@mondart/nestjs-common-module-iam 3.2.15 → 3.2.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -20
- package/dist/constants/iam-decorator-key.const.d.ts +1 -0
- package/dist/constants/iam-decorator-key.const.d.ts.map +1 -1
- package/dist/constants/iam-decorator-key.const.js +2 -1
- package/dist/constants/iam-decorator-key.const.js.map +1 -1
- package/dist/guards/iam-context.guard.d.ts.map +1 -1
- package/dist/guards/iam-context.guard.js.map +1 -1
- package/dist/interfaces/iam-context-options.interface.d.ts +4 -2
- package/dist/interfaces/iam-context-options.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.js.map +1 -1
- package/dist/services/iam-token-verifier.service.d.ts +22 -5
- package/dist/services/iam-token-verifier.service.d.ts.map +1 -1
- package/dist/services/iam-token-verifier.service.js +192 -24
- package/dist/services/iam-token-verifier.service.js.map +1 -1
- package/package.json +5 -2
package/README.md
CHANGED
|
@@ -94,34 +94,39 @@ IamContextModule.forRoot({
|
|
|
94
94
|
|
|
95
95
|
The gateway introspects the token and forwards its claims as the
|
|
96
96
|
`injectedpayload` header. Anyone who can reach the service directly can forge
|
|
97
|
-
that header, so each service
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
```
|
|
110
|
-
|
|
111
|
-
With `tokenVerification` set, the guard runs on every HTTP request, before
|
|
112
|
-
the controller filter:
|
|
113
|
-
|
|
114
|
-
- The access token's RS256 signature is checked against the realm's JWKS
|
|
115
|
-
(cached, refetched on key rotation), along with expiry and an allowed issuer.
|
|
97
|
+
that header, so each service verifies the Bearer token itself. It needs no
|
|
98
|
+
Keycloak config: the realms' issuers and public keys come from IAM over Kafka
|
|
99
|
+
(`iam.token.keys`, request/reply), through a client cloned from
|
|
100
|
+
`permissions.kafkaClient`. Verification is on whenever that client is set.
|
|
101
|
+
|
|
102
|
+
Once the keys are loaded, the guard runs on every HTTP request, before the
|
|
103
|
+
controller filter:
|
|
104
|
+
|
|
105
|
+
- The access token's RS256 signature is checked against its realm's keys,
|
|
106
|
+
along with expiry and an issuer IAM knows. A token from a realm or key not
|
|
107
|
+
loaded yet makes it ask IAM again (at most once a minute); keys are also
|
|
108
|
+
reloaded every hour.
|
|
116
109
|
- `injectedpayload` is replaced with the verified claims, so `@IamContext()`,
|
|
117
110
|
`@GetAgent()` and `@GetUser()` only ever see verified data. A forwarded
|
|
118
111
|
payload whose `sub` differs from the token is logged.
|
|
119
112
|
- A missing token removes `injectedpayload`: the caller is anonymous.
|
|
120
|
-
- An invalid token,
|
|
113
|
+
- An invalid token, an unknown issuer, or anything other than an access token
|
|
121
114
|
(`typ: Bearer`) gets 401. That includes offline tokens; exchange them for an
|
|
122
115
|
access token first. `@PublicIam()` routes treat such callers as anonymous
|
|
123
116
|
instead.
|
|
124
117
|
|
|
118
|
+
When IAM can't be reached:
|
|
119
|
+
|
|
120
|
+
| Mode | Boot | Requests until IAM answers |
|
|
121
|
+
|---|---|---|
|
|
122
|
+
| default | not delayed; retries every 30 s | `injectedpayload` is trusted as before |
|
|
123
|
+
| `IAM_TOKEN_VERIFICATION_REQUIRED=true` (or `tokenVerification.required`) | waits for IAM | 503 |
|
|
124
|
+
|
|
125
|
+
Either way the failure is logged and sent to Sentry once per outage. Keys
|
|
126
|
+
already loaded stay in use while IAM is down.
