@nolag/core 0.4.0

package/dist/modules/authzModule/authz.service.js

@@ -0,0 +1,654 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthzService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const clientToken_1 = require("../../utils/clientToken");
+const accessScope_entity_1 = require("../accessScopeModule/accessScope.entity");
+const actorAppAccess_entity_1 = require("../actorTokenModule/actorAppAccess.entity");
+const actorToken_entity_1 = require("../actorTokenModule/actorToken.entity");
+const actorToken_facade_1 = require("../actorTokenModule/actorToken.facade");
+const actorTokenState_entity_1 = require("../actorTokenModule/actorTokenState.entity");
+const EAccessPermission_enum_1 = require("../actorTokenModule/enum/EAccessPermission.enum");
+const EActorTokenStatus_enum_1 = require("../actorTokenModule/enum/EActorTokenStatus.enum");
+const EActorType_enum_1 = require("../actorTokenModule/enum/EActorType.enum");
+const core_config_1 = require("../../core.config");
+const lobby_entity_1 = require("../lobbyModule/lobby.entity");
+const lobbyRoom_entity_1 = require("../lobbyModule/lobbyRoom.entity");
+const platformApp_entity_1 = require("../platformAppModule/platformApp.entity");
+const EAppAccessMode_enum_1 = require("../platformAppModule/enum/EAppAccessMode.enum");
+const EAppStatus_enum_1 = require("../platformAppModule/enum/EAppStatus.enum");
+const project_entity_1 = require("../projectModule/project.entity");
+const ERoomStatus_enum_1 = require("../roomModule/enum/ERoomStatus.enum");
+const room_entity_1 = require("../roomModule/room.entity");
+const roomActorAccess_entity_1 = require("../roomModule/roomActorAccess.entity");
+const signingKey_facade_1 = require("../signingKeyModule/signingKey.facade");
+let AuthzService = AuthzService_1 = class AuthzService {
+    _dataSource;
+    _actorTokenFacade;
+    _signingKeyFacade;
+    _config;
+    _logger = new common_1.Logger(AuthzService_1.name);
+    constructor(_dataSource, _actorTokenFacade, _signingKeyFacade, _config) {
+        this._dataSource = _dataSource;
+        this._actorTokenFacade = _actorTokenFacade;
+        this._signingKeyFacade = _signingKeyFacade;
+        this._config = _config;
+    }
+    async validateActor(accessToken) {
+        if ((0, clientToken_1.isClientTokenJwt)(accessToken)) {
+            return this._validateClientToken(accessToken);
+        }
+        const actorToken = await this._actorTokenFacade.authenticateActorToken(accessToken);
+        if (!actorToken) {
+            return { valid: false, error: "token_invalid" };
+        }
+        if (actorToken.status !== EActorTokenStatus_enum_1.EActorTokenStatus.Active) {
+            return { valid: false, error: "token_suspended" };
+        }
+        if (actorToken.expiresAt && new Date(actorToken.expiresAt) < new Date()) {
+            return { valid: false, error: "token_expired" };
+        }
+        const payload = await this._buildSessionPayload(actorToken);
+        if (!payload) {
+            return { valid: false, error: "project_not_found" };
+        }
+        return { valid: true, ...payload };
+    }
+    async _validateClientToken(token) {
+        const deny = {
+            valid: false,
+            error: "token_invalid",
+        };
+        const verified = await this._signingKeyFacade.verifyClientToken(token);
+        if (!verified) {
+            return deny;
+        }
+        const actorToken = await this._actorTokenFacade.getActiveActorByKeyId(verified.payload.sub);
+        if (!actorToken) {
+            this._logger.warn("Client token rejected: actor not found or inactive", {
+                sub: verified.payload.sub,
+                kid: verified.signingKey.keyId,
+            });
+            return deny;
+        }
+        if (actorToken.projectId !== verified.signingKey.projectId) {
+            this._logger.warn("Client token rejected: signing key project does not match actor project", {
+                kid: verified.signingKey.keyId,
+                signingKeyProjectId: verified.signingKey.projectId,
+                actorProjectId: actorToken.projectId,
+            });
+            return deny;
+        }
+        const payload = await this._buildSessionPayload(actorToken);
+        if (!payload) {
+            return { valid: false, error: "project_not_found" };
+        }
+        return { valid: true, ...payload, authExpiresAt: verified.payload.exp };
+    }
+    async revalidateActor(actorTokenId) {
+        const actorToken = await this._dataSource.manager.findOne(actorToken_entity_1.ActorTokenEntity, {
