has(key) || granted.has(`${key.split(':')[0]}:*`));
|
|
40
40
|
}
|
|
41
41
|
async onApplicationBootstrap() {
|
|
42
42
|
const service = this.moduleOptions.permissions?.service;
|
|
@@ -58,14 +58,12 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
58
58
|
}
|
|
59
59
|
collectPermissions() {
|
|
60
60
|
const byKey = new Map();
|
|
61
|
-
const
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
});
|
|
68
|
-
};
|
|
61
|
+
const addAll = (definitions) => definitions.forEach((definition) => {
|
|
62
|
+
if (!byKey.get(definition.key)?.description) {
|
|
63
|
+
byKey.set(definition.key, definition);
|
|
64
|
+
}
|
|
65
|
+
});
|
|
66
|
+
const add = (target) => addAll(Reflect.getMetadata(iam_decorator_key_const_1.IAM_ROUTE_PERMISSIONS, target) ?? []);
|
|
69
67
|
for (const wrapper of this.discoveryService.getControllers()) {
|
|
70
68
|
const { instance, metatype } = wrapper;
|
|
71
69
|
if (!instance || !metatype)
|
|
@@ -76,6 +74,7 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
76
74
|
.getAllMethodNames(prototype)
|
|
77
75
|
.forEach((name) => add(prototype[name]));
|
|
78
76
|
}
|
|
77
|
+
addAll(this.moduleOptions.permissions?.extraKeys ?? []);
|
|
79
78
|
return [...byKey.values()];
|
|
80
79
|
}
|
|
81
80
|
getKafkaClient() {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AAOrD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB;QAHpB,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QAPtB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ7D,CAAC;IAOJ,cAAc,CACZ,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAGhD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CACnE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAMD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,WAAsC,EAAE,EAAE,CACxD,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA/FY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;GAR5B,oBAAoB,CA+FhC"}
|
|
@@ -1,15 +1,32 @@
|
|
|
1
|
+
import { OnApplicationBootstrap, OnApplicationShutdown } from '@nestjs/common';
|
|
2
|
+
import { ModuleRef } from '@nestjs/core';
|
|
1
3
|
import { JWTPayload } from 'jose';
|
|
2
4
|
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
3
|
-
export declare class IamTokenVerifierService {
|
|
5
|
+
export declare class IamTokenVerifierService implements OnApplicationBootstrap, OnApplicationShutdown {
|
|
4
6
|
private readonly moduleOptions;
|
|
7
|
+
private readonly moduleRef?;
|
|
5
8
|
private readonly logger;
|
|
6
|
-
private
|
|
7
|
-
|
|
9
|
+
private keys?;
|
|
10
|
+
private loadedAt;
|
|
11
|
+
private lastAttempt;
|
|
12
|
+
private loading?;
|
|
13
|
+
private failing;
|
|
14
|
+
private retryTimer?;
|
|
15
|
+
private client?;
|
|
16
|
+
constructor(moduleOptions: IamContextModuleOptions, moduleRef?: ModuleRef);
|
|
8
17
|
get enabled(): boolean;
|
|
18
|
+
get required(): boolean;
|
|
19
|
+
onApplicationBootstrap(): Promise<void>;
|
|
20
|
+
onApplicationShutdown(): Promise<void>;
|
|
9
21
|
verifyRequest(request: any): Promise<void>;
|
|
10
22
|
verify(token: string): Promise<JWTPayload>;
|
|
11
|
-
private
|
|
12
|
-
private
|
|
23
|
+
private verifyWithLoadedKeys;
|
|
24
|
+
private refreshThrottled;
|
|
25
|
+
private refresh;
|
|
26
|
+
private load;
|
|
27
|
+
private scheduleRetry;
|
|
28
|
+
private fetchKeys;
|
|
29
|
+
private getClient;
|
|
13
30
|
private forwardedSubject;
|
|
14
31
|
}
|
|
15
32
|
