@nathapp/nestjs-oauth-prisma 1.0.0

package/dist/prisma-oauth-pushed-request.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-oauth-pushed-request.repository.js","sourceRoot":"","sources":["../lib/prisma-oauth-pushed-request.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,yGAAkG;AAElG,sDAAgF;AAKhF,6DAAoH;AAG7G,IAAM,kCAAkC,GAAxC,MAAM,kCACX,SAAQ,+EAAgF;IAGxF,YAAyC,EAAuB;QAAI,KAAK,CAAC,EAAE,CAAC,CAAC;QAE3D,oBAAe,GAAG,oBAAoB,CAAC;IAFqB,CAAC;IAItE,aAAa,CAAC,MAAwB;QAC9C,OAAO,IAAA,2CAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC;IAES,QAAQ,CAAC,CAAwB;;QACzC,MAAM,MAAM,GAAG;YACb,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,SAAS;YACjC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ;YAC3B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,SAAS;YAC3B,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,SAAS;YAC3B,aAAa,EAAE,MAAA,CAAC,CAAC,aAAa,mCAAI,SAAS;YAC3C,mBAAmB,EAAE,MAAA,CAAC,CAAC,mBAAmB,mCAAI,SAAS;YACvD,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,SAAS;YAC3B,MAAM,EAAE,MAAA,CAAC,CAAC,MAAM,mCAAI,SAAS;YAC7B,MAAM,EAAE,MAAA,CAAC,CAAC,MAAM,mCAAI,SAAS;YAC7B,UAAU,EAAE,MAAA,CAAC,CAAC,UAAU,mCAAI,SAAS;YACrC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,SAAS;YACjC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAC3C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/H,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,EAAQ;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;YAC/B,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAS;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IAES,mBAAmB,CAAC,CAAsB;;QAClD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,IAAI;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC7C,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,IAAI;YACtB,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,IAAI;YACtB,aAAa,EAAE,MAAA,CAAC,CAAC,aAAa,mCAAI,IAAI;YACtC,mBAAmB,EAAE,MAAA,CAAC,CAAC,mBAAmB,mCAAI,IAAI;YAClD,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,IAAI;YACtB,MAAM,EAAE,MAAA,CAAC,CAAC,MAAM,mCAAI,IAAI;YACxB,MAAM,EAAE,MAAA,CAAC,CAAC,MAAM,mCAAI,IAAI;YACxB,UAAU,EAAE,MAAA,CAAC,CAAC,UAAU,mCAAI,IAAI;YAChC,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,IAAI;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAA+B;QAC3D,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/C,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAjFY,gFAAkC;6CAAlC,kCAAkC;IAD9C,IAAA,mBAAU,GAAE;IAKE,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;;GAJ7B,kCAAkC,CAiF9C"}

package/dist/prisma-oauth-refresh-token.repository.d.ts

@@ -0,0 +1,28 @@
+import { AbstractPrismaRepository, type PrismaClientLike } from '@nathapp/nestjs-prisma';
+import { ITransactionManager } from '@nathapp/nestjs-data';
+import { type IOAuthRefreshTokenRepository, type IOAuthRefreshToken } from '@nathapp/nestjs-oauth';
+import { type OAuthPrismaDelegate, type OAuthRefreshTokenRow } from './oauth-prisma.types';
+export declare class PrismaOAuthRefreshTokenRepository extends AbstractPrismaRepository<IOAuthRefreshToken, OAuthRefreshTokenRow, string> implements IOAuthRefreshTokenRepository {
+    constructor(tx: ITransactionManager);
+    protected modelDelegate(client: PrismaClientLike): OAuthPrismaDelegate<OAuthRefreshTokenRow>;
+    private get oauthModel();
+    protected toDomain(e: OAuthRefreshTokenRow): IOAuthRefreshToken;
+    protected toPersistenceCreate(d: IOAuthRefreshToken): {
+        id: string;
+        tenantId: string | null;
+        tokenHash: string;
+        clientId: string;
+        userId: string;
+        scope: string | null;
+        previousTokenHash: string | null;
+        expiresAt: Date;
+        cnfJkt: string | null;
+        resource: string | null;
+    };
+    protected toPersistenceUpdate(p: Partial<IOAuthRefreshToken>): Record<string, unknown>;
+    findByTokenHash(tokenHash: string): Promise<IOAuthRefreshToken | null>;
+    revoke(id: string, revokedAt: Date): Promise<void>;
+    revokeByUserAndClient(userId: string, clientId: string, revokedAt: Date): Promise<void>;
+    revokeIfActive(id: string, revokedAt: Date): Promise<boolean>;
+    deleteExpired(now: Date): Promise<number>;
+}