+            where: { actorTokenId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!actorToken) {
+            this._logger.warn("revalidateActor: token not found", { actorTokenId });
+            return {
+                valid: false,
+                error: "token_not_found",
+                disconnectReason: "token_not_found",
+            };
+        }
+        if (actorToken.status !== EActorTokenStatus_enum_1.EActorTokenStatus.Active) {
+            this._logger.warn("revalidateActor: token not active", {
+                actorTokenId,
+                status: actorToken.status,
+            });
+            return {
+                valid: false,
+                error: "token_suspended",
+                disconnectReason: "token_revoked",
+            };
+        }
+        if (actorToken.expiresAt && new Date(actorToken.expiresAt) < new Date()) {
+            this._logger.warn("revalidateActor: token expired", { actorTokenId });
+            return {
+                valid: false,
+                error: "token_expired",
+                disconnectReason: "token_expired",
+            };
+        }
+        const payload = await this._buildSessionPayload(actorToken);
+        if (!payload) {
+            return {
+                valid: false,
+                error: "project_not_found",
+                disconnectReason: "project_not_found",
+            };
+        }
+        return { valid: true, ...payload };
+    }
+    async _buildSessionPayload(actorToken) {
+        const project = await this._dataSource.manager.findOne(project_entity_1.ProjectEntity, {
+            where: { projectId: actorToken.projectId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!project) {
+            return null;
+        }
+        const scope = await this._resolveScope(actorToken);
+        const { apps } = await this._buildAppAccess(actorToken, scope.scopeId, scope.scopeSlug);
+        const limits = this._resolveLimits(project);
+        const persistentSession = EActorType_enum_1.PERSISTENT_SESSION_ACTOR_TYPES.includes(actorToken.actorType);
+        return {
+            actorTokenId: actorToken.actorTokenId,
+            organizationId: project.organizationId,
+            projectId: actorToken.projectId,
+            projectName: project.name,
+            actorType: actorToken.actorType,
+            scopeId: scope.scopeId,
+            scopeSlug: scope.scopeSlug,
+            scopeName: scope.scopeName,
+            apps,
+            maxConnections: limits.maxConnections,
+            maxMessageSizeBytes: limits.maxMessageSizeBytes,
+            sessionExpirySeconds: persistentSession ? limits.sessionExpirySeconds : 0,
+            persistentSession,
+        };
+    }
+    async _resolveScope(actorToken) {
+        if (!actorToken.accessScopeId) {
+            return {};
+        }
+        const scope = await this._dataSource.manager.findOne(accessScope_entity_1.AccessScopeEntity, {
+            where: { accessScopeId: actorToken.accessScopeId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!scope || !scope.isActive) {
+            return {};
+        }
+        return {
+            scopeId: scope.accessScopeId,
+            scopeSlug: scope.slug,
+            scopeName: scope.name,
+        };
+    }
+    _resolveLimits(project) {
+        if (!project.limitsSyncedAt) {
+            return {
+                maxConnections: this._config.defaultMaxConnections,
+                maxMessageSizeBytes: this._config.defaultMaxMessageSizeBytes,
+                sessionExpirySeconds: this._config.defaultSessionExpirySeconds,
+            };
+        }
+        return {
+            maxConnections: project.maxConnections === 0
+                ? this._config.defaultMaxConnections
+                : project.maxConnections,
+            maxMessageSizeBytes: project.maxMessageSizeBytes === 0
+                ? this._config.defaultMaxMessageSizeBytes
+                : project.maxMessageSizeBytes,
+            sessionExpirySeconds: project.sessionExpirySeconds && project.sessionExpirySeconds > 0
+                ? project.sessionExpirySeconds
+                : this._config.defaultSessionExpirySeconds,
+        };
+    }
+    async checkRoomAccess(actorTokenId, pattern) {
+        const deny = { allow: false, allowedTopics: [] };
+        const actorToken = await this._dataSource.manager.findOne(actorToken_entity_1.ActorTokenEntity, {
+            where: { actorTokenId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!actorToken || actorToken.status !== EActorTokenStatus_enum_1.EActorTokenStatus.Active) {
+            return deny;
+        }
+        if (actorToken.expiresAt && new Date(actorToken.expiresAt) < new Date()) {
+            return deny;
+        }
+        const scope = await this._resolveScope(actorToken);
+        const parts = pattern.split("/");
+        let appSlug;
+        let roomSlug;
+        if (parts.length === 4) {
+            if (!scope.scopeSlug || parts[1] !== scope.scopeSlug)
+                return deny;
+            appSlug = parts[0];
+            roomSlug = parts[2];
+        }
+        else if (parts.length === 3) {
+            appSlug = parts[0];
+            roomSlug = parts[1];
+        }
+        else {
+            return deny;
+        }
+        const app = await this._dataSource.manager.findOne(platformApp_entity_1.PlatformAppEntity, {
+            where: {
+                slug: appSlug,
+                projectId: actorToken.projectId,
+                status: EAppStatus_enum_1.EAppStatus.Active,
+                deletedAt: (0, typeorm_2.IsNull)(),
+            },
+        });
+        if (!app)
+            return deny;
+        let appPermission;
+        let appAccessTopics;
+        if (app.accessMode === EAppAccessMode_enum_1.EAppAccessMode.Open) {
+            appPermission = EAccessPermission_enum_1.EAccessPermission.PubSub;
+            appAccessTopics = null;
+        }
+        else {
+            const appAccess = await this._dataSource.manager.findOne(actorAppAccess_entity_1.ActorAppAccessEntity, {
+                where: {
+                    actorTokenId,
+                    appId: app.appId,
+                    isActive: true,
+                    deletedAt: (0, typeorm_2.IsNull)(),
+                },
+            });
+            if (!appAccess)
+                return deny;
+            if (appAccess.expiresAt && new Date(appAccess.expiresAt) < new Date()) {
+                return deny;
+            }
+            appPermission = appAccess.permission;
+            appAccessTopics = appAccess.topics ?? null;
+        }
+        const room = await this._dataSource.manager.findOne(room_entity_1.RoomEntity, {
+            where: {
+                slug: roomSlug,
+                appId: app.appId,
+                status: ERoomStatus_enum_1.ERoomStatus.Active,
+                deletedAt: (0, typeorm_2.IsNull)(),
+            },
+        });
+        if (!room)
+            return deny;
+        const roomAccessEntries = await this._dataSource.manager.find(roomActorAccess_entity_1.RoomActorAccessEntity, { where: { roomId: room.roomId, deletedAt: (0, typeorm_2.IsNull)() } });
+        let permission;
+        let topics;
+        if (roomAccessEntries.length === 0) {
+            permission = appPermission;
+            topics = appAccessTopics ?? app.topics ?? null;
+        }
+        else {
+            const grant = roomAccessEntries.find((ra) => ra.actorTokenId === actorTokenId && ra.isActive) ??
+                roomAccessEntries.find((ra) => !ra.actorTokenId &&
+                    ra.actorType === actorToken.actorType &&
+                    ra.isActive);
+            if (!grant)
+                return deny;
+            if (grant.expiresAt && new Date(grant.expiresAt) < new Date()) {
+                return deny;
+            }
+            permission = grant.permission;
+            topics = grant.topics ?? app.topics ?? null;
+        }
+        const topicsToAdd = topics ?? [];
+        if (topicsToAdd.length === 0)
+            return deny;
+        return {
+            allow: true,
+            appId: app.appId,
+            allowedTopics: topicsToAdd.map((topicName) => this._buildAllowedTopic({
+                appSlug: app.slug,
+                room,
+                topicName,
+                permission,
+                scope,
+            })),
+        };
+    }
+    _buildAllowedTopic(args) {
+        const { appSlug, room, topicName, permission, scope } = args;
+        return {
+            pattern: scope.scopeSlug
+                ? `${appSlug}/${scope.scopeSlug}/${room.slug}/${topicName}`
+                : `${appSlug}/${room.slug}/${topicName}`,
+            topic: scope.scopeId
+                ? `${scope.scopeId}/${room.roomId}/${topicName}`
+                : `${room.roomId}/${topicName}`,
+            permission,
+            roomId: room.roomId,
+            roomSlug: room.slug,
+            scopeId: scope.scopeId,
+            scopeSlug: scope.scopeSlug,
+        };
+    }
+    async _buildAppAccess(actorToken, scopeId, scopeSlug) {
+        const scope = { scopeId, scopeSlug };
+        const actorAppAccess = await this._dataSource.manager.find(actorAppAccess_entity_1.ActorAppAccessEntity, {
+            where: {
+                actorTokenId: actorToken.actorTokenId,
+                isActive: true,
+                deletedAt: (0, typeorm_2.IsNull)(),
+            },
+            relations: ["app"],
+        });
+        const validAppAccess = actorAppAccess.filter((access) => {
+            if (!access.app || access.app.status !== EAppStatus_enum_1.EAppStatus.Active)
+                return false;
+            if (access.expiresAt && new Date(access.expiresAt) < new Date()) {
+                return false;
+            }
+            return true;
+        });
+        const explicitAppIds = new Set(validAppAccess.map((access) => access.app.appId));
+        const openApps = await this._dataSource.manager.find(platformApp_entity_1.PlatformAppEntity, {
+            where: {
+                projectId: actorToken.projectId,
+                accessMode: EAppAccessMode_enum_1.EAppAccessMode.Open,
+                status: EAppStatus_enum_1.EAppStatus.Active,
+                deletedAt: (0, typeorm_2.IsNull)(),
+            },
+        });
+        for (const app of openApps) {
+            if (!explicitAppIds.has(app.appId)) {
+                const synthetic = new actorAppAccess_entity_1.ActorAppAccessEntity();
+                synthetic.actorTokenId = actorToken.actorTokenId;
+                synthetic.appId = app.appId;
+                synthetic.permission = EAccessPermission_enum_1.EAccessPermission.PubSub;
+                synthetic.topics = null;
+                synthetic.isActive = true;
+                synthetic.expiresAt = null;
+                synthetic.app = app;
+                validAppAccess.push(synthetic);
+            }
+        }
+        if (validAppAccess.length === 0) {
+            return { apps: [] };
+        }
+        const appIds = validAppAccess.map((access) => access.app.appId);
+        const allRooms = await this._dataSource.manager.find(room_entity_1.RoomEntity, {
+            where: {
+                appId: (0, typeorm_2.In)(appIds),
+                status: ERoomStatus_enum_1.ERoomStatus.Active,
+                deletedAt: (0, typeorm_2.IsNull)(),
+            },
+        });
+        const roomIds = allRooms.map((r) => r.roomId);
+        const allRoomActorAccess = roomIds.length
+            ? await this._dataSource.manager.find(roomActorAccess_entity_1.RoomActorAccessEntity, {
+                where: { roomId: (0, typeorm_2.In)(roomIds), deletedAt: (0, typeorm_2.IsNull)() },
+            })
+            : [];
+        const roomAccessByRoomId = new Map();
+        const actorAccessByRoomId = new Map();
+        for (const ra of allRoomActorAccess) {
+            const forRoom = roomAccessByRoomId.get(ra.roomId);
+            if (forRoom) {
+                forRoom.push(ra);
+            }
+            else {
+                roomAccessByRoomId.set(ra.roomId, [ra]);
+            }
+        }
+        for (const ra of allRoomActorAccess) {
+            if (ra.actorTokenId === actorToken.actorTokenId && ra.isActive) {
+                actorAccessByRoomId.set(ra.roomId, ra);
+            }
+        }
+        for (const ra of allRoomActorAccess) {
+            if (!ra.actorTokenId &&
+                ra.actorType === actorToken.actorType &&
+                ra.isActive &&
+                !actorAccessByRoomId.has(ra.roomId)) {
+                actorAccessByRoomId.set(ra.roomId, ra);
+            }
+        }
+        const roomsByAppId = new Map();
+        for (const room of allRooms) {
+            const forApp = roomsByAppId.get(room.appId);
+            if (forApp) {
+                forApp.push(room);
+            }
+            else {
+                roomsByAppId.set(room.appId, [room]);
+            }
+        }
+        const appsMap = new Map();
+        for (const access of validAppAccess) {
+            const app = access.app;
+            const build = {
+                appId: app.appId,
+                appName: app.name,
+                appSlug: app.slug,
+                hydrationWebhook: app.hydrationWebhook ?? null,
+                triggerWebhook: app.triggerWebhook ?? null,
+                topicWebhooks: this._buildTopicWebhooksMap(app.topicConfigs),
+                allowedTopics: [],
+                allowedLobbies: [],
+                accessibleRoomIds: [],
+            };
+            appsMap.set(app.appId, build);
+            for (const room of roomsByAppId.get(app.appId) ?? []) {
+                const roomAccessEntries = roomAccessByRoomId.get(room.roomId);
+                const isPrivate = !!roomAccessEntries?.length;
+                let permission;
+                let topics;
+                if (!isPrivate) {
+                    permission = access.permission;
+                    topics = access.topics ?? app.topics ?? null;
+                }
+                else {
+                    const grant = actorAccessByRoomId.get(room.roomId);
+                    if (!grant)
+                        continue;
+                    if (grant.expiresAt && new Date(grant.expiresAt) < new Date()) {
+                        continue;
+                    }
+                    permission = grant.permission;
+                    topics = grant.topics ?? app.topics ?? null;
+                }
+                build.accessibleRoomIds.push(room.roomId);
+                for (const topicName of topics ?? []) {
+                    build.allowedTopics.push(this._buildAllowedTopic({
+                        appSlug: app.slug,
+                        room,
+                        topicName,
+                        permission,
+                        scope,
+                    }));
+                }
+            }
+        }
+        await this._attachLobbies(appsMap);
+        const subscriptionsByApp = await this._getActiveSubscriptionsGroupedByApp(actorToken.actorTokenId, appsMap);
+        const apps = [];
+        for (const [appId, build] of appsMap) {
+            apps.push({
+                appId: build.appId,
+                appName: build.appName,
+                appSlug: build.appSlug,
+                allowedTopics: build.allowedTopics,
+                allowedLobbies: build.allowedLobbies,
+                activeSubscriptions: subscriptionsByApp.get(appId) ?? [],
+                hydrationWebhook: build.hydrationWebhook,
+                triggerWebhook: build.triggerWebhook,
+                topicWebhooks: build.topicWebhooks,
+            });
+        }
+        return { apps };
+    }
+    async _attachLobbies(appsMap) {
+        const allAccessibleRoomIds = [...appsMap.values()].flatMap((a) => a.accessibleRoomIds);
+        if (allAccessibleRoomIds.length === 0)
+            return;
+        const lobbyRoomEntries = await this._dataSource.manager.find(lobbyRoom_entity_1.LobbyRoomEntity, { where: { roomId: (0, typeorm_2.In)(allAccessibleRoomIds), deletedAt: (0, typeorm_2.IsNull)() } });
+        if (lobbyRoomEntries.length === 0)
+            return;
+        const lobbyIds = [...new Set(lobbyRoomEntries.map((lr) => lr.lobbyId))];
+        const lobbies = await this._dataSource.manager.find(lobby_entity_1.LobbyEntity, {
+            where: { lobbyId: (0, typeorm_2.In)(lobbyIds), deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        const lobbyById = new Map(lobbies.map((l) => [l.lobbyId, l]));
+        const lobbyIdsPerApp = new Map();
+        for (const lr of lobbyRoomEntries) {
+            const lobby = lobbyById.get(lr.lobbyId);
+            if (!lobby)
+                continue;
+            const set = lobbyIdsPerApp.get(lobby.appId);
+            if (set) {
+                set.add(lr.lobbyId);
+            }
+            else {
+                lobbyIdsPerApp.set(lobby.appId, new Set([lr.lobbyId]));
+            }
+        }
+        for (const [appId, build] of appsMap) {
+            for (const lobbyId of lobbyIdsPerApp.get(appId) ?? []) {
+                const lobby = lobbyById.get(lobbyId);
+                if (lobby) {
+                    build.allowedLobbies.push({
+                        lobbyId: lobby.lobbyId,
+                        lobbySlug: lobby.slug,
+                    });
+                }
+            }
+        }
+    }
+    _buildTopicWebhooksMap(topicConfigs) {
+        if (!topicConfigs)
+            return {};
+        const result = {};
+        for (const [topicName, config] of Object.entries(topicConfigs)) {
+            const onPublish = config?.webhooks?.onPublish;
+            const onSubscribe = config?.webhooks?.onSubscribe;
+            if (!onPublish && !onSubscribe)
+                continue;
+            result[topicName] = {};
+            if (onPublish)
+                result[topicName].on_publish = onPublish;
+            if (onSubscribe)
+                result[topicName].on_subscribe = onSubscribe;
+        }
+        return result;
+    }
+    async _getActiveSubscriptionsGroupedByApp(actorTokenId, appsMap) {
+        const result = new Map();
+        const state = await this._dataSource.manager.findOne(actorTokenState_entity_1.ActorTokenStateEntity, {
