@revisium/core 2.9.1 → 2.10.0-alpha.0

package/dist/src/features/auth/commands/handlers/login-google.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-google.handler.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/handlers/login-google.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA8D;AAC9D,uCAA2E;AAC3E,qDAA6D;AAC7D,kCAKyC;AACzC,yCAA2D;AAC3D,qEAA4E;AAC5E,uFAA2E;AAGpE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAI7B,YACmB,UAAsB,EACtB,MAAqB,EACrB,kBAAsC,EACtC,WAAwB;QAHxB,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAe;QACrB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAsB;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAChD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,IAAI,CACV,CAAC;QAEF,MAAM,IAAI,GACR,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE,IAAI,CAAC,EAAE;aACb,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,eAAuB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE;gBACL,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aAChE;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAI3B,IAAI,wBAAiB,CAAC;YACpB,KAAK;YACL,QAAQ,EAAE,EAAE;YACZ,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,wBAAe,CAAC,UAAU;SACnC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,qCAA4B,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1DY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,qBAAc,EAAC,yBAAkB,CAAC;qCAMF,iBAAU;QACd,8BAAa;QACD,yCAAkB;QACzB,0BAAW;GARhC,kBAAkB,CA0D9B"}
+{"version":3,"file":"login-google.handler.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/handlers/login-google.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA8D;AAC9D,uCAA2E;AAC3E,qDAA6D;AAC7D,kCAKyC;AACzC,yCAA2D;AAC3D,qEAA4E;AAC5E,uFAA2E;AAGpE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAI7B,YACmB,UAAsB,EACtB,MAAqB,EACrB,kBAAsC,EACtC,WAAwB;QAHxB,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAe;QACrB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAsB;QACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAChD,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,IAAI,CACV,CAAC;QAEF,MAAM,IAAI,GACR,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAE1E,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,eAAuB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE;gBACL,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aAChE;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAI3B,IAAI,wBAAiB,CAAC;YACpB,KAAK;YACL,QAAQ,EAAE,EAAE;YACZ,gBAAgB,EAAE,IAAI;YACtB,MAAM,EAAE,wBAAe,CAAC,UAAU;SACnC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,qCAA4B,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvDY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,qBAAc,EAAC,yBAAkB,CAAC;qCAMF,iBAAU;QACd,8BAAa;QACD,yCAAkB;QACzB,0BAAW;GARhC,kBAAkB,CAuD9B"}

package/dist/src/features/auth/commands/handlers/login.handler.js

@@ -1,10 +1,43 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
@@ -12,10 +45,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoginHandler = void 0;
 const common_1 = require("@nestjs/common");
 const cqrs_1 = require("@nestjs/cqrs");
+const bcrypt = __importStar(require("bcrypt"));
 const auth_service_1 = require("../../auth.service");
 const impl_1 = require("../impl");
 const no_auth_service_1 = require("../../no-auth.service");
 const prisma_service_1 = require("../../../../infrastructure/database/prisma.service");
+let dummyBcryptHash;
+function getDummyBcryptHash() {
+    if (!dummyBcryptHash) {
+        dummyBcryptHash = bcrypt.hashSync('unused', auth_service_1.BCRYPT_ROUNDS);
+    }
+    return dummyBcryptHash;
+}
+const INVALID_CREDENTIALS_MESSAGE = 'Invalid credentials';
 let LoginHandler = class LoginHandler {
     constructor(prisma, authService, noAuth) {
         this.prisma = prisma;
@@ -25,34 +67,30 @@ let LoginHandler = class LoginHandler {
     async execute({ data }) {
         if (this.noAuth.enabled) {
             const admin = this.noAuth.adminUser;
+            const access = this.authService.signAccessToken({
+                username: admin.userId,
+                email: admin.email,
+                sub: admin.userId,
+            });
             return {
-                accessToken: this.authService.login({
-                    username: admin.userId,
-                    email: admin.email,
-                    sub: admin.userId,
-                }),
+                accessToken: access.accessToken,
+                refreshToken: null,
+                expiresIn: access.expiresIn,
             };
         }
         const user = await this.getUser(data.emailOrUsername);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User does not exist');
-        }
-        if (!user.password) {
-            throw new common_1.UnauthorizedException('Password login is not available');
-        }
-        if (!(await this.authService.comparePassword(data.password, user.password))) {
-            throw new common_1.UnauthorizedException('Invalid password');
+        const passwordHash = user?.password || getDummyBcryptHash();
+        const passwordMatches = await this.authService.comparePassword(data.password, passwordHash);
+        if (!user?.password || !passwordMatches) {
+            throw new common_1.UnauthorizedException(INVALID_CREDENTIALS_MESSAGE);
         }
         if (!user.isEmailConfirmed) {
             throw new common_1.UnauthorizedException('Email is not confirmed');
         }
-        return {
-            accessToken: this.authService.login({
-                username: user.username || '',
-                email: user.email || '',
-                sub: user.id,
-            }),
-        };
+        return this.authService.issueTokens(user, {
+            ip: data.ip,
+            userAgent: data.userAgent,
+        });
     }
     getUser(emailOrUserName) {
         return this.prisma.user.findFirst({