//# sourceMappingURL=iam-token-verifier.service.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAIL,UAAU,EAEX,MAAM,MAAM,CAAC;AAGd,OAAO,EAEL,uBAAuB,EAExB,MAAM,6CAA6C,CAAC;AA2BrD,qBACa,uBACX,YAAW,sBAAsB,EAAE,qBAAqB;IAatD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAClB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAZzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,IAAI,CAAC,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAC,CAAiB;IACpC,OAAO,CAAC,MAAM,CAAC,CAAc;gBAIV,aAAa,EAAE,uBAAuB,EAC1B,SAAS,CAAC,EAAE,SAAS;IAIpD,IAAI,OAAO,IAAI,OAAO,CAKrB;IAED,IAAI,QAAQ,IAAI,OAAO,CAKtB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAcvC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;YA0BlC,oBAAoB;IAmBlC,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,OAAO;YAKD,IAAI;IAmClB,OAAO,CAAC,aAAa;YASP,SAAS;YA6BT,SAAS;IA2BvB,OAAO,CAAC,gBAAgB;CAOzB"}
|
|
@@ -1,10 +1,43 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
2
18
|
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
19
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
20
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
21
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
22
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
23
|
};
|
|
24
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
25
|
+
var ownKeys = function(o) {
|
|
26
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
27
|
+
var ar = [];
|
|
28
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
29
|
+
return ar;
|
|
30
|
+
};
|
|
31
|
+
return ownKeys(o);
|
|
32
|
+
};
|
|
33
|
+
return function (mod) {
|
|
34
|
+
if (mod && mod.__esModule) return mod;
|
|
35
|
+
var result = {};
|
|
36
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
37
|
+
__setModuleDefault(result, mod);
|
|
38
|
+
return result;
|
|
39
|
+
};
|
|
40
|
+
})();
|
|
8
41
|
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
42
|
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
43
|
};
|
|
@@ -15,21 +48,63 @@ var IamTokenVerifierService_1;
|
|
|
15
48
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
49
|
exports.IamTokenVerifierService = void 0;
|
|
17
50
|
const common_1 = require("@nestjs/common");
|
|
51
|
+
const core_1 = require("@nestjs/core");
|
|
52
|
+
const microservices_1 = require("@nestjs/microservices");
|
|
53
|
+
const Sentry = __importStar(require("@sentry/nestjs"));
|
|
18
54
|
const jose_1 = require("jose");
|
|
55
|
+
const rxjs_1 = require("rxjs");
|
|
56
|
+
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
19
57
|
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
20
58
|
const BEARER_PREFIX = /^Bearer\s+/i;
|
|
21
59
|
const ACCESS_TOKEN_TYPE = 'Bearer';
|
|
22
60
|
const CLOCK_TOLERANCE_SECONDS = 30;
|
|
61
|
+
const KAFKA_TIMEOUT_MS = 5_000;
|
|
62
|
+
const RETRY_MS = 30_000;
|
|
63
|
+
const REFRESH_THROTTLE_MS = 60_000;
|
|
64
|
+
const KEYS_TTL_MS = 60 * 60_000;
|
|
65
|
+
const CLIENT_SUFFIX = '-iam-token-keys';
|
|
23
66
|
let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifierService {
|
|
24
|
-
constructor(moduleOptions) {
|
|
67
|
+
constructor(moduleOptions, moduleRef) {
|
|
25
68
|
this.moduleOptions = moduleOptions;
|
|
69
|
+
this.moduleRef = moduleRef;
|
|
26
70
|
this.logger = new common_1.Logger(IamTokenVerifierService_1.name);
|
|
27
|
-
this.
|
|
71
|
+
this.loadedAt = 0;
|
|
72
|
+
this.lastAttempt = 0;
|
|
73
|
+
this.failing = false;
|
|
28
74
|
}
|
|
29
75
|
get enabled() {
|
|
30
|
-
return !!this.moduleOptions.tokenVerification?.
|
|
76
|
+
return !!(this.moduleOptions.tokenVerification?.loadKeys ||
|
|
77
|
+
this.moduleOptions.permissions?.kafkaClient);
|
|
78
|
+
}
|
|
79
|
+
get required() {
|
|
80
|
+
return (this.moduleOptions.tokenVerification?.required ??
|
|
81
|
+
process.env.IAM_TOKEN_VERIFICATION_REQUIRED === 'true');
|
|
82
|
+
}
|
|
83
|
+
async onApplicationBootstrap() {
|
|
84
|
+
if (!this.enabled)
|
|
85
|
+
return;
|
|
86
|
+
if (!this.required) {
|
|
87
|
+
void this.refresh();
|
|
88
|
+
return;
|
|
89
|
+
}
|
|
90
|
+
while (!(await this.refresh())) {
|
|
91
|
+
this.logger.warn(`Waiting for token keys from IAM, retrying in ${RETRY_MS / 1000}s`);
|
|
92
|
+
await new Promise((resolve) => setTimeout(resolve, RETRY_MS));
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
async onApplicationShutdown() {
|
|
96
|
+
clearTimeout(this.retryTimer);
|
|
97
|
+
await this.client?.close();
|
|
31
98
|
}
|
|
32
99
|
async verifyRequest(request) {
|
|
100
|
+
if (!this.keys) {
|
|
101
|
+
if (this.required) {
|
|
102
|
+
throw new common_1.ServiceUnavailableException('Token keys are not loaded');
|
|
103
|
+
}
|
|
104
|
+
return;
|
|
105
|
+
}
|
|
106
|
+
if (Date.now() - this.loadedAt > KEYS_TTL_MS)
|
|
107
|
+
void this.refreshThrottled();
|
|
33
108
|
const headers = request.headers ?? {};
|
|
34
109
|
const authorization = headers['authorization'];
|
|
35
110
|
const forwarded = headers['injectedpayload'];
|
|
@@ -50,14 +125,12 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
50
125
|
let payload;
|
|
51
126
|
try {
|
|
52
127
|
const { iss } = (0, jose_1.decodeJwt)(token);
|
|
53
|
-
|
|
54
|
-
|
|
128
|
+
payload = await this.verifyWithLoadedKeys(token, iss);
|
|
129
|
+
if (!payload && (await this.refreshThrottled())) {
|
|
130
|
+
payload = await this.verifyWithLoadedKeys(token, iss);
|
|
55
131
|
}
|
|
56
|
-
(
|
|
57
|
-
issuer
|
|
58
|
-
algorithms: ['RS256'],
|
|
59
|
-
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
60
|
-
}));
|
|
132
|
+
if (!payload)
|
|
133
|
+
throw new Error('unknown issuer or signing key');
|
|
61
134
|
}
|
|
62
135
|
catch (error) {
|
|
63
136
|
throw new common_1.UnauthorizedException(`Invalid token: ${error?.code ?? error?.message ?? error}`);
|
|
@@ -67,21 +140,115 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
67
140
|
}
|
|
68
141
|
return payload;
|
|
69
142
|
}
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
if (!jwks)
|
|
73
|
-
|
|
74
|
-
|
|
143
|
+
async verifyWithLoadedKeys(token, issuer) {
|
|
144
|
+
const jwks = issuer ? this.keys?.get(issuer) : undefined;
|
|
145
|
+
if (!jwks)
|
|
146
|
+
return undefined;
|
|
147
|
+
try {
|
|
148
|
+
const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
|
|
149
|
+
issuer,
|
|
150
|
+
algorithms: ['RS256'],
|
|
151
|
+
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
152
|
+
});
|
|
153
|
+
return payload;
|
|
154
|
+
}
|
|
155
|
+
catch (error) {
|
|
156
|
+
if (error instanceof jose_1.errors.JWKSNoMatchingKey)
|
|
157
|
+
return undefined;
|
|
158
|
+
throw error;
|
|
159
|
+
}
|
|
160
|
+
}
|
|
161
|
+
refreshThrottled() {
|
|
162
|
+
if (Date.now() - this.lastAttempt < REFRESH_THROTTLE_MS) {
|
|
163
|
+
return Promise.resolve(false);
|
|
164
|
+
}
|
|
165
|
+
return this.refresh();
|
|
166
|
+
}
|
|
167
|
+
refresh() {
|
|
168
|
+
this.loading ??= this.load().finally(() => (this.loading = undefined));
|
|
169
|
+
return this.loading;
|
|
170
|
+
}
|
|
171
|
+
async load() {
|
|
172
|
+
this.lastAttempt = Date.now();
|
|
173
|
+
try {
|
|
174
|
+
const keys = await this.fetchKeys();
|
|
175
|
+
if (!keys || !Object.keys(keys).length) {
|
|
176
|
+
throw new Error('IAM returned no token keys');
|
|
177
|
+
}
|
|
178
|
+
this.keys = new Map(Object.entries(keys).map(([issuer, jwks]) => [
|
|
179
|
+
issuer,
|
|
180
|
+
(0, jose_1.createLocalJWKSet)(jwks),
|
|
181
|
+
]));
|
|
182
|
+
this.loadedAt = Date.now();
|
|
183
|
+
if (this.failing)
|
|
184
|
+
this.logger.log('Token keys loaded from IAM again');
|
|
185
|
+
this.failing = false;
|
|
186
|
+
return true;
|
|
187
|
+
}
|
|
188
|
+
catch (cause) {
|
|
189
|
+
const error = Object.assign(new Error(`Cannot load token keys from IAM: ${cause}`), { cause });
|
|
190
|
+
const fallback = this.keys || this.required
|
|
191
|
+
? ''
|
|
192
|
+
: '; trusting injectedpayload until IAM answers';
|
|
193
|
+
this.logger.error(`${error.message}${fallback}`);
|
|
194
|
+
if (!this.failing)
|
|
195
|
+
Sentry.captureException(error);
|
|
196
|
+
this.failing = true;
|
|
197
|
+
if (!this.required)
|
|
198
|
+
this.scheduleRetry();
|
|
199
|
+
return false;
|
|
75
200
|
}
|
|
76
|
-
return jwks;
|
|
77
201
|
}
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
202
|
+
scheduleRetry() {
|
|
203
|
+
if (this.keys || this.retryTimer)
|
|
204
|
+
return;
|
|
205
|
+
this.retryTimer = setTimeout(() => {
|
|
206
|
+
this.retryTimer = undefined;
|
|
207
|
+
void this.refresh();
|
|
208
|
+
}, RETRY_MS);
|
|
209
|
+
this.retryTimer.unref?.();
|
|
210
|
+
}
|
|
211
|
+
async fetchKeys() {
|
|
212
|
+
const loadKeys = this.moduleOptions.tokenVerification?.loadKeys;
|
|
213
|
+
if (loadKeys)
|
|
214
|
+
return loadKeys();
|
|
215
|
+
try {
|
|
216
|
+
const client = await this.getClient();
|
|
217
|
+
const response = await (0, rxjs_1.firstValueFrom)(client
|
|
218
|
+
.send(iam_decorator_key_const_1.IAM_TOKEN_KEYS_TOPIC, {
|
|
219
|
+
event_source: this.moduleOptions.permissions?.service,
|
|
220
|
+
data: {},
|
|
221
|
+
})
|
|
222
|
+
.pipe((0, rxjs_1.timeout)(KAFKA_TIMEOUT_MS)));
|
|
223
|
+
return (typeof response === 'string' ? JSON.parse(response) : response)
|
|
224
|
+
?.data;
|
|
225
|
+
}
|
|
226
|
+
catch (error) {
|
|
227
|
+
await this.client?.close().catch(() => undefined);
|
|
228
|
+
this.client = undefined;
|
|
229
|
+
throw error;
|
|
230
|
+
}
|
|
231
|
+
}
|
|
232
|
+
async getClient() {
|
|
233
|
+
if (!this.client) {
|
|
234
|
+
const source = this.moduleRef.get(this.moduleOptions.permissions.kafkaClient, { strict: false });
|
|
235
|
+
const options = source.options ?? {};
|
|
236
|
+
this.client = new microservices_1.ClientKafka({
|
|
237
|
+
...options,
|
|
238
|
+
producerOnlyMode: false,
|
|
239
|
+
client: {
|
|
240
|
+
...options.client,
|
|
241
|
+
clientId: `${options.client?.clientId ?? 'nestjs-consumer'}${CLIENT_SUFFIX}`,
|
|
242
|
+
},
|
|
243
|
+
consumer: {
|
|
244
|
+
...options.consumer,
|
|
245
|
+
groupId: `${options.consumer?.groupId ?? 'nestjs-group'}${CLIENT_SUFFIX}`,
|
|
246
|
+
},
|
|
247
|
+
});
|
|
248
|
+
this.client.subscribeToResponseOf(iam_decorator_key_const_1.IAM_TOKEN_KEYS_TOPIC);
|
|
249
|
+
}
|
|
250
|
+
await this.client.connect();
|
|
251
|
+
return this.client;
|
|
85
252
|
}
|
|
86
253
|
forwardedSubject(forwarded) {
|
|
87
254
|
try {
|
|
@@ -96,6 +263,7 @@ exports.IamTokenVerifierService = IamTokenVerifierService;
|
|
|
96
263
|
exports.IamTokenVerifierService = IamTokenVerifierService = IamTokenVerifierService_1 = __decorate([
|
|
97
264
|
(0, common_1.Injectable)(),
|
|
98
265
|
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
99
|
-
|
|
266
|
+
__param(1, (0, common_1.Optional)()),
|
|
267
|
+
__metadata("design:paramtypes", [Object, core_1.ModuleRef])
|
|
100
268
|
], IamTokenVerifierService);
|
|
101
269
|
