@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/auth-guard-h9QB_l11.mjs

@@ -0,0 +1,125 @@
+import { c as isConfigurationError, l as isInfrastructureError, n as BetterAuthConfigurationError, s as isAuthFailure, t as AuthFailures } from "./auth-errors-C3rbTV9p.mjs";
+import { f as GUARD_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate } from "./decorate-Dt0e9K6R.mjs";
+import { Inject, Injectable } from "@nestjs/common";
+//#region src/auth-guard.ts
+let BetterAuthGuard = class BetterAuthGuard {
+	core;
+	static [AUTH_ENHANCER] = "guard";
+	[AUTH_ENHANCER] = "guard";
+	constructor(core) {
+		this.core = core;
+	}
+	canActivate(context) {
+		return this.core.canActivate(context);
+	}
+};
+BetterAuthGuard = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(GUARD_CORE)),
+	__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthGuard);
+var GuardCore = class {
+	instances;
+	planner;
+	transports;
+	resolver;
+	evaluator;
+	scope;
+	readings;
+	constructor(instances, planner, transports, resolver, evaluator, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.resolver = resolver;
+		this.evaluator = evaluator;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	async canActivate(context) {
+		let transport;
+		let call;
+		let plan;
+		try {
+			plan = this.planner.forContext(context);
+			if (plan.access === "inherit") {
+				transport = this.transports.find(context);
+				const lineage = transport?.lineage?.(context);
+				if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {
+					call = this.transports.describe(context, transport);
+					throw BetterAuthConfigurationError.atRequest("NO_ENCLOSING_DECISION", "An inherited invocation has no enclosing guard decision", { site: plan.site });
+				}
+				if (plan.originCheck !== "form") return true;
+			}
+			if (plan.access === "public" && plan.originCheck !== "form") {
+				const lineage = this.transports.find(context)?.lineage?.(context);
+				if (lineage && !plan.nested) this.readings.recordLineage(lineage, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			transport = this.transports.select(context);
+			call = this.transports.describe(context, transport);
+			const entry = this.instances.get(plan.instance);
+			if (plan.originCheck !== "off") {
+				const browser = call.browser;
+				if (browser) {
+					if (plan.originCheck === "form" || browser.enforce) {
+						const failure = await entry.origin.check(browser, plan.originCheck);
+						if (failure) throw failure;
+					} else await entry.origin.advisory(browser);
+				}
+			}
+			if (plan.access === "inherit") return true;
+			if (plan.access === "public") {
+				if (!plan.nested) this.readings.record(call, {
+					outcome: "no-identity",
+					instance: plan.instance
+				});
+				return true;
+			}
+			const result = await this.resolver.resolve(call, {
+				auth: entry.handle,
+				freshness: plan.freshness,
+				accepts: plan.accepts,
+				sourceSet: plan.sourceSet
+			});
+			this.readings.record(call, {
+				...result,
+				instance: plan.instance
+			});
+			if (result.outcome === "rejected") throw result.failure;
+			if (result.outcome === "absent") {
+				if (plan.access === "optional") return true;
+				throw AuthFailures.unauthenticated();
+			}
+			if (!plan.accepts.has(result.principal.kind)) throw AuthFailures.forbidden("PRINCIPAL_NOT_SUPPORTED");
+			const decision = await this.evaluator.evaluate(plan, result.principal, call, entry, context, transport.id);
+			if (decision.effect === "deny") throw AuthFailures.rejected({
+				status: decision.status ?? 403,
+				reason: decision.reason,
+				message: decision.message,
+				challenge: decision.challenge
+			});
+			return true;
+		} catch (error) {
+			if (isAuthFailure(error) && transport) {
+				const mapping = plan && this.instances.get(plan.instance).options.errors?.map;
+				throw mapping ? mapping(error, context, transport.id) : transport.toException(error, context);
+			}
+			if ((isConfigurationError(error) || isInfrastructureError(error)) && transport) {
+				const repeated = call ? this.scope.surfaced(call.key, error, {
