@mondart/nestjs-common-module-iam 3.2.20 → 3.2.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +32 -0
- package/dist/constants/iam-decorator-key.const.d.ts +3 -0
- package/dist/constants/iam-decorator-key.const.d.ts.map +1 -1
- package/dist/constants/iam-decorator-key.const.js +4 -1
- package/dist/constants/iam-decorator-key.const.js.map +1 -1
- package/dist/decorators/get-agent.decorator.d.ts.map +1 -1
- package/dist/decorators/get-agent.decorator.js +1 -0
- package/dist/decorators/get-agent.decorator.js.map +1 -1
- package/dist/decorators/iam-context.decorator.d.ts.map +1 -1
- package/dist/decorators/iam-context.decorator.js +1 -0
- package/dist/decorators/iam-context.decorator.js.map +1 -1
- package/dist/helpers/kafka-options.helper.d.ts +4 -0
- package/dist/helpers/kafka-options.helper.d.ts.map +1 -0
- package/dist/helpers/kafka-options.helper.js +20 -0
- package/dist/helpers/kafka-options.helper.js.map +1 -0
- package/dist/iam-context.module.d.ts.map +1 -1
- package/dist/iam-context.module.js +2 -0
- package/dist/iam-context.module.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/interfaces/get-agent.interface.d.ts +1 -0
- package/dist/interfaces/get-agent.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.d.ts +14 -1
- package/dist/interfaces/iam-context-options.interface.d.ts.map +1 -1
- package/dist/interfaces/iam-context-options.interface.js.map +1 -1
- package/dist/services/iam-permission-map.service.d.ts +26 -0
- package/dist/services/iam-permission-map.service.d.ts.map +1 -0
- package/dist/services/iam-permission-map.service.js +166 -0
- package/dist/services/iam-permission-map.service.js.map +1 -0
- package/dist/services/iam-permission.service.d.ts +3 -1
- package/dist/services/iam-permission.service.d.ts.map +1 -1
- package/dist/services/iam-permission.service.js +17 -3
- package/dist/services/iam-permission.service.js.map +1 -1
- package/dist/services/iam-token-verifier.service.d.ts +4 -0
- package/dist/services/iam-token-verifier.service.d.ts.map +1 -1
- package/dist/services/iam-token-verifier.service.js +45 -14
- package/dist/services/iam-token-verifier.service.js.map +1 -1
- package/package.json +3 -2
package/README.md
CHANGED
|
@@ -90,6 +90,28 @@ IamContextModule.forRoot({
|
|
|
90
90
|
(e.g. on a route users share) instead of `@RequirePermission()`. They are
|
|
91
91
|
synced with the decorated ones, so IAM doesn't mark them deprecated.
|
|
92
92
|
|
|
93
|
+
### The permission map
|
|
94
|
+
|
|
95
|
+
Keys of this service aren't read from the token. IAM serves a signed map of
|
|
96
|
+
which realm role grants which of this service's keys (`iam.permission.map`),
|
|
97
|
+
and the check looks up the agent's realm roles (`realm_access.roles`, from
|
|
98
|
+
the verified token) in it; roles add up. So access changes apply without a
|
|
99
|
+
new token, and the token stays small however many keys a role holds.
|
|
100
|
+
|
|
101
|
+
- IAM announces every change (`iam.permission.map.changed`); each replica
|
|
102
|
+
listens in a consumer group of its own and fetches its slice again within
|
|
103
|
+
5 s. It also fetches every 5 minutes, in case it missed an event.
|
|
104
|
+
- The map is signed with IAM's key (see below). One that fails the
|
|
105
|
+
signature, names another service, or is older than the one held is
|
|
106
|
+
rejected. A map expires after 24 h: if IAM stays unreachable that long,
|
|
107
|
+
the service has none.
|
|
108
|
+
- Without a current map the `permissions` claim is used, as before, while
|
|
109
|
+
Keycloak still adds it. With neither, the check answers 503.
|
|
110
|
+
- Keys of other services (rare) are checked against the claim.
|
|
111
|
+
|
|
112
|
+
IAM itself passes `permissionMap: { service: 'iam', load }` to build the map
|
|
113
|
+
without Kafka.
|
|
114
|
+
|
|
93
115
|
## Verifying tokens in the service
|
|
94
116
|
|
|
95
117
|
The gateway introspects the token and forwards its claims as the
|
|
@@ -127,6 +149,16 @@ already loaded stay in use while IAM is down.
|
|
|
127
149
|
|
|
128
150
|
IAM itself passes `tokenVerification.loadKeys` to read the keys without Kafka.
|
|
129
151
|
|
|
152
|
+
### IAM's signing key
|
|
153
|
+
|
|
154
|
+
The keys come signed (`iam.token.keys.signed`), together with IAM's public
|
|
155
|
+
Ed25519 key, and the permission map is signed with the same key. The service
|
|
156
|
+
trusts the first IAM key it receives and afterwards only a key that key names
|
|
157
|
+
in the reply's `rotation`: a forged reply after boot is rejected and reported
|
|
158
|
+
to Sentry. Forged replies racing IAM's at boot are kept out by Kafka ACLs:
|
|
159
|
+
only IAM's credentials may write `iam.token.keys.signed.reply` and
|
|
160
|
+
`iam.permission.map.reply`, and every service needs credentials of its own.
|
|
161
|
+
|
|
130
162
|
## Entity access rules
|
|
131
163
|
|
|
132
164
|
Access rules describe, per user type, which field(s) on the entity must
|
|
@@ -3,6 +3,9 @@ export declare const IAM_ROUTE_USER_TYPE = "iam_route_user_type";
|
|
|
3
3
|
export declare const IAM_ROUTE_PERMISSIONS = "iam_route_permissions";
|
|
4
4
|
export declare const IAM_PERMISSION_SYNC_TOPIC = "iam.permission.sync";
|
|
5
5
|
export declare const IAM_TOKEN_KEYS_TOPIC = "iam.token.keys";
|
|
6
|
+
export declare const IAM_TOKEN_KEYS_SIGNED_TOPIC = "iam.token.keys.signed";
|
|
7
|
+
export declare const IAM_PERMISSION_MAP_TOPIC = "iam.permission.map";
|
|
8
|
+
export declare const IAM_PERMISSION_MAP_CHANGED_TOPIC = "iam.permission.map.changed";
|
|
6
9
|
export declare const IAM_SUPER_ADMIN_GROUP_SUFFIX = "/super-admin";
|
|
7
10
|
export declare const IAM_ENTITY_ACCESS_KEY = "iam_entity_access";
|
|
8
11
|
export declare const IAM_ENTITY_SCOPE_KEY = "iam_entity_scope";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAG7D,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,eAAO,MAAM,gCAAgC,+BAA+B,CAAC;AAG7E,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}
|
|
@@ -1,11 +1,14 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_TOKEN_KEYS_TOPIC = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
3
|
+
exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = exports.IAM_PERMISSION_MAP_CHANGED_TOPIC = exports.IAM_PERMISSION_MAP_TOPIC = exports.IAM_TOKEN_KEYS_SIGNED_TOPIC = exports.IAM_TOKEN_KEYS_TOPIC = exports.IAM_PERMISSION_SYNC_TOPIC = exports.IAM_ROUTE_PERMISSIONS = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
|
|
4
4
|
exports.IAM_PUBLIC_ROUTE = 'iam_public_route';
|
|
5
5
|
exports.IAM_ROUTE_USER_TYPE = 'iam_route_user_type';
|
|
6
6
|
exports.IAM_ROUTE_PERMISSIONS = 'iam_route_permissions';
|
|
7
7
|
exports.IAM_PERMISSION_SYNC_TOPIC = 'iam.permission.sync';
|
|
8
8
|
exports.IAM_TOKEN_KEYS_TOPIC = 'iam.token.keys';
|
|
9
|
+
exports.IAM_TOKEN_KEYS_SIGNED_TOPIC = 'iam.token.keys.signed';
|
|
10
|
+
exports.IAM_PERMISSION_MAP_TOPIC = 'iam.permission.map';
|
|
11
|
+
exports.IAM_PERMISSION_MAP_CHANGED_TOPIC = 'iam.permission.map.changed';
|
|
9
12
|
exports.IAM_SUPER_ADMIN_GROUP_SUFFIX = '/super-admin';
|
|
10
13
|
exports.IAM_ENTITY_ACCESS_KEY = 'iam_entity_access';
|
|
11
14
|
exports.IAM_ENTITY_SCOPE_KEY = 'iam_entity_scope';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAElD,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAC5C,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAGhD,QAAA,yBAAyB,GAAG,qBAAqB,CAAC;AAElD,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAExC,QAAA,2BAA2B,GAAG,uBAAuB,CAAC;AAEtD,QAAA,wBAAwB,GAAG,oBAAoB,CAAC;AAEhD,QAAA,gCAAgC,GAAG,4BAA4B,CAAC;AAGhE,QAAA,4BAA4B,GAAG,cAAc,CAAC;AAE9C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-agent.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/get-agent.decorator.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,QAAQ,