|
|
127
|
+
|
|
128
|
+
IAM itself passes `tokenVerification.loadKeys` to read the keys without Kafka.
|
|
129
|
+
|
|
125
130
|
## Entity access rules
|
|
126
131
|
|
|
127
132
|
Access rules describe, per user type, which field(s) on the entity must
|
|
@@ -2,6 +2,7 @@ export declare const IAM_PUBLIC_ROUTE = "iam_public_route";
|
|
|
2
2
|
export declare const IAM_ROUTE_USER_TYPE = "iam_route_user_type";
|
|
3
3
|
export declare const IAM_ROUTE_PERMISSIONS = "iam_route_permissions";
|
|
4
4
|
export declare const IAM_PERMISSION_SYNC_TOPIC = "iam.permission.sync";
|
|
5
|
+
export declare const IAM_TOKEN_KEYS_TOPIC = "iam.token.keys";
|
|
5
6
|
export declare const IAM_SUPER_ADMIN_GROUP_SUFFIX = "/super-admin";
|
|
6
7
|
export declare const IAM_ENTITY_ACCESS_KEY = "iam_entity_access";
|
|
7
8
|
export declare const IAM_ENTITY_SCOPE_KEY = "iam_entity_scope";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAGrD,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}
|
|
@@ -1,10 +1,11 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
3
|
+
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_TOKEN_KEYS_TOPIC = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
4
4
|
exports.IAM_PUBLIC_ROUTE = 'iam_public_route';
|
|
5
5
|
exports.IAM_ROUTE_USER_TYPE = 'iam_route_user_type';
|
|
6
6
|
exports.IAM_ROUTE_PERMISSIONS = 'iam_route_permissions';
|
|
7
7
|
exports.IAM_PERMISSION_SYNC_TOPIC = 'iam.permission.sync';
|
|
8
|
+
exports.IAM_TOKEN_KEYS_TOPIC = 'iam.token.keys';
|
|
8
9
|
exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = '/super-admin';
|
|
9
10
|
exports.IAM_ENTITY_ACCESS_KEY = 'iam_entity_access';
|
|
10
11
|
exports.IAM_ENTITY_SCOPE_KEY = 'iam_entity_scope';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAElD,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAGxC,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE9C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGxC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAGhD,aAAa,EAAE,uBAAuB;
|
|
1
|
+
{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAYzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAerD,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAGxC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBANb,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAGhD,aAAa,EAAE,uBAAuB;IAcnD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqH9D,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,eAAe;IAavB,OAAO,CAAC,0BAA0B;IAkBlC,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,WAAW;CAkBpB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,uFAAiF;AACjF,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAGhD,aAAsC;QANtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAGhD,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,+EAAoE;AACpE,kFAQ8C;AAE9C,+EAA0E;AAC1E,uFAAiF;AACjF,oEAA8D;AAC9D,qFAA+E;AAC/E,+FAKqD;AAgB9C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAGhD,aAAsC;QANtC,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAGhD,kBAAa,GAAb,aAAa,CAAyB;IACtD,CAAC;IAaJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAIF,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa;oBAAE,MAAM,KAAK,CAAC;gBAChC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,yBAAyB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAEhE,6CAAmB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEnE,MAAM,gBAAgB,GACpB,yBAAyB;YACzB,IAAI,CAAC,aAAa,CAAC,uBAAuB;YAC1C,EAAE,