@rt-tools/auth-server 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,78 @@
-# Temporary Holding Version
+# @rt-tools/auth-server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/Eyhenij/rt-tools/blob/main/LICENSE)
+
+The server side of the entry module: the Keycloak token check, an access declaration on every
+operation and the sync of the admin's rights to Keycloak. One check serves NestJS controllers and
+Connect procedures.
+
+## Connecting
+
+```ts
+import { definePermissions } from '@rt-tools/auth-contract';
+import { AuthServerModule } from '@rt-tools/auth-server';
+
+export const RIGHTS = definePermissions({ orders: ['read', 'write'] });
+
+@Module({
+    imports: [
+        AuthServerModule.forRoot({
+            issuer: 'https://sso.example.com/realms/rt',
+            clientId: 'orders-admin',
+            catalog: RIGHTS,
+            sync: { baseUrl: 'https://sso.example.com', realm: 'rt', syncClientId: 'rt-catalog-sync', syncClientSecret: process.env.SYNC_SECRET },
+        }),
+    ],
+})
+export class AppModule {}
+```
+
+The module puts a guard on every route. At start it checks that every operation declares exactly
+one access. When `sync` is given, it also sends the catalog to Keycloak.
+
+## Access
+
+```ts
+@Get()
+@PermittedOperation('orders:read')
+public list(@CurrentCaller() caller: ICaller): Order[] { … }
+```
+
+| Decorator                         | The operation is open to      |
+| --------------------------------- | ----------------------------- |
+| `@OpenOperation()`              | everyone, without a token     |
+| `@SignedInOperation()`            | anyone with an accepted token |
+| `@PermittedOperation(permission)` | a caller with the right       |
+
+An operation with no declaration or with two stops the start and is named. A call without an
+accepted token gets 401, a call without the right gets 403. Neither names the right.
+
+A token is accepted when the realm signed it by its key and named itself the issuer. Its term must
+hold, and it must be issued to the client of this admin (`azp`). The keys are fetched from the
+realm and cached.
+
+## Connect
+
+```ts
+const entries = connectAccessEntries(OrdersService, {
+    listOrders: { kind: 'permission', permission: 'orders:read' },
+    health: { kind: 'public' },
+});
+const interceptor = createAuthInterceptor(app.get(AUTH_TOKEN_VERIFIER), entries);
+```
+
+The map names every method of the service exactly once, otherwise `connectAccessEntries` throws.
+The refusals are `unauthenticated` and `permission_denied`. A procedure reads the caller with
+`context.values.get(CONNECT_CALLER)`.
+
+## The catalog sync
+
+`syncPermissionCatalog` creates the roles the client of the admin lacks and removes none. Removing
+a role takes it from every person who holds it. The rights Keycloak holds beyond the catalog are
+named in the log. The sync client needs a service account with `view-clients` and `manage-clients`.
+
+## Connecting it to an application
+
+The order of the whole connection is in the guide of the module.
+It covers Keycloak, the server, the admin, the entry screens and the move of people:
+[docs/auth-integration.md](https://github.com/Eyhenij/rt-tools/blob/main/docs/auth-integration.md).

package/cjs/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./lib/access.js"), exports);
+tslib_1.__exportStar(require("./lib/access-audit.js"), exports);
+tslib_1.__exportStar(require("./lib/auth-server.module.js"), exports);
+tslib_1.__exportStar(require("./lib/auth.guard.js"), exports);
+tslib_1.__exportStar(require("./lib/auth.tokens.js"), exports);
+tslib_1.__exportStar(require("./lib/catalog-sync.js"), exports);
+tslib_1.__exportStar(require("./lib/connect-access.js"), exports);
+tslib_1.__exportStar(require("./lib/current-caller.decorator.js"), exports);
+tslib_1.__exportStar(require("./lib/token-verifier.js"), exports);
+//# sourceMappingURL=index.js.map

package/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../projects/auth-server/src/index.ts"],"names":[],"mappings":";;;AAAA,0DAAgC;AAChC,gEAAsC;AACtC,sEAA4C;AAC5C,8DAAoC;AACpC,+DAAqC;AACrC,gEAAsC;AACtC,kEAAwC;AACxC,4EAAkD;AAClD,kEAAwC"}

package/cjs/lib/access-audit.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.undeclaredAccess = undeclaredAccess;
+exports.accessAuditError = accessAuditError;
+const constants_1 = require("@nestjs/common/constants");
+const access_1 = require("./access");
+function isRoute(handler) {
+    return Reflect.getMetadata(constants_1.PATH_METADATA, handler) !== undefined && Reflect.getMetadata(constants_1.METHOD_METADATA, handler) !== undefined;
+}
+/**
+ * The route handlers of the controllers that declare no access or more than one, as
+ * `Controller.method — none` / `— 2`.
+ *
+ * A handler is a prototype method with a route mark of the framework. An empty list means every
+ * handler declares exactly one access.
+ */
+function undeclaredAccess(controllers) {
+    const faults = [];
+    for (const controller of controllers) {
+        const prototype = controller.prototype;
+        for (const name of Object.getOwnPropertyNames(prototype)) {
+            const handler = Reflect.get(prototype, name);
+            if (name === 'constructor' || typeof handler !== 'function' || !isRoute(handler)) {
+                continue;
+            }
+            const count = (0, access_1.accessDeclarationsOf)(handler).length;
+            if (count !== 1) {
+                faults.push(`${controller.name}.${name} — ${count === 0 ? 'none' : String(count)}`);
+            }
+        }
+    }
+    return faults;
+}
+/** The refusal of the start, naming every faulty operation at once. */
+function accessAuditError(faults) {
+    const lines = faults.map((fault) => '  ' + fault).join('\n');
+    return new Error(`Every operation declares exactly one access; these do not:\n${lines}`);
+}
+//# sourceMappingURL=access-audit.js.map

package/cjs/lib/access-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-audit.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access-audit.ts"],"names":[],"mappings":";;AAkBA,4CAgBC;AAGD,4CAGC;AAxCD,wDAA0E;AAE1E,qCAAgD;AAKhD,SAAS,OAAO,CAAC,OAAe;IAC5B,OAAO,OAAO,CAAC,WAAW,CAAC,yBAAa,EAAE,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,2BAAe,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC;AACpI,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,WAAwC;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,SAAS,GAAW,UAAU,CAAC,SAAmB,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,aAAa,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,SAAS;YACb,CAAC;YACD,MAAM,KAAK,GAAW,IAAA,6BAAoB,EAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,MAAyB;IACtD,MAAM,KAAK,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,IAAI,KAAK,CAAC,+DAA+D,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC"}

package/cjs/lib/access.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESS_DECLARATIONS = void 0;
+exports.accessDeclarationsOf = accessDeclarationsOf;
+exports.OpenOperation = OpenOperation;
+exports.SignedInOperation = SignedInOperation;
+exports.PermittedOperation = PermittedOperation;
+require("reflect-metadata");
+/** The key the declarations of a handler lie under: a list, so a second one is seen, not lost. */
+exports.ACCESS_DECLARATIONS = 'rt-tools.auth.access';
+/** The declarations of a handler, in the order written. */
+function accessDeclarationsOf(handler) {
+    const declared = Reflect.getMetadata(exports.ACCESS_DECLARATIONS, handler);
+    return Array.isArray(declared) ? declared : [];
+}
+function declare(access) {
+    return (_target, _key, descriptor) => {
+        const handler = descriptor.value;
+        Reflect.defineMetadata(exports.ACCESS_DECLARATIONS, [...accessDeclarationsOf(handler), access], handler);
+    };
+}
+/* eslint-disable sonarjs/function-name -- decorator factories are named with a capital letter: so the framework names them, and so they read at the place of use */
+/** The operation is open to everyone, without a token. */
+function OpenOperation() {
+    return declare({ kind: 'public' });
+}
+/** The operation is open to anyone with an accepted token. */
+function SignedInOperation() {
+    return declare({ kind: 'signed-in' });
+}
+/** The operation is open to a caller with the right. */
+function PermittedOperation(permission) {
+    return declare({ kind: 'permission', permission });
+}
+/* eslint-enable sonarjs/function-name */
+//# sourceMappingURL=access.js.map