+					instance: plan?.instance ?? "default",
+					site: plan?.site ?? "guard",
+					lineage: call.lineage
+				}) : false;
+				throw transport.toInternalException?.(error, context, { repeated }) ?? error;
+			}
+			throw error;
+		}
+	}
+};
+//#endregion
+export { GuardCore as n, BetterAuthGuard as t };
+
+//# sourceMappingURL=auth-guard-h9QB_l11.mjs.map

package/dist/auth-guard-h9QB_l11.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-guard-h9QB_l11.mjs","names":[],"sources":["../src/auth-guard.ts"],"sourcesContent":["import {\n  Inject,\n  Injectable,\n  type CanActivate,\n  type ExecutionContext,\n} from \"@nestjs/common\";\nimport type {\n  AuthTransport,\n  PrincipalResolver,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AuthFailures,\n  BetterAuthConfigurationError,\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { AUTH_ENHANCER, GUARD_CORE } from \"./auth-tokens.js\";\nimport type { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthGuard implements CanActivate {\n  static readonly [AUTH_ENHANCER] = \"guard\";\n  readonly [AUTH_ENHANCER] = \"guard\";\n\n  constructor(\n    @Inject(GUARD_CORE) private readonly core: Pick<GuardCore, \"canActivate\">,\n  ) {}\n\n  canActivate(context: ExecutionContext): Promise<boolean> {\n    return this.core.canActivate(context);\n  }\n}\nexport class GuardCore implements CanActivate {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly resolver: PrincipalResolver,\n    private readonly evaluator: AuthorizationEvaluator,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    let transport: AuthTransport | undefined;\n    let call: TransportCall | undefined;\n    let plan: RoutePlan | undefined;\n    try {\n      plan = this.planner.forContext(context);\n      if (plan.access === \"inherit\") {\n        transport = this.transports.find(context);\n        const lineage = transport?.lineage?.(context);\n        if (lineage && !this.readings.enclosing(lineage, context.getArgs())) {\n          call = this.transports.describe(context, transport);\n          throw BetterAuthConfigurationError.atRequest(\n            \"NO_ENCLOSING_DECISION\",\n            \"An inherited invocation has no enclosing guard decision\",\n            { site: plan.site },\n          );\n        }\n        if (plan.originCheck !== \"form\") {\n          return true;\n        }\n      }\n      if (plan.access === \"public\" && plan.originCheck !== \"form\") {\n        const lineage = this.transports.find(context)?.lineage?.(context);\n        if (lineage && !plan.nested) {\n          this.readings.recordLineage(lineage, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      transport = this.transports.select(context);\n      call = this.transports.describe(context, transport);\n      const entry = this.instances.get(plan.instance);\n      if (plan.originCheck !== \"off\") {\n        const browser = call.browser;\n        if (browser) {\n          if (plan.originCheck === \"form\" || browser.enforce) {\n            const failure = await entry.origin.check(browser, plan.originCheck);\n            if (failure) {\n              throw failure;\n            }\n          } else {\n            await entry.origin.advisory(browser);\n          }\n        }\n      }\n      if (plan.access === \"inherit\") {\n        return true;\n      }\n      if (plan.access === \"public\") {\n        if (!plan.nested) {\n          this.readings.record(call, {\n            outcome: \"no-identity\",\n            instance: plan.instance,\n          });\n        }\n        return true;\n      }\n      const result = await this.resolver.resolve(call, {\n        auth: entry.handle,\n        freshness: plan.freshness,\n        accepts: plan.accepts,\n        sourceSet: plan.sourceSet,\n      });\n      this.readings.record(call, { ...result, instance: plan.instance });\n      if (result.outcome === \"rejected\") {\n        throw result.failure;\n      }\n      if (result.outcome === \"absent\") {\n        if (plan.access === \"optional\") {\n          return true;\n        }\n        throw AuthFailures.unauthenticated();\n      }\n      if (!plan.accepts.has(result.principal.kind)) {\n        throw AuthFailures.forbidden(\"PRINCIPAL_NOT_SUPPORTED\");\n      }\n      const decision = await this.evaluator.evaluate(\n        plan,\n        result.principal,\n        call,\n        entry,\n        context,\n        transport.id,\n      );\n      if (decision.effect === \"deny\") {\n        throw AuthFailures.rejected({\n          status: decision.status ?? 