|
|
1
|
+
{"version":3,"file":"get-agent.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/get-agent.decorator.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,QAAQ,mDAkCpB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-agent.decorator.js","sourceRoot":"","sources":["../../src/decorators/get-agent.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAS3D,QAAA,QAAQ,GAAG,IAAA,6BAAoB,EAC1C,CAAC,IAAa,EAAE,GAAqB,EAAE,EAAE;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAEhD,MAAM,eAAe,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,
|
|
1
|
+
{"version":3,"file":"get-agent.decorator.js","sourceRoot":"","sources":["../../src/decorators/get-agent.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAS3D,QAAA,QAAQ,GAAG,IAAA,6BAAoB,EAC1C,CAAC,IAAa,EAAE,GAAqB,EAAE,EAAE;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAEhD,MAAM,eAAe,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAQN,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,EAAE,QAAQ;gBAChB,OAAO,CAAC,KAAK,GAAG;oBACd,OAAO,EAAE,IAAI,EAAE,GAAG;oBAClB,OAAO,EAAE,IAAI,EAAE,QAAQ;oBACvB,QAAQ,EAAE,IAAI,EAAE,SAAS;oBACzB,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;oBACzC,WAAW,EAAE,IAAI,EAAE,WAAW;oBAC9B,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;oBAChC,SAAS,EAAE,IAAI,EAAE,GAAG;oBACpB,KAAK;iBACN,CAAC;QACN,CAAC;QACD,OAAO,OAAO,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC,CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/iam-context.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,eAAO,MAAM,UAAU,mDAMtB,CAAC;AAUF,eAAO,MAAM,aAAa,GAAI,SAAS,GAAG,KAAG,
|
|
1
|
+
{"version":3,"file":"iam-context.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/iam-context.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKvD,eAAO,MAAM,UAAU,mDAMtB,CAAC;AAUF,eAAO,MAAM,aAAa,GAAI,SAAS,GAAG,KAAG,aAgE5C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.decorator.js","sourceRoot":"","sources":["../../src/decorators/iam-context.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AACxE,mCAAoC;AACpC,4DAAuD;AAK1C,QAAA,UAAU,GAAG,IAAA,6BAAoB,EAC5C,CAAC,IAAa,EAAE,GAAqB,EAAiB,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAEhD,OAAO,IAAA,qBAAa,EAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAUK,MAAM,aAAa,GAAG,CAAC,OAAY,EAAiB,EAAE;IAC3D,MAAM,OAAO,GACX,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;IAEvB,MAAM,eAAe,GAAG,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,IAAA,mBAAU,GAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAC1D,CAAC;IACF,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,IAAI,IAAsB,CAAC;IAC3B,IAAI,KAAwB,CAAC;IAE7B,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,
|
|
1
|
+
{"version":3,"file":"iam-context.decorator.js","sourceRoot":"","sources":["../../src/decorators/iam-context.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AACxE,mCAAoC;AACpC,4DAAuD;AAK1C,QAAA,UAAU,GAAG,IAAA,6BAAoB,EAC5C,CAAC,IAAa,EAAE,GAAqB,EAAiB,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAEhD,OAAO,IAAA,qBAAa,EAAC,OAAO,CAAC,CAAC;AAChC,CAAC,CACF,CAAC;AAUK,MAAM,aAAa,GAAG,CAAC,OAAY,EAAiB,EAAE;IAC3D,MAAM,OAAO,GACX,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ;QAClC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;QAC9B,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC;IAEvB,MAAM,eAAe,GAAG,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEjD,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,IAAA,mBAAU,GAAE,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAC1D,CAAC;IACF,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,IAAI,IAAsB,CAAC;IAC3B,IAAI,KAAwB,CAAC;IAE7B,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,IAAI,GAUN,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC5D,IAAI,GAAG;oBACL,MAAM,EAAE,IAAI,EAAE,GAAG;oBACjB,SAAS,EAAE,IAAI,EAAE,UAAU;oBAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ;oBACvB,KAAK;iBACN,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;gBAC1B,OAAO,GAAG,IAAI,CAAC;gBACf,KAAK,GAAG;oBACN,OAAO,EAAE,IAAI,EAAE,GAAG;oBAClB,QAAQ,EAAE,IAAI,EAAE,SAAS;oBACzB,gBAAgB,EAAE,IAAI,EAAE,iBAAiB;oBACzC,WAAW,EAAE,IAAI,EAAE,WAAW;oBAC9B,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;oBAChC,SAAS,EAAE,IAAI,EAAE,GAAG;oBACpB,KAAK;iBACN,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,+BAAa,CAAC;QACvB,EAAE;QACF,GAAG;QACH,SAAS;QACT,SAAS;QACT,OAAO;QACP,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC,CAAC;AAhEW,QAAA,aAAa,iBAgExB;AAUF,MAAM,UAAU,GAAG,CACjB,OAAY,EACZ,OAAY,EACuB,EAAE;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;SAC5D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,cAAc,GAAG,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC;IAErD,MAAM,EAAE,GACN,cAAc;QACd,YAAY,CAAC,CAAC,CAAC;QACf,MAAM;QACN,OAAO,EAAE,OAAO;QAChB,aAAa;QACb,IAAI,CAAC;IACP,MAAM,GAAG,GACP,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE;QACzD,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC,CAAC"}
|
|
@@ -0,0 +1,4 @@
|
|
|
1
|
+
import { ModuleRef } from '@nestjs/core';
|
|
2
|
+
import { KafkaOptions } from '@nestjs/microservices';
|
|
3
|
+
export declare const cloneKafkaOptions: (moduleRef: ModuleRef, token: string | symbol, suffix: string) => NonNullable<KafkaOptions["options"]>;
|
|
4
|
+
//# sourceMappingURL=kafka-options.helper.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"kafka-options.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/kafka-options.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAe,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAOlE,eAAO,MAAM,iBAAiB,GAC5B,WAAW,SAAS,EACpB,OAAO,MAAM,GAAG,MAAM,EACtB,QAAQ,MAAM,KACb,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAgBrC,CAAC"}
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.cloneKafkaOptions = void 0;
|
|
4
|
+
const cloneKafkaOptions = (moduleRef, token, suffix) => {
|
|
5
|
+
const source = moduleRef.get(token, { strict: false });
|
|
6
|
+
const options = source.options ?? {};
|
|
7
|
+
return {
|
|
8
|
+
...options,
|
|
9
|
+
client: {
|
|
10
|
+
...options.client,
|
|
11
|
+
clientId: `${options.client?.clientId ?? 'nestjs-consumer'}${suffix}`,
|
|
12
|
+
},
|
|
13
|
+
consumer: {
|
|
14
|
+
...options.consumer,
|
|
15
|
+
groupId: `${options.consumer?.groupId ?? 'nestjs-group'}${suffix}`,
|
|
16
|
+
},
|
|
17
|
+
};
|
|
18
|
+
};
|
|
19
|
+
exports.cloneKafkaOptions = cloneKafkaOptions;
|
|
20
|
+
//# sourceMappingURL=kafka-options.helper.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"kafka-options.helper.js","sourceRoot":"","sources":["../../src/helpers/kafka-options.helper.ts"],"names":[],"mappings":";;;AAQO,MAAM,iBAAiB,GAAG,CAC/B,SAAoB,EACpB,KAAsB,EACtB,MAAc,EACwB,EAAE;IACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAc,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAGpE,MAAM,OAAO,GAAI,MAAc,CAAC,OAAO,IAAI,EAAE,CAAC;IAC9C,OAAO;QACL,GAAG,OAAO;QACV,MAAM,EAAE;YACN,GAAG,OAAO,CAAC,MAAM;YACjB,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,IAAI,iBAAiB,GAAG,MAAM,EAAE;SACtE;QACD,QAAQ,EAAE;YACR,GAAG,OAAO,CAAC,QAAQ;YACnB,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc,GAAG,MAAM,EAAE;SACnE;KACF,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,iBAAiB,qBAoB5B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAUzE,OAAO,EAGL,4BAA4B,EAC5B,uBAAuB,EACxB,MAAM,4CAA4C,CAAC;AA+BpD,qBAEa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,uBAA4B,GAAG,aAAa;IAQpE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,4BAA4B,GAAG,aAAa;IASzE,OAAO,CAAC,MAAM,CAAC,MAAM;CAetB"}
|
|
@@ -13,6 +13,7 @@ const core_1 = require("@nestjs/core");
|
|
|
13
13
|
const iam_context_guard_1 = require("./guards/iam-context.guard");
|
|
14
14
|
const iam_entity_access_service_1 = require("./services/iam-entity-access.service");
|
|
15
15
|
const iam_permission_service_1 = require("./services/iam-permission.service");
|
|
16
|
+
const iam_permission_map_service_1 = require("./services/iam-permission-map.service");
|
|
16
17
|
const iam_token_verifier_service_1 = require("./services/iam-token-verifier.service");
|
|
17
18
|
const iam_find_one_query_scope_pipe_1 = require("./pipes/iam-find-one-query-scope.pipe");
|
|
18
19
|
const iam_paginate_query_scope_pipe_1 = require("./pipes/iam-paginate-query-scope.pipe");
|
|
@@ -20,6 +21,7 @@ const iam_context_options_interface_1 = require("./interfaces/iam-context-option
|
|
|
20
21
|
const services = [
|
|
21
22
|
iam_entity_access_service_1.IamEntityAccessService,
|
|
22
23
|
iam_permission_service_1.IamPermissionService,
|
|
24
|
+
iam_permission_map_service_1.IamPermissionMapService,
|
|
23
25
|
iam_token_verifier_service_1.IamTokenVerifierService,
|
|
24
26
|
iam_find_one_query_scope_pipe_1.IamFindOneQueryScopePipe,
|
|
25
27
|
iam_paginate_query_scope_pipe_1.IamPaginateQueryScopePipe,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,uCAA0D;AAE1D,kEAA6D;AAC7D,oFAA8E;AAC9E,8EAAyE;AACzE,sFAAgF;AAChF,yFAAiF;AACjF,yFAAkF;AAClF,8FAKoD;AAEpD,MAAM,QAAQ,GAAG;IACf,kDAAsB;IACtB,6CAAoB;IACpB,oDAAuB;IACvB,wDAAwB;IACxB,yDAAyB;CAC1B,CAAC;AAGF,MAAM,YAAY,GAAG,CACnB,UAAmC,EAAE,EACZ,EAAE,CAAC,CAAC;IAC7B,GAAG,kEAAkC;IACrC,GAAG,OAAO;IACV,WAAW,EAAE;QACX,GAAG,kEAAkC,CAAC,WAAW;QACjD,GAAG,OAAO,CAAC,WAAW;KACvB;IACD,YAAY,EAAE;QACZ,GAAG,kEAAkC,CAAC,YAAY;QAClD,GAAG,OAAO,CAAC,YAAY;KACxB;CACF,CAAC,CAAC;AAQI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,OAAO,kBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE;YACjC,OAAO,EAAE,0DAA0B;YACnC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,OAAqC;QACvD,OAAO,kBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;YACpD,OAAO,EAAE,0DAA0B;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE,CACnC,YAAY,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,MAAM,CACnB,OAAc,EACd,eAAyB;QAEzB,OAAO;YACL,MAAM,EAAE,kBAAgB;YACxB,OAAO,EAAE,CAAC,sBAAe,EAAE,GAAG,OAAO,CAAC;YACtC,SAAS,EAAE;gBACT,eAAe;gBACf,GAAG,QAAQ;gBACX,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,mCAAe,EAAE;aAClD;YACD,OAAO,EAAE,CAAC,0DAA0B,EAAE,GAAG,QAAQ,CAAC;SACnD,CAAC;IACJ,CAAC;CACF,CAAA;AAjCY,4CAAgB;2BAAhB,gBAAgB;IAF5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CAiC5B"}
|
|
1
|
+
{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,uCAA0D;AAE1D,kEAA6D;AAC7D,oFAA8E;AAC9E,8EAAyE;AACzE,sFAAgF;AAChF,sFAAgF;AAChF,yFAAiF;AACjF,yFAAkF;AAClF,8FAKoD;AAEpD,MAAM,QAAQ,GAAG;IACf,kDAAsB;IACtB,6CAAoB;IACpB,oDAAuB;IACvB,oDAAuB;IACvB,wDAAwB;IACxB,yDAAyB;CAC1B,CAAC;AAGF,MAAM,YAAY,GAAG,CACnB,UAAmC,EAAE,EACZ,EAAE,CAAC,CAAC;IAC7B,GAAG,kEAAkC;IACrC,GAAG,OAAO;IACV,WAAW,EAAE;QACX,GAAG,kEAAkC,CAAC,WAAW;QACjD,GAAG,OAAO,CAAC,WAAW;KACvB;IACD,YAAY,EAAE;QACZ,GAAG,kEAAkC,CAAC,YAAY;QAClD,GAAG,OAAO,CAAC,YAAY;KACxB;CACF,CAAC,CAAC;AAQI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,OAAO,kBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE;YACjC,OAAO,EAAE,0DAA0B;YACnC,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,OAAqC;QACvD,OAAO,kBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;YACpD,OAAO,EAAE,0DAA0B;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE,CACnC,YAAY,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,MAAM,CACnB,OAAc,EACd,eAAyB;QAEzB,OAAO;YACL,MAAM,EAAE,kBAAgB;YACxB,OAAO,EAAE,CAAC,sBAAe,EAAE,GAAG,OAAO,CAAC;YACtC,SAAS,EAAE;gBACT,eAAe;gBACf,GAAG,QAAQ;gBACX,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,mCAAe,EAAE;aAClD;YACD,OAAO,EAAE,CAAC,0DAA0B,EAAE,GAAG,QAAQ,CAAC;SACnD,CAAC;IACJ,CAAC;CACF,CAAA;AAjCY,4CAAgB;2BAAhB,gBAAgB;IAF5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CAiC5B"}
|
package/dist/index.d.ts
CHANGED
|
@@ -18,6 +18,7 @@ export * from './pipes/iam-paginate-query-scope.pipe';
|
|
|
18
18
|
export * from './pipes/iam-find-one-query-scope.pipe';
|
|
19
19
|
export * from './services/iam-entity-access.service';
|
|
20
20
|
export * from './services/iam-permission.service';
|
|
21
|
+
export * from './services/iam-permission-map.service';
|
|
21
22
|
export * from './services/iam-token-verifier.service';
|
|
22
23
|
export * from './iam-context.module';
|
|
23
24
|
export * from './constants/iam-decorator-key.const';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,oCAAoC,CAAC;AACnD,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sBAAsB,CAAC;AACrC,cAAc,qCAAqC,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -34,6 +34,7 @@ __exportStar(require("./pipes/iam-paginate-query-scope.pipe"), exports);
|
|
|
34
34
|
__exportStar(require("./pipes/iam-find-one-query-scope.pipe"), exports);
|
|
35
35
|
__exportStar(require("./services/iam-entity-access.service"), exports);
|
|
36
36
|
__exportStar(require("./services/iam-permission.service"), exports);
|
|
37
|
+
__exportStar(require("./services/iam-permission-map.service"), exports);
|
|
37
38
|
__exportStar(require("./services/iam-token-verifier.service"), exports);
|
|
38
39
|
__exportStar(require("./iam-context.module"), exports);
|
|
39
40
|
__exportStar(require("./constants/iam-decorator-key.const"), exports);
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,qEAAmD;AACnD,mEAAiD;AACjD,kEAAgD;AAChD,wDAAsC;AACtC,mEAAiD;AACjD,kEAAgD;AAChD,4EAA0D;AAC1D,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,oEAAkD;AAClD,wEAAsD;AACtD,uDAAqC;AACrC,sEAAoD"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,qEAAmD;AACnD,mEAAiD;AACjD,kEAAgD;AAChD,wDAAsC;AACtC,mEAAiD;AACjD,kEAAgD;AAChD,4EAA0D;AAC1D,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,6EAA2D;AAC3D,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,oEAAkD;AAClD,wEAAsD;AACtD,wEAAsD;AACtD,uDAAqC;AACrC,sEAAoD"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"get-agent.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/get-agent.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
|
|
1
|
+
{"version":3,"file":"get-agent.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/get-agent.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
|
|
@@ -1,10 +1,19 @@
|
|
|
1
1
|
import { Type } from '@nestjs/common';
|
|
2
|
-
import type { JSONWebKeySet } from 'jose';
|
|
2
|
+
import type { JSONWebKeySet, JWK } from 'jose';
|
|
3
3
|
import { EntityTarget } from 'typeorm';
|
|
4
4
|
import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
|
|
5
5
|
import type { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
6
6
|
import { ApplyIamEntityScopeOptions, EntityAccessByRole } from './iam-entity-access.interface';
|
|
7
7
|
export type IamTokenKeys = Record<string, JSONWebKeySet>;
|
|
8
|
+
export interface IamSignedTokenKeys {
|
|
9
|
+
signingKey: JWK;
|
|
10
|
+
rotation?: string;
|
|
11
|
+
keys: string;
|
|
12
|
+
}
|
|
13
|
+
export interface IamPermissionMap {
|
|
14
|
+
service: string;
|
|
15
|
+
roles: Record<string, string[]>;
|
|
16
|
+
}
|
|
8
17
|
export type IamControllerClass = Type<unknown>;
|
|
9
18
|
export type IamControllerMatcher = string | IamControllerClass;
|
|
10
19
|
export interface IamEntityAccessPreset<T = any> {
|
|
@@ -29,6 +38,10 @@ export interface IamContextModuleOptions {
|
|
|
29
38
|
required?: boolean;
|
|
30
39
|
loadKeys?: () => Promise<IamTokenKeys>;
|
|
31
40
|
};
|
|
41
|
+
permissionMap?: {
|
|
42
|
+
service?: string;
|
|
43
|
+
load?: () => Promise<IamPermissionMap>;
|
|
44
|
+
};
|
|
32
45
|
entityAccess?: {
|
|
33
46
|
defaultAccess?: EntityAccessByRole<any>;
|
|
34
47
|
defaultScope?: Partial<ApplyIamEntityScopeOptions<any>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EACnB,MAAM,+BAA+B,CAAC;AAGvC,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAMzD,MAAM,WAAW,kBAAkB;IAEjC,UAAU,EAAE,GAAG,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,IAAI,EAAE,MAAM,CAAC;CACd;AAOD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,GAAG;IAC5C,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAKxB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK/B,KAAK,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IAItC,uBAAuB,CAAC,EAAE,eAAe,EAAE,CAAC;IAM5C,8BAA8B,CAAC,EAAE,OAAO,CAAC;IAWzC,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;KACjC,CAAC;IAgBF,WAAW,CAAC,EAAE;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAC9B,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;KACvC,CAAC;IAiBF,iBAAiB,CAAC,EAAE;QAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,OAAO,CAAC,YAAY,CAAC,CAAC;KACxC,CAAC;IAgBF,aAAa,CAAC,EAAE;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;KACxC,CAAC;IAEF,YAAY,CAAC,EAAE;QAIb,aAAa,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAKxC,YAAY,CAAC,EAAE,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC;QAKxD,OAAO,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;KACxC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,eAAO,MAAM,0BAA0B,eAAuC,CAAC;AAE/E,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CACvD,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAC7D,CACF,GACC,IAAI,CACF,uBAAuB,EACvB,yBAAyB,GAAG,gCAAgC,CAa/D,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"iam-context-options.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-context-options.interface.ts"],"names":[],"mappings":";;;AAsKa,QAAA,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAElE,QAAA,kCAAkC,GASzC;IACJ,uBAAuB,EAAE,EAAE;IAC3B,8BAA8B,EAAE,KAAK;IACrC,WAAW,EAAE;QACX,MAAM,EAAE,EAAE;QACV,MAAM,EAAE,EAAE;KACX;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,SAAS;QACxB,YAAY,EAAE,SAAS;QACvB,OAAO,EAAE,EAAE;KACZ;CACF,CAAC"}
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
import { OnApplicationBootstrap, OnApplicationShutdown } from '@nestjs/common';
|
|
2
|
+
import { ModuleRef } from '@nestjs/core';
|
|
3
|
+
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
4
|
+
import { IamTokenVerifierService } from './iam-token-verifier.service';
|
|
5
|
+
export declare class IamPermissionMapService implements OnApplicationBootstrap, OnApplicationShutdown {
|
|
6
|
+
private readonly moduleOptions;
|
|
7
|
+
private readonly verifier;
|
|
8
|
+
private readonly moduleRef?;
|
|
9
|
+
private readonly logger;
|
|
10
|
+
private roles?;
|
|
11
|
+
private issuedAt;
|
|
12
|
+
private expiresAt;
|
|
13
|
+
private failing;
|
|
14
|
+
private timer?;
|
|
15
|
+
private consumer?;
|
|
16
|
+
constructor(moduleOptions: IamContextModuleOptions, verifier: IamTokenVerifierService, moduleRef?: ModuleRef);
|
|
17
|
+
get service(): string | undefined;
|
|
18
|
+
get enabled(): boolean;
|
|
19
|
+
onApplicationBootstrap(): Promise<void>;
|
|
20
|
+
onApplicationShutdown(): Promise<void>;
|
|
21
|
+
covers(roles: string[] | undefined, key: string): boolean | undefined;
|
|
22
|
+
refresh(): Promise<void>;
|
|
23
|
+
private apply;
|
|
24
|
+
private listen;
|
|
25
|
+
}
|
|
26
|
+
//# sourceMappingURL=iam-permission-map.service.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-permission-map.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission-map.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,qBAAqB,EAEtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,OAAO,EAEL,uBAAuB,EAExB,MAAM,6CAA6C,CAAC;AAErD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAavE,qBACa,uBACX,YAAW,sBAAsB,EAAE,qBAAqB;IAYtD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACb,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAZzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,KAAK,CAAC,CAA2B;IACzC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAC,CAAiB;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAIT,aAAa,EAAE,uBAAuB,EACtC,QAAQ,EAAE,uBAAuB,EACrB,SAAS,CAAC,EAAE,SAAS;IAGpD,IAAI,OAAO,IAAI,MAAM,GAAG,SAAS,CAKhC;IAED,IAAI,OAAO,IAAI,OAAO,CAMrB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQvC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAS/D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC9B,OAAO,CAAC,KAAK;YAuBC,MAAM;CA4BrB"}
|
|
@@ -0,0 +1,166 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
+
if (k2 === undefined) k2 = k;
|
|
4
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
+
}
|
|
8
|
+
Object.defineProperty(o, k2, desc);
|
|
9
|
+
}) : (function(o, m, k, k2) {
|
|
10
|
+
if (k2 === undefined) k2 = k;
|
|
11
|
+
o[k2] = m[k];
|
|
12
|
+
}));
|
|
13
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
+
}) : function(o, v) {
|
|
16
|
+
o["default"] = v;
|
|
17
|
+
});
|
|
18
|
+
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
19
|
+
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
20
|
+
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
21
|
+
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
22
|
+
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
23
|
+
};
|
|
24
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
25
|
+
var ownKeys = function(o) {
|
|
26
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
27
|
+
var ar = [];
|
|
28
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
29
|
+
return ar;
|
|
30
|
+
};
|
|
31
|
+
return ownKeys(o);
|
|
32
|
+
};
|
|
33
|
+
return function (mod) {
|
|
34
|
+
if (mod && mod.__esModule) return mod;
|
|
35
|
+
var result = {};
|
|
36
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
37
|
+
__setModuleDefault(result, mod);
|
|
38
|
+
return result;
|
|
39
|
+
};
|
|
40
|
+
})();
|
|
41
|
+
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
42
|
+
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
43
|
+
};
|
|
44
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
45
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
46
|
+
};
|
|
47
|
+
var IamPermissionMapService_1;
|
|
48
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
49
|
+
exports.IamPermissionMapService = void 0;
|
|
50
|
+
const common_1 = require("@nestjs/common");
|
|
51
|
+
const core_1 = require("@nestjs/core");
|
|
52
|
+
const Sentry = __importStar(require("@sentry/nestjs"));
|
|
53
|
+
const os_1 = require("os");
|
|
54
|
+
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
55
|
+
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
56
|
+
const kafka_options_helper_1 = require("../helpers/kafka-options.helper");
|
|
57
|
+
const iam_token_verifier_service_1 = require("./iam-token-verifier.service");
|
|
58
|
+
const CHECK_MS = 5 * 60_000;
|
|
59
|
+
const JITTER_MS = 5_000;
|
|
60
|
+
let IamPermissionMapService = IamPermissionMapService_1 = class IamPermissionMapService {
|
|
61
|
+
constructor(moduleOptions, verifier, moduleRef) {
|
|
62
|
+
this.moduleOptions = moduleOptions;
|
|
63
|
+
this.verifier = verifier;
|
|
64
|
+
this.moduleRef = moduleRef;
|
|
65
|
+
this.logger = new common_1.Logger(IamPermissionMapService_1.name);
|
|
66
|
+
this.issuedAt = 0;
|
|
67
|
+
this.expiresAt = 0;
|
|
68
|
+
this.failing = false;
|
|
69
|
+
}
|
|
70
|
+
get service() {
|
|
71
|
+
return (this.moduleOptions.permissions?.service ??