package/dist/prisma-oauth-refresh-token.repository.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaOAuthRefreshTokenRepository = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_prisma_1 = require("@nathapp/nestjs-prisma");
+const nestjs_data_1 = require("@nathapp/nestjs-data");
+const oauth_prisma_types_1 = require("./oauth-prisma.types");
+let PrismaOAuthRefreshTokenRepository = class PrismaOAuthRefreshTokenRepository extends nestjs_prisma_1.AbstractPrismaRepository {
+    constructor(tx) { super(tx); }
+    modelDelegate(client) {
+        return (0, oauth_prisma_types_1.getOAuthPrismaDelegate)(client, 'oAuthRefreshToken');
+    }
+    get oauthModel() {
+        return this.modelDelegate(this.tx.getClient());
+    }
+    toDomain(e) {
+        var _a, _b, _c, _d, _e, _f;
+        return {
+            id: e.id,
+            tenantId: (_a = e.tenantId) !== null && _a !== void 0 ? _a : undefined,
+            tokenHash: e.tokenHash,
+            clientId: e.clientId,
+            userId: e.userId,
+            scope: (_b = e.scope) !== null && _b !== void 0 ? _b : undefined,
+            previousTokenHash: (_c = e.previousTokenHash) !== null && _c !== void 0 ? _c : undefined,
+            expiresAt: e.expiresAt,
+            revokedAt: (_d = e.revokedAt) !== null && _d !== void 0 ? _d : undefined,
+            cnf: e.cnfJkt ? { jkt: e.cnfJkt } : undefined,
+            lastUsedAt: (_e = e.lastUsedAt) !== null && _e !== void 0 ? _e : undefined,
+            resource: (_f = e.resource) !== null && _f !== void 0 ? _f : undefined,
+            createdAt: e.createdAt,
+        };
+    }
+    toPersistenceCreate(d) {
+        var _a, _b, _c, _d, _e, _f;
+        return {
+            id: d.id,
+            tenantId: (_a = d.tenantId) !== null && _a !== void 0 ? _a : null,
+            tokenHash: d.tokenHash,
+            clientId: d.clientId,
+            userId: d.userId,
+            scope: (_b = d.scope) !== null && _b !== void 0 ? _b : null,
+            previousTokenHash: (_c = d.previousTokenHash) !== null && _c !== void 0 ? _c : null,
+            expiresAt: d.expiresAt,
+            cnfJkt: (_e = (_d = d.cnf) === null || _d === void 0 ? void 0 : _d.jkt) !== null && _e !== void 0 ? _e : null,
+            resource: (_f = d.resource) !== null && _f !== void 0 ? _f : null,
+        };
+    }
+    toPersistenceUpdate(p) {
+        const out = {};
+        if (p.revokedAt !== undefined)
+            out.revokedAt = p.revokedAt;
+        if (p.lastUsedAt !== undefined)
+            out.lastUsedAt = p.lastUsedAt;
+        return out;
+    }
+    async findByTokenHash(tokenHash) {
+        const e = await this.oauthModel.findUnique({ where: { tokenHash } });
+        return e ? this.toDomain(e) : null;
+    }
+    async revoke(id, revokedAt) {
+        await this.model.update({ where: { id }, data: { revokedAt } });
+    }
+    async revokeByUserAndClient(userId, clientId, revokedAt) {
+        await this.oauthModel.updateMany({
+            where: { userId, clientId, revokedAt: null },
+            data: { revokedAt },
+        });
+    }
+    async revokeIfActive(id, revokedAt) {
+        const res = await this.oauthModel.updateMany({
+            where: { id, revokedAt: null },
+            data: { revokedAt },
+        });
+        return res.count === 1;
+    }
+    async deleteExpired(now) {
+        const res = await this.oauthModel.deleteMany({ where: { expiresAt: { lt: now } } });
+        return res.count;
+    }
+};
+exports.PrismaOAuthRefreshTokenRepository = PrismaOAuthRefreshTokenRepository;
+exports.PrismaOAuthRefreshTokenRepository = PrismaOAuthRefreshTokenRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(nestjs_data_1.TRANSACTION_MANAGER)),
+    __metadata("design:paramtypes", [Object])
+], PrismaOAuthRefreshTokenRepository);
+//# sourceMappingURL=prisma-oauth-refresh-token.repository.js.map