+            where: { actorTokenId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        const recorded = state?.connectionState?.topics;
+        if (!recorded?.length) {
+            return result;
+        }
+        const patternLookup = new Map();
+        for (const build of appsMap.values()) {
+            for (const allowed of build.allowedTopics) {
+                patternLookup.set(allowed.pattern, {
+                    appId: build.appId,
+                    topic: allowed.topic,
+                });
+            }
+        }
+        for (const sub of recorded) {
+            const lookup = patternLookup.get(sub.name);
+            if (!lookup)
+                continue;
+            const forApp = result.get(lookup.appId);
+            const entry = {
+                pattern: sub.name,
+                topic: lookup.topic,
+                loadBalance: sub.loadBalance,
+                loadBalanceGroup: sub.loadBalanceGroup,
+                filters: sub.filters,
+            };
+            if (forApp) {
+                forApp.push(entry);
+            }
+            else {
+                result.set(lookup.appId, [entry]);
+            }
+        }
+        return result;
+    }
+    async updateSubscription(actorTokenId, topic, action, manager, loadBalance, loadBalanceGroup, filters) {
+        let state = await manager
+            .createQueryBuilder(actorTokenState_entity_1.ActorTokenStateEntity, "state")
+            .where("state.actor_token_id = :actorTokenId", { actorTokenId })
+            .andWhere("state.deleted_at IS NULL")
+            .setLock("pessimistic_write")
+            .getOne();
+        if (!state) {
+            state = new actorTokenState_entity_1.ActorTokenStateEntity();
+            state.actorTokenId = actorTokenId;
+            state.connectionState = { topics: [] };
+        }
+        if (!state.connectionState) {
+            state.connectionState = { topics: [] };
+        }
+        if (!state.connectionState.topics) {
+            state.connectionState.topics = [];
+        }
+        if (action === "subscribe") {
+            const subscription = {
+                name: topic,
+                loadBalance: loadBalance ?? false,
+                loadBalanceGroup: loadBalance ? loadBalanceGroup : undefined,
+                ...(filters?.length ? { filters } : {}),
+            };
+            const existingIndex = state.connectionState.topics.findIndex((t) => t.name === topic);
+            if (existingIndex === -1) {
+                state.connectionState.topics.push(subscription);
+            }
+            else {
+                state.connectionState.topics[existingIndex] = subscription;
+            }
+        }
+        else {
+            state.connectionState.topics = state.connectionState.topics.filter((t) => t.name !== topic);
+        }
+        state.lastActivityAt = new Date();
+        await manager.save(actorTokenState_entity_1.ActorTokenStateEntity, state);
+    }
+    async clearSubscriptions(actorTokenId) {
+        const state = await this._dataSource.manager.findOne(actorTokenState_entity_1.ActorTokenStateEntity, {
+            where: { actorTokenId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (state) {
+            state.connectionState = { topics: [] };
+            state.lastActivityAt = new Date();
+            await this._dataSource.manager.save(actorTokenState_entity_1.ActorTokenStateEntity, state);
+        }
+    }
+    async getActorScope(actorTokenId) {
+        const actorToken = await this._dataSource.manager.findOne(actorToken_entity_1.ActorTokenEntity, {
+            where: { actorTokenId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!actorToken)
+            return null;
+        const project = await this._dataSource.manager.findOne(project_entity_1.ProjectEntity, {
+            where: { projectId: actorToken.projectId, deletedAt: (0, typeorm_2.IsNull)() },
+        });
+        if (!project)
+            return null;
+        return {
+            organizationId: project.organizationId,
+            projectId: actorToken.projectId,
+        };
+    }
+    static isPersistentActorType(actorType) {
+        return EActorType_enum_1.PERSISTENT_SESSION_ACTOR_TYPES.includes(actorType);
+    }
+};
+exports.AuthzService = AuthzService;
+exports.AuthzService = AuthzService = AuthzService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectDataSource)()),
+    __metadata("design:paramtypes", [typeorm_2.DataSource,
+        actorToken_facade_1.ActorTokenFacade,
+        signingKey_facade_1.SigningKeyFacade,
+        core_config_1.CoreConfig])
+], AuthzService);