//# sourceMappingURL=iam-token-verifier.service.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,uCAAyC;AACzC,yDAAoD;AACpD,uDAAyC;AACzC,+BAMc;AACd,+BAA+C;AAC/C,kFAA4E;AAC5E,+FAIqD;AAErD,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAgBjC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAYlC,YAEE,aAAuD,EAC3C,SAAsC;QADjC,kBAAa,GAAb,aAAa,CAAyB;QAC1B,cAAS,GAAT,SAAS,CAAY;QAZnC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,aAAQ,GAAG,CAAC,CAAC;QACb,gBAAW,GAAG,CAAC,CAAC;QAEhB,YAAO,GAAG,KAAK,CAAC;IAQrB,CAAC;IAGJ,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,QAAQ,GAAG,IAAI,GAAG,CACnE,CAAC;YACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,OAAY;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,oCAA2B,CAAC,2BAA2B,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,WAAW;YAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,aAAa,GAAuB,OAAO,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAuB,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,OAAO,CAAC,GAAG,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBAChD,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;QAID,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAGO,KAAK,CAAC,oBAAoB,CAChC,KAAa,EACb,MAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM;gBACN,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAM,CAAC,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAGO,OAAO;QACb,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM;gBACN,IAAA,wBAAiB,EAAC,IAAI,CAAC;aACxB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,EACtD,EAAE,KAAK,EAAE,CACV,CAAC;YACF,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;gBACxB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,8CAA8C,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QAChE,IAAI,QAAQ;YAAE,OAAO,QAAQ,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,MAAM;iBACH,IAAI,CAAC,8CAAoB,EAAE;gBAC1B,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO;gBACrD,IAAI,EAAE,EAAE;aACT,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACrE,EAAE,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,CAAC,GAAG,CAChC,IAAI,CAAC,aAAa,CAAC,WAAY,CAAC,WAAY,EAC5C,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;YAGF,MAAM,OAAO,GAAI,MAAc,CAAC,OAAO,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,2BAAW,CAAC;gBAC5B,GAAG,OAAO;gBACV,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE;oBACN,GAAG,OAAO,CAAC,MAAM;oBACjB,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,GAAG,aAAa,EAAE;iBAC7E;gBACD,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc,GAAG,aAAa,EAAE;iBAC1E;aACF,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,8CAAoB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAjQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAcR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAA8B,gBAAS;GAfzC,uBAAuB,CAiQnC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mondart/nestjs-common-module-iam",
|
|
3
|
-
"version": "3.2.
|
|
3
|
+
"version": "3.2.16",
|
|
4
4
|
"description": "Reusable IAM (Identity and Access Management) utilities for NestJS.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Mondart"
|
|
@@ -22,11 +22,13 @@
|
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
24
|
"@mondart/nestjs-common-module-core": "3.2.12",
|
|
25
|
-
"jose": "5.10.0"
|
|
25
|
+
"jose": "5.10.0",
|
|
26
|
+
"@sentry/nestjs": "^10.32.1"
|
|
26
27
|
},
|
|
27
28
|
"peerDependencies": {
|
|
28
29
|
"@nestjs/common": "^11.1.10",
|
|
29
30
|
"@nestjs/core": "^11.1.10",
|
|
31
|
+
"@nestjs/microservices": "^11.1.10",
|
|
30
32
|
"@nestjs/swagger": "^11.0.3",
|
|
31
33
|
"@nestjs/typeorm": "^11.0.0",
|
|
32
34
|
"class-transformer": "^0.5.1",
|
|
@@ -40,6 +42,7 @@
|
|
|
40
42
|
"access": "public"
|
|
41
43
|
},
|
|
42
44
|
"devDependencies": {
|
|
45
|
+
"@nestjs/microservices": "^11.1.10",
|
|
43
46
|
"@nestjs/testing": "^11.1.27",
|
|
44
47
|
"@types/jest": "^30.0.0",
|
|
45
48
|
"@types/supertest": "^7.2.0",
|