package/dist/prisma-oauth-refresh-token.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-oauth-refresh-token.repository.js","sourceRoot":"","sources":["../lib/prisma-oauth-refresh-token.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,0DAAyF;AACzF,sDAAgF;AAKhF,6DAAmH;AAG5G,IAAM,iCAAiC,GAAvC,MAAM,iCACX,SAAQ,wCAA0E;IAGlF,YAAyC,EAAuB,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAwB;QAC9C,OAAO,IAAA,2CAAsB,EAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAoB,CAAC,CAAC;IACnE,CAAC;IAES,QAAQ,CAAC,CAAuB;;QACxC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,SAAS;YACjC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,SAAS;YAC3B,iBAAiB,EAAE,MAAA,CAAC,CAAC,iBAAiB,mCAAI,SAAS;YACnD,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,MAAA,CAAC,CAAC,SAAS,mCAAI,SAAS;YACnC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS;YAC7C,UAAU,EAAE,MAAA,CAAC,CAAC,UAAU,mCAAI,SAAS;YACrC,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,SAAS;YACjC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAAqB;;QACjD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,IAAI;YAC5B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,MAAA,CAAC,CAAC,KAAK,mCAAI,IAAI;YACtB,iBAAiB,EAAE,MAAA,CAAC,CAAC,iBAAiB,mCAAI,IAAI;YAC9C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,MAAA,MAAA,CAAC,CAAC,GAAG,0CAAE,GAAG,mCAAI,IAAI;YAC1B,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAA8B;QAC1D,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC3D,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;YAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACrC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,SAAe;QACtC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAe;QAC3E,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;YAC5C,IAAI,EAAE,EAAE,SAAS,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,SAAe;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC9B,IAAI,EAAE,EAAE,SAAS,EAAE;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAS;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;CACF,CAAA;AAlFY,8EAAiC;4CAAjC,iCAAiC;IAD7C,IAAA,mBAAU,GAAE;IAKE,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;;GAJ7B,iCAAiC,CAkF7C"}

package/dist/prisma-oauth-scope.repository.d.ts

@@ -0,0 +1,25 @@
+import { AbstractPrismaRepository, type PrismaClientLike } from '@nathapp/nestjs-prisma';
+import { ITransactionManager } from '@nathapp/nestjs-data';
+import { type IOAuthScopeRepository, type IOAuthScope, OAuthScopeStatus } from '@nathapp/nestjs-oauth';
+import { type OAuthPrismaDelegate, type OAuthScopeRow } from './oauth-prisma.types';
+export declare class PrismaOAuthScopeRepository extends AbstractPrismaRepository<IOAuthScope, OAuthScopeRow, string> implements IOAuthScopeRepository {
+    constructor(tx: ITransactionManager);
+    protected modelDelegate(client: PrismaClientLike): OAuthPrismaDelegate<OAuthScopeRow>;
+    private get oauthModel();
+    private get clientScopeModel();
+    protected toDomain(e: OAuthScopeRow): IOAuthScope;
+    protected toPersistenceCreate(d: IOAuthScope): {
+        id: string;
+        code: string;
+        name: string;
+        description: string | null;
+        claims: string[];
+        isSystem: boolean;
+        status: OAuthScopeStatus;
+    };
+    protected toPersistenceUpdate(p: Partial<IOAuthScope>): Record<string, unknown>;
+    findByCode(code: string): Promise<IOAuthScope | null>;
+    findByCodes(codes: string[]): Promise<IOAuthScope[]>;
+    findClientScopeCodes(clientId: string): Promise<string[]>;
+    setClientScopes(clientId: string, scopeIds: string[]): Promise<void>;
+}