package/cjs/lib/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access.ts"],"names":[],"mappings":";;;AAoBA,oDAGC;AAYD,sCAEC;AAGD,8CAEC;AAGD,gDAEC;AA/CD,4BAA0B;AAgB1B,kGAAkG;AACrF,QAAA,mBAAmB,GAAW,sBAAsB,CAAC;AAElE,2DAA2D;AAC3D,SAAgB,oBAAoB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAY,OAAO,CAAC,WAAW,CAAC,2BAAmB,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,MAAe;IAC5B,OAAO,CAAC,OAAe,EAAE,IAAqB,EAAE,UAA8B,EAAQ,EAAE;QACpF,MAAM,OAAO,GAAW,UAAU,CAAC,KAAe,CAAC;QACnD,OAAO,CAAC,cAAc,CAAC,2BAAmB,EAAE,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACrG,CAAC,CAAC;AACN,CAAC;AAED,oKAAoK;AAEpK,0DAA0D;AAC1D,SAAgB,aAAa;IACzB,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,8DAA8D;AAC9D,SAAgB,iBAAiB;IAC7B,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,wDAAwD;AACxD,SAAgB,kBAAkB,CAAC,UAAuB;IACtD,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,yCAAyC"}

package/cjs/lib/auth-server.module.js

@@ -0,0 +1,71 @@
+"use strict";
+var AuthServerModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthServerModule = exports.AuthStartCheck = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const access_audit_1 = require("./access-audit");
+const auth_guard_1 = require("./auth.guard");
+const auth_tokens_1 = require("./auth.tokens");
+const catalog_sync_1 = require("./catalog-sync");
+const token_verifier_1 = require("./token-verifier");
+/**
+ * At start: every operation declares exactly one access, and the catalog reaches Keycloak.
+ *
+ * An operation without a declaration or with two stops the start and is named; the catalog sync
+ * creates the roles Keycloak lacks and names the extra ones in the log.
+ */
+class AuthStartCheck {
+    #discovery;
+    #options;
+    #logger = new common_1.Logger('AuthServer');
+    constructor(discovery, options) {
+        this.#discovery = discovery;
+        this.#options = options;
+    }
+    async onApplicationBootstrap() {
+        const controllers = this.#discovery
+            .getControllers()
+            .map((wrapper) => wrapper.metatype)
+            .filter((metatype) => typeof metatype === 'function');
+        const faults = (0, access_audit_1.undeclaredAccess)(controllers);
+        if (faults.length) {
+            throw (0, access_audit_1.accessAuditError)(faults);
+        }
+        if (this.#options.sync) {
+            const result = await (0, catalog_sync_1.syncPermissionCatalog)({ ...this.#options.sync, clientId: this.#options.clientId }, this.#options.catalog);
+            this.#logger.log(`catalog: ${this.#options.catalog.length} rights, created ${result.created.length}`);
+            if (result.extra.length) {
+                this.#logger.warn(`Keycloak holds rights the catalog lacks: ${result.extra.join(', ')}`);
+            }
+        }
+    }
+}
+exports.AuthStartCheck = AuthStartCheck;
+/** The entry module of an admin server: the token check, the guard and the start check. */
+let AuthServerModule = AuthServerModule_1 = class AuthServerModule {
+    static forRoot(options) {
+        return {
+            module: AuthServerModule_1,
+            global: true,
+            imports: [core_1.DiscoveryModule],
+            providers: [
+                { provide: auth_tokens_1.AUTH_SERVER_OPTIONS, useValue: options },
+                { provide: auth_tokens_1.AUTH_TOKEN_VERIFIER, useValue: new token_verifier_1.KeycloakTokenVerifier(options) },
+                { provide: core_1.APP_GUARD, useClass: auth_guard_1.AuthGuard },
+                {
+                    provide: AuthStartCheck,
+                    useFactory: (discovery) => new AuthStartCheck(discovery, options),
+                    inject: [core_1.DiscoveryService],
+                },
+            ],
+            exports: [auth_tokens_1.AUTH_TOKEN_VERIFIER],
+        };
+    }
+};
+exports.AuthServerModule = AuthServerModule;
+exports.AuthServerModule = AuthServerModule = AuthServerModule_1 = tslib_1.__decorate([
+    (0, common_1.Module)({})
+], AuthServerModule);
+//# sourceMappingURL=auth-server.module.js.map

