@postxl/generators 0.2.2

package/dist/backend-authentication/generators/auth-guard.generator.js

@@ -0,0 +1,121 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAuthGuard = generateAuthGuard;
+const Generator = __importStar(require("@postxl/generator"));
+function generateAuthGuard(context) {
+    const imports = Generator.ImportGenerator.from(context.authentication.guard._filePath);
+    imports.add(context.view.service);
+    imports.add(context.actions.dispatcher);
+    imports.add(context.types.user);
+    imports.add({ name: context.authentication.service.name, location: context.authentication.service._filePath });
+    return /* ts */ `
+  import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'
+
+import { FastifyRequest } from 'fastify'
+
+${imports.generate()}
+
+import { UserInfo, UserRoles } from './authentication.types'
+
+export type Viewer = { userInfo: UserInfo; userRoles: UserRoles; user: User; isAuthorized: boolean }
+
+export type FastifyRequestWithViewer = FastifyRequest & { viewer: Viewer }
+@Injectable()
+export class ${context.authentication.guard.name} implements CanActivate {
+  constructor(
+    private readonly authService: ${context.authentication.service.name},
+    private readonly viewService: ${context.view.service.name},
+    private readonly dispatcherService: ${context.actions.dispatcher.name},
+  ) {}
+
+  public async canActivate(context: ExecutionContext): Promise<boolean> {
+    const http = context.switchToHttp()
+    const req = http.getRequest<FastifyRequestWithViewer>()
+
+    let viewer: Viewer | null = null
+
+    let userInfo: UserInfo | null = null
+    let userRoles: UserRoles = []
+
+    // TODO: Add authorization check
+    const isAuthorized = true
+
+    const associatedUserInfo = await this.authService.getUserInfoFromRequest(req)
+
+    if (associatedUserInfo.ok) {
+      userInfo = associatedUserInfo.userInfo
+    }
+
+    const associatedUserRoles = await this.authService.getUserRolesFromRequest(req)
+
+    if (associatedUserRoles.ok) {
+      userRoles = associatedUserRoles.userRoles
+    }
+
+    if (userInfo) {
+      let user = await this.viewService.users.data.getBySub(userInfo.sub)
+
+      if (!user) {
+        // If user doesn't exist yet, we create a new one using the data in viewer
+        // (i.e. provided by the authentication provider).
+        user = await this.dispatcherService.dispatch({
+          action: {
+            scope: 'user',
+            type: 'create',
+            payload: { sub: userInfo.sub, name: userInfo.name, email: userInfo.email, profilePictureUrl: null },
+          },
+          user: this.viewService.users.data.rootUser,
+        })
+
+        if (!user) {
+          throw new Error('Error creating new user!')
+        }
+      }
+
+      viewer = { userInfo, userRoles, user, isAuthorized }
+    }
+
+    if (!viewer) {
+      return false
+    }
+
+    req.viewer = viewer
+
+    return true
+  }
+}`;
+}
+//# sourceMappingURL=auth-guard.generator.js.map

package/dist/backend-authentication/generators/auth-guard.generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-guard.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/auth-guard.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,8CAmFC;AAvFD,6DAA8C;AAI9C,SAAgB,iBAAiB,CAAC,OAAsB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAEtF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9G,OAAO,QAAQ,CAAC;;;;;EAKhB,OAAO,CAAC,QAAQ,EAAE;;;;;;;;eAQL,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;;oCAEZ,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;oCACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;0CACnB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DvE,CAAA;AACF,CAAC"}

package/dist/backend-authentication/generators/authentication-module.generator.d.ts

@@ -0,0 +1,2 @@
+import { ContextResult } from '../authentication.generator';
+export declare function generateAuthenticationModule(context: ContextResult): string;

package/dist/backend-authentication/generators/authentication-module.generator.js