package/dist/prisma-oauth-scope.repository.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaOAuthScopeRepository = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_prisma_1 = require("@nathapp/nestjs-prisma");
+const nestjs_data_1 = require("@nathapp/nestjs-data");
+const oauth_prisma_types_1 = require("./oauth-prisma.types");
+let PrismaOAuthScopeRepository = class PrismaOAuthScopeRepository extends nestjs_prisma_1.AbstractPrismaRepository {
+    constructor(tx) { super(tx); }
+    modelDelegate(client) {
+        return (0, oauth_prisma_types_1.getOAuthPrismaDelegate)(client, 'oAuthScope');
+    }
+    get oauthModel() {
+        return this.modelDelegate(this.tx.getClient());
+    }
+    get clientScopeModel() {
+        return (0, oauth_prisma_types_1.getOAuthPrismaDelegate)(this.tx.getClient(), 'oAuthClientScope');
+    }
+    toDomain(e) {
+        var _a;
+        return {
+            id: e.id, code: e.code, name: e.name, description: (_a = e.description) !== null && _a !== void 0 ? _a : undefined,
+            claims: Array.isArray(e.claims) && e.claims.every((claim) => typeof claim === 'string')
+                ? e.claims : [],
+            isSystem: e.isSystem, status: e.status,
+            createdAt: e.createdAt, updatedAt: e.updatedAt,
+        };
+    }
+    toPersistenceCreate(d) {
+        var _a;
+        return {
+            id: d.id, code: d.code, name: d.name, description: (_a = d.description) !== null && _a !== void 0 ? _a : null,
+            claims: d.claims, isSystem: d.isSystem, status: d.status,
+        };
+    }
+    toPersistenceUpdate(p) {
+        const out = {};
+        if (p.name !== undefined)
+            out.name = p.name;
+        if (p.description !== undefined)
+            out.description = p.description;
+        if (p.claims !== undefined)
+            out.claims = p.claims;
+        if (p.status !== undefined)
+            out.status = p.status;
+        return out;
+    }
+    async findByCode(code) {
+        const e = await this.oauthModel.findUnique({ where: { code } });
+        return e ? this.toDomain(e) : null;
+    }
+    async findByCodes(codes) {
+        const rows = await this.oauthModel.findMany({ where: { code: { in: codes } } });
+        return rows.map((r) => this.toDomain(r));
+    }
+    async findClientScopeCodes(clientId) {
+        const rows = await this.clientScopeModel.findMany({ where: { clientId }, include: { scope: true } });
+        return rows.map((row) => row.scope.code);
+    }
+    async setClientScopes(clientId, scopeIds) {
+        await this.clientScopeModel.deleteMany({ where: { clientId } });
+        if (scopeIds.length) {
+            await this.clientScopeModel.createMany({
+                data: scopeIds.map((scopeId) => ({ clientId, scopeId })),
+            });
+        }
+    }
+};
+exports.PrismaOAuthScopeRepository = PrismaOAuthScopeRepository;
+exports.PrismaOAuthScopeRepository = PrismaOAuthScopeRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(nestjs_data_1.TRANSACTION_MANAGER)),
+    __metadata("design:paramtypes", [Object])
+], PrismaOAuthScopeRepository);
+//# sourceMappingURL=prisma-oauth-scope.repository.js.map

package/dist/prisma-oauth-scope.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-oauth-scope.repository.js","sourceRoot":"","sources":["../lib/prisma-oauth-scope.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,0DAAyF;AACzF,sDAAgF;AAEhF,6DAAsI;AAG/H,IAAM,0BAA0B,GAAhC,MAAM,0BACX,SAAQ,wCAA4D;IAGpE,YAAyC,EAAuB,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAwB;QAC9C,OAAO,IAAA,2CAAsB,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAoB,CAAC,CAAC;IACnE,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAA,2CAAsB,EAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAoB,EAAE,kBAAkB,CAAC,CAAC;IAC3F,CAAC;IAES,QAAQ,CAAC,CAAgB;;QACjC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,MAAA,CAAC,CAAC,WAAW,mCAAI,SAAS;YAC7E,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;gBACtG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAA0B;YAC1D,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAAc;;QAC1C,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,MAAA,CAAC,CAAC,WAAW,mCAAI,IAAI;YACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;SACzD,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAAuB;QACnD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC5C,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS;YAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;QACjE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAClD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAe;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACrG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAkB;QACxD,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;gBACrC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF,CAAA;AAnEY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;IAKE,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;;GAJ7B,0BAA0B,CAmEtC"}

package/dist/prisma-oauth-signing-key.repository.d.ts

@@ -0,0 +1,24 @@
+import { AbstractPrismaRepository, type PrismaClientLike } from '@nathapp/nestjs-prisma';
+import { ITransactionManager } from '@nathapp/nestjs-data';
+import { type IOAuthSigningKeyRepository, type IOAuthSigningKey, type IOAuthSigningKeyPublic, type SigningKeyStatus } from '@nathapp/nestjs-oauth';
+import { type OAuthPrismaDelegate, type OAuthSigningKeyRow } from './oauth-prisma.types';
+export declare class PrismaOAuthSigningKeyRepository extends AbstractPrismaRepository<IOAuthSigningKey, OAuthSigningKeyRow, string> implements IOAuthSigningKeyRepository {
+    constructor(tx: ITransactionManager);
+    protected modelDelegate(client: PrismaClientLike): OAuthPrismaDelegate<OAuthSigningKeyRow>;
+    private get oauthModel();
+    protected toDomain(e: OAuthSigningKeyRow): IOAuthSigningKey;
+    protected toPersistenceCreate(d: IOAuthSigningKey): {
+        id: string;
+        kid: string;
+        alg: string;
+        privateKeyPem: string;
+        publicKeyPem: string;
+        status: SigningKeyStatus;
+        expiresAt: Date | null;
+        tenantId: string | null;
+    };
+    protected toPersistenceUpdate(p: Partial<IOAuthSigningKey>): Record<string, unknown>;
+    findActive(tenantId?: string | null): Promise<IOAuthSigningKey | null>;
+    findByStatusIn(statuses: SigningKeyStatus[], tenantId?: string | null): Promise<IOAuthSigningKeyPublic[]>;
+    setStatus(id: string, status: SigningKeyStatus, expiresAt?: Date): Promise<void>;
+}