package/cjs/lib/auth-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-server.module.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth-server.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAAuF;AACvF,uCAA4E;AAK5E,iDAAsF;AACtF,6CAAyC;AACzC,+CAAyE;AACzE,iDAAgG;AAChG,qDAA6E;AAU7E;;;;;GAKG;AACH,MAAa,cAAc;IACd,UAAU,CAAmB;IAC7B,QAAQ,CAAqB;IAC7B,OAAO,GAAW,IAAI,eAAM,CAAC,YAAY,CAAC,CAAC;IAEpD,YAAY,SAA2B,EAAE,OAA2B;QAChE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,sBAAsB;QAC/B,MAAM,WAAW,GAAuB,IAAI,CAAC,UAAU;aAClD,cAAc,EAAE;aAChB,GAAG,CAAC,CAAC,OAAwB,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;aAC5D,MAAM,CAAC,CAAC,QAAiB,EAAgC,EAAE,CAAC,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC;QACjG,MAAM,MAAM,GAAsB,IAAA,+BAAgB,EAAC,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAA,+BAAgB,EAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAuB,MAAM,IAAA,oCAAqB,EAC1D,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CACxB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,oBAAoB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AA9BD,wCA8BC;AAED,2FAA2F;AAEpF,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAClB,MAAM,CAAC,OAAO,CAAC,OAA2B;QAC7C,OAAO;YACH,MAAM,EAAE,kBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,sBAAe,CAAC;YAC1B,SAAS,EAAE;gBACP,EAAE,OAAO,EAAE,iCAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnD,EAAE,OAAO,EAAE,iCAAmB,EAAE,QAAQ,EAAE,IAAI,sCAAqB,CAAC,OAAO,CAAC,EAAE;gBAC9E,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,sBAAS,EAAE;gBAC3C;oBACI,OAAO,EAAE,cAAc;oBACvB,UAAU,EAAE,CAAC,SAA2B,EAAkB,EAAE,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC;oBACnG,MAAM,EAAE,CAAC,uBAAgB,CAAC;iBAC7B;aACJ;YACD,OAAO,EAAE,CAAC,iCAAmB,CAAC;SACjC,CAAC;IACN,CAAC;CACJ,CAAA;AAnBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CAmB5B"}

package/cjs/lib/auth.guard.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_contract_1 = require("@rt-tools/auth-contract");
+const access_1 = require("./access");
+const auth_tokens_1 = require("./auth.tokens");
+/**
+ * The only access check of an admin server. **Closed by default.**
+ *
+ * Two refusals, told apart by the question: no accepted token is «not signed in» (401) and is
+ * cured by signing in; a token without the right is «not allowed» (403) and is not. Neither names
+ * the missing right or what in the token did not match.
+ */
+let AuthGuard = class AuthGuard {
+    #verifier;
+    constructor(verifier) {
+        this.#verifier = verifier;
+    }
+    async canActivate(context) {
+        const declared = (0, access_1.accessDeclarationsOf)(context.getHandler());
+        if (declared.length !== 1) {
+            // The start audit stops such an application; a handler that slipped past it is refused
+            // rather than opened by a guess.
+            throw new common_1.UnauthorizedException();
+        }
+        const access = declared[0];
+        if (access.kind === 'public') {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const header = request.headers['authorization'];
+        const caller = await this.#verifier.callerOf(typeof header === 'string' ? header : null);
+        if (!caller) {
+            throw new common_1.UnauthorizedException();
+        }
+        if (access.kind === 'permission' && !(0, auth_contract_1.hasPermission)(caller, access.permission)) {
+            throw new common_1.ForbiddenException();
+        }
+        request[auth_tokens_1.REQUEST_CALLER] = caller;
+        return true;
+    }
+};
+exports.AuthGuard = AuthGuard;
+exports.AuthGuard = AuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(auth_tokens_1.AUTH_TOKEN_VERIFIER)),
+    tslib_1.__metadata("design:paramtypes", [Function])
+], AuthGuard);
+//# sourceMappingURL=auth.guard.js.map

package/cjs/lib/auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAA8H;AAE9H,2DAAiE;AAEjE,qCAAyD;AACzD,+CAAoE;AASpE;;;;;;GAMG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACT,SAAS,CAAwB;IAE1C,YAAyC,QAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAyB;QAC9C,MAAM,QAAQ,GAAuB,IAAA,6BAAoB,EAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,uFAAuF;YACvF,iCAAiC;YACjC,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAY,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAiB,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAgB,CAAC;QAChF,MAAM,MAAM,GAAkC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAmB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAA,6BAAa,EAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,4BAAc,CAAC,GAAG,MAAM,CAAC;QACjC,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA9BY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAII,mBAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;;GAH/B,SAAS,CA8BrB"}