CAAC;QAEL,IACE,CAAC,yBAAyB;YAC1B,CAAC,IAAI,CAAC,aAAa,CAAC,8BAA8B;YAClD,CAAC,gBAAgB,CAAC,MAAM,EACxB,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,uCAAuC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,UAAU,EACV,gBAAgB,CACjB,CAAC;QAEF,OAAO,CAAC,mDAAyB,CAAC,GAAG,eAAe,CAAC;QAErD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAEvD,+CAAqB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAErE,IACE,mBAAmB,CAAC,MAAM;YAC1B,CAAC,eAAe,KAAK,oCAAe,CAAC,KAAK;gBACxC,CAAC,IAAI,CAAC,oBAAoB,CAAC,cAAc,CACvC,UAAU,CAAC,KAAK,EAChB,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAC1C,CAAC,EACJ,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,eAAe,GACnB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,8CAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,CAAC,8DAAoC,CAAC;gBAC3C,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,sBAAsB,GAC1B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,+CAAqB,EACrB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,0BAA0B,CACzD,sBAAsB,CACvB,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAC1B,kCACE,mBAAmB,CAAC,YAAY,IAAI,UACtC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,UAAyB;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,IAAI,EAAE,CAAC;QAE5D,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CACrB,UAAyB,EACzB,QAAgC;QAEhC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC;YACrC,CAAC;YAED,OAAO,OAAO,KAAK,UAAU,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,0BAA0B,CAChC,gBAAkD;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,GAAG,gBAAgB;YAEnB,YAAY,EAAE,gBAAgB,CAAC,YAAY,IAAI,MAAM,EAAE,YAAY;YAEnE,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB,CACzB,gBAA+C;QAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM;YACpC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAChD,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO;YACL,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,YAAY;YAChD,GAAG,MAAM,EAAE,KAAK;YAChB,GAAG,gBAAgB;YAEnB,MAAM,EAAE,IAAI,CAAC,WAAW,CACtB,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,EAC9C,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,EACvC,gBAAgB,CAAC,MAAM,CACxB;SACF,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,MAAuB;QAEvB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/D,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;QAClC,CAAC,CAAyC,CAAC;IAC7C,CAAC;IAEO,WAAW,CACjB,YAAoC,EACpC,YAAoC,EACpC,eAAuC;QAEvC,OAAO;YACL,KAAK,EAAE;gBACL,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,YAAY,EAAE,KAAK;gBACtB,GAAG,eAAe,EAAE,KAAK;aAC1B;YAED,IAAI,EAAE,eAAe,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,IAAI;YAEvE,KAAK,EACH,eAAe,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK,IAAI,YAAY,EAAE,KAAK;SACvE,CAAC;IACJ,CAAC;CACF,CAAA;AAvOY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;qCALP,gBAAS;QACI,kDAAsB;QACxB,6CAAoB;QACjB,oDAAuB;GALxD,eAAe,CAuO3B"}
|
|
@@ -1,8 +1,10 @@
|
|
|
1
1
|
import { Type } from '@nestjs/common';
|
|
2
|
+
import type { JSONWebKeySet } from 'jose';
|
|
2
3
|
import { EntityTarget } from 'typeorm';
|
|
3
4
|
import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
|
|
4
5
|
import type { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
5
6
|
import { ApplyIamEntityScopeOptions, EntityAccessByRole } from './iam-entity-access.interface';
|
|
7
|
+
export type IamTokenKeys = Record<string, JSONWebKeySet>;
|
|
6
8
|
export type IamControllerClass = Type<unknown>;
|
|
7
9
|
export type IamControllerMatcher = string | IamControllerClass;
|
|
8
10
|
export interface IamEntityAccessPreset<T = any> {
|
|
@@ -24,8 +26,8 @@ export interface IamContextModuleOptions {
|
|
|
24
26
|
extraKeys?: IamPermissionDefinition[];
|
|
25
27
|
};
|
|
26
28
|
tokenVerification?: {
|
|
27
|
-
|
|
28
|
-
|
|
29
|
+
required?: boolean;
|
|
30
|
+
loadKeys?: () => Promise<IamTokenKeys>;
|
|
29
31
|
};
|
|
30
32
|
entityAccess?: {
|
|
31
33
|
defaultAccess?: EntityAccessByRole<any>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAGvC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAgBF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;KACvC,CAAC;IAiBF,iBAAiB,CAAC,EAAE;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;KACxC,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AA4Ha,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
|
|
@@ -1,15 +1,32 @@
|
|
|
1
|
+
import { OnApplicationBootstrap, OnApplicationShutdown } from '@nestjs/common';
|
|
2
|
+
import { ModuleRef } from '@nestjs/core';
|
|
1
3
|
import { JWTPayload } from 'jose';
|
|
2
4
|
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
3
|
-
export declare class IamTokenVerifierService {
|
|
5
|
+
export declare class IamTokenVerifierService implements OnApplicationBootstrap, OnApplicationShutdown {
|
|
4
6
|
private readonly moduleOptions;
|
|
7
|
+
private readonly moduleRef?;
|
|
5
8
|
private readonly logger;
|
|
6
|
-
private
|
|
7
|
-
|
|
9
|
+
private keys?;
|
|
10
|
+
private loadedAt;
|
|
11
|
+
private lastAttempt;
|
|
12
|
+
private loading?;
|
|
13
|
+
private failing;
|
|
14
|
+
private retryTimer?;
|
|
15
|
+
private client?;
|
|
16
|
+
constructor(moduleOptions: IamContextModuleOptions, moduleRef?: ModuleRef);
|
|
8
17
|
get enabled(): boolean;
|
|
18
|
+
get required(): boolean;
|
|
19
|
+
onApplicationBootstrap(): Promise<void>;
|
|
20
|
+
onApplicationShutdown(): Promise<void>;
|
|
9
21
|
verifyRequest(request: any): Promise<void>;
|
|
10
22
|
verify(token: string): Promise<JWTPayload>;
|
|
11
|
-
private
|
|
12
|
-
private
|
|
23
|
+
private verifyWithLoadedKeys;
|
|
24
|
+
private refreshThrottled;
|
|
25
|
+
private refresh;
|
|
26
|
+
private load;
|
|
27
|
+
private scheduleRetry;
|
|
28
|
+
private fetchKeys;
|
|
29
|
+
private getClient;
|
|
13
30
|
private forwardedSubject;
|
|
14
31
|
}
|
|
15
32
|
//# sourceMappingURL=iam-token-verifier.service.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAIL,UAAU,EAEX,MAAM,MAAM,CAAC;AAGd,OAAO,EAEL,uBAAuB,EAExB,MAAM,6CAA6C,CAAC;AA2BrD,qBACa,uBACX,YAAW,sBAAsB,EAAE,qBAAqB;IAatD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAClB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAZzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,IAAI,CAAC,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAC,CAAiB;IACpC,OAAO,CAAC,MAAM,CAAC,CAAc;gBAIV,aAAa,EAAE,uBAAuB,EAC1B,SAAS,CAAC,EAAE,SAAS;IAIpD,IAAI,OAAO,IAAI,OAAO,CAKrB;IAED,IAAI,QAAQ,IAAI,OAAO,CAKtB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAcvC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;YA0BlC,oBAAoB;IAmBlC,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,OAAO;YAKD,IAAI;IAmClB,OAAO,CAAC,aAAa;YASP,SAAS;YA6BT,SAAS;IA2BvB,OAAO,CAAC,gBAAgB;CAOzB"}
|
|
@@ -1,10 +1,43 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
2
18
|
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
3
19
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
4
20