@@ -0,0 +1,79 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAuthenticationModule = generateAuthenticationModule;
+const Generator = __importStar(require("@postxl/generator"));
+function generateAuthenticationModule(context) {
+    const imports = Generator.ImportGenerator
+        //
+        .from(context.authentication.module._filePath)
+        .add({ name: context.authentication.service.name, location: context.authentication.service._filePath });
+    return /* ts */ `
+  import { DynamicModule, Provider } from '@nestjs/common'
+
+  ${imports.generate()}
+
+  import { MockAuthenticationService } from './authentication.mock.service'
+  import { AuthenticationController } from './authentication.controller'
+  import type { AuthenticationConfig } from './authentication.config'
+
+export class ${context.authentication.module.name} {
+  static forRoot(config: AuthenticationConfig): DynamicModule {
+    if (process.env.NODE_ENV === 'production' && !config.enableAuthentication) {
+      throw new Error('Authentication is disabled in production mode. Remove the env variable "AUTH=false"!')
+    }
+    
+    const serviceProvider: Provider =
+      config.enableAuthentication
+        ? {
+            provide: ${context.authentication.service.name},
+            useValue: new ${context.authentication.service.name}(config),
+          }
+        : {
+            provide: ${context.authentication.service.name},
+            useClass: MockAuthenticationService,
+          }        
+
+    return {
+      module: AuthenticationModule,
+      providers: [serviceProvider],
+      exports: [serviceProvider],
+      controllers: [AuthenticationController],
+      global: true,
+    }
+  }
+}`;
+}
+//# sourceMappingURL=authentication-module.generator.js.map

package/dist/backend-authentication/generators/authentication-module.generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-module.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-module.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,oEAyCC;AA7CD,6DAA8C;AAI9C,SAAgB,4BAA4B,CAAC,OAAsB;IACjE,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe;QACvC,EAAE;SACD,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;SAC7C,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEzG,OAAO,QAAQ,CAAC;;;IAGd,OAAO,CAAC,QAAQ,EAAE;;;;;;eAMP,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI;;;;;;;;;uBAS1B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;4BAC9B,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;;;uBAGxC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;;;;;;;;;;;;EAYxD,CAAA;AACF,CAAC"}

package/dist/backend-authentication/generators/authentication-service.generator.d.ts

@@ -0,0 +1,2 @@
+import { ContextResult } from '../authentication.generator';
+export declare function generateAuthenticationService(context: ContextResult): string;

package/dist/backend-authentication/generators/authentication-service.generator.js

@@ -0,0 +1,393 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAuthenticationService = generateAuthenticationService;
+function generateAuthenticationService(context) {
+    return /* ts */ `
+// We import Fastify cookie here to ensure that the cookie plugin and its types are registered.
+import '@fastify/cookie'
+
+import * as z from 'zod'
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common'
+
+import { FastifyRequest } from 'fastify'
+import jwt from 'jsonwebtoken'
+import { JwksClient } from 'jwks-rsa'
+import { OidcClient } from 'oidc-client-ts'
+
+import type { AuthenticationConfig_EnabledKeycloak } from './authentication.config'
+import { authenticationCookieName, UserInfo, UserRoles, zUserInfo, zUserRoles } from './authentication.types'
+import { unknownToErrorMessage } from './utils'
+
+/**
+ * State object for the authentication service.
+ */
+const zState = z.object({
+  redirectTo: z.string().optional(),
+})
+
+/**
+ * State object for the authentication service.
+ */
+export type State = z.infer<typeof zState>
+
+@Injectable()
+export class ${context.authentication.service.name} implements OnModuleInit {
+  private readonly logger = new Logger(${context.authentication.service.name}.name)
+
+  private readonly oidc: OidcClient
+
+  private readonly jwks: JwksClient
+
+  // collects subscriptions of users, with the key being the user's email and the value being the last check date
+  // this is used to cache the subscription check for a certain amount of time
+  private readonly subscriptions: Map<string, Date> = new Map()
+
+  private readonly _cookieDomain: string
+  public get cookieDomain(): string {
+    return this._cookieDomain
+  }
+
+  constructor(public readonly config: AuthenticationConfig_EnabledKeycloak) {
+    
+    this.oidc = new OidcClient({
+      authority: this.config.keycloakUrl.toString(),
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUrl.toString(),
+      client_authentication: 'client_secret_basic',
+      client_secret: this.config.clientSecret,
+      response_type: 'code',
+      // prettier-ignore
+      metadataUrl: \`\${this.config.keycloakUrl.toString()}/realms/\${this.config.realm}/.well-known/openid-configuration\`,
+    })
+
+    this.jwks = new JwksClient({
+      jwksUri: \`\${this.config.keycloakUrl.toString()}/realms/\${this.config.realm}/protocol/openid-connect/certs\`,
+      timeout: 30_000,
+    })
+
+    // Setting  cookie domain from the URL by removing the subdomain unless the URL
+    // is already a top-level domain.
+    // Background: The cookie domain shall match the server domain without subdomain so
+    //             that browser forwards the cookie to the server.
+    const parts = this.config.url.hostname.split('.')
+
+    if (parts.length > 2) {
+      this._cookieDomain = parts.slice(1).join('.')
+    } else {
+     this._cookieDomain = this.config.url.hostname
+    }  
+  }
+
+  public async onModuleInit() {
+    // Clear Keycloak stale state to check if Keycloak is running
+    try {
+      await this.oidc.clearStaleState()
+    } catch (error) {
+      this.logger.error('Error clearing stale state', error)
+    }
+  }
+
+  /**
+   * Refreshes the access token via the refresh token.
+   */
+  public async refreshAccessToken(req: FastifyRequest): Promise<
+    | {
+        ok: true
+        accessToken: string
+        idToken: string
+        refreshToken?: string
+        state: State | null
+      }
+    | {
+        ok: false
+        error: unknown
+      }
+  > {
+    const refreshToken = req.cookies[\`\${authenticationCookieName}-refresh\`]
+    if (!refreshToken) {
+      return { ok: false, error: new Error('No refresh token provided') }
+    }
+    const url = \`\${this.config.keycloakUrl.toString()}/realms/\${this.config.realm}/protocol/openid-connect/token\`
+    const params = new URLSearchParams({
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: this.config.clientId,
+      client_secret: this.config.clientSecret,
+    })
+    try {
+      const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: params.toString(),
+      })
+
+      if (!response.ok) {
+        return { ok: false, error: new Error(\`Failed to refresh access token: \${response.statusText}\`) }
+      }
+
+      const data = (await response.json()) as {
+        access_token: string
+        id_token: string
+        refresh_token?: string
+        state?: string
+      }
+
+      return {
+        ok: true,
+        accessToken: data.access_token,
+        idToken: data.id_token,
+        refreshToken: data.refresh_token,
+        state: null,
+      }
+    } catch (error) {
+      return { ok: false, error: error }
+    }
+  }
+
+  /**
+   * Extracts the code from URL and exchanges it for an access token.
+   */
+  public async getAccessTokenFromURL(url: string): Promise<
+    | {
+        ok: true
+        accessToken: string
+        refreshToken?: string
+        state: State | null
+      }
+    | {
+        ok: false
+        error: unknown
+      }
+  > {
+    try {
+      this.logger.log(\`Getting access token from URL \${url}\`)
+      const res = await this.oidc.processSigninResponse(url)
+      const state = this.decodeState(res.userState)
+
+      return { ok: true, accessToken: res.access_token, refreshToken: res.refresh_token, state }
+    } catch (error) {
+      return { ok: false, error: error }
+    }
+  }
+
+  /**
+   * Returns the URL that the user may use to perform authentication.
+   */
+  public async getAuthenticationUrl({ redirectTo }: { redirectTo?: string }): Promise<string> {
+    const request = await this.oidc.createSigninRequest({
+      scope: 'email profile openid',
+      state: this.encodeState({ redirectTo }),
+    })
+
+    return replaceDockerHost(request.url)
+  }
+
+  /**
+   * Obtains the user associated with the request.
+   */
+  public async getUserInfoFromRequest(req: FastifyRequest): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
+    const accessToken = this.getAccessTokenFromRequest(req)
+
+    if (!accessToken) {
+      return { ok: false }
+    }
+
+    const info = await this.getUserInfo(accessToken)
+
+    return info
+  }
+
+  /**
+   * Extracts access token from request headers
+   */
+  private getAccessTokenFromRequest(req: FastifyRequest): string | undefined {
+    const bearer = req.cookies[authenticationCookieName] ?? req.headers.authorization
+
+    if (!bearer) {
+      return
+    }
+
+    return bearer.replace('Bearer', '').trim()
+  }
+
+  /**
+   * Extracts the user from the API token.
+   *
+   * If the app configuration does not enforce authentication or is configured for E2E testing,
+   * the system user will be returned, **even if the token is invalid!**.
+   */
+  public async getUserInfo(accessToken: string): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
+    // use access token to retrieve user info if still valid
+    const userInfo = this.accessTokenToUserInfo(accessToken)
+    if (userInfo?.exp && userInfo.exp > new Date()) {
+      return { ok: true, userInfo }
+    }
+
+    try {
+      const endpoint = await this.oidc.metadataService.getUserInfoEndpoint()
+      const response = await fetch(endpoint, {
+        method: 'GET',
+        headers: { Authorization: \`Bearer \${accessToken}\` },
+      })
+
+      const raw = await response.text()
+
+      try {
+        const parsed = await zUserInfo.safeParseAsync(JSON.parse(raw), {})
+        if (parsed.success) {
+          return { ok: true, userInfo: parsed.data }
+        }
+
+        this.logger.error(\`Failed to validate user info: \${JSON.stringify(parsed.error)}\`)
+
+        return { ok: false }
+      } catch (error) {
+        this.logger.error(unknownToErrorMessage(error, 'Failed to parse user info'))
+        return { ok: false }
+      }
+    } catch (error) {
+      this.logger.error(unknownToErrorMessage(error, 'Failed to fetch user info'))
+      return { ok: false }
+    }
+  }
+
+  public async getUserRolesFromRequest(
+    req: FastifyRequest,
+  ): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
+    const accessToken = req.cookies[authenticationCookieName] ?? req.headers.authorization
+
+    if (!accessToken) {
+      return { ok: false }
+    }
+
+    const roles = await this.getUserRoles(accessToken)
+
+    return roles
+  }
+
+  public async getUserRoles(accessToken: string): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
+    try {
+      const getKey = (header: jwt.JwtHeader, callback: jwt.SigningKeyCallback) => {
+        this.jwks.getSigningKey(header.kid, (err, key) => {
+          if (err || !key) {
+            callback(err)
+          } else {
+            callback(null, key.getPublicKey())
+          }
+        })
+      }
+
+      const decoded = await _jwtVerify(accessToken, getKey, { algorithms: ['RS256'] })
+
+      if (typeof decoded === 'object' && decoded !== null) {
+        const rawUserRoles = decoded.realm_access?.roles || []
+
+        const userRoles = zUserRoles.safeParse(rawUserRoles)
+        if (userRoles.success) {
+          return { ok: true, userRoles: userRoles.data }
+        }
+
+        return { ok: false }
+      }
+
+      return { ok: true, userRoles: [] }
+    } catch (error) {
+      console.error(error)
+
+      return { ok: false }
+    }
+  }
+
+  /**
+   * Retrieves Keycloak logout url
+   */
+  public async getLogoutUrl(req: FastifyRequest): Promise<string> {
+    // fetch id token by refreshing the access token
+    const res = await this.refreshAccessToken(req)
+    const signoutRequest = await this.oidc.createSignoutRequest({
+      post_logout_redirect_uri: this.config.postLogoutRedirectUrl?.toString() ?? this.config.frontendUrl?.toString(),
+      id_token_hint: res.ok ? res.idToken : undefined,
+    })
+    return signoutRequest.url
+  }
+
+  /**
+   * Retrieves UserInfo from Access Token
+   */
+  private accessTokenToUserInfo(accessToken: string): UserInfo | undefined {
+    const decodedToken = jwt.decode(accessToken, { complete: true })
+    if (!decodedToken || typeof decodedToken !== 'object') {
+      return undefined
+    }
+    const parsedToken = zUserInfo.safeParse(decodedToken.payload)
+    if (!parsedToken.success) {
+      return undefined
+    }
+
+    return parsedToken.data
+  }
+
+  private encodeState(state: State) {
+    return Buffer.from(JSON.stringify(state)).toString('base64')
+  }
+
+  /**
+   * Decodes the state string from the URL.
+   */
+  private decodeState(state?: unknown): State | null {
+    if (!state) {
+      return null
+    }
+
+    if (typeof state !== 'string') {
+      return null
+    }
+
+    try {
+      const raw = JSON.parse(Buffer.from(state, 'base64').toString()) as unknown
+
+      return zState.parse(raw)
+    } catch (_error) {
+      return null
+    }
+  }
+}
+
+/**
+ * Verifies a JWT token.
+ */
+function _jwtVerify(
+  token: string,
+  key: jwt.Secret | jwt.GetPublicKeyOrSecret,
+  options?: jwt.VerifyOptions,
+): Promise<string | jwt.JwtPayload | undefined> {
+  return new Promise((resolve, reject) => {
+    jwt.verify(token, key, options, (error, decoded) => {
+      if (error) {
+        reject(error)
+      } else {
+        resolve(decoded)
+      }
+    })
+  })
+}
+
+/**
+ * Replace Docker internal hostname with localhost for local development.
+ *
+ * SECURITY NOTE: These HTTP URLs are for local development only.
+ * In production, use HTTPS by configuring the keycloakUrl in the authentication config
+ * to use https:// protocol. The URLs here are only used for Docker Compose development.
+ */
+function replaceDockerHost(url: string): string {
+  // Development-only HTTP URLs for Docker Compose
+  // prettier-ignore
+  if (url.startsWith('http://keycloak:8080')) { // NOSONAR - this is only for execution in test env
+    return url.replace('http://keycloak:8080', 'http://localhost:3000/auth') // NOSONAR - this is only for execution in test env
+  }
+  return url
+}`;
+}
+//# sourceMappingURL=authentication-service.generator.js.map