package/cjs/lib/auth.tokens.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUEST_CALLER = exports.AUTH_SERVER_OPTIONS = exports.AUTH_TOKEN_VERIFIER = void 0;
+/** The token check of the admin, provided by the module. */
+exports.AUTH_TOKEN_VERIFIER = Symbol('rt-tools.auth.token-verifier');
+/** The options the module was configured with. */
+exports.AUTH_SERVER_OPTIONS = Symbol('rt-tools.auth.options');
+/** The field of the request the guard puts the caller into. */
+exports.REQUEST_CALLER = Symbol('rt-tools.auth.caller');
+//# sourceMappingURL=auth.tokens.js.map

package/cjs/lib/auth.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.tokens.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.tokens.ts"],"names":[],"mappings":";;;AAAA,4DAA4D;AAC/C,QAAA,mBAAmB,GAAkB,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAEzF,kDAAkD;AACrC,QAAA,mBAAmB,GAAkB,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAElF,+DAA+D;AAClD,QAAA,cAAc,GAAkB,MAAM,CAAC,sBAAsB,CAAC,CAAC"}

package/cjs/lib/catalog-sync.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncPermissionCatalog = syncPermissionCatalog;
+const auth_contract_1 = require("@rt-tools/auth-contract");
+async function answer(response, step) {
+    if (!response.ok) {
+        throw new Error(`The catalog sync stopped at ${step}: Keycloak answered ${response.status}`);
+    }
+    return (await response.json());
+}
+/**
+ * Sends the rights of an admin to Keycloak as roles of its client.
+ *
+ * Creates the roles Keycloak lacks and removes none: removing a role takes it from every person
+ * who holds it. The rights Keycloak holds beyond the catalog come back as `extra` for the log.
+ */
+async function syncPermissionCatalog(options, catalog, request = fetch) {
+    const base = `${options.baseUrl}/realms/${options.realm}`;
+    const admin = `${options.baseUrl}/admin/realms/${options.realm}`;
+    const token = await answer(await request(`${base}/protocol/openid-connect/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'client_credentials',
+            client_id: options.syncClientId,
+            client_secret: options.syncClientSecret,
+        }),
+    }), 'the token');
+    const headers = { authorization: `Bearer ${token.access_token}`, 'content-type': 'application/json' };
+    const clients = await answer(await request(`${admin}/clients?clientId=${encodeURIComponent(options.clientId)}`, { headers }), 'the client');
+    if (clients.length !== 1) {
+        throw new Error(`The catalog sync stopped at the client: the realm has no client ${options.clientId}`);
+    }
+    const rolesUrl = `${admin}/clients/${clients[0].id}/roles`;
+    const held = new Set((await answer(await request(rolesUrl, { headers }), 'the roles')).map((role) => role.name));
+    const created = [];
+    for (const permission of catalog) {
+        if (held.has(permission)) {
+            continue;
+        }
+        const response = await request(rolesUrl, { method: 'POST', body: JSON.stringify({ name: permission }), headers });
+        if (!response.ok && response.status !== 409) {
+            throw new Error(`The catalog sync stopped at the role ${permission}: Keycloak answered ${response.status}`);
+        }
+        created.push(permission);
+    }
+    const wanted = new Set(catalog);
+    // Keycloak adds roles of its own to a client; only a role of the right shape counts as extra.
+    return { extra: [...held].filter((role) => (0, auth_contract_1.isPermission)(role) && !wanted.has(role)), created };
+}
+//# sourceMappingURL=catalog-sync.js.map

package/cjs/lib/catalog-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-sync.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/catalog-sync.ts"],"names":[],"mappings":";;AAmCA,sDA+CC;AAlFD,2DAAoE;AAsBpE,KAAK,UAAU,MAAM,CAAI,QAAkB,EAAE,IAAY;IACrD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,qBAAqB,CACvC,OAA4B,EAC5B,OAA+B,EAC/B,UAAkB,KAAK;IAEvB,MAAM,IAAI,GAAW,GAAG,OAAO,CAAC,OAAO,WAAW,OAAO,CAAC,KAAK,EAAE,CAAC;IAClE,MAAM,KAAK,GAAW,GAAG,OAAO,CAAC,OAAO,iBAAiB,OAAO,CAAC,KAAK,EAAE,CAAC;IACzE,MAAM,KAAK,GAA6B,MAAM,MAAM,CAChD,MAAM,OAAO,CAAC,GAAG,IAAI,gCAAgC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACtB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,OAAO,CAAC,YAAY;YAC/B,aAAa,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC;KACL,CAAC,EACF,WAAW,CACd,CAAC;IACF,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC9H,MAAM,OAAO,GAAqB,MAAM,MAAM,CAC1C,MAAM,OAAO,CAAC,GAAG,KAAK,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAC/F,YAAY,CACf,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAW,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACnE,MAAM,IAAI,GAAgB,IAAI,GAAG,CAC7B,CAAC,MAAM,MAAM,CAAqB,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CACrF,CAAC,IAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAChD,CACJ,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvB,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAa,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5H,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAgB,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC;IACrD,8FAA8F;IAC9F,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAA,4BAAY,EAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AACpH,CAAC"}