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
5
21
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
6
22
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
7
23
|
};
|
|
24
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
25
|
+
var ownKeys = function(o) {
|
|
26
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
27
|
+
var ar = [];
|
|
28
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
29
|
+
return ar;
|
|
30
|
+
};
|
|
31
|
+
return ownKeys(o);
|
|
32
|
+
};
|
|
33
|
+
return function (mod) {
|
|
34
|
+
if (mod && mod.__esModule) return mod;
|
|
35
|
+
var result = {};
|
|
36
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
37
|
+
__setModuleDefault(result, mod);
|
|
38
|
+
return result;
|
|
39
|
+
};
|
|
40
|
+
})();
|
|
8
41
|
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
9
42
|
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
10
43
|
};
|
|
@@ -15,21 +48,63 @@ var IamTokenVerifierService_1;
|
|
|
15
48
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
16
49
|
exports.IamTokenVerifierService = void 0;
|
|
17
50
|
const common_1 = require("@nestjs/common");
|
|
51
|
+
const core_1 = require("@nestjs/core");
|
|
52
|
+
const microservices_1 = require("@nestjs/microservices");
|
|
53
|
+
const Sentry = __importStar(require("@sentry/nestjs"));
|
|
18
54
|
const jose_1 = require("jose");
|
|
55
|
+
const rxjs_1 = require("rxjs");
|
|
56
|
+
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
19
57
|
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
20
58
|
const BEARER_PREFIX = /^Bearer\s+/i;
|
|
21
59
|
const ACCESS_TOKEN_TYPE = 'Bearer';
|
|
22
60
|
const CLOCK_TOLERANCE_SECONDS = 30;
|
|
61
|
+
const KAFKA_TIMEOUT_MS = 5_000;
|
|
62
|
+
const RETRY_MS = 30_000;
|
|
63
|
+
const REFRESH_THROTTLE_MS = 60_000;
|
|
64
|
+
const KEYS_TTL_MS = 60 * 60_000;
|
|
65
|
+
const CLIENT_SUFFIX = '-iam-token-keys';
|
|
23
66
|
let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifierService {
|
|
24
|
-
constructor(moduleOptions) {
|
|
67
|
+
constructor(moduleOptions, moduleRef) {
|
|
25
68
|
this.moduleOptions = moduleOptions;
|
|
69
|
+
this.moduleRef = moduleRef;
|
|
26
70
|
this.logger = new common_1.Logger(IamTokenVerifierService_1.name);
|
|
27
|
-
this.
|
|
71
|
+
this.loadedAt = 0;
|
|
72
|
+
this.lastAttempt = 0;
|
|
73
|
+
this.failing = false;
|
|
28
74
|
}
|
|
29
75
|
get enabled() {
|
|
30
|
-
return !!this.moduleOptions.tokenVerification?.
|
|
76
|
+
return !!(this.moduleOptions.tokenVerification?.loadKeys ||
|
|
77
|
+
this.moduleOptions.permissions?.kafkaClient);
|
|
78
|
+
}
|
|
79
|
+
get required() {
|
|
80
|
+
return (this.moduleOptions.tokenVerification?.required ??
|
|
81
|
+
process.env.IAM_TOKEN_VERIFICATION_REQUIRED === 'true');
|
|
82
|
+
}
|
|
83
|
+
async onApplicationBootstrap() {
|
|
84
|
+
if (!this.enabled)
|
|
85
|
+
return;
|
|
86
|
+
if (!this.required) {
|
|
87
|
+
void this.refresh();
|
|
88
|
+
return;
|
|
89
|
+
}
|
|
90
|
+
while (!(await this.refresh())) {
|
|
91
|
+
this.logger.warn(`Waiting for token keys from IAM, retrying in ${RETRY_MS / 1000}s`);
|
|
92
|
+
await new Promise((resolve) => setTimeout(resolve, RETRY_MS));
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
async onApplicationShutdown() {
|
|
96
|
+
clearTimeout(this.retryTimer);
|
|
97
|
+
await this.client?.close();
|
|
31
98
|
}
|
|
32
99
|
async verifyRequest(request) {
|
|
100
|
+
if (!this.keys) {
|
|
101
|
+
