@quanticjs/auth-web-bff 5.8.0 → 5.10.0

package/dist/bff.service.js

@@ -19,15 +19,20 @@ const uuid_1 = require("uuid");
 const crypto_1 = require("crypto");
 const core_1 = require("@quanticjs/core");
 const interfaces_1 = require("./interfaces");
-function extractRealmRoles(accessToken) {
+function extractTokenClaims(accessToken, clientId) {
     try {
         const payload = JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64url').toString());
-        return Array.isArray(payload.realm_access?.roles)
-            ? payload.realm_access.roles
-            : [];
+        return {
+            realmRoles: Array.isArray(payload.realm_access?.roles)
+                ? payload.realm_access.roles
+                : [],
+            clientRoles: Array.isArray(payload.resource_access?.[clientId]?.roles)
+                ? payload.resource_access[clientId].roles
+                : [],
+        };
     }
     catch {
-        return [];
+        return { realmRoles: [], clientRoles: [] };
     }
 }
 let BffService = class BffService {
@@ -78,6 +83,11 @@ let BffService = class BffService {
         const tokenSet = await this.client.callback(this.getCallbackUrl(), { code, state, iss: this.client.issuer.metadata.issuer }, { code_verifier: codeVerifier, state });
         const claims = tokenSet.claims();
         const sessionId = (0, uuid_1.v4)();
+        const { realmRoles, clientRoles } = extractTokenClaims(tokenSet.access_token, this.options.keycloak.clientId);
+        let permissions = clientRoles;
+        if (this.options.permissionResolver) {
+            permissions = await this.options.permissionResolver(realmRoles, clientRoles);
+        }
         const sessionData = {
             accessToken: tokenSet.access_token,
             refreshToken: tokenSet.refresh_token,
@@ -86,7 +96,8 @@ let BffService = class BffService {
             id: claims.sub,
             email: claims.email ?? '',
             displayName: claims.name ?? claims.preferred_username ?? '',
-            roles: extractRealmRoles(tokenSet.access_token),
+            roles: realmRoles,
+            permissions,
             username: claims.preferred_username,
         };
         await this.saveSession(sessionId, sessionData);
@@ -123,13 +134,19 @@ let BffService = class BffService {
             return null;
         try {
             const tokenSet = await this.client.refresh(sess.refreshToken);
+            const { realmRoles, clientRoles } = extractTokenClaims(tokenSet.access_token, this.options.keycloak.clientId);
+            let permissions = clientRoles;
+            if (this.options.permissionResolver) {
+                permissions = await this.options.permissionResolver(realmRoles, clientRoles);
+            }
             const updated = {
                 ...sess,
                 accessToken: tokenSet.access_token,
                 refreshToken: tokenSet.refresh_token ?? sess.refreshToken,
                 idToken: tokenSet.id_token ?? sess.idToken,
                 expiresAt: tokenSet.expires_at ?? Math.floor(Date.now() / 1000) + 300,
-                roles: extractRealmRoles(tokenSet.access_token),
+                roles: realmRoles,
+                permissions,
             };
             await this.saveSession(sessionId, updated);
             return updated.accessToken;
@@ -186,6 +203,7 @@ let BffService = class BffService {
             email: session.email,
             displayName: session.displayName,
             roles: session.roles,
+            permissions: session.permissions,
             username: session.username,
         };
     }

package/dist/interfaces.d.ts

@@ -16,6 +16,7 @@ export interface BffModuleOptions {
     };
     publicUrl: string;
     callbackPath?: string;
+    permissionResolver?: (realmRoles: string[], clientRoles: string[]) => string[] | Promise<string[]>;
 }
 export interface SessionData {
     accessToken: string;
@@ -26,6 +27,7 @@ export interface SessionData {
     email: string;
     displayName: string;
     roles: string[];
+    permissions: string[];
     username?: string;
 }
 export declare const BFF_OPTIONS: unique symbol;

package/package.json

@@ -1,15 +1,16 @@
 {
   "name": "@quanticjs/auth-web-bff",
-  "version": "5.8.0",
+  "version": "5.10.0",
   "description": "BFF authentication module — Keycloak OIDC, Redis sessions, httpOnly cookies",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
     "build": "tsc -p tsconfig.json",
+    "test": "jest --passWithNoTests",
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@quanticjs/core": "^5.8.0"
+    "@quanticjs/core": "^5.10.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",