package/cjs/lib/connect-access.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONNECT_CALLER = void 0;
+exports.connectAccessEntries = connectAccessEntries;
+exports.createAuthInterceptor = createAuthInterceptor;
+const connect_1 = require("@connectrpc/connect");
+const auth_contract_1 = require("@rt-tools/auth-contract");
+/** The caller the interceptor accepted, read by a procedure from its context values. */
+exports.CONNECT_CALLER = (0, connect_1.createContextKey)(null, { description: 'rt-tools.auth.caller' });
+/**
+ * The accesses of one service as entries `typeName/MethodName`, checked against its description.
+ *
+ * Every method declares exactly one access, and a key that names no method is refused too: both
+ * would otherwise show only to the person who calls the method.
+ */
+function connectAccessEntries(service, access) {
+    const names = new Set(service.methods.map((method) => method.localName));
+    const missing = [...names].filter((name) => !(name in access));
+    const unknown = Object.keys(access).filter((name) => !names.has(name));
+    if (missing.length || unknown.length) {
+        throw new Error(`Every method of ${service.typeName} declares exactly one access; missing: ${missing.join(', ') || 'none'}; unknown: ${unknown.join(', ') || 'none'}`);
+    }
+    return service.methods.map((method) => [
+        `${service.typeName}/${method.name}`,
+        access[method.localName],
+    ]);
+}
+/**
+ * The Connect interceptor of an admin server: the same token check as the NestJS guard, and the
+ * same two refusals — `unauthenticated` and `permission_denied` — without naming the right.
+ *
+ * A method the map does not name is refused: the map is closed by default, as the guard is.
+ */
+function createAuthInterceptor(verifier, entries) {
+    const accessOf = new Map(entries);
+    return (next) => async (request) => {
+        const access = accessOf.get(`${request.method.parent.typeName}/${request.method.name}`);
+        if (!access) {
+            throw new connect_1.ConnectError('unauthenticated', connect_1.Code.Unauthenticated);
+        }
+        if (access.kind !== 'public') {
+            const caller = await verifier.callerOf(request.header.get('authorization'));
+            if (!caller) {
+                throw new connect_1.ConnectError('unauthenticated', connect_1.Code.Unauthenticated);
+            }
+            if (access.kind === 'permission' && !(0, auth_contract_1.hasPermission)(caller, access.permission)) {
+                throw new connect_1.ConnectError('permission denied', connect_1.Code.PermissionDenied);
+            }
+            request.contextValues.set(exports.CONNECT_CALLER, caller);
+        }
+        return next(request);
+    };
+}
+//# sourceMappingURL=connect-access.js.map

package/cjs/lib/connect-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-access.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/connect-access.ts"],"names":[],"mappings":";;;AAyBA,oDAgBC;AAQD,sDAmBC;AApED,iDAAiI;AAEjI,2DAAiE;AAcjE,wFAAwF;AAC3E,QAAA,cAAc,GAA+B,IAAA,0BAAgB,EAAiB,IAAI,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAE1I;;;;;GAKG;AACH,SAAgB,oBAAoB,CAChC,OAA4B,EAC5B,MAAyC;IAEzC,MAAM,KAAK,GAAgB,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAA6B,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACrH,MAAM,OAAO,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,CAAC,QAAQ,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CACxJ,CAAC;IACN,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAA2C,EAAqB,EAAE,CAAC;QAC3F,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KAC3B,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,QAA+B,EAAE,OAAgD;IACnH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,IAAgC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAqC,EAAE,EAAE;QACzF,MAAM,MAAM,GAAwB,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,sBAAY,CAAC,iBAAiB,EAAE,cAAI,CAAC,eAAe,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmB,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,sBAAY,CAAC,iBAAiB,EAAE,cAAI,CAAC,eAAe,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,IAAA,6BAAa,EAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,sBAAY,CAAC,mBAAmB,EAAE,cAAI,CAAC,gBAAgB,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,sBAAc,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC;AACN,CAAC"}