|
|
72
|
+
this.moduleOptions.permissionMap?.service);
|
|
73
|
+
}
|
|
74
|
+
get enabled() {
|
|
75
|
+
return !!(this.service &&
|
|
76
|
+
(this.moduleOptions.permissionMap?.load ||
|
|
77
|
+
this.moduleOptions.permissions?.kafkaClient));
|
|
78
|
+
}
|
|
79
|
+
async onApplicationBootstrap() {
|
|
80
|
+
if (!this.enabled)
|
|
81
|
+
return;
|
|
82
|
+
void this.refresh();
|
|
83
|
+
this.timer = setInterval(() => void this.refresh(), CHECK_MS);
|
|
84
|
+
this.timer.unref?.();
|
|
85
|
+
if (!this.moduleOptions.permissionMap?.load)
|
|
86
|
+
void this.listen();
|
|
87
|
+
}
|
|
88
|
+
async onApplicationShutdown() {
|
|
89
|
+
clearInterval(this.timer);
|
|
90
|
+
await this.consumer?.disconnect().catch(() => undefined);
|
|
91
|
+
}
|
|
92
|
+
covers(roles, key) {
|
|
93
|
+
if (!this.roles || Date.now() > this.expiresAt)
|
|
94
|
+
return undefined;
|
|
95
|
+
const wildcard = `${this.service}:*`;
|
|
96
|
+
return (roles ?? []).some((role) => {
|
|
97
|
+
const keys = this.roles.get(role);
|
|
98
|
+
return !!keys && (keys.has(key) || keys.has(wildcard));
|
|
99
|
+
});
|
|
100
|
+
}
|
|
101
|
+
async refresh() {
|
|
102
|
+
try {
|
|
103
|
+
const load = this.moduleOptions.permissionMap?.load;
|
|
104
|
+
if (load) {
|
|
105
|
+
this.apply(await load(), Date.now(), Infinity);
|
|
106
|
+
return;
|
|
107
|
+
}
|
|
108
|
+
const token = await this.verifier.request(iam_decorator_key_const_1.IAM_PERMISSION_MAP_TOPIC, { service: this.service });
|
|
109
|
+
const map = await this.verifier.verifySigned(token);
|
|
110
|
+
if (map.service !== this.service) {
|
|
111
|
+
throw new Error(`IAM sent the permission map of ${map.service}`);
|
|
112
|
+
}
|
|
113
|
+
const issuedAt = (map.iat ?? 0) * 1000;
|
|
114
|
+
if (issuedAt < this.issuedAt)
|
|
115
|
+
return;
|
|
116
|
+
this.apply(map, issuedAt, (map.exp ?? 0) * 1000);
|
|
117
|
+
}
|
|
118
|
+
catch (cause) {
|
|
119
|
+
const error = Object.assign(new Error(`Cannot load the permission map from IAM: ${cause}`), { cause });
|
|
120
|
+
this.logger.error(error.message);
|
|
121
|
+
if (!this.failing)
|
|
122
|
+
Sentry.captureException(error);
|
|
123
|
+
this.failing = true;
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
apply(map, issuedAt, expiresAt) {
|
|
127
|
+
this.roles = new Map(Object.entries(map.roles ?? {}).map(([role, keys]) => [
|
|
128
|
+
role,
|
|
129
|
+
new Set(keys),
|
|
130
|
+
]));
|
|
131
|
+
this.issuedAt = issuedAt;
|
|
132
|
+
this.expiresAt = expiresAt;
|
|
133
|
+
if (this.failing)
|
|
134
|
+
this.logger.log('Permission map loaded from IAM again');
|
|
135
|
+
this.failing = false;
|
|
136
|
+
}
|
|
137
|
+
async listen() {
|
|
138
|
+
try {
|
|
139
|
+
const { Kafka } = await Promise.resolve().then(() => __importStar(require('kafkajs')));
|
|
140
|
+
const options = (0, kafka_options_helper_1.cloneKafkaOptions)(this.moduleRef, this.moduleOptions.permissions.kafkaClient, `-iam-map-${(0, os_1.hostname)()}`);
|
|
141
|
+
const consumer = new Kafka(options.client).consumer({
|
|
142
|
+
groupId: options.consumer.groupId,
|
|
143
|
+
});
|
|
144
|
+
this.consumer = consumer;
|
|
145
|
+
await consumer.connect();
|
|
146
|
+
await consumer.subscribe({ topic: iam_decorator_key_const_1.IAM_PERMISSION_MAP_CHANGED_TOPIC });
|
|
147
|
+
await consumer.run({
|
|
148
|
+
eachMessage: async () => {
|
|
149
|
+
setTimeout(() => void this.refresh(), Math.random() * JITTER_MS).unref?.();
|
|
150
|
+
},
|
|
151
|
+
});
|
|
152
|
+
}
|
|
153
|
+
catch (error) {
|
|
154
|
+
this.logger.warn(`Not listening for permission map changes: ${error}`);
|
|
155
|
+
}
|
|
156
|
+
}
|
|
157
|
+
};
|
|
158
|
+
exports.IamPermissionMapService = IamPermissionMapService;
|
|
159
|
+
exports.IamPermissionMapService = IamPermissionMapService = IamPermissionMapService_1 = __decorate([
|
|
160
|
+
(0, common_1.Injectable)(),
|
|
161
|
+
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
162
|
+
__param(2, (0, common_1.Optional)()),
|
|
163
|
+
__metadata("design:paramtypes", [Object, iam_token_verifier_service_1.IamTokenVerifierService,
|
|
164
|
+
core_1.ModuleRef])
|
|
165
|
+
], IamPermissionMapService);
|
|
166
|
+
//# sourceMappingURL=iam-permission-map.service.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"iam-permission-map.service.js","sourceRoot":"","sources":["../../src/services/iam-permission-map.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,uDAAyC;AAEzC,2BAA8B;AAC9B,kFAG8C;AAC9C,+FAIqD;AACrD,0EAAoE;AACpE,6EAAuE;AAGvE,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;AAE5B,MAAM,SAAS,GAAG,KAAK,CAAC;AASjB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAWlC,YAEE,aAAuD,EACtC,QAAiC,EACtC,SAAsC;QAFjC,kBAAa,GAAb,aAAa,CAAyB;QACtC,aAAQ,GAAR,QAAQ,CAAyB;QACrB,cAAS,GAAT,SAAS,CAAY;QAZnC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,aAAQ,GAAG,CAAC,CAAC;QACb,cAAS,GAAG,CAAC,CAAC;QACd,YAAO,GAAG,KAAK,CAAC;IASrB,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO;YACvC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,OAAO;YACZ,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI;gBACrC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI;YAAE,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IAMD,MAAM,CAAC,KAA2B,EAAE,GAAW;QAC7C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjE,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC;QACrC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC;YACpD,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,kDAAwB,EACxB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAC1B,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAmB,KAAK,CAAC,CAAC;YACtE,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;YAEvC,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACrC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,KAAK,CAAC,4CAA4C,KAAK,EAAE,CAAC,EAC9D,EAAE,KAAK,EAAE,CACV,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEjC,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,KAAK,CACX,GAAqB,EACrB,QAAgB,EAChB,SAAiB;QAEjB,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACpD,IAAI;YACJ,IAAI,GAAG,CAAC,IAAI,CAAC;SACd,CAAC,CACH,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAQO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC;YAEH,MAAM,EAAE,KAAK,EAAE,GAAG,wDAAa,SAAS,GAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAA,wCAAiB,EAC/B,IAAI,CAAC,SAAU,EACf,IAAI,CAAC,aAAa,CAAC,WAAY,CAAC,WAAY,EAC5C,YAAY,IAAA,aAAQ,GAAE,EAAE,CACzB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAa,CAAC,CAAC,QAAQ,CAAC;gBACzD,OAAO,EAAE,OAAO,CAAC,QAAS,CAAC,OAAO;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YACzB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,0DAAgC,EAAE,CAAC,CAAC;YACtE,MAAM,QAAQ,CAAC,GAAG,CAAC;gBACjB,WAAW,EAAE,KAAK,IAAI,EAAE;oBACtB,UAAU,CACR,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,EACzB,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC;gBACd,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF,CAAA;AA9IY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAaR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;IAGlC,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CADgB,oDAAuB;QACT,gBAAS;GAfzC,uBAAuB,CA8InC"}