package/dist/src/features/auth/commands/handlers/login.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.handler.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/handlers/login.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAuD;AACvD,uCAA+D;AAC/D,qDAA6D;AAC7D,kCAGyC;AACzC,2DAAkE;AAClE,uFAA2E;AAGpE,IAAM,YAAY,GAAlB,MAAM,YAAY;IAIvB,YACmB,MAAqB,EACrB,WAAwB,EACxB,MAAqB;QAFrB,WAAM,GAAN,MAAM,CAAe;QACrB,gBAAW,GAAX,WAAW,CAAa;QACxB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACpC,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;oBAClC,QAAQ,EAAE,KAAK,CAAC,MAAM;oBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,MAAM;iBAClB,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAEtD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EACvE,CAAC;YACD,MAAM,IAAI,8BAAqB,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAClC,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;gBACvB,GAAG,EAAE,IAAI,CAAC,EAAE;aACb,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,eAAuB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE;gBACL,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aAChE;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA1DY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,qBAAc,EAAC,mBAAY,CAAC;qCAMA,8BAAa;QACR,0BAAW;QAChB,+BAAa;GAP7B,YAAY,CA0DxB"}
+{"version":3,"file":"login.handler.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/handlers/login.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuD;AACvD,uCAA+D;AAC/D,+CAAiC;AACjC,qDAA4E;AAC5E,kCAGyC;AACzC,2DAAkE;AAClE,uFAA2E;AAO3E,IAAI,eAAmC,CAAC;AACxC,SAAS,kBAAkB;IACzB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,4BAAa,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,2BAA2B,GAAG,qBAAqB,CAAC;AAGnD,IAAM,YAAY,GAAlB,MAAM,YAAY;IAIvB,YACmB,MAAqB,EACrB,WAAwB,EACxB,MAAqB;QAFrB,WAAM,GAAN,MAAM,CAAe;QACrB,gBAAW,GAAX,WAAW,CAAa;QACxB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAgB;QAClC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC;gBAC9C,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,GAAG,EAAE,KAAK,CAAC,MAAM;aAClB,CAAC,CAAC;YACH,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAMtD,MAAM,YAAY,GAAG,IAAI,EAAE,QAAQ,IAAI,kBAAkB,EAAE,CAAC;QAC5D,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAC5D,IAAI,CAAC,QAAQ,EACb,YAAY,CACb,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,eAAuB;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAChC,KAAK,EAAE;gBACL,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;aAChE;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA1DY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,qBAAc,EAAC,mBAAY,CAAC;qCAMA,8BAAa;QACR,0BAAW;QAChB,+BAAa;GAP7B,YAAY,CA0DxB"}

package/dist/src/features/auth/commands/impl/confirm-email-code.command.d.ts

@@ -1,12 +1,18 @@
 export declare class ConfirmEmailCodeCommand {
     readonly data: {
         code: string;
+        ip?: string;
+        userAgent?: string;
     };
     constructor(data: {
         code: string;
+        ip?: string;
+        userAgent?: string;
     });
 }
 export type ConfirmEmailCodeCommandData = ConfirmEmailCodeCommand['data'];
 export type ConfirmEmailCodeCommandReturnType = {
     accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number;
 };

package/dist/src/features/auth/commands/impl/confirm-email-code.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirm-email-code.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/confirm-email-code.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;IAClC,YACkB,IAEf;QAFe,SAAI,GAAJ,IAAI,CAEnB;IACA,CAAC;CACL;AAND,0DAMC"}
+{"version":3,"file":"confirm-email-code.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/confirm-email-code.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;IAClC,YACkB,IAIf;QAJe,SAAI,GAAJ,IAAI,CAInB;IACA,CAAC;CACL;AARD,0DAQC"}

package/dist/src/features/auth/commands/impl/login-github.command.d.ts

@@ -1,12 +1,18 @@
 export declare class LoginGithubCommand {
     readonly data: {
         code: string;
+        ip?: string;
+        userAgent?: string;
     };
     constructor(data: {
         code: string;
+        ip?: string;
+        userAgent?: string;
     });
 }
 export type LoginGithubCommandData = LoginGithubCommand['data'];
 export type LoginGithubCommandReturnType = {
     accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number;
 };

package/dist/src/features/auth/commands/impl/login-github.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-github.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login-github.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,kBAAkB;IAC7B,YACkB,IAEf;QAFe,SAAI,GAAJ,IAAI,CAEnB;IACA,CAAC;CACL;AAND,gDAMC"}
+{"version":3,"file":"login-github.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login-github.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,kBAAkB;IAC7B,YACkB,IAIf;QAJe,SAAI,GAAJ,IAAI,CAInB;IACA,CAAC;CACL;AARD,gDAQC"}

package/dist/src/features/auth/commands/impl/login-google.command.d.ts

@@ -2,13 +2,19 @@ export declare class LoginGoogleCommand {
     readonly data: {
         redirectUrl: string;
         code: string;
+        ip?: string;
+        userAgent?: string;
     };
     constructor(data: {
         redirectUrl: string;
         code: string;
+        ip?: string;
+        userAgent?: string;
     });
 }
 export type LoginGoogleCommandData = LoginGoogleCommand['data'];
 export type LoginGoogleCommandReturnType = {
     accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number;
 };