package/cjs/lib/current-caller.decorator.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentCaller = void 0;
+exports.callerOfRequest = callerOfRequest;
+const common_1 = require("@nestjs/common");
+const auth_tokens_1 = require("./auth.tokens");
+/** The caller the guard accepted; `undefined` on an operation open to everyone. */
+function callerOfRequest(request) {
+    const caller = Reflect.get(request, auth_tokens_1.REQUEST_CALLER);
+    return caller === undefined ? undefined : caller;
+}
+/** A handler parameter that receives the caller the guard accepted. */
+exports.CurrentCaller = (0, common_1.createParamDecorator)((_data, context) => callerOfRequest(context.switchToHttp().getRequest()));
+//# sourceMappingURL=current-caller.decorator.js.map

package/cjs/lib/current-caller.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-caller.decorator.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/current-caller.decorator.ts"],"names":[],"mappings":";;;AAOA,0CAGC;AAVD,2CAAwE;AAIxE,+CAA+C;AAE/C,mFAAmF;AACnF,SAAgB,eAAe,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,4BAAc,CAAC,CAAC;IAC7D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,MAAkB,CAAC;AAClE,CAAC;AAED,uEAAuE;AAC1D,QAAA,aAAa,GAA6B,IAAA,6BAAoB,EACvE,CAAC,KAAc,EAAE,OAAyB,EAAuB,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAU,CAAC,CACnI,CAAC"}

package/cjs/lib/testing/keys.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEST_CLIENT = exports.TEST_ISSUER = void 0;
+exports.testRealm = testRealm;
+exports.personClaims = personClaims;
+const jose_1 = require("jose");
+/** The realm of the tests. */
+exports.TEST_ISSUER = 'http://localhost:58080/realms/rt';
+exports.TEST_CLIENT = 'orders-admin';
+async function testRealm() {
+    const own = await (0, jose_1.generateKeyPair)('RS256');
+    const foreign = await (0, jose_1.generateKeyPair)('RS256');
+    const jwk = { ...(await (0, jose_1.exportJWK)(own.publicKey)), kid: 'own', alg: 'RS256', use: 'sig' };
+    return {
+        keys: (0, jose_1.createLocalJWKSet)({ keys: [jwk] }),
+        sign: async (claims, options = {}) => new jose_1.SignJWT(claims)
+            .setProtectedHeader({ alg: 'RS256', kid: 'own' })
+            .setIssuer(options.issuer ?? exports.TEST_ISSUER)
+            .setIssuedAt()
+            .setExpirationTime(options.expiresIn ?? '5m')
+            .sign(options.foreignKey ? foreign.privateKey : own.privateKey),
+    };
+}
+/** The claims of a person with the given roles in the test client, issued to it. */
+function personClaims(roles, azp = exports.TEST_CLIENT) {
+    return { sub: 'p-1', email: 'anna@example.com', resource_access: { [exports.TEST_CLIENT]: { roles } }, azp };
+}
+//# sourceMappingURL=keys.js.map

package/cjs/lib/testing/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../projects/auth-server/src/lib/testing/keys.ts"],"names":[],"mappings":";;;AAYA,8BAiBC;AAGD,oCAEC;AAlCD,+BAAoG;AAEpG,8BAA8B;AACjB,QAAA,WAAW,GAAW,kCAAkC,CAAC;AACzD,QAAA,WAAW,GAAW,cAAc,CAAC;AAQ3C,KAAK,UAAU,SAAS;IAC3B,MAAM,GAAG,GAAkB,MAAM,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAkB,MAAM,IAAA,sBAAe,EAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAQ,EAAE,GAAG,CAAC,MAAM,IAAA,gBAAS,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC/F,OAAO;QACH,IAAI,EAAE,IAAA,wBAAiB,EAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,KAAK,EACP,MAA+B,EAC/B,UAAyE,EAAE,EAC5D,EAAE,CACjB,IAAI,cAAO,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChD,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,mBAAW,CAAC;aACxC,WAAW,EAAE;aACb,iBAAiB,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;aAC5C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAC1E,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,SAAgB,YAAY,CAAC,KAAwB,EAAE,MAAc,mBAAW;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,EAAE,CAAC,mBAAW,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACzG,CAAC"}