|
|
@@ -3,13 +3,15 @@ import { DiscoveryService, MetadataScanner, ModuleRef } from '@nestjs/core';
|
|
|
3
3
|
import { GetAgentInterface } from '../interfaces/get-agent.interface';
|
|
4
4
|
import { IamPermissionDefinition } from '../decorators/require-permission.decorator';
|
|
5
5
|
import { IamContextModuleOptions } from '../interfaces/iam-context-options.interface';
|
|
6
|
+
import { IamPermissionMapService } from './iam-permission-map.service';
|
|
6
7
|
export declare class IamPermissionService implements OnApplicationBootstrap {
|
|
7
8
|
private readonly moduleOptions;
|
|
8
9
|
private readonly discoveryService;
|
|
9
10
|
private readonly metadataScanner;
|
|
10
11
|
private readonly moduleRef;
|
|
12
|
+
private readonly permissionMap;
|
|
11
13
|
private readonly logger;
|
|
12
|
-
constructor(moduleOptions: IamContextModuleOptions, discoveryService: DiscoveryService, metadataScanner: MetadataScanner, moduleRef: ModuleRef);
|
|
14
|
+
constructor(moduleOptions: IamContextModuleOptions, discoveryService: DiscoveryService, metadataScanner: MetadataScanner, moduleRef: ModuleRef, permissionMap: IamPermissionMapService);
|
|
13
15
|
hasPermissions(agent: GetAgentInterface | undefined, required: string[]): boolean;
|
|
14
16
|
onApplicationBootstrap(): Promise<void>;
|
|
15
17
|
collectPermissions(): IamPermissionDefinition[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,
|
|
1
|
+
{"version":3,"file":"iam-permission.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAEL,uBAAuB,EACxB,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAavE,qBACa,oBAAqB,YAAW,sBAAsB;IAK/D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IARhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAI7C,aAAa,EAAE,uBAAuB,EACtC,gBAAgB,EAAE,gBAAgB,EAClC,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,uBAAuB;IAazD,cAAc,CACZ,KAAK,EAAE,iBAAiB,GAAG,SAAS,EACpC,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO;IA4BJ,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB7C,kBAAkB,IAAI,uBAAuB,EAAE;IAyB/C,OAAO,CAAC,cAAc;CAOvB"}
|
|
@@ -19,13 +19,15 @@ const core_1 = require("@nestjs/core");
|
|
|
19
19
|
const rxjs_1 = require("rxjs");
|
|
20
20
|
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
21
21
|
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
22
|
+
const iam_permission_map_service_1 = require("./iam-permission-map.service");
|
|
22
23
|
const KAFKA_TIMEOUT_MS = 5_000;
|
|
23
24
|
let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
24
|
-
constructor(moduleOptions, discoveryService, metadataScanner, moduleRef) {
|
|
25
|
+
constructor(moduleOptions, discoveryService, metadataScanner, moduleRef, permissionMap) {
|
|
25
26
|
this.moduleOptions = moduleOptions;
|
|
26
27
|
this.discoveryService = discoveryService;
|
|
27
28
|
this.metadataScanner = metadataScanner;
|
|
28
29
|
this.moduleRef = moduleRef;
|
|
30
|
+
this.permissionMap = permissionMap;
|
|
29
31
|
this.logger = new common_1.Logger(IamPermissionService_1.name);
|
|
30
32
|
}
|
|
31
33
|
hasPermissions(agent, required) {
|
|
@@ -36,7 +38,18 @@ let IamPermissionService = IamPermissionService_1 = class IamPermissionService {
|
|
|
36
38
|
return true;
|
|
37
39
|
}
|
|
38
40
|
const granted = new Set(permissions ?? []);
|
|
39
|
-
return required.every((key) =>
|
|
41
|
+
return required.every((key) => {
|
|
42
|
+
const service = key.split(':')[0];
|
|
43
|
+
if (service === this.permissionMap.service) {
|
|
44
|
+
const covered = this.permissionMap.covers(agent.roles, key);
|
|
45
|
+
if (covered !== undefined)
|
|
46
|
+
return covered;
|
|
47
|
+
}
|
|
48
|
+
if (!permissions && this.permissionMap.enabled) {
|
|
49
|
+
throw new common_1.ServiceUnavailableException('Permissions are not loaded');
|
|
50
|
+
}
|
|
51
|
+
return granted.has(key) || granted.has(`${service}:*`);
|
|
52
|
+
});
|
|
40
53
|
}
|
|
41
54
|
async onApplicationBootstrap() {
|
|
42
55
|
const service = this.moduleOptions.permissions?.service;
|
|
@@ -91,6 +104,7 @@ exports.IamPermissionService = IamPermissionService = IamPermissionService_1 = _
|
|
|
91
104
|
__param(0, (0, common_1.Inject)(iam_context_options_interface_1.IAM_CONTEXT_MODULE_OPTIONS)),
|
|
92
105
|
__metadata("design:paramtypes", [Object, core_1.DiscoveryService,
|
|
93
106
|
core_1.MetadataScanner,
|
|
94
|
-
core_1.ModuleRef
|
|
107
|
+
core_1.ModuleRef,
|
|
108
|
+
iam_permission_map_service_1.IamPermissionMapService])
|
|
95
109
|
], IamPermissionService);
|
|
96
110
|
//# sourceMappingURL=iam-permission.service.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"iam-permission.service.js","sourceRoot":"","sources":["../../src/services/iam-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAA4E;AAE5E,+BAA2D;AAC3D,kFAI8C;AAE9C,+FAGqD;AACrD,6EAAuE;AAOvE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAOxB,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YAEE,aAAuD,EACtC,gBAAkC,EAClC,eAAgC,EAChC,SAAoB,EACpB,aAAsC;QAJtC,kBAAa,GAAb,aAAa,CAAyB;QACtC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QACpB,kBAAa,GAAb,aAAa,CAAyB;QARxC,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAS7D,CAAC;IAYJ,cAAc,CACZ,KAAoC,EACpC,QAAkB;QAElB,IAAI,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,KAAK,CAAC;QAElC,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAGhD,IACE,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9B,IAAI,CAAC,QAAQ,CAAC,sDAA4B,CAAC,CAC5C,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5D,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,OAAO,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,oCAA2B,CAAC,4BAA4B,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAA,qBAAc,EAClB,IAAI,CAAC,cAAc,EAAE;iBAClB,IAAI,CAAC,mDAAyB,EAAE;gBAC/B,YAAY,EAAE,OAAO;gBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE;aAC/B,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,WAAW,CAAC,MAAM,qBAAqB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAMD,kBAAkB;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,WAAsC,EAAE,EAAE,CACxD,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC;gBAC5C,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACxC,CAAC;QACH,CAAC,CAAC,CAAC;QACL,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE,CAC7B,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,+CAAqB,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7D,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe;iBACjB,iBAAiB,CAAC,SAAS,CAAC;iBAC5B,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC;IAEO,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AA7GY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;6CAEA,uBAAgB;QACjB,sBAAe;QACrB,gBAAS;QACL,oDAAuB;GAT9C,oBAAoB,CA6GhC"}