package/dist/src/features/auth/commands/impl/login-google.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"login-google.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login-google.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,kBAAkB;IAC7B,YACkB,IAGf;QAHe,SAAI,GAAJ,IAAI,CAGnB;IACA,CAAC;CACL;AAPD,gDAOC"}
+{"version":3,"file":"login-google.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login-google.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,kBAAkB;IAC7B,YACkB,IAKf;QALe,SAAI,GAAJ,IAAI,CAKnB;IACA,CAAC;CACL;AATD,gDASC"}

package/dist/src/features/auth/commands/impl/login.command.d.ts

@@ -2,13 +2,19 @@ export declare class LoginCommand {
     readonly data: {
         readonly emailOrUsername: string;
         readonly password: string;
+        readonly ip?: string;
+        readonly userAgent?: string;
     };
     constructor(data: {
         readonly emailOrUsername: string;
         readonly password: string;
+        readonly ip?: string;
+        readonly userAgent?: string;
     });
 }
 export type LoginCommandData = LoginCommand['data'];
 export type LoginCommandReturnType = {
     accessToken: string;
+    refreshToken: string | null;
+    expiresIn: number;
 };

package/dist/src/features/auth/commands/impl/login.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAY;IACvB,YACkB,IAGf;QAHe,SAAI,GAAJ,IAAI,CAGnB;IACA,CAAC;CACL;AAPD,oCAOC"}
+{"version":3,"file":"login.command.js","sourceRoot":"","sources":["../../../../../../src/features/auth/commands/impl/login.command.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAY;IACvB,YACkB,IAKf;QALe,SAAI,GAAJ,IAAI,CAKnB;IACA,CAAC;CACL;AATD,oCASC"}

package/dist/src/features/auth/commands/index.d.ts

@@ -1,2 +1,10 @@
-import { CheckOrganizationPermissionHandler, CheckProjectPermissionHandler, CheckSystemPermissionHandler, ConfirmEmailCodeHandler, CreateUserHandler, LoginGithubHandler, LoginGoogleHandler, LoginHandler, SignUpHandler } from '../../../features/auth/commands/handlers';
-export declare const AUTH_COMMANDS: (typeof LoginHandler | typeof CreateUserHandler | typeof CheckSystemPermissionHandler | typeof CheckOrganizationPermissionHandler | typeof CheckProjectPermissionHandler | typeof SignUpHandler | typeof LoginGoogleHandler | typeof LoginGithubHandler | typeof ConfirmEmailCodeHandler)[];
+import { CheckOrganizationPermissionHandler } from '../../../features/auth/commands/handlers/check-organization-permission.handler';
+import { CheckProjectPermissionHandler } from '../../../features/auth/commands/handlers/check-project-permission.handler';
+import { CheckSystemPermissionHandler } from '../../../features/auth/commands/handlers/check-system-permission.handler';
+import { ConfirmEmailCodeHandler } from '../../../features/auth/commands/handlers/confirm-email-code.handler';
+import { CreateUserHandler } from '../../../features/auth/commands/handlers/create-user.handler';
+import { LoginGithubHandler } from '../../../features/auth/commands/handlers/login-github.handler';
+import { LoginGoogleHandler } from '../../../features/auth/commands/handlers/login-google.handler';
+import { LoginHandler } from '../../../features/auth/commands/handlers/login.handler';
+import { SignUpHandler } from '../../../features/auth/commands/handlers/sign-up.handler';
+export declare const AUTH_COMMANDS: (typeof CheckOrganizationPermissionHandler | typeof CheckProjectPermissionHandler | typeof CheckSystemPermissionHandler | typeof ConfirmEmailCodeHandler | typeof CreateUserHandler | typeof LoginGithubHandler | typeof LoginGoogleHandler | typeof LoginHandler | typeof SignUpHandler)[];

package/dist/src/features/auth/commands/index.js

@@ -1,16 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_COMMANDS = void 0;
-const handlers_1 = require("./handlers");
+const check_organization_permission_handler_1 = require("./handlers/check-organization-permission.handler");
+const check_project_permission_handler_1 = require("./handlers/check-project-permission.handler");
+const check_system_permission_handler_1 = require("./handlers/check-system-permission.handler");
+const confirm_email_code_handler_1 = require("./handlers/confirm-email-code.handler");
+const create_user_handler_1 = require("./handlers/create-user.handler");
+const login_github_handler_1 = require("./handlers/login-github.handler");
+const login_google_handler_1 = require("./handlers/login-google.handler");
+const login_handler_1 = require("./handlers/login.handler");
+const sign_up_handler_1 = require("./handlers/sign-up.handler");
 exports.AUTH_COMMANDS = [
-    handlers_1.LoginHandler,
-    handlers_1.CreateUserHandler,
-    handlers_1.CheckSystemPermissionHandler,
-    handlers_1.CheckProjectPermissionHandler,
-    handlers_1.CheckOrganizationPermissionHandler,
-    handlers_1.SignUpHandler,
-    handlers_1.ConfirmEmailCodeHandler,
-    handlers_1.LoginGoogleHandler,
-    handlers_1.LoginGithubHandler,
+    login_handler_1.LoginHandler,
+    create_user_handler_1.CreateUserHandler,
+    check_system_permission_handler_1.CheckSystemPermissionHandler,
+    check_project_permission_handler_1.CheckProjectPermissionHandler,
+    check_organization_permission_handler_1.CheckOrganizationPermissionHandler,
+    sign_up_handler_1.SignUpHandler,
+    confirm_email_code_handler_1.ConfirmEmailCodeHandler,
+    login_google_handler_1.LoginGoogleHandler,
+    login_github_handler_1.LoginGithubHandler,
 ];
 //# sourceMappingURL=index.js.map

package/dist/src/features/auth/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/features/auth/commands/index.ts"],"names":[],"mappings":";;;AAAA,yCAU6C;AAEhC,QAAA,aAAa,GAAG;IAC3B,uBAAY;IACZ,4BAAiB;IACjB,uCAA4B;IAC5B,wCAA6B;IAC7B,6CAAkC;IAClC,wBAAa;IACb,kCAAuB;IACvB,6BAAkB;IAClB,6BAAkB;CACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/features/auth/commands/index.ts"],"names":[],"mappings":";;;AAAA,4GAA+H;AAC/H,kGAAqH;AACrH,gGAAmH;AACnH,sFAAyG;AACzG,wEAA4F;AAC5F,0EAA8F;AAC9F,0EAA8F;AAC9F,4DAAiF;AACjF,gEAAoF;AAEvE,QAAA,aAAa,GAAG;IAC3B,4BAAY;IACZ,uCAAiB;IACjB,8DAA4B;IAC5B,gEAA6B;IAC7B,0EAAkC;IAClC,+BAAa;IACb,oDAAuB;IACvB,yCAAkB;IAClB,yCAAkB;CACnB,CAAC"}

package/dist/src/features/auth/consts.d.ts

@@ -36,7 +36,8 @@ export declare enum PermissionAction {
     read = "read",
     revert = "revert",
     update = "update",
-    add = "add"
+    add = "add",
+    manage = "manage"
 }
 export declare enum PermissionSubject {
     Organization = "Organization",
@@ -46,5 +47,8 @@ export declare enum PermissionSubject {
     Table = "Table",
     Row = "Row",
     Endpoint = "Endpoint",
-    User = "User"
+    User = "User",
+    ApiKey = "ApiKey",
+    Cache = "Cache",
+    FileUsage = "FileUsage"
 }

package/dist/src/features/auth/consts.js

@@ -51,6 +51,7 @@ var PermissionAction;
     PermissionAction["revert"] = "revert";
     PermissionAction["update"] = "update";
     PermissionAction["add"] = "add";
+    PermissionAction["manage"] = "manage";
 })(PermissionAction || (exports.PermissionAction = PermissionAction = {}));
 var PermissionSubject;
 (function (PermissionSubject) {
@@ -62,5 +63,8 @@ var PermissionSubject;
     PermissionSubject["Row"] = "Row";
     PermissionSubject["Endpoint"] = "Endpoint";
     PermissionSubject["User"] = "User";
+    PermissionSubject["ApiKey"] = "ApiKey";
+    PermissionSubject["Cache"] = "Cache";
+    PermissionSubject["FileUsage"] = "FileUsage";
 })(PermissionSubject || (exports.PermissionSubject = PermissionSubject = {}));
 //# sourceMappingURL=consts.js.map

package/dist/src/features/auth/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../../src/features/auth/consts.ts"],"names":[],"mappings":";;;AAAA,IAAY,QAWX;AAXD,WAAY,QAAQ;IAClB,uCAA2B,CAAA;IAC3B,mDAAuC,CAAA;IACvC,qCAAyB,CAAA;IACzB,mDAAuC,CAAA;IACvC,mDAAuC,CAAA;IACvC,mCAAuB,CAAA;IACvB,6BAAiB,CAAA;IACjB,6BAAiB,CAAA;IACjB,2BAAe,CAAA;IACf,yBAAa,CAAA;AACf,CAAC,EAXW,QAAQ,wBAAR,QAAQ,QAWnB;AAED,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,8CAA2B,CAAA;IAC3B,0DAAuC,CAAA;IACvC,4CAAyB,CAAA;AAC3B,CAAC,EAJW,eAAe,+BAAf,eAAe,QAI1B;AAED,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,gEAAuC,CAAA;IACvC,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EANW,qBAAqB,qCAArB,qBAAqB,QAMhC;AAED,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,2CAAuB,CAAA;IACvB,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;AACnB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAC9D,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CACpE,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAC/D,CAAC;AAEK,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAAhE,QAAA,iBAAiB,qBAA+C;AAEtE,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,EAAE,CACxD,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AADnB,QAAA,uBAAuB,2BACJ;AAEzB,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAAlE,QAAA,kBAAkB,sBAAgD;AAE/E,IAAY,gBAOX;AAPD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,iCAAa,CAAA;IACb,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,+BAAW,CAAA;AACb,CAAC,EAPW,gBAAgB,gCAAhB,gBAAgB,QAO3B;AAED,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,oCAAe,CAAA;IACf,gCAAW,CAAA;IACX,0CAAqB,CAAA;IACrB,kCAAa,CAAA;AACf,CAAC,EATW,iBAAiB,iCAAjB,iBAAiB,QAS5B"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../../../../src/features/auth/consts.ts"],"names":[],"mappings":";;;AAAA,IAAY,QAWX;AAXD,WAAY,QAAQ;IAClB,uCAA2B,CAAA;IAC3B,mDAAuC,CAAA;IACvC,qCAAyB,CAAA;IACzB,mDAAuC,CAAA;IACvC,mDAAuC,CAAA;IACvC,mCAAuB,CAAA;IACvB,6BAAiB,CAAA;IACjB,6BAAiB,CAAA;IACjB,2BAAe,CAAA;IACf,yBAAa,CAAA;AACf,CAAC,EAXW,QAAQ,wBAAR,QAAQ,QAWnB;AAED,IAAY,eAIX;AAJD,WAAY,eAAe;IACzB,8CAA2B,CAAA;IAC3B,0DAAuC,CAAA;IACvC,4CAAyB,CAAA;AAC3B,CAAC,EAJW,eAAe,+BAAf,eAAe,QAI1B;AAED,IAAY,qBAMX;AAND,WAAY,qBAAqB;IAC/B,gEAAuC,CAAA;IACvC,gEAAuC,CAAA;IACvC,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;IACjB,0CAAiB,CAAA;AACnB,CAAC,EANW,qBAAqB,qCAArB,qBAAqB,QAMhC;AAED,IAAY,gBAIX;AAJD,WAAY,gBAAgB;IAC1B,2CAAuB,CAAA;IACvB,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;AACnB,CAAC,EAJW,gBAAgB,gCAAhB,gBAAgB,QAI3B;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAC9D,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CACpE,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAC/D,CAAC;AAEK,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAAhE,QAAA,iBAAiB,qBAA+C;AAEtE,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,EAAE,CACxD,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AADnB,QAAA,uBAAuB,2BACJ;AAEzB,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAAlE,QAAA,kBAAkB,sBAAgD;AAE/E,IAAY,gBAQX;AARD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,iCAAa,CAAA;IACb,qCAAiB,CAAA;IACjB,qCAAiB,CAAA;IACjB,+BAAW,CAAA;IACX,qCAAiB,CAAA;AACnB,CAAC,EARW,gBAAgB,gCAAhB,gBAAgB,QAQ3B;AAED,IAAY,iBAYX;AAZD,WAAY,iBAAiB;IAC3B,kDAA6B,CAAA;IAC7B,wCAAmB,CAAA;IACnB,sCAAiB,CAAA;IACjB,0CAAqB,CAAA;IACrB,oCAAe,CAAA;IACf,gCAAW,CAAA;IACX,0CAAqB,CAAA;IACrB,kCAAa,CAAA;IACb,sCAAiB,CAAA;IACjB,oCAAe,CAAA;IACf,4CAAuB,CAAA;AACzB,CAAC,EAZW,iBAAiB,iCAAjB,iBAAiB,QAY5B"}

package/dist/src/features/auth/guards/base-persmission.guard.d.ts

@@ -1,12 +1,16 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { ApiKeyScopeService } from '../../../features/api-key/api-key-scope.service';
+import { CaslAbilityFactory } from '../../../features/auth/casl-ability.factory';
 import { AuthApiService } from '../../../features/auth/commands/auth-api.service';
 import { IPermissionParams } from '../../../features/auth/guards/permission-params';
 import { IOptionalAuthUser } from '../../../features/auth/types';
 export declare abstract class BasePermissionGuard<T = Record<string, never>> implements CanActivate {
     protected reflector: Reflector;
     protected authApi: AuthApiService;
-    constructor(reflector: Reflector, authApi: AuthApiService);
+    protected apiKeyScopeService: ApiKeyScopeService;
+    protected caslAbilityFactory: CaslAbilityFactory;
+    constructor(reflector: Reflector, authApi: AuthApiService, apiKeyScopeService: ApiKeyScopeService, caslAbilityFactory: CaslAbilityFactory);
     protected getFromHttpContext(context: ExecutionContext): {
         user: IOptionalAuthUser;
         params: T;
@@ -19,6 +23,17 @@ export declare abstract class BasePermissionGuard<T = Record<string, never>> imp
         user: IOptionalAuthUser;
         params: T;
     };
-    protected abstract executeCommand(params: T, permissions: IPermissionParams[], userId?: string): any;
+    protected abstract executeCommand(params: T, permissions: IPermissionParams[], userId?: string): Promise<boolean>;
     canActivate(context: ExecutionContext): Promise<boolean>;
+    private extractPermissions;
+    private checkReadOnly;
+    private checkServiceKeyPermissions;
+    private checkRolePermissions;
+    protected validateApiKeyScope(user: NonNullable<IOptionalAuthUser>, params: T): Promise<void>;
+    protected buildScopeRequest(_params: T): {
+        organizationId?: string;
+        projectId?: string;
+        branchName?: string;
+        tableId?: string;
+    } | null;
 }

package/dist/src/features/auth/guards/base-persmission.guard.js

@@ -11,14 +11,19 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BasePermissionGuard = void 0;
 const common_1 = require("@nestjs/common");
+const ability_1 = require("@casl/ability");
 const core_1 = require("@nestjs/core");
 const graphql_1 = require("@nestjs/graphql");
+const api_key_scope_service_1 = require("../../api-key/api-key-scope.service");
+const casl_ability_factory_1 = require("../casl-ability.factory");
 const auth_api_service_1 = require("../commands/auth-api.service");
 const permission_params_1 = require("./permission-params");
 let BasePermissionGuard = class BasePermissionGuard {
-    constructor(reflector, authApi) {
+    constructor(reflector, authApi, apiKeyScopeService, caslAbilityFactory) {
         this.reflector = reflector;
         this.authApi = authApi;
+        this.apiKeyScopeService = apiKeyScopeService;
+        this.caslAbilityFactory = caslAbilityFactory;
     }
     getFromHttpContext(context) {
         return context.switchToHttp().getRequest();
@@ -30,10 +35,33 @@ let BasePermissionGuard = class BasePermissionGuard {
         const args = gqlContext.getArgs();
         return {
             user,
-            params: args.data,
+            params: args.data ?? {},
         };
     }
     async canActivate(context) {
+        const permissions = this.extractPermissions(context);
+        const { user, params } = this.getParams(context);
+        if (!params) {
+            throw new common_1.NotFoundException('Required parameters not found');
+        }
+        if (user?.authMethod === 'internal_key') {
+            return true;
+        }
+        if (user?.apiKeyReadOnly) {
+            this.checkReadOnly(permissions);
+        }
+        if (user?.authMethod === 'service_key' && user.serviceKeyPermissions) {
+            this.checkServiceKeyPermissions(user.serviceKeyPermissions.rules, permissions);
+        }
+        else {
+            await this.checkRolePermissions(params, permissions, user?.userId);
+        }
+        if (user?.apiKeyId && user.apiKeyScope) {
+            await this.validateApiKeyScope(user, params);
+        }
+        return true;
+    }
+    extractPermissions(context) {
         const permissions = [];
         const classPermission = this.reflector.get(permission_params_1.PERMISSION_PARAMS_KEY, context.getClass());
         if (classPermission) {
@@ -43,14 +71,47 @@ let BasePermissionGuard = class BasePermissionGuard {
         if (methodPermission) {
             permissions.push(methodPermission);
         }
-        const { user, params } = this.getParams(context);
-        if (!params) {
-            throw new common_1.NotFoundException('Required parameters not found');
+        return permissions;
+    }
+    checkReadOnly(permissions) {
+        const writeActions = new Set([
+            'create',
+            'update',
+            'delete',
+            'revert',
+            'add',
+            'manage',
+        ]);
+        for (const permission of permissions) {
+            if (writeActions.has(permission.action)) {
+                throw new common_1.ForbiddenException(`API key is read-only: ${permission.action} on ${permission.subject} is not allowed`);
+            }
         }
+    }
+    checkServiceKeyPermissions(rules, permissions) {
+        const ability = this.caslAbilityFactory.createFromRules(rules);
         try {
-            await this.executeCommand(params, permissions, user?.userId);
+            for (const permission of permissions) {
+                ability_1.ForbiddenError.from(ability)
+                    .setMessage(`You are not allowed to ${permission.action} on ${permission.subject}`)
+                    .throwUnlessCan(permission.action, permission.subject);
+            }
+        }
+        catch (e) {
+            if (e instanceof Error) {
+                throw new common_1.ForbiddenException(e.message);
+            }
+            throw new common_1.InternalServerErrorException();
+        }
+    }
+    async checkRolePermissions(params, permissions, userId) {
+        try {
+            await this.executeCommand(params, permissions, userId);
         }
         catch (e) {
+            if (e instanceof common_1.NotFoundException) {
+                throw e;
+            }
             if (e instanceof Error) {
                 throw new common_1.ForbiddenException(e.message);
             }
@@ -58,13 +119,33 @@ let BasePermissionGuard = class BasePermissionGuard {
                 throw new common_1.InternalServerErrorException();
             }
         }
-        return true;
+    }
+    async validateApiKeyScope(user, params) {
+        const scopeRequest = this.buildScopeRequest(params);
+        if (!scopeRequest) {
+            return;
+        }
+        let resolvedBranchNames;
+        if (user.apiKeyScope.branchNames.length > 0 &&
+            scopeRequest.branchName &&
+            scopeRequest.projectId) {
+            resolvedBranchNames = await this.apiKeyScopeService.resolveBranchNames(user.apiKeyScope.branchNames, scopeRequest.projectId);
+        }
+        const isValid = this.apiKeyScopeService.validateScope(user.apiKeyScope, scopeRequest, resolvedBranchNames);
+        if (!isValid) {
+            throw new common_1.ForbiddenException('API key scope does not allow access to this resource');
+        }
+    }
+    buildScopeRequest(_params) {
+        return null;
     }
 };
 exports.BasePermissionGuard = BasePermissionGuard;
 exports.BasePermissionGuard = BasePermissionGuard = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [core_1.Reflector,
-        auth_api_service_1.AuthApiService])
+        auth_api_service_1.AuthApiService,
+        api_key_scope_service_1.ApiKeyScopeService,
+        casl_ability_factory_1.CaslAbilityFactory])
 ], BasePermissionGuard);
 //# sourceMappingURL=base-persmission.guard.js.map

package/dist/src/features/auth/guards/base-persmission.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"base-persmission.guard.js","sourceRoot":"","sources":["../../../../../src/features/auth/guards/base-persmission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,6CAAsD;AACtD,mEAA6E;AAC7E,2DAGoD;AAI7C,IAAe,mBAAmB,GAAlC,MAAe,mBAAmB;IAGvC,YACY,SAAoB,EACpB,OAAuB;QADvB,cAAS,GAAT,SAAS,CAAW;QACpB,YAAO,GAAP,OAAO,CAAgB;IAChC,CAAC;IAEM,kBAAkB,CAAC,OAAyB;QACpD,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAGpC,CAAC;IACP,CAAC;IAES,iBAAiB,CAAC,OAAyB;QACnD,MAAM,UAAU,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAwC;aACvE,GAAG,CAAC,IAAI,CAAC;QACZ,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAe,CAAC;QAE/C,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,IAAI;SAClB,CAAC;IACJ,CAAC;IAaD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,WAAW,GAAwB,EAAE,CAAC;QAE5C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACxC,yCAAqB,EACrB,OAAO,CAAC,QAAQ,EAAE,CACnB,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACzC,yCAAqB,EACrB,OAAO,CAAC,UAAU,EAAE,CACrB,CAAC;QAEF,IAAI,gBAAgB,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0BAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,qCAA4B,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7EqB,kDAAmB;8BAAnB,mBAAmB;IADxC,IAAA,mBAAU,GAAE;qCAKY,gBAAS;QACX,iCAAc;GALf,mBAAmB,CA6ExC"}
+{"version":3,"file":"base-persmission.guard.js","sourceRoot":"","sources":["../../../../../src/features/auth/guards/base-persmission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAOwB;AACxB,2CAA+C;AAC/C,uCAAyC;AACzC,6CAAsD;AACtD,+EAAgF;AAChF,kEAA4E;AAC5E,mEAA6E;AAC7E,2DAGoD;AAI7C,IAAe,mBAAmB,GAAlC,MAAe,mBAAmB;IAGvC,YACY,SAAoB,EACpB,OAAuB,EACvB,kBAAsC,EACtC,kBAAsC;QAHtC,cAAS,GAAT,SAAS,CAAW;QACpB,YAAO,GAAP,OAAO,CAAgB;QACvB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,uBAAkB,GAAlB,kBAAkB,CAAoB;IAC/C,CAAC;IAEM,kBAAkB,CAAC,OAAyB;QACpD,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAGpC,CAAC;IACP,CAAC;IAES,iBAAiB,CAAC,OAAyB;QACnD,MAAM,UAAU,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAwC;aACvE,GAAG,CAAC,IAAI,CAAC;QACZ,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAe,CAAC;QAE/C,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,IAAI,IAAK,EAAQ;SAC/B,CAAC;IACJ,CAAC;IAaD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0BAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,IAAI,EAAE,UAAU,KAAK,cAAc,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,IAAI,EAAE,UAAU,KAAK,aAAa,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACrE,IAAI,CAAC,0BAA0B,CAC7B,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAChC,WAAW,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,kBAAkB,CAAC,OAAyB;QAClD,MAAM,WAAW,GAAwB,EAAE,CAAC;QAE5C,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACxC,yCAAqB,EACrB,OAAO,CAAC,QAAQ,EAAE,CACnB,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACzC,yCAAqB,EACrB,OAAO,CAAC,UAAU,EAAE,CACrB,CAAC;QAEF,IAAI,gBAAgB,EAAE,CAAC;YACrB,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAEO,aAAa,CAAC,WAAgC;QACpD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;YAC3B,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,QAAQ;YACR,KAAK;YACL,QAAQ;SACT,CAAC,CAAC;QACH,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,2BAAkB,CAC1B,yBAAyB,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,OAAO,iBAAiB,CACrF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,0BAA0B,CAChC,KAAkB,EAClB,WAAgC;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,wBAAc,CAAC,IAAI,CAAC,OAAO,CAAC;qBACzB,UAAU,CACT,0BAA0B,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,OAAO,EAAE,CACvE;qBACA,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,qCAA4B,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,MAAS,EACT,WAAgC,EAChC,MAAe;QAEf,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,0BAAiB,EAAE,CAAC;gBACnC,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,qCAA4B,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,mBAAmB,CACjC,IAAoC,EACpC,MAAS;QAET,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,IAAI,mBAAyC,CAAC;QAC9C,IACE,IAAI,CAAC,WAAY,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACxC,YAAY,CAAC,UAAU;YACvB,YAAY,CAAC,SAAS,EACtB,CAAC;YACD,mBAAmB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CACpE,IAAI,CAAC,WAAY,CAAC,WAAW,EAC7B,YAAY,CAAC,SAAS,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CACnD,IAAI,CAAC,WAAY,EACjB,YAAY,EACZ,mBAAmB,CACpB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAC1B,sDAAsD,CACvD,CAAC;QACJ,CAAC;IACH,CAAC;IAES,iBAAiB,CAAC,OAAU;QAMpC,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArMqB,kDAAmB;8BAAnB,mBAAmB;IADxC,IAAA,mBAAU,GAAE;qCAKY,gBAAS;QACX,iCAAc;QACH,0CAAkB;QAClB,yCAAkB;GAP9B,mBAAmB,CAqMxC"}

package/dist/src/features/auth/guards/jwt/gql-jwt-auth-guard.service.d.ts

@@ -1,10 +1,7 @@
-import { ExecutionContext } from '@nestjs/common';
-import { NoAuthService } from '../../../../features/auth/no-auth.service';
-declare const GqlJwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
-export declare class GqlJwtAuthGuard extends GqlJwtAuthGuard_base {
-    private readonly noAuth;
-    constructor(noAuth: NoAuthService);
-    canActivate(context: ExecutionContext): boolean | Promise<boolean> | import("rxjs").Observable<boolean>;
-    getRequest(context: ExecutionContext): any;
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { GqlUniversalAuthGuard } from '../../../../features/auth/guards/universal/gql-universal-auth.guard';
+export declare class GqlJwtAuthGuard implements CanActivate {
+    private readonly universalGuard;
+    constructor(universalGuard: GqlUniversalAuthGuard);
+    canActivate(context: ExecutionContext): Promise<boolean>;
 }
-export {};

package/dist/src/features/auth/guards/jwt/gql-jwt-auth-guard.service.js

@@ -11,30 +11,18 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GqlJwtAuthGuard = void 0;
 const common_1 = require("@nestjs/common");
-const graphql_1 = require("@nestjs/graphql");
-const passport_1 = require("@nestjs/passport");
-const no_auth_service_1 = require("../../no-auth.service");
-let GqlJwtAuthGuard = class GqlJwtAuthGuard extends (0, passport_1.AuthGuard)('jwt') {
-    constructor(noAuth) {
-        super();
-        this.noAuth = noAuth;
+const gql_universal_auth_guard_1 = require("../universal/gql-universal-auth.guard");
+let GqlJwtAuthGuard = class GqlJwtAuthGuard {
+    constructor(universalGuard) {
+        this.universalGuard = universalGuard;
     }
     canActivate(context) {
-        if (this.noAuth.enabled) {
-            graphql_1.GqlExecutionContext.create(context).getContext().req.user =
-                this.noAuth.adminUser;
-            return true;
-        }
-        return super.canActivate(context);
-    }
-    getRequest(context) {
-        const ctx = graphql_1.GqlExecutionContext.create(context);
-        return ctx.getContext().req;
+        return this.universalGuard.canActivate(context);
     }
 };
 exports.GqlJwtAuthGuard = GqlJwtAuthGuard;
 exports.GqlJwtAuthGuard = GqlJwtAuthGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [no_auth_service_1.NoAuthService])
+    __metadata("design:paramtypes", [gql_universal_auth_guard_1.GqlUniversalAuthGuard])
 ], GqlJwtAuthGuard);
 //# sourceMappingURL=gql-jwt-auth-guard.service.js.map

package/dist/src/features/auth/guards/jwt/gql-jwt-auth-guard.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"gql-jwt-auth-guard.service.js","sourceRoot":"","sources":["../../../../../../src/features/auth/guards/jwt/gql-jwt-auth-guard.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA8D;AAC9D,6CAAsD;AACtD,+CAA6C;AAC7C,2DAAkE;AAG3D,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACnD,YAA6B,MAAqB;QAChD,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAAe;IAElD,CAAC;IAED,WAAW,CAAC,OAAyB;QACnC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI;gBACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,UAAU,CAAC,OAAyB;QAClC,MAAM,GAAG,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC;IAC9B,CAAC;CACF,CAAA;AAlBY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAE0B,+BAAa;GADvC,eAAe,CAkB3B"}
+{"version":3,"file":"gql-jwt-auth-guard.service.js","sourceRoot":"","sources":["../../../../../../src/features/auth/guards/jwt/gql-jwt-auth-guard.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2E;AAC3E,oFAAoG;AAG7F,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAA6B,cAAqC;QAArC,mBAAc,GAAd,cAAc,CAAuB;IAAG,CAAC;IAEtE,WAAW,CAAC,OAAyB;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AANY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEkC,gDAAqB;GADvD,eAAe,CAM3B"}