package/dist/prisma-oauth-signing-key.repository.js

@@ -0,0 +1,110 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaOAuthSigningKeyRepository = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_prisma_1 = require("@nathapp/nestjs-prisma");
+const nestjs_data_1 = require("@nathapp/nestjs-data");
+const oauth_prisma_types_1 = require("./oauth-prisma.types");
+let PrismaOAuthSigningKeyRepository = class PrismaOAuthSigningKeyRepository extends nestjs_prisma_1.AbstractPrismaRepository {
+    constructor(tx) { super(tx); }
+    modelDelegate(client) {
+        return (0, oauth_prisma_types_1.getOAuthPrismaDelegate)(client, 'oAuthSigningKey');
+    }
+    get oauthModel() {
+        return this.modelDelegate(this.tx.getClient());
+    }
+    toDomain(e) {
+        var _a, _b;
+        return {
+            id: e.id,
+            kid: e.kid,
+            alg: e.alg,
+            privateKeyPem: e.privateKeyPem,
+            publicKeyPem: e.publicKeyPem,
+            status: e.status,
+            createdAt: e.createdAt,
+            expiresAt: (_a = e.expiresAt) !== null && _a !== void 0 ? _a : undefined,
+            tenantId: (_b = e.tenantId) !== null && _b !== void 0 ? _b : undefined,
+        };
+    }
+    toPersistenceCreate(d) {
+        var _a, _b;
+        return {
+            id: d.id,
+            kid: d.kid,
+            alg: d.alg,
+            privateKeyPem: d.privateKeyPem,
+            publicKeyPem: d.publicKeyPem,
+            status: d.status,
+            expiresAt: (_a = d.expiresAt) !== null && _a !== void 0 ? _a : null,
+            tenantId: (_b = d.tenantId) !== null && _b !== void 0 ? _b : null,
+        };
+    }
+    toPersistenceUpdate(p) {
+        const out = {};
+        if (p.status !== undefined)
+            out.status = p.status;
+        if (p.expiresAt !== undefined)
+            out.expiresAt = p.expiresAt;
+        return out;
+    }
+    async findActive(tenantId) {
+        const where = { status: 'active' };
+        if (tenantId !== undefined) {
+            where.tenantId = tenantId;
+        }
+        const e = await this.model.findFirst({ where });
+        return e ? this.toDomain(e) : null;
+    }
+    async findByStatusIn(statuses, tenantId) {
+        const now = new Date();
+        const where = {
+            status: { in: statuses },
+            OR: [{ expiresAt: null }, { expiresAt: { gt: now } }],
+        };
+        if (tenantId !== undefined) {
+            where.tenantId = tenantId;
+        }
+        const rows = await this.oauthModel.findMany({
+            where,
+            select: { id: true, kid: true, alg: true, publicKeyPem: true, status: true, createdAt: true, expiresAt: true },
+        });
+        return rows.map((r) => {
+            var _a;
+            return ({
+                id: r.id,
+                kid: r.kid,
+                alg: r.alg,
+                publicKeyPem: r.publicKeyPem,
+                status: r.status,
+                createdAt: r.createdAt,
+                expiresAt: (_a = r.expiresAt) !== null && _a !== void 0 ? _a : undefined,
+            });
+        });
+    }
+    async setStatus(id, status, expiresAt) {
+        await this.model.update({
+            where: { id },
+            data: { status, ...(expiresAt !== undefined ? { expiresAt } : {}) },
+        });
+    }
+};
+exports.PrismaOAuthSigningKeyRepository = PrismaOAuthSigningKeyRepository;
+exports.PrismaOAuthSigningKeyRepository = PrismaOAuthSigningKeyRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(nestjs_data_1.TRANSACTION_MANAGER)),
+    __metadata("design:paramtypes", [Object])
+], PrismaOAuthSigningKeyRepository);
+//# sourceMappingURL=prisma-oauth-signing-key.repository.js.map

package/dist/prisma-oauth-signing-key.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-oauth-signing-key.repository.js","sourceRoot":"","sources":["../lib/prisma-oauth-signing-key.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,0DAAyF;AACzF,sDAAgF;AAOhF,6DAAiH;AAG1G,IAAM,+BAA+B,GAArC,MAAM,+BACX,SAAQ,wCAAsE;IAG9E,YAAyC,EAAuB,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtE,aAAa,CAAC,MAAwB;QAC9C,OAAO,IAAA,2CAAsB,EAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,IAAY,UAAU;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAoB,CAAC,CAAC;IACnE,CAAC;IAES,QAAQ,CAAC,CAAqB;;QACtC,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,MAAM,EAAE,CAAC,CAAC,MAA0B;YACpC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,MAAA,CAAC,CAAC,SAAS,mCAAI,SAAS;YACnC,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,SAAS;SAClC,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAAmB;;QAC/C,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,MAAA,CAAC,CAAC,SAAS,mCAAI,IAAI;YAC9B,QAAQ,EAAE,MAAA,CAAC,CAAC,QAAQ,mCAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAES,mBAAmB,CAAC,CAA4B;QACxD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAClD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC3D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAAwB;QACvC,MAAM,KAAK,GAA4B,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAGD,KAAK,CAAC,cAAc,CAAC,QAA4B,EAAE,QAAwB;QACzE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAA4B;YACrC,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE;YACxB,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;SACtD,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAyG;YAClJ,KAAK;YACL,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SAC/G,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAA0B,EAAE;;YAAC,OAAA,CAAC;gBAC9C,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAA0B;gBACpC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,MAAA,CAAC,CAAC,SAAS,mCAAI,SAAS;aACpC,CAAC,CAAA;SAAA,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAwB,EAAE,SAAgB;QACpE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAxFY,0EAA+B;0CAA/B,+BAA+B;IAD3C,IAAA,mBAAU,GAAE;IAKE,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;;GAJ7B,+BAA+B,CAwF3C"}

package/dist/prisma-signing-key.provider.d.ts

@@ -0,0 +1,22 @@
+import { Logger } from "@nestjs/common";
+import { IClock, IIdGenerator } from "@nathapp/nestjs-common";
+import { ITransactionManager } from "@nathapp/nestjs-data";
+import { type IOAuthSigningKeyRepository, type IOAuthSigningKey, type ISigningKeyProvider, type ActiveSigningKey, type Jwk } from "@nathapp/nestjs-oauth";
+export declare class PrismaSigningKeyProvider implements ISigningKeyProvider {
+    protected readonly repo: IOAuthSigningKeyRepository;
+    protected readonly txManager: ITransactionManager;
+    protected readonly idGenerator: IIdGenerator;
+    protected readonly clock: IClock;
+    protected readonly logger: Logger;
+    constructor(repo: IOAuthSigningKeyRepository, txManager: ITransactionManager, idGenerator: IIdGenerator, clock: IClock);
+    getActiveSigningKey(tenantId?: string | null): Promise<ActiveSigningKey>;
+    getVerificationKeys(tenantId?: string | null): Promise<Jwk[]>;
+    rotate(tenantId?: string | null): Promise<void>;
+    protected generateAndPersist(status: "active", tenantId: string | null): Promise<IOAuthSigningKey>;
+    protected encryptPrivateKey(pem: string): Promise<string>;
+    protected decryptPrivateKey(encrypted: string): Promise<string>;
+    protected generateKid(): string;
+    private generateInitialActiveKey;
+    private rotateOrReuseConcurrentWinner;
+    protected toJwk(publicKeyPem: string, kid: string, alg: string): Jwk;
+}