if (this.required) {
|
|
102
|
+
throw new common_1.ServiceUnavailableException('Token keys are not loaded');
|
|
103
|
+
}
|
|
104
|
+
return;
|
|
105
|
+
}
|
|
106
|
+
if (Date.now() - this.loadedAt > KEYS_TTL_MS)
|
|
107
|
+
void this.refreshThrottled();
|
|
33
108
|
const headers = request.headers ?? {};
|
|
34
109
|
const authorization = headers['authorization'];
|
|
35
110
|
const forwarded = headers['injectedpayload'];
|
|
@@ -50,14 +125,12 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
50
125
|
let payload;
|
|
51
126
|
try {
|
|
52
127
|
const { iss } = (0, jose_1.decodeJwt)(token);
|
|
53
|
-
|
|
54
|
-
|
|
128
|
+
payload = await this.verifyWithLoadedKeys(token, iss);
|
|
129
|
+
if (!payload && (await this.refreshThrottled())) {
|
|
130
|
+
payload = await this.verifyWithLoadedKeys(token, iss);
|
|
55
131
|
}
|
|
56
|
-
(
|
|
57
|
-
issuer
|
|
58
|
-
algorithms: ['RS256'],
|
|
59
|
-
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
60
|
-
}));
|
|
132
|
+
if (!payload)
|
|
133
|
+
throw new Error('unknown issuer or signing key');
|
|
61
134
|
}
|
|
62
135
|
catch (error) {
|
|
63
136
|
throw new common_1.UnauthorizedException(`Invalid token: ${error?.code ?? error?.message ?? error}`);
|
|
@@ -67,21 +140,115 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
67
140
|
}
|
|
68
141
|
return payload;
|
|
69
142
|
}
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
if (!jwks)
|
|
73
|
-
|
|
74
|
-
|
|
143
|
+
async verifyWithLoadedKeys(token, issuer) {
|
|
144
|
+
const jwks = issuer ? this.keys?.get(issuer) : undefined;
|
|
145
|
+
if (!jwks)
|
|
146
|
+
return undefined;
|
|
147
|
+
try {
|
|
148
|
+
const { payload } = await (0, jose_1.jwtVerify)(token, jwks, {
|
|
149
|
+
issuer,
|
|
150
|
+
algorithms: ['RS256'],
|
|
151
|
+
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
152
|
+
});
|
|
153
|
+
return payload;
|
|
154
|
+
}
|
|
155
|
+
catch (error) {
|
|
156
|
+
if (error instanceof jose_1.errors.JWKSNoMatchingKey)
|
|
157
|
+
return undefined;
|
|
158
|
+
throw error;
|
|
159
|
+
}
|
|
160
|
+
}
|
|
161
|
+
refreshThrottled() {
|
|
162
|
+
if (Date.now() - this.lastAttempt < REFRESH_THROTTLE_MS) {
|
|
163
|
+
return Promise.resolve(false);
|
|
164
|
+
}
|
|
165
|
+
return this.refresh();
|
|
166
|
+
}
|
|
167
|
+
refresh() {
|
|
168
|
+
this.loading ??= this.load().finally(() => (this.loading = undefined));
|
|
169
|
+
return this.loading;
|
|
170
|
+
}
|
|
171
|
+
async load() {
|
|
172
|
+
this.lastAttempt = Date.now();
|
|
173
|
+
try {
|
|
174
|
+
const keys = await this.fetchKeys();
|
|
175
|
+
if (!keys || !Object.keys(keys).length) {
|
|
176
|
+
throw new Error('IAM returned no token keys');
|
|
177
|
+
}
|
|
178
|
+
this.keys = new Map(Object.entries(keys).map(([issuer, jwks]) => [
|
|
179
|
+
issuer,
|
|
180
|
+
(0, jose_1.createLocalJWKSet)(jwks),
|
|
181
|
+
]));
|
|
182
|
+
this.loadedAt = Date.now();
|
|
183
|
+
if (this.failing)
|
|
184
|
+
this.logger.log('Token keys loaded from IAM again');
|
|
185
|
+
this.failing = false;
|
|
186
|
+
return true;
|
|
187
|
+
}
|
|
188
|
+
catch (cause) {
|
|
189
|
+
const error = Object.assign(new Error(`Cannot load token keys from IAM: ${cause}`), { cause });
|
|
190
|
+
const fallback = this.keys || this.required
|
|
191
|
+
? ''
|
|
192
|
+
: '; trusting injectedpayload until IAM answers';
|
|
193
|
+
this.logger.error(`${error.message}${fallback}`);
|
|
194
|
+
if (!this.failing)
|
|
195