package/cjs/lib/token-verifier.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakTokenVerifier = void 0;
+exports.bearerToken = bearerToken;
+const jose_1 = require("jose");
+const auth_contract_1 = require("@rt-tools/auth-contract");
+const BEARER = /^Bearer ([A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+)$/;
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+function bearerToken(authorization) {
+    const match = BEARER.exec(authorization?.trim() ?? '');
+    return match ? match[1] : null;
+}
+function resourceAccessOf(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const access = {};
+    for (const [clientId, entry] of Object.entries(value)) {
+        const roles = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;
+        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role) => typeof role === 'string') : [] };
+    }
+    return access;
+}
+/** The claims the caller is read from, taken from a verified payload by their shape. */
+function claimsOf(payload) {
+    return {
+        sub: String(payload.sub),
+        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,
+        email_verified: payload['email_verified'] === true,
+        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,
+        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,
+        resource_access: resourceAccessOf(payload['resource_access']),
+    };
+}
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin (`azp`). Every other case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+class KeycloakTokenVerifier {
+    #options;
+    #keys;
+    constructor(options, keys) {
+        this.#options = options;
+        this.#keys = keys ?? (0, jose_1.createRemoteJWKSet)(new URL(`${options.issuer}/protocol/openid-connect/certs`));
+    }
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    async callerOf(authorization) {
+        const token = bearerToken(authorization);
+        if (!token) {
+            return null;
+        }
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, this.#keys, { issuer: this.#options.issuer });
+            if (payload['azp'] !== this.#options.clientId || typeof payload.sub !== 'string') {
+                return null;
+            }
+            return (0, auth_contract_1.callerFromClaims)(claimsOf(payload), this.#options.clientId);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.KeycloakTokenVerifier = KeycloakTokenVerifier;
+//# sourceMappingURL=token-verifier.js.map

package/cjs/lib/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":";;;AAeA,kCAGC;AAlBD,+BAAkF;AAElF,2DAAqF;AAUrF,MAAM,MAAM,GAAW,8DAA8D,CAAC;AAEtF,uGAAuG;AACvG,SAAgB,WAAW,CAAC,aAAwC;IAChE,MAAM,KAAK,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,OAAmB;IACjC,OAAO;QACH,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAClD,IAAI,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,kBAAkB,EAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KAChE,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAa,qBAAqB;IACrB,QAAQ,CAAqB;IAC7B,KAAK,CAAkB;IAEhC,YAAY,OAA2B,EAAE,IAAsB;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,QAAQ,CAAC,aAAwC;QAC1D,MAAM,KAAK,GAAkB,WAAW,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAA,gCAAgB,EAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;CACJ;AAzBD,sDAyBC"}

package/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/esm/index.d.ts

@@ -0,0 +1,10 @@
+export * from './lib/access.js';
+export * from './lib/access-audit.js';
+export * from './lib/auth-server.module.js';
+export * from './lib/auth.guard.js';
+export * from './lib/auth.tokens.js';
+export * from './lib/catalog-sync.js';
+export * from './lib/connect-access.js';
+export * from './lib/current-caller.decorator.js';
+export * from './lib/token-verifier.js';
+//# sourceMappingURL=index.d.ts.map

package/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../projects/auth-server/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,yBAAyB,CAAC"}

package/esm/index.js

@@ -0,0 +1,10 @@
+export * from './lib/access.js';
+export * from './lib/access-audit.js';
+export * from './lib/auth-server.module.js';
+export * from './lib/auth.guard.js';
+export * from './lib/auth.tokens.js';
+export * from './lib/catalog-sync.js';
+export * from './lib/connect-access.js';
+export * from './lib/current-caller.decorator.js';
+export * from './lib/token-verifier.js';
+//# sourceMappingURL=index.js.map

package/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../projects/auth-server/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,yBAAyB,CAAC","sourcesContent":["export * from './lib/access.js';\nexport * from './lib/access-audit.js';\nexport * from './lib/auth-server.module.js';\nexport * from './lib/auth.guard.js';\nexport * from './lib/auth.tokens.js';\nexport * from './lib/catalog-sync.js';\nexport * from './lib/connect-access.js';\nexport * from './lib/current-caller.decorator.js';\nexport * from './lib/token-verifier.js';\n"]}