@ofidj/node 3.6.23 → 3.6.25

package/sdk/Interfaces.js

@@ -8,4 +8,4 @@ var LoggerLevelEnum;
     LoggerLevelEnum[LoggerLevelEnum["ERROR"] = 3] = "ERROR";
     LoggerLevelEnum[LoggerLevelEnum["NONE"] = 4] = "NONE";
 })(LoggerLevelEnum || (exports.LoggerLevelEnum = LoggerLevelEnum = {}));
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiSW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZGsvSW50ZXJmYWNlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFrRUEsSUFBWSxlQUtYO0FBTEQsV0FBWSxlQUFlO0lBQ3ZCLHFEQUFRLENBQUE7SUFDUixxREFBUSxDQUFBO0lBQ1IsdURBQVMsQ0FBQTtJQUNULHFEQUFRLENBQUE7QUFDWixDQUFDLEVBTFcsZUFBZSwrQkFBZixlQUFlLFFBSzFCIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiSW50ZXJmYWNlcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZGsvSW50ZXJmYWNlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFvRUEsSUFBWSxlQUtYO0FBTEQsV0FBWSxlQUFlO0lBQ3ZCLHFEQUFRLENBQUE7SUFDUixxREFBUSxDQUFBO0lBQ1IsdURBQVMsQ0FBQTtJQUNULHFEQUFRLENBQUE7QUFDWixDQUFDLEVBTFcsZUFBZSwrQkFBZixlQUFlLFFBSzFCIn0=

package/server/verifyAppSession.d.ts

@@ -0,0 +1,27 @@
+export declare class SessionVerificationError extends Error {
+    status: 401 | 503;
+    constructor(status: 401 | 503, message: string);
+}
+export interface VerifiedAppSession {
+    subject: string;
+    username: string;
+    appId: string;
+    roles: string[];
+}
+export declare function verifyAppSession(token: string, options: {
+    appId: string;
+    apiEndpoint: string;
+}): Promise<VerifiedAppSession>;
+export declare function verifyOrganizationSession(token: string, options: {
+    appId: string;
+    apiEndpoint: string;
+    organizationId: string;
+    permission?: string;
+}): Promise<{
+    organizationId: string;
+    permissions: string[];
+    subject: string;
+    username: string;
+    appId: string;
+    roles: string[];
+}>;

package/server/verifyAppSession.js

@@ -0,0 +1,106 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionVerificationError = void 0;
+exports.verifyAppSession = verifyAppSession;
+exports.verifyOrganizationSession = verifyOrganizationSession;
+const Base64_1 = require("../tools/Base64");
+class SessionVerificationError extends Error {
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'SessionVerificationError';
+    }
+}
+exports.SessionVerificationError = SessionVerificationError;
+// Call on the server for each protected operation. Fidj verifies the token and
+// stored session; role assignments are read live rather than trusted from the JWT.
+function verifyAppSession(token, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        let payload;
+        try {
+            if (!token || token.length > 16384) {
+                throw new Error();
+            }
+            if (token.split('.').length !== 3) {
+                payload = null;
+            }
+            else {
+                const encoded = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/');
+                payload = JSON.parse(Base64_1.Base64.decode(encoded.padEnd(Math.ceil(encoded.length / 4) * 4, '=')));
+                if (payload.aud !== options.appId ||
+                    typeof payload.sub !== 'string' ||
+                    typeof payload.name !== 'string') {
+                    throw new Error();
+                }
+            }
+        }
+        catch (_a) {
+            throw new SessionVerificationError(401, 'Sign in to this app.');
+        }
+        let response;
+        try {
+            response = yield fetch(`${options.apiEndpoint.replace(/\/$/, '')}/apps/${encodeURIComponent(options.appId)}/me`, {
+                headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+                signal: AbortSignal.timeout(5000),
+                redirect: 'error',
+            });
+        }
+        catch (_b) {
+            throw new SessionVerificationError(503, 'Identity service unavailable. Please retry.');
+        }
+        if ([401, 403, 404].includes(response.status)) {
+            throw new SessionVerificationError(401, 'Session expired or revoked. Sign in again.');
+        }
+        if (!response.ok) {
+            throw new SessionVerificationError(503, 'Identity service unavailable. Please retry.');
+        }
+        let result;
+        try {
+            result = yield response.json();
+            if (!Array.isArray(result.roles) ||
+                result.roles.some((role) => typeof role.type !== 'string')) {
+                throw new Error();
+            }
+        }
+        catch (_c) {
+            throw new SessionVerificationError(503, 'Invalid identity-service response.');
+        }
+        if (!payload && (typeof result.subject !== 'string' || result.appId !== options.appId))
+            throw new SessionVerificationError(401, 'App session scope mismatch.');
+        return {
+            subject: (payload === null || payload === void 0 ? void 0 : payload.sub) || result.subject,
+            username: (payload === null || payload === void 0 ? void 0 : payload.name) || result.username,
+            appId: options.appId,
+            roles: result.roles.map((role) => role.type),
+        };
+    });
+}
+function verifyOrganizationSession(token, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const session = yield verifyAppSession(token, options);
+        let response;
+        try {
+            response = yield fetch(`${options.apiEndpoint.replace(/\/$/, '')}/apps/${encodeURIComponent(options.appId)}/organizations/${encodeURIComponent(options.organizationId)}`, { headers: { Authorization: `Bearer ${token}` }, redirect: 'error', signal: AbortSignal.timeout(5000) });
+        }
+        catch (_c) {
+            throw new SessionVerificationError(503, 'Identity service unavailable.');
+        }
+        if (!response.ok)
+            throw new SessionVerificationError(response.status >= 500 ? 503 : 401, 'Organization access denied.');
+        const result = yield response.json();
+        if (((_a = result.organization) === null || _a === void 0 ? void 0 : _a.id) !== options.organizationId || !Array.isArray((_b = result.access) === null || _b === void 0 ? void 0 : _b.permissions) || (options.permission && !result.access.permissions.includes(options.permission)))
+            throw new SessionVerificationError(401, 'Organization permission denied.');
+        return Object.assign(Object.assign({}, session), { organizationId: options.organizationId, permissions: result.access.permissions });
+    });