package/dist/prisma-signing-key.provider.js

@@ -0,0 +1,133 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PrismaSigningKeyProvider_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaSigningKeyProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const common_1 = require("@nestjs/common");
+const nestjs_common_1 = require("@nathapp/nestjs-common");
+const nestjs_data_1 = require("@nathapp/nestjs-data");
+const generateKeyPairAsync = (0, node_util_1.promisify)(node_crypto_1.generateKeyPair);
+const nestjs_oauth_1 = require("@nathapp/nestjs-oauth");
+const ALG = "RS256";
+const MODULUS_LENGTH = 2048;
+const RETIRING_GRACE_MS = 1000 * 60 * 60 * 24 * 7;
+let PrismaSigningKeyProvider = PrismaSigningKeyProvider_1 = class PrismaSigningKeyProvider {
+    constructor(repo, txManager, idGenerator, clock) {
+        this.repo = repo;
+        this.txManager = txManager;
+        this.idGenerator = idGenerator;
+        this.clock = clock;
+        this.logger = new common_1.Logger(PrismaSigningKeyProvider_1.name);
+    }
+    async getActiveSigningKey(tenantId) {
+        const actualTenantId = tenantId !== null && tenantId !== void 0 ? tenantId : null;
+        const existing = await this.repo.findActive(actualTenantId);
+        const key = existing !== null && existing !== void 0 ? existing : (await this.generateInitialActiveKey(actualTenantId));
+        const privateKeyPem = await this.decryptPrivateKey(key.privateKeyPem);
+        return { kid: key.kid, alg: key.alg, privateKeyPem };
+    }
+    async getVerificationKeys(tenantId) {
+        const actualTenantId = tenantId !== null && tenantId !== void 0 ? tenantId : null;
+        const keys = await this.repo.findByStatusIn(["active", "retiring"], actualTenantId);
+        return keys.map((k) => this.toJwk(k.publicKeyPem, k.kid, k.alg));
+    }
+    async rotate(tenantId) {
+        const actualTenantId = tenantId !== null && tenantId !== void 0 ? tenantId : null;
+        const next = await this.rotateOrReuseConcurrentWinner(actualTenantId);
+        this.logger.log(`Signing key rotated. New active kid=${next.kid}`);
+    }
+    async generateAndPersist(status, tenantId) {
+        const { privateKey, publicKey } = await generateKeyPairAsync("rsa", {
+            modulusLength: MODULUS_LENGTH,
+            publicKeyEncoding: { type: "spki", format: "pem" },
+            privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        });
+        const keyToStore = await this.encryptPrivateKey(privateKey);
+        const entity = {
+            id: this.idGenerator.generate(),
+            kid: this.generateKid(),
+            alg: ALG,
+            privateKeyPem: keyToStore,
+            publicKeyPem: publicKey,
+            status,
+            createdAt: this.clock.now(),
+            tenantId,
+        };
+        return this.repo.create(entity);
+    }
+    async encryptPrivateKey(pem) {
+        if (process.env.NODE_ENV === 'production' && !process.env.OAUTH_ALLOW_PLAINTEXT_SIGNING_KEYS) {
+            throw new Error('Plaintext RSA private key storage is not allowed in production. ' +
+                'Override encryptPrivateKey()/decryptPrivateKey() or set OAUTH_ALLOW_PLAINTEXT_SIGNING_KEYS=true to opt out.');
+        }
+        return pem;
+    }
+    async decryptPrivateKey(encrypted) {
+        if (encrypted.startsWith('-----BEGIN') &&
+            process.env.NODE_ENV === 'production' &&
+            !process.env.OAUTH_ALLOW_PLAINTEXT_SIGNING_KEYS) {
+            throw new Error('Detected plaintext PEM private key in production database. ' +
+                'Override decryptPrivateKey() with KMS-backed decryption, or set OAUTH_ALLOW_PLAINTEXT_SIGNING_KEYS=true to opt out (insecure).');
+        }
+        return encrypted;
+    }
+    generateKid() {
+        return (0, node_crypto_1.randomBytes)(16).toString("hex");
+    }
+    async generateInitialActiveKey(tenantId) {
+        try {
+            return await this.generateAndPersist("active", tenantId);
+        }
+        catch (error) {
+            const winner = await this.repo.findActive(tenantId);
+            if (winner)
+                return winner;
+            throw error;
+        }
+    }
+    async rotateOrReuseConcurrentWinner(tenantId) {
+        return this.txManager.run(async () => {
+            const previous = await this.repo.findActive(tenantId);
+            if (previous) {
+                const expiresAt = new Date(this.clock.now().getTime() + RETIRING_GRACE_MS);
+                await this.repo.setStatus(previous.id, "retiring", expiresAt);
+            }
+            try {
+                return await this.generateAndPersist("active", tenantId);
+            }
+            catch (error) {
+                const winner = await this.repo.findActive(tenantId);
+                if (winner)
+                    return winner;
+                throw error;
+            }
+        });
+    }
+    toJwk(publicKeyPem, kid, alg) {
+        const jwk = (0, node_crypto_1.createPublicKey)(publicKeyPem).export({ format: "jwk" });
+        return { kty: jwk.kty, use: "sig", alg, kid, n: jwk.n, e: jwk.e };
+    }
+};
+exports.PrismaSigningKeyProvider = PrismaSigningKeyProvider;
+exports.PrismaSigningKeyProvider = PrismaSigningKeyProvider = PrismaSigningKeyProvider_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(nestjs_oauth_1.OAUTH_SIGNING_KEY_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(nestjs_data_1.TRANSACTION_MANAGER)),
+    __param(2, (0, common_1.Inject)(nestjs_common_1.ID_GENERATOR)),
+    __param(3, (0, common_1.Inject)(nestjs_common_1.CLOCK)),
+    __metadata("design:paramtypes", [Function, Object, Object, Object])
+], PrismaSigningKeyProvider);
+//# sourceMappingURL=prisma-signing-key.provider.js.map