|
+
Sentry.captureException(error);
|
|
196
|
+
this.failing = true;
|
|
197
|
+
if (!this.required)
|
|
198
|
+
this.scheduleRetry();
|
|
199
|
+
return false;
|
|
75
200
|
}
|
|
76
|
-
return jwks;
|
|
77
201
|
}
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
202
|
+
scheduleRetry() {
|
|
203
|
+
if (this.keys || this.retryTimer)
|
|
204
|
+
return;
|
|
205
|
+
this.retryTimer = setTimeout(() => {
|
|
206
|
+
this.retryTimer = undefined;
|
|
207
|
+
void this.refresh();
|
|
208
|
+
}, RETRY_MS);
|
|
209
|
+
this.retryTimer.unref?.();
|
|
210
|
+
}
|
|
211
|
+
async fetchKeys() {
|
|
212
|
+
const loadKeys = this.moduleOptions.tokenVerification?.loadKeys;
|
|
213
|
+
if (loadKeys)
|
|
214
|
+
return loadKeys();
|
|
215
|
+
try {
|
|
216
|
+
const client = await this.getClient();
|
|
217
|
+
const response = await (0, rxjs_1.firstValueFrom)(client
|
|
218
|
+
.send(iam_decorator_key_const_1.IAM_TOKEN_KEYS_TOPIC, {
|
|
219
|
+
event_source: this.moduleOptions.permissions?.service,
|
|
220
|
+
data: {},
|
|
221
|
+
})
|
|
222
|
+
.pipe((0, rxjs_1.timeout)(KAFKA_TIMEOUT_MS)));
|
|
223
|
+
return (typeof response === 'string' ? JSON.parse(response) : response)
|
|
224
|
+
?.data;
|
|
225
|
+
}
|
|
226
|
+
catch (error) {
|
|
227
|
+
await this.client?.close().catch(() => undefined);
|
|
228
|
+
this.client = undefined;
|
|
229
|
+
throw error;
|
|
230
|
+
}
|
|
231
|
+
}
|
|
232
|
+
async getClient() {
|
|
233
|
+
if (!this.client) {
|
|
234
|
+
const source = this.moduleRef.get(this.moduleOptions.permissions.kafkaClient, { strict: false });
|
|
235
|
+
const options = source.options ?? {};
|
|
236
|
+
this.client = new microservices_1.ClientKafka({
|
|
237
|
+
...options,
|
|
238
|
+
producerOnlyMode: false,
|
|
239
|
+
client: {
|
|
240
|
+
...options.client,
|
|
241
|
+
clientId: `${options.client?.clientId ?? 'nestjs-consumer'}${CLIENT_SUFFIX}`,
|
|
242
|
+
},
|
|
243
|
+
consumer: {
|
|
244
|
+
...options.consumer,
|
|
245
|
+
groupId: `${options.consumer?.groupId ?? 'nestjs-group'}${CLIENT_SUFFIX}`,
|
|
246
|
+
},
|
|
247
|
+
});
|
|
248
|
+
this.client.subscribeToResponseOf(iam_decorator_key_const_1.IAM_TOKEN_KEYS_TOPIC);
|
|
249
|
+
}
|
|
250
|
+
await this.client.connect();
|
|
251
|
+
return this.client;
|
|
85
252
|
}
|
|
86
253
|
forwardedSubject(forwarded) {
|
|
87
254
|
try {
|
|
@@ -96,6 +263,7 @@ exports.IamTokenVerifierService = IamTokenVerifierService;
|
|
|
96
263
|
exports.IamTokenVerifierService = IamTokenVerifierService = IamTokenVerifierService_1 = __decorate([
|
|
97
264
|
(0, common_1.Injectable)(),
|
|
98
265
|
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
99
|
-
|
|
266
|
+
__param(1, (0, common_1.Optional)()),
|
|
267
|
+
__metadata("design:paramtypes", [Object, core_1.ModuleRef])
|
|
100
268
|
], IamTokenVerifierService);
|
|
101
269
|
//# sourceMappingURL=iam-token-verifier.service.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,uCAAyC;AACzC,yDAAoD;AACpD,uDAAyC;AACzC,+BAMc;AACd,+BAA+C;AAC/C,kFAA4E;AAC5E,+FAIqD;AAErD,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAgBjC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAYlC,YAEE,aAAuD,EAC3C,SAAsC;QADjC,kBAAa,GAAb,aAAa,CAAyB;QAC1B,cAAS,GAAT,SAAS,CAAY;QAZnC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,aAAQ,GAAG,CAAC,CAAC;QACb,gBAAW,GAAG,CAAC,CAAC;QAEhB,YAAO,GAAG,KAAK,CAAC;IAQrB,CAAC;IAGJ,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,QAAQ,GAAG,IAAI,GAAG,CACnE