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyaWZ5QXBwU2Vzc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZXJ2ZXIvdmVyaWZ5QXBwU2Vzc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7QUFzQkEsNENBNkRDO0FBRUQsOERBUUM7QUE3RkQsNENBQXVDO0FBR3ZDLE1BQWEsd0JBQXlCLFNBQVEsS0FBSztJQUMvQyxZQUNXLE1BQWlCLEVBQ3hCLE9BQWU7UUFFZixLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFIUixXQUFNLEdBQU4sTUFBTSxDQUFXO1FBSXhCLElBQUksQ0FBQyxJQUFJLEdBQUcsMEJBQTBCLENBQUM7SUFDM0MsQ0FBQztDQUNKO0FBUkQsNERBUUM7QUFTRCwrRUFBK0U7QUFDL0UsbUZBQW1GO0FBQ25GLFNBQXNCLGdCQUFnQixDQUNsQyxLQUFhLEVBQ2IsT0FBNkM7O1FBRTdDLElBQUksT0FBWSxDQUFDO1FBQ2pCLElBQUksQ0FBQztZQUNELElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxLQUFLLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ3RCLENBQUM7WUFDRCxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUFBLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFBQSxDQUFDO2lCQUFNLENBQUM7Z0JBQzNELE1BQU0sT0FBTyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMxRSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxlQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQzVGLElBQ0ksT0FBTyxDQUFDLEdBQUcsS0FBSyxPQUFPLENBQUMsS0FBSztvQkFDN0IsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7b0JBQy9CLE9BQU8sT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLEVBQ2xDLENBQUM7b0JBQ0MsTUFBTSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUN0QixDQUFDO1lBQ0QsQ0FBQztRQUNMLENBQUM7UUFBQyxXQUFNLENBQUM7WUFDTCxNQUFNLElBQUksd0JBQXdCLENBQUMsR0FBRyxFQUFFLHNCQUFzQixDQUFDLENBQUM7UUFDcEUsQ0FBQztRQUNELElBQUksUUFBa0IsQ0FBQztRQUN2QixJQUFJLENBQUM7WUFDRCxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQ2xCLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxTQUFTLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUN4RjtnQkFDSSxPQUFPLEVBQUUsRUFBQyxhQUFhLEVBQUUsVUFBVSxLQUFLLEVBQUUsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUM7Z0JBQ3ZFLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztnQkFDakMsUUFBUSxFQUFFLE9BQU87YUFDcEIsQ0FDSixDQUFDO1FBQ04sQ0FBQztRQUFDLFdBQU0sQ0FBQztZQUNMLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLEVBQUUsNkNBQTZDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLEVBQUUsNENBQTRDLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLEVBQUUsNkNBQTZDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxNQUFvQyxDQUFDO1FBQ3pDLElBQUksQ0FBQztZQUNELE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUMvQixJQUNJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDO2dCQUM1QixNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxFQUM1RCxDQUFDO2dCQUNDLE1BQU0sSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUN0QixDQUFDO1FBQ0wsQ0FBQztRQUFDLFdBQU0sQ0FBQztZQUNMLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLEVBQUUsb0NBQW9DLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLE9BQVEsTUFBYyxDQUFDLE9BQU8sS0FBSyxRQUFRLElBQUssTUFBYyxDQUFDLEtBQUssS0FBSyxPQUFPLENBQUMsS0FBSyxDQUFDO1lBQUUsTUFBTSxJQUFJLHdCQUF3QixDQUFDLEdBQUcsRUFBRSw2QkFBNkIsQ0FBQyxDQUFDO1FBQ2pMLE9BQU87WUFDSCxPQUFPLEVBQUUsQ0FBQSxPQUFPLGFBQVAsT0FBTyx1QkFBUCxPQUFPLENBQUUsR0FBRyxLQUFLLE1BQWMsQ0FBQyxPQUFPO1lBQ2hELFFBQVEsRUFBRSxDQUFBLE9BQU8sYUFBUCxPQUFPLHVCQUFQLE9BQU8sQ0FBRSxJQUFJLEtBQUssTUFBYyxDQUFDLFFBQVE7WUFDbkQsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLO1lBQ3BCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztTQUMvQyxDQUFDO0lBQ04sQ0FBQztDQUFBO0FBRUQsU0FBc0IseUJBQXlCLENBQUMsS0FBYSxFQUFFLE9BQTBGOzs7UUFDckosTUFBTSxPQUFPLEdBQUcsTUFBTSxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDdkQsSUFBSSxRQUFrQixDQUFDO1FBQ3ZCLElBQUksQ0FBQztZQUFBLFFBQVEsR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsU0FBUyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLGtCQUFrQixrQkFBa0IsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsRUFBRSxFQUFDLE9BQU8sRUFBRSxFQUFDLGFBQWEsRUFBRSxVQUFVLEtBQUssRUFBRSxFQUFDLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBQyxDQUFDLENBQUM7UUFBQSxDQUFDO1FBQUMsV0FBTSxDQUFDO1lBQUEsTUFBTSxJQUFJLHdCQUF3QixDQUFDLEdBQUcsRUFBRSwrQkFBK0IsQ0FBQyxDQUFDO1FBQUEsQ0FBQztRQUN2VyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUU7WUFBRSxNQUFNLElBQUksd0JBQXdCLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLDZCQUE2QixDQUFDLENBQUM7UUFDeEgsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDckMsSUFBSSxDQUFBLE1BQUEsTUFBTSxDQUFDLFlBQVksMENBQUUsRUFBRSxNQUFLLE9BQU8sQ0FBQyxjQUFjLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQUEsTUFBTSxDQUFDLE1BQU0sMENBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUFFLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxHQUFHLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztRQUNwUSx1Q0FBVyxPQUFPLEtBQUUsY0FBYyxFQUFFLE9BQU8sQ0FBQyxjQUFjLEVBQUUsV0FBVyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBdUIsSUFBRTtJQUNwSCxDQUFDO0NBQUEifQ==