package/dist/prisma-signing-key.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-signing-key.provider.js","sourceRoot":"","sources":["../lib/prisma-signing-key.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAIqB;AACrB,yCAAsC;AACtC,2CAA4D;AAC5D,0DAAmF;AACnF,sDAAgF;AAEhF,MAAM,oBAAoB,GAAG,IAAA,qBAAS,EAAC,6BAAe,CAAC,CAAC;AACxD,wDAO+B;AAE/B,MAAM,GAAG,GAAG,OAAO,CAAC;AACpB,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAiB3C,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAEE,IAAmD,EAEnD,SAAiD,EAEjD,WAA4C,EAE5C,KAAgC;QANb,SAAI,GAAJ,IAAI,CAA4B;QAEhC,cAAS,GAAT,SAAS,CAAqB;QAE9B,gBAAW,GAAX,WAAW,CAAc;QAEzB,UAAK,GAAL,KAAK,CAAQ;QAVf,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAWnE,CAAC;IAEJ,KAAK,CAAC,mBAAmB,CAAC,QAAwB;QAChD,MAAM,cAAc,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACtE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAwB;QAChD,MAAM,cAAc,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAwB;QACnC,MAAM,cAAc,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAIS,KAAK,CAAC,kBAAkB,CAChC,MAAgB,EAChB,QAAuB;QAEvB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE;YAClE,aAAa,EAAE,cAAc;YAC7B,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;YAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;SACrD,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAqB;YAC/B,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE;YACvB,GAAG,EAAE,GAAG;YACR,aAAa,EAAE,UAAU;YACzB,YAAY,EAAE,SAAS;YACvB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3B,QAAQ;SACT,CAAC;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IASS,KAAK,CAAC,iBAAiB,CAAC,GAAW;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAClE,6GAA6G,CAC9G,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAMS,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACjD,IACE,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YACrC,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC7D,gIAAgI,CACjI,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,WAAW;QACnB,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,QAAuB;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,6BAA6B,CAAC,QAAuB;QACjE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACtD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,iBAAiB,CAAC,CAAC;gBAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACpD,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,YAAoB,EAAE,GAAW,EAAE,GAAW;QAC5D,MAAM,GAAG,GAAG,IAAA,6BAAe,EAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAIjE,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;CACF,CAAA;AArIY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,2CAA4B,CAAC,CAAA;IAEpC,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,eAAM,EAAC,4BAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,eAAM,EAAC,qBAAK,CAAC,CAAA;;GAVL,wBAAwB,CAqIpC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@nathapp/nestjs-oauth-prisma",
+  "version": "1.0.0",
+  "description": "Prisma adapter for @nathapp/nestjs-oauth",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "rimraf dist && tsc -p tsconfig.json",
+    "clean": "rimraf dist/ .turbo/",
+    "lint": "eslint -c .eslintrc.js --ext .ts .",
+    "lint:fix": "eslint -c .eslintrc.js --ext .ts . --fix",
+    "test": "jest --config ./test/jest-test.json --forceExit --no-colors --silent",
+    "test:json": "jest --config ./test/jest-test.json --json --no-colors --silent",
+    "test:verbose": "jest --config ./test/jest-test.json",
+    "test:cov": "jest --config ./test/jest-test.json --coverage",
+    "type-check": "tsc --noEmit -p tsconfig.json"
+  },
+  "author": "",
+  "license": "ISC",
+  "engines": {
+    "node": "^20.19.0 || >=22.12.0"
+  },
+  "directories": {
+    "lib": "lib"
+  },
+  "files": [
+    "dist",
+    "prisma"
+  ],
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0 || ^12.1.0",
+    "@nestjs/core": "^11.0.0 || ^12.1.0",
+    "@nathapp/nestjs-prisma": "^3.3.0 || ^4.0.2"
+  },
+  "dependencies": {
+    "@nathapp/nestjs-oauth": "1.0.0",
+    "@nathapp/nestjs-data": "^3.3.0 || ^4.0.2",
+    "@nathapp/nestjs-common": "^3.3.0 || ^4.0.2"
+  },
+  "devDependencies": {
+    "@nathapp/nestjs-prisma": "^4.0.2",
+    "eslint": "^8.57.0",
+    "typescript": "^5"
+  }
+}

package/prisma/migrations/20260608_oauth_signing_keys_one_active/migration.mysql.sql

@@ -0,0 +1,8 @@
+-- MySQL equivalent of migration.sql. MySQL has no partial indexes; a functional
+-- unique index (MySQL 8.0.13+) that is NULL for every non-active row allows at most
+-- one active signing key (NULLs never collide).
+-- Preflight: MySQL never enforced this invariant, so existing data may violate it.
+-- If this returns more than 1, retire all but one active key before creating the index:
+--   SELECT COUNT(*) FROM oauth_signing_keys WHERE status = 'active';
+CREATE UNIQUE INDEX oauth_signing_keys_one_active
+  ON oauth_signing_keys ((CASE WHEN status = 'active' THEN 1 ELSE NULL END));

package/prisma/migrations/20260608_oauth_signing_keys_one_active/migration.sql

@@ -0,0 +1,3 @@
+CREATE UNIQUE INDEX IF NOT EXISTS oauth_signing_keys_one_active
+ON oauth_signing_keys (status)
+WHERE status = 'active';