package/dist/backend-authentication/generators/authentication-service.generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-service.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-service.generator.ts"],"names":[],"mappings":";;AAEA,sEAoYC;AApYD,SAAgB,6BAA6B,CAAC,OAAsB;IAClE,OAAO,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6BH,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;yCACT,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoW1E,CAAA;AACF,CAAC"}

package/dist/backend-authentication/generators/authentication-types.generator.d.ts

@@ -0,0 +1,2 @@
+import { ContextResult } from '../authentication.generator';
+export declare function generateAuthenticationTypes(context: ContextResult): string;

package/dist/backend-authentication/generators/authentication-types.generator.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateAuthenticationTypes = generateAuthenticationTypes;
+function generateAuthenticationTypes(context) {
+    return /* ts */ `
+import { z } from 'zod'
+import { Result } from '@postxl/utils'
+import { Viewer } from '@authentication/auth.guard'
+
+/**
+ * ${context.authentication.types.userInfo.name} object decoder as configured in the OIDC provider.
+ */
+// https://www.keycloak.org/docs/latest/securing_apps/index.html#userinfo-endpoint
+export const z${context.authentication.types.userInfo.name} = z.object({
+  // https://openid.net/specs/openid-connect-core-1_0.html#UserInfo
+  /**
+   * The Id of the user.
+   */
+  sub: z.string(),
+
+  // Custom Attributes
+  name: z.string(),
+  preferred_username: z.string(),
+  given_name: z.string(),
+  family_name: z.string(),
+  email: z.string(),
+  uuid: z.string().optional(),
+  groups: z
+    .string()
+    .optional()
+    .transform((groups) => groups?.split(',')),
+
+  // If part of a token, \`exp\` represents the timestamp of its expiry in seconds
+  exp: z
+    .number()
+    .optional()
+    .transform((exp) => (exp ? new Date(exp * 1000) : undefined)),
+})
+
+/**
+ * ${context.authentication.types.userInfo.name} object type.
+ */
+export type ${context.authentication.types.userInfo.name} = z.infer<typeof z${context.authentication.types.userInfo.name}>
+
+export const z${context.authentication.types.userRoles.name} = z.array(z.enum(['admin', 'user', 'unauthorized']))
+
+export type ${context.authentication.types.userRoles.name} = z.infer<typeof z${context.authentication.types.userRoles.name}>
+
+export type ViewerResult = Result<
+  Omit<Viewer, 'userInfo'>,
+  | {
+      type: 'redirect'
+      redirectUrl: string
+    }
+  | { type: 'waitingForServer' }
+>
+
+/**
+ * The name of the cookie that holds the authentication token.
+ */
+export const authenticationCookieName = 'pxl-auth'  
+`;
+}
+//# sourceMappingURL=authentication-types.generator.js.map

package/dist/backend-authentication/generators/authentication-types.generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication-types.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-types.generator.ts"],"names":[],"mappings":";;AAEA,kEA2DC;AA3DD,SAAgB,2BAA2B,CAAC,OAAsB;IAChE,OAAO,QAAQ,CAAC;;;;;;KAMb,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;gBAG/B,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BrD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;cAEjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;gBAExG,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;;cAE7C,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;;;;;;;;;;;;;;;CAezH,CAAA;AACD,CAAC"}

package/dist/backend-authentication/index.d.ts

@@ -0,0 +1,4 @@
+import * as Generator from './authentication.generator';
+export type WithBackendAuthentication<Context> = Generator.WithAuthentication<Context>;
+export declare const backendAuthenticationGenerator: import("@postxl/generator").GeneratorInterface;
+export declare const backendAuthenticationGeneratorId: string & import("zod").BRAND<"PXL.GeneratorInterfaceId">;