|
|
@@ -14,6 +14,7 @@ export declare class IamTokenVerifierService implements OnApplicationBootstrap,
|
|
|
14
14
|
private retryTimer?;
|
|
15
15
|
private client?;
|
|
16
16
|
private closed;
|
|
17
|
+
private iamKey?;
|
|
17
18
|
constructor(moduleOptions: IamContextModuleOptions, moduleRef?: ModuleRef);
|
|
18
19
|
get enabled(): boolean;
|
|
19
20
|
get required(): boolean;
|
|
@@ -28,6 +29,9 @@ export declare class IamTokenVerifierService implements OnApplicationBootstrap,
|
|
|
28
29
|
private closeClient;
|
|
29
30
|
private scheduleRetry;
|
|
30
31
|
private fetchKeys;
|
|
32
|
+
request<T>(topic: string, data: unknown): Promise<T>;
|
|
33
|
+
verifySigned<T>(token: string): Promise<T & JWTPayload>;
|
|
34
|
+
private trustSigningKey;
|
|
31
35
|
private getClient;
|
|
32
36
|
private forwardedSubject;
|
|
33
37
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.d.ts","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,qBAAqB,EAItB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAML,UAAU,EAGX,MAAM,MAAM,CAAC;AAMd,OAAO,EAEL,uBAAuB,EAGxB,MAAM,6CAA6C,CAAC;AAmCrD,qBACa,uBACX,YAAW,sBAAsB,EAAE,qBAAqB;IAetD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAClB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAdzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IACnE,OAAO,CAAC,IAAI,CAAC,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,OAAO,CAAC,CAAmB;IACnC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAC,CAAiB;IACpC,OAAO,CAAC,MAAM,CAAC,CAAc;IAC7B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,MAAM,CAAC,CAAoD;gBAIhD,aAAa,EAAE,uBAAuB,EAC1B,SAAS,CAAC,EAAE,SAAS;IAIpD,IAAI,OAAO,IAAI,OAAO,CAKrB;IAED,IAAI,QAAQ,IAAI,OAAO,CAKtB;IAEK,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAevC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAetC,aAAa,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B1C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;YA0BlC,oBAAoB;IAmBlC,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,OAAO;YAMD,IAAI;YAsCJ,WAAW;IAMzB,OAAO,CAAC,aAAa;YASP,SAAS;IAajB,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAwBpD,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC;YAc/C,eAAe;YAoCf,SAAS;IAiBvB,OAAO,CAAC,gBAAgB;CAOzB"}
|
|
@@ -55,6 +55,7 @@ const jose_1 = require("jose");
|
|
|
55
55
|
const rxjs_1 = require("rxjs");
|
|
56
56
|
const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
|
|
57
57
|
const iam_context_options_interface_1 = require("../interfaces/iam-context-options.interface");
|
|
58
|
+
const kafka_options_helper_1 = require("../helpers/kafka-options.helper");
|
|
58
59
|
const BEARER_PREFIX = /^Bearer\s+/i;
|
|
59
60
|
const ACCESS_TOKEN_TYPE = 'Bearer';
|
|
60
61
|
const CLOCK_TOLERANCE_SECONDS = 30;
|
|
@@ -63,6 +64,7 @@ const RETRY_MS = 30_000;
|
|
|
63
64
|
const REFRESH_THROTTLE_MS = 60_000;
|
|
64
65
|
const KEYS_TTL_MS = 60 * 60_000;
|
|
65
66
|
const CLIENT_SUFFIX = '-iam-token-keys';
|
|
67
|
+
const IAM_SIGNING_ALG = 'EdDSA';
|
|
66
68
|
let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifierService {
|
|
67
69
|
constructor(moduleOptions, moduleRef) {
|
|
68
70
|
this.moduleOptions = moduleOptions;
|
|
@@ -227,12 +229,17 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
227
229
|
const loadKeys = this.moduleOptions.tokenVerification?.loadKeys;
|
|
228
230
|
if (loadKeys)
|
|
229
231
|
return loadKeys();
|
|
232
|
+
const reply = await this.request(iam_decorator_key_const_1.IAM_TOKEN_KEYS_SIGNED_TOPIC, {});
|
|
233
|
+
await this.trustSigningKey(reply);
|
|
234
|
+
return (await this.verifySigned(reply.keys)).keys;
|
|
235
|
+
}
|
|
236
|
+
async request(topic, data) {
|
|
230
237
|
try {
|
|
231
238
|
const client = await this.getClient();
|
|
232
239
|
const response = await (0, rxjs_1.firstValueFrom)(client
|
|
233
|
-
.send(
|
|
240
|
+
.send(topic, {
|
|
234
241
|
event_source: this.moduleOptions.permissions?.service,
|
|
235
|
-
data
|
|
242
|
+
data,
|
|
236
243
|
})
|
|
237
244
|
.pipe((0, rxjs_1.timeout)(KAFKA_TIMEOUT_MS)));
|
|
238
245
|
return (typeof response === 'string' ? JSON.parse(response) : response)
|
|
@@ -243,23 +250,47 @@ let IamTokenVerifierService = IamTokenVerifierService_1 = class IamTokenVerifier
|
|
|
243
250
|
throw error;
|
|
244
251
|
}
|
|
245
252
|
}
|
|
253
|
+
async verifySigned(token) {
|
|
254
|
+
if (!this.iamKey)
|
|
255
|
+
await this.refresh();
|
|
256
|
+
if (!this.iamKey)
|
|
257
|
+
throw new Error("IAM's signing key is not loaded");
|
|
258
|
+
const { payload } = await (0, jose_1.jwtVerify)(token, this.iamKey.key, {
|
|
259
|
+
algorithms: [IAM_SIGNING_ALG],
|
|
260
|
+
clockTolerance: CLOCK_TOLERANCE_SECONDS,
|
|
261
|
+
});
|
|
262
|
+
return payload;
|
|
263
|
+
}
|
|
264
|
+
async trustSigningKey({ signingKey, rotation, }) {
|
|
265
|
+
const thumbprint = await (0, jose_1.calculateJwkThumbprint)(signingKey);
|
|
266
|
+
if (this.iamKey?.thumbprint === thumbprint)
|
|
267
|
+
return;
|
|
268
|
+
if (this.iamKey) {
|
|
269
|
+
const next = rotation
|
|
270
|
+
? await (0, jose_1.jwtVerify)(rotation, this.iamKey.key, {
|
|
271
|
+
algorithms: [IAM_SIGNING_ALG],
|
|
272
|
+
}).then(({ payload }) => payload.next, () => undefined)
|
|
273
|
+
: undefined;
|
|
274
|
+
if (next !== thumbprint) {
|
|
275
|
+
const error = new Error(`IAM signing key ${thumbprint} is not named by the trusted key ${this.iamKey.thumbprint}`);
|
|
276
|
+
Sentry.captureException(error);
|
|
277
|
+
throw error;
|
|
278
|
+
}
|
|
279
|
+
this.logger.log(`IAM signing key rotated to ${thumbprint}`);
|
|
280
|
+
}
|
|
281
|
+
this.iamKey = {
|
|
282
|
+
thumbprint,
|
|
283
|
+
key: await (0, jose_1.importJWK)(signingKey, IAM_SIGNING_ALG),
|
|
284
|
+
};
|
|
285
|
+
}
|
|
246
286
|
async getClient() {
|
|
247
287
|
if (!this.client) {
|
|
248
|
-
const source = this.moduleRef.get(this.moduleOptions.permissions.kafkaClient, { strict: false });
|
|
249
|
-
const options = source.options ?? {};
|
|
250
288
|
this.client = new microservices_1.ClientKafka({
|
|
251
|
-
...
|
|
289
|
+
...(0, kafka_options_helper_1.cloneKafkaOptions)(this.moduleRef, this.moduleOptions.permissions.kafkaClient, CLIENT_SUFFIX),
|
|
252
290
|
producerOnlyMode: false,
|
|
253
|
-
client: {
|
|
254
|
-
...options.client,
|
|
255
|
-
clientId: `${options.client?.clientId ?? 'nestjs-consumer'}${CLIENT_SUFFIX}`,
|
|
256
|
-
},
|
|
257
|
-
consumer: {
|
|
258
|
-
...options.consumer,
|
|
259
|
-
groupId: `${options.consumer?.groupId ?? 'nestjs-group'}${CLIENT_SUFFIX}`,
|
|
260
|
-
},
|
|
261
291
|
});
|
|
262
|
-
this.client.subscribeToResponseOf(iam_decorator_key_const_1.
|
|
292
|
+
this.client.subscribeToResponseOf(iam_decorator_key_const_1.IAM_TOKEN_KEYS_SIGNED_TOPIC);
|
|
293
|
+
this.client.subscribeToResponseOf(iam_decorator_key_const_1.IAM_PERMISSION_MAP_TOPIC);
|
|
263
294
|
}
|
|
264
295
|
await this.client.connect();
|
|
265
296
|
return this.client;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,uCAAyC;AACzC,yDAAoD;AACpD,uDAAyC;AACzC,+
|
|
1
|
+
{"version":3,"file":"iam-token-verifier.service.js","sourceRoot":"","sources":["../../src/services/iam-token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,uCAAyC;AACzC,yDAAoD;AACpD,uDAAyC;AACzC,+BASc;AACd,+BAA+C;AAC/C,kFAG8C;AAC9C,+FAKqD;AACrD,0EAAoE;AAEpE,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC,MAAM,eAAe,GAAG,OAAO,CAAC;AAqBzB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAclC,YAEE,aAAuD,EAC3C,SAAsC;QADjC,kBAAa,GAAb,aAAa,CAAyB;QAC1B,cAAS,GAAT,SAAS,CAAY;QAdnC,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;QAE3D,aAAQ,GAAG,CAAC,CAAC;QACb,gBAAW,GAAG,CAAC,CAAC;QAEhB,YAAO,GAAG,KAAK,CAAC;QAGhB,WAAM,GAAG,KAAK,CAAC;IAOpB,CAAC;IAGJ,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,CACP,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ;YAC9C,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,QAAQ,GAAG,IAAI,GAAG,CACnE,CAAC;YACF,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAWD,KAAK,CAAC,aAAa,CAAC,OAAY;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,oCAA2B,CAAC,2BAA2B,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,GAAG,WAAW;YAAE,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,aAAa,GAAuB,OAAO,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,SAAS,GAAuB,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEjE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5E,IAAI,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,OAAO,CAAC,GAAG,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YAEH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAEtD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;gBAChD,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAC7B,kBAAkB,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,KAAK,EAAE,CAC3D,CAAC;QACJ,CAAC;QAID,IAAI,OAAO,CAAC,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAGO,KAAK,CAAC,oBAAoB,CAChC,KAAa,EACb,MAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM;gBACN,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAM,CAAC,iBAAiB;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,GAAG,mBAAmB,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAGO,OAAO;QACb,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CACjB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM;gBACN,IAAA,wBAAiB,EAAC,IAAI,CAAC;aACxB,CAAC,CACH,CAAC;YACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,KAAK,CAAC,oCAAoC,KAAK,EAAE,CAAC,EACtD,EAAE,KAAK,EAAE,CACV,CAAC;YACF,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;gBACxB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,8CAA8C,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC;YAEjD,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;YAC5B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,QAAQ,CAAC,CAAC;QACb,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC;QAChE,IAAI,QAAQ;YAAE,OAAO,QAAQ,EAAE,CAAC;QAEhC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAC9B,qDAA2B,EAC3B,EAAE,CACH,CAAC;QACF,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAyB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,CAAC;IAGD,KAAK,CAAC,OAAO,CAAI,KAAa,EAAE,IAAa;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,MAAM;iBACH,IAAI,CAAC,KAAK,EAAE;gBACX,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO;gBACrD,IAAI;aACL,CAAC;iBACD,IAAI,CAAC,IAAA,cAAO,EAAC,gBAAgB,CAAC,CAAC,CACnC,CAAC;YACF,OAAO,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACrE,EAAE,IAAI,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAMD,KAAK,CAAC,YAAY,CAAI,KAAa;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YAC1D,UAAU,EAAE,CAAC,eAAe,CAAC;YAC7B,cAAc,EAAE,uBAAuB;SACxC,CAAC,CAAC;QACH,OAAO,OAAyB,CAAC;IACnC,CAAC;IAMO,KAAK,CAAC,eAAe,CAAC,EAC5B,UAAU,EACV,QAAQ,GACW;QACnB,MAAM,UAAU,GAAG,MAAM,IAAA,6BAAsB,EAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU,KAAK,UAAU;YAAE,OAAO;QAEnD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,QAAQ;gBACnB,CAAC,CAAC,MAAM,IAAA,gBAAS,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACzC,UAAU,EAAE,CAAC,eAAe,CAAC;iBAC9B,CAAC,CAAC,IAAI,CACL,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAC7B,GAAG,EAAE,CAAC,SAAS,CAChB;gBACH,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,mBAAmB,UAAU,oCAAoC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAC1F,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,UAAU;YACV,GAAG,EAAE,MAAM,IAAA,gBAAS,EAAC,UAAU,EAAE,eAAe,CAAC;SAClD,CAAC;IACJ,CAAC;IAOO,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,2BAAW,CAAC;gBAC5B,GAAG,IAAA,wCAAiB,EAClB,IAAI,CAAC,SAAU,EACf,IAAI,CAAC,aAAa,CAAC,WAAY,CAAC,WAAY,EAC5C,aAAa,CACd;gBACD,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,qDAA2B,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,kDAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AA/TY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAgBR,WAAA,IAAA,eAAM,EAAC,0DAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAA8B,gBAAS;GAjBzC,uBAAuB,CA+TnC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mondart/nestjs-common-module-iam",
|
|
3
|
-
"version": "3.2.
|
|
3
|
+
"version": "3.2.22",
|
|
4
4
|
"description": "Reusable IAM (Identity and Access Management) utilities for NestJS.",
|
|
5
5
|
"author": {
|
|
6
6
|
"name": "Mondart"
|
|
@@ -21,8 +21,9 @@
|
|
|
21
21
|
"test:debug": "node --inspect-brk -r ts-node/register ./node_modules/.bin/jest --runInBand"
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
|
-
"@mondart/nestjs-common-module-core": "3.2.
|
|
24
|
+
"@mondart/nestjs-common-module-core": "3.2.17",
|
|
25
25
|
"jose": "5.10.0",
|
|
26
|
+
"kafkajs": "^2.2.4",
|
|
26
27
|
"@sentry/nestjs": "^10.32.1"
|
|
27
28
|
},
|
|
28
29
|
"peerDependencies": {
|