,CAAC;YACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,OAAY;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,oCAA2B,CAAC,2BAA2B,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,WAAW;YAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,aAAa,GAAuB,OAAO,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAuB,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,OAAO,CAAC,GAAG,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBAChD,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;QAID,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAGO,KAAK,CAAC,oBAAoB,CAChC,KAAa,EACb,MAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM;gBACN,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAM,CAAC,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAGO,OAAO;QACb,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM;gBACN,IAAA,wBAAiB,EAAC,IAAI,CAAC;aACxB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,EACtD,EAAE,KAAK,EAAE,CACV,CAAC;YACF,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;gBACxB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,8CAA8C,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QACzC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QAChE,IAAI,QAAQ;YAAE,OAAO,QAAQ,EAAE,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,MAAM;iBACH,IAAI,CAAC,8CAAoB,EAAE;gBAC1B,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO;gBACrD,IAAI,EAAE,EAAE;aACT,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACrE,EAAE,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,CAAC,GAAG,CAChC,IAAI,CAAC,aAAa,CAAC,WAAY,CAAC,WAAY,EAC5C,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;YAGF,MAAM,OAAO,GAAI,MAAc,CAAC,OAAO,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,2BAAW,CAAC;gBAC5B,GAAG,OAAO;gBACV,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE;oBACN,GAAG,OAAO,CAAC,MAAM;oBACjB,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,GAAG,aAAa,EAAE;iBAC7E;gBACD,QAAQ,EAAE;oBACR,GAAG,OAAO,CAAC,QAAQ;oBACnB,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc,GAAG,aAAa,EAAE;iBAC1E;aACF,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,8CAAoB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAjQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAcR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAA8B,gBAAS;GAfzC,uBAAuB,CAiQnC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mondart/nestjs-common-module-iam",
|
|
3
|
-
"version": "3.2.
|
|
3
|
+
"version": "3.2.16",
|
|
4
4
|
"description": "Reusable IAM (Identity and Access Management) utilities for NestJS.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Mondart"
|
|
@@ -22,11 +22,13 @@
|
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
24
|
"@mondart/nestjs-common-module-core": "3.2.12",
|
|
25
|
-
"jose": "5.10.0"
|
|
25
|
+
"jose": "5.10.0",
|
|
26
|
+
"@sentry/nestjs": "^10.32.1"
|
|
26
27
|
},
|
|
27
28
|
"peerDependencies": {
|
|
28
29
|
"@nestjs/common": "^11.1.10",
|
|
29
30
|
"@nestjs/core": "^11.1.10",
|
|
31
|
+
"@nestjs/microservices": "^11.1.10",
|
|
30
32
|
"@nestjs/swagger": "^11.0.3",
|
|
31
33
|
"@nestjs/typeorm": "^11.0.0",
|
|
32
34
|
"class-transformer": "^0.5.1",
|
|
@@ -40,6 +42,7 @@
|
|
|
40
42
|
"access": "public"
|
|
41
43
|
},
|
|
42
44
|
"devDependencies": {
|
|
45
|
+
"@nestjs/microservices": "^11.1.10",
|
|
43
46
|
"@nestjs/testing": "^11.1.27",
|
|
44
47
|
"@types/jest": "^30.0.0",
|
|
45
48
|
"@types/supertest": "^7.2.0",
|