403,\n          reason: decision.reason,\n          message: decision.message,\n          challenge: decision.challenge,\n        });\n      }\n      return true;\n    } catch (error) {\n      if (isAuthFailure(error) && transport) {\n        const mapping =\n          plan && this.instances.get(plan.instance).options.errors?.map;\n        throw mapping\n          ? mapping(error, context, transport.id)\n          : transport.toException(error, context);\n      }\n      if (\n        (isConfigurationError(error) || isInfrastructureError(error)) &&\n        transport\n      ) {\n        const repeated = call\n          ? this.scope.surfaced(call.key, error, {\n              instance: plan?.instance ?? \"default\",\n              site: plan?.site ?? \"guard\",\n              lineage: call.lineage,\n            })\n          : false;\n        throw (\n          transport.toInternalException?.(error, context, { repeated }) ?? error\n        );\n      }\n      throw error;\n    }\n  }\n}\n"],"mappings":";;;;AA4BO,IAAM,kBAAN,MAAM,gBAAuC;CAKX;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,YAAY,SAA6C;EACvD,OAAO,KAAK,KAAK,YAAY,OAAO;CACtC;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAA8C;CAEzB;CACA;CACA;CACA;CACA;CACA;CACA;CAPnB,YACE,WACA,SACA,YACA,UACA,WACA,OACA,UACA;EAPiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,WAAA;EACA,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,IAAI;EACJ,IAAI;EACJ,IAAI;EACJ,IAAI;GACF,OAAO,KAAK,QAAQ,WAAW,OAAO;GACtC,IAAI,KAAK,WAAW,WAAW;IAC7B,YAAY,KAAK,WAAW,KAAK,OAAO;IACxC,MAAM,UAAU,WAAW,UAAU,OAAO;IAC5C,IAAI,WAAW,CAAC,KAAK,SAAS,UAAU,SAAS,QAAQ,QAAQ,CAAC,GAAG;KACnE,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;KAClD,MAAM,6BAA6B,UACjC,yBACA,2DACA,EAAE,MAAM,KAAK,KAAK,CACpB;IACF;IACA,IAAI,KAAK,gBAAgB,QACvB,OAAO;GAEX;GACA,IAAI,KAAK,WAAW,YAAY,KAAK,gBAAgB,QAAQ;IAC3D,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;IAChE,IAAI,WAAW,CAAC,KAAK,QACnB,KAAK,SAAS,cAAc,SAAS;KACnC,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,YAAY,KAAK,WAAW,OAAO,OAAO;GAC1C,OAAO,KAAK,WAAW,SAAS,SAAS,SAAS;GAClD,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;GAC9C,IAAI,KAAK,gBAAgB,OAAO;IAC9B,MAAM,UAAU,KAAK;IACrB,IAAI,SAAS;KACX,IAAI,KAAK,gBAAgB,UAAU,QAAQ,SAAS;MAClD,MAAM,UAAU,MAAM,MAAM,OAAO,MAAM,SAAS,KAAK,WAAW;MAClE,IAAI,SACF,MAAM;KAEV,OACE,MAAM,MAAM,OAAO,SAAS,OAAO;IAEvC;GACF;GACA,IAAI,KAAK,WAAW,WAClB,OAAO;GAET,IAAI,KAAK,WAAW,UAAU;IAC5B,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,OAAO,MAAM;KACzB,SAAS;KACT,UAAU,KAAK;IACjB,CAAC;IAEH,OAAO;GACT;GACA,MAAM,SAAS,MAAM,KAAK,SAAS,QAAQ,MAAM;IAC/C,MAAM,MAAM;IACZ,WAAW,KAAK;IAChB,SAAS,KAAK;IACd,WAAW,KAAK;GAClB,CAAC;GACD,KAAK,SAAS,OAAO,MAAM;IAAE,GAAG;IAAQ,UAAU,KAAK;GAAS,CAAC;GACjE,IAAI,OAAO,YAAY,YACrB,MAAM,OAAO;GAEf,IAAI,OAAO,YAAY,UAAU;IAC/B,IAAI,KAAK,WAAW,YAClB,OAAO;IAET,MAAM,aAAa,gBAAgB;GACrC;GACA,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,UAAU,IAAI,GACzC,MAAM,aAAa,UAAU,yBAAyB;GAExD,MAAM,WAAW,MAAM,KAAK,UAAU,SACpC,MACA,OAAO,WACP,MACA,OACA,SACA,UAAU,EACZ;GACA,IAAI,SAAS,WAAW,QACtB,MAAM,aAAa,SAAS;IAC1B,QAAQ,SAAS,UAAU;IAC3B,QAAQ,SAAS;IACjB,SAAS,SAAS;IAClB,WAAW,SAAS;GACtB,CAAC;GAEH,OAAO;EACT,SAAS,OAAO;GACd,IAAI,cAAc,KAAK,KAAK,WAAW;IACrC,MAAM,UACJ,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ,CAAC,CAAC,QAAQ,QAAQ;IAC5D,MAAM,UACF,QAAQ,OAAO,SAAS,UAAU,EAAE,IACpC,UAAU,YAAY,OAAO,OAAO;GAC1C;GACA,KACG,qBAAqB,KAAK,KAAK,sBAAsB,KAAK,MAC3D,WACA;IACA,MAAM,WAAW,OACb,KAAK,MAAM,SAAS,KAAK,KAAK,OAAO;KACnC,UAAU,MAAM,YAAY;KAC5B,MAAM,MAAM,QAAQ;KACpB,SAAS,KAAK;IAChB,CAAC,IACD;IACJ,MACE,UAAU,sBAAsB,OAAO,SAAS,EAAE,SAAS,CAAC,KAAK;GAErE;GACA,MAAM;EACR;CACF;AACF"}