@rt-tools/auth-server 0.0.0-stage → 0.2.0

package/cjs/lib/token-verifier.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakTokenVerifier = void 0;
+exports.bearerToken = bearerToken;
+const jose_1 = require("jose");
+const auth_contract_1 = require("@rt-tools/auth-contract");
+const BEARER = /^Bearer ([A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+)$/;
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+function bearerToken(authorization) {
+    const match = BEARER.exec(authorization?.trim() ?? '');
+    return match ? match[1] : null;
+}
+function resourceAccessOf(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const access = {};
+    for (const [clientId, entry] of Object.entries(value)) {
+        const roles = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;
+        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role) => typeof role === 'string') : [] };
+    }
+    return access;
+}
+/** The claims the caller is read from, taken from a verified payload by their shape. */
+function claimsOf(payload) {
+    return {
+        sub: String(payload.sub),
+        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,
+        email_verified: payload['email_verified'] === true,
+        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,
+        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,
+        resource_access: resourceAccessOf(payload['resource_access']),
+    };
+}
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin or to a service client it names (`azp`). Every other
+ * case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+class KeycloakTokenVerifier {
+    #options;
+    #keys;
+    constructor(options, keys) {
+        this.#options = options;
+        this.#keys = keys ?? (0, jose_1.createRemoteJWKSet)(new URL(options.keysUrl ?? `${options.issuer}/protocol/openid-connect/certs`));
+    }
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    async callerOf(authorization) {
+        const token = bearerToken(authorization);
+        if (!token) {
+            return null;
+        }
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, this.#keys, { issuer: this.#options.issuer });
+            if (!this.#accepts(payload['azp']) || typeof payload.sub !== 'string') {
+                return null;
+            }
+            return (0, auth_contract_1.callerFromClaims)(claimsOf(payload), this.#options.clientId);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Whether a token issued to this client is accepted: the client of this admin or a service client it names. */
+    #accepts(azp) {
+        return azp === this.#options.clientId || (typeof azp === 'string' && (this.#options.serviceClients ?? []).includes(azp));
+    }
+}
+exports.KeycloakTokenVerifier = KeycloakTokenVerifier;
+//# sourceMappingURL=token-verifier.js.map

package/cjs/lib/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":";;;AA0BA,kCAGC;AA7BD,+BAAkF;AAElF,2DAAqF;AAqBrF,MAAM,MAAM,GAAW,8DAA8D,CAAC;AAEtF,uGAAuG;AACvG,SAAgB,WAAW,CAAC,aAAwC;IAChE,MAAM,KAAK,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,OAAmB;IACjC,OAAO;QACH,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAClD,IAAI,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,kBAAkB,EAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KAChE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAa,qBAAqB;IACrB,QAAQ,CAAqB;IAC7B,KAAK,CAAkB;IAEhC,YAAY,OAA2B,EAAE,IAAsB;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC;IAC3H,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,QAAQ,CAAC,aAAwC;QAC1D,MAAM,KAAK,GAAkB,WAAW,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,IAAA,gCAAgB,EAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,gHAAgH;IAChH,QAAQ,CAAC,GAAY;QACjB,OAAO,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7H,CAAC;CACJ;AA9BD,sDA8BC"}

package/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/esm/index.d.ts

@@ -0,0 +1,11 @@
+export * from './lib/access.js';
+export * from './lib/access-audit.js';
+export * from './lib/auth-server.module.js';
+export * from './lib/auth.guard.js';
+export * from './lib/auth.tokens.js';
+export * from './lib/catalog-sync.js';
+export * from './lib/connect-access.js';
+export * from './lib/current-caller.decorator.js';
+export * from './lib/env-options.js';
+export * from './lib/token-verifier.js';
+//# sourceMappingURL=index.d.ts.map

package/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../projects/auth-server/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC"}

package/esm/index.js

@@ -0,0 +1,11 @@
+export * from './lib/access.js';
+export * from './lib/access-audit.js';
+export * from './lib/auth-server.module.js';
+export * from './lib/auth.guard.js';
+export * from './lib/auth.tokens.js';
+export * from './lib/catalog-sync.js';
+export * from './lib/connect-access.js';
+export * from './lib/current-caller.decorator.js';
+export * from './lib/env-options.js';
+export * from './lib/token-verifier.js';
+//# sourceMappingURL=index.js.map

package/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../projects/auth-server/src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC","sourcesContent":["export * from './lib/access.js';\nexport * from './lib/access-audit.js';\nexport * from './lib/auth-server.module.js';\nexport * from './lib/auth.guard.js';\nexport * from './lib/auth.tokens.js';\nexport * from './lib/catalog-sync.js';\nexport * from './lib/connect-access.js';\nexport * from './lib/current-caller.decorator.js';\nexport * from './lib/env-options.js';\nexport * from './lib/token-verifier.js';\n"]}

package/esm/lib/access-audit.d.ts

@@ -0,0 +1,13 @@
+/** A class whose prototype holds the route handlers. */
+export type TControllerClass = abstract new (...args: never[]) => object;
+/**
+ * The route handlers of the controllers that declare no access or more than one, as
+ * `Controller.method — none` / `— 2`.
+ *
+ * A handler is a prototype method with a route mark of the framework. An empty list means every
+ * handler declares exactly one access.
+ */
+export declare function undeclaredAccess(controllers: readonly TControllerClass[]): readonly string[];
+/** The refusal of the start, naming every faulty operation at once. */
+export declare function accessAuditError(faults: readonly string[]): Error;
+//# sourceMappingURL=access-audit.d.ts.map

package/esm/lib/access-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-audit.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access-audit.ts"],"names":[],"mappings":"AAIA,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,MAAM,CAAC;AAMzE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,MAAM,EAAE,CAgB5F;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAGjE"}

package/esm/lib/access-audit.js

@@ -0,0 +1,35 @@
+import { METHOD_METADATA, PATH_METADATA } from '@nestjs/common/constants';
+import { accessDeclarationsOf } from './access';
+function isRoute(handler) {
+    return Reflect.getMetadata(PATH_METADATA, handler) !== undefined && Reflect.getMetadata(METHOD_METADATA, handler) !== undefined;
+}
+/**
+ * The route handlers of the controllers that declare no access or more than one, as
+ * `Controller.method — none` / `— 2`.
+ *
+ * A handler is a prototype method with a route mark of the framework. An empty list means every
+ * handler declares exactly one access.
+ */
+export function undeclaredAccess(controllers) {
+    const faults = [];
+    for (const controller of controllers) {
+        const prototype = controller.prototype;
+        for (const name of Object.getOwnPropertyNames(prototype)) {
+            const handler = Reflect.get(prototype, name);
+            if (name === 'constructor' || typeof handler !== 'function' || !isRoute(handler)) {
+                continue;
+            }
+            const count = accessDeclarationsOf(handler).length;
+            if (count !== 1) {
+                faults.push(`${controller.name}.${name} — ${count === 0 ? 'none' : String(count)}`);
+            }
+        }
+    }
+    return faults;
+}
+/** The refusal of the start, naming every faulty operation at once. */
+export function accessAuditError(faults) {
+    const lines = faults.map((fault) => '  ' + fault).join('\n');
+    return new Error(`Every operation declares exactly one access; these do not:\n${lines}`);
+}
+//# sourceMappingURL=access-audit.js.map

package/esm/lib/access-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-audit.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAKhD,SAAS,OAAO,CAAC,OAAe;IAC5B,OAAO,OAAO,CAAC,WAAW,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,SAAS,CAAC;AACpI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAwC;IACrE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,SAAS,GAAW,UAAU,CAAC,SAAmB,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAY,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,aAAa,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/E,SAAS;YACb,CAAC;YACD,MAAM,KAAK,GAAW,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACtD,MAAM,KAAK,GAAW,MAAM,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,OAAO,IAAI,KAAK,CAAC,+DAA+D,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC","sourcesContent":["import { METHOD_METADATA, PATH_METADATA } from '@nestjs/common/constants';\n\nimport { accessDeclarationsOf } from './access';\n\n/** A class whose prototype holds the route handlers. */\nexport type TControllerClass = abstract new (...args: never[]) => object;\n\nfunction isRoute(handler: object): boolean {\n    return Reflect.getMetadata(PATH_METADATA, handler) !== undefined && Reflect.getMetadata(METHOD_METADATA, handler) !== undefined;\n}\n\n/**\n * The route handlers of the controllers that declare no access or more than one, as\n * `Controller.method — none` / `— 2`.\n *\n * A handler is a prototype method with a route mark of the framework. An empty list means every\n * handler declares exactly one access.\n */\nexport function undeclaredAccess(controllers: readonly TControllerClass[]): readonly string[] {\n    const faults: string[] = [];\n    for (const controller of controllers) {\n        const prototype: object = controller.prototype as object;\n        for (const name of Object.getOwnPropertyNames(prototype)) {\n            const handler: unknown = Reflect.get(prototype, name);\n            if (name === 'constructor' || typeof handler !== 'function' || !isRoute(handler)) {\n                continue;\n            }\n            const count: number = accessDeclarationsOf(handler).length;\n            if (count !== 1) {\n                faults.push(`${controller.name}.${name} — ${count === 0 ? 'none' : String(count)}`);\n            }\n        }\n    }\n    return faults;\n}\n\n/** The refusal of the start, naming every faulty operation at once. */\nexport function accessAuditError(faults: readonly string[]): Error {\n    const lines: string = faults.map((fault: string): string => '  ' + fault).join('\\n');\n    return new Error(`Every operation declares exactly one access; these do not:\\n${lines}`);\n}\n"]}

package/esm/lib/access.d.ts

@@ -0,0 +1,31 @@
+import 'reflect-metadata';
+import { TPermission } from '@rt-tools/auth-contract';
+/**
+ * What an operation is open to. Every operation declares exactly one: the start audit refuses an
+ * operation that declares none or two, so a forgotten declaration never opens anything.
+ */
+export type TAccess = 
+/** Open to everyone, without a token. */
+{
+    readonly kind: 'public';
+}
+/** Open to anyone with an accepted token. */
+ | {
+    readonly kind: 'signed-in';
+}
+/** Open to a caller with the right. */
+ | {
+    readonly kind: 'permission';
+    readonly permission: TPermission;
+};
+/** The key the declarations of a handler lie under: a list, so a second one is seen, not lost. */
+export declare const ACCESS_DECLARATIONS: string;
+/** The declarations of a handler, in the order written. */
+export declare function accessDeclarationsOf(handler: object): readonly TAccess[];
+/** The operation is open to everyone, without a token. */
+export declare function OpenOperation(): MethodDecorator;
+/** The operation is open to anyone with an accepted token. */
+export declare function SignedInOperation(): MethodDecorator;
+/** The operation is open to a caller with the right. */
+export declare function PermittedOperation(permission: TPermission): MethodDecorator;
+//# sourceMappingURL=access.d.ts.map

package/esm/lib/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,OAAO;AACf,yCAAyC;AACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE;AAC7B,6CAA6C;GAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE;AAChC,uCAAuC;GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAA;CAAE,CAAC;AAExE,kGAAkG;AAClG,eAAO,MAAM,mBAAmB,EAAE,MAA+B,CAAC;AAElE,2DAA2D;AAC3D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAGxE;AAWD,0DAA0D;AAC1D,wBAAgB,aAAa,IAAI,eAAe,CAE/C;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,eAAe,CAEnD;AAED,wDAAwD;AACxD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,WAAW,GAAG,eAAe,CAE3E"}

package/esm/lib/access.js

@@ -0,0 +1,29 @@
+import 'reflect-metadata';
+/** The key the declarations of a handler lie under: a list, so a second one is seen, not lost. */
+export const ACCESS_DECLARATIONS = 'rt-tools.auth.access';
+/** The declarations of a handler, in the order written. */
+export function accessDeclarationsOf(handler) {
+    const declared = Reflect.getMetadata(ACCESS_DECLARATIONS, handler);
+    return Array.isArray(declared) ? declared : [];
+}
+function declare(access) {
+    return (_target, _key, descriptor) => {
+        const handler = descriptor.value;
+        Reflect.defineMetadata(ACCESS_DECLARATIONS, [...accessDeclarationsOf(handler), access], handler);
+    };
+}
+/* eslint-disable sonarjs/function-name -- decorator factories are named with a capital letter: so the framework names them, and so they read at the place of use */
+/** The operation is open to everyone, without a token. */
+export function OpenOperation() {
+    return declare({ kind: 'public' });
+}
+/** The operation is open to anyone with an accepted token. */
+export function SignedInOperation() {
+    return declare({ kind: 'signed-in' });
+}
+/** The operation is open to a caller with the right. */
+export function PermittedOperation(permission) {
+    return declare({ kind: 'permission', permission });
+}
+/* eslint-enable sonarjs/function-name */
+//# sourceMappingURL=access.js.map

package/esm/lib/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/access.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAgB1B,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAW,sBAAsB,CAAC;AAElE,2DAA2D;AAC3D,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAY,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,MAAe;IAC5B,OAAO,CAAC,OAAe,EAAE,IAAqB,EAAE,UAA8B,EAAQ,EAAE;QACpF,MAAM,OAAO,GAAW,UAAU,CAAC,KAAe,CAAC;QACnD,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACrG,CAAC,CAAC;AACN,CAAC;AAED,oKAAoK;AAEpK,0DAA0D;AAC1D,MAAM,UAAU,aAAa;IACzB,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB;IAC7B,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,kBAAkB,CAAC,UAAuB;IACtD,OAAO,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,yCAAyC","sourcesContent":["import 'reflect-metadata';\n\nimport { TPermission } from '@rt-tools/auth-contract';\n\n/**\n * What an operation is open to. Every operation declares exactly one: the start audit refuses an\n * operation that declares none or two, so a forgotten declaration never opens anything.\n */\nexport type TAccess =\n    /** Open to everyone, without a token. */\n    | { readonly kind: 'public' }\n    /** Open to anyone with an accepted token. */\n    | { readonly kind: 'signed-in' }\n    /** Open to a caller with the right. */\n    | { readonly kind: 'permission'; readonly permission: TPermission };\n\n/** The key the declarations of a handler lie under: a list, so a second one is seen, not lost. */\nexport const ACCESS_DECLARATIONS: string = 'rt-tools.auth.access';\n\n/** The declarations of a handler, in the order written. */\nexport function accessDeclarationsOf(handler: object): readonly TAccess[] {\n    const declared: unknown = Reflect.getMetadata(ACCESS_DECLARATIONS, handler);\n    return Array.isArray(declared) ? (declared as TAccess[]) : [];\n}\n\nfunction declare(access: TAccess): MethodDecorator {\n    return (_target: object, _key: string | symbol, descriptor: PropertyDescriptor): void => {\n        const handler: object = descriptor.value as object;\n        Reflect.defineMetadata(ACCESS_DECLARATIONS, [...accessDeclarationsOf(handler), access], handler);\n    };\n}\n\n/* eslint-disable sonarjs/function-name -- decorator factories are named with a capital letter: so the framework names them, and so they read at the place of use */\n\n/** The operation is open to everyone, without a token. */\nexport function OpenOperation(): MethodDecorator {\n    return declare({ kind: 'public' });\n}\n\n/** The operation is open to anyone with an accepted token. */\nexport function SignedInOperation(): MethodDecorator {\n    return declare({ kind: 'signed-in' });\n}\n\n/** The operation is open to a caller with the right. */\nexport function PermittedOperation(permission: TPermission): MethodDecorator {\n    return declare({ kind: 'permission', permission });\n}\n\n/* eslint-enable sonarjs/function-name */\n"]}

package/esm/lib/auth-server.module.d.ts

@@ -0,0 +1,28 @@
+import { DynamicModule, OnApplicationBootstrap } from '@nestjs/common';
+import { DiscoveryService } from '@nestjs/core';
+import { TPermission } from '@rt-tools/auth-contract';
+import { ICatalogSyncOptions } from './catalog-sync';
+import { ITokenCheckOptions } from './token-verifier';
+/** What an admin server tells the module. */
+export interface IAuthServerOptions extends ITokenCheckOptions {
+    /** Every right of this admin — `definePermissions(…)` of the contract. */
+    readonly catalog: readonly TPermission[];
+    /** Where the catalog is sent at start; without it nothing is sent. */
+    readonly sync?: Omit<ICatalogSyncOptions, 'clientId'>;
+}
+/**
+ * At start: every operation declares exactly one access, and the catalog reaches Keycloak.
+ *
+ * An operation without a declaration or with two stops the start and is named; the catalog sync
+ * creates the roles Keycloak lacks and names the extra ones in the log.
+ */
+export declare class AuthStartCheck implements OnApplicationBootstrap {
+    #private;
+    constructor(discovery: DiscoveryService, options: IAuthServerOptions);
+    onApplicationBootstrap(): Promise<void>;
+}
+/** The entry module of an admin server: the token check, the guard and the start check. */
+export declare class AuthServerModule {
+    static forRoot(options: IAuthServerOptions): DynamicModule;
+}
+//# sourceMappingURL=auth-server.module.d.ts.map

package/esm/lib/auth-server.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-server.module.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth-server.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAA8B,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAG5E,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAKtD,OAAO,EAAE,mBAAmB,EAA6C,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,kBAAkB,CAAC;AAE7E,6CAA6C;AAC7C,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC1D,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,qBAAa,cAAe,YAAW,sBAAsB;;gBAK7C,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB;IAKvD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBvD;AAED,2FAA2F;AAC3F,qBACa,gBAAgB;WACX,OAAO,CAAC,OAAO,EAAE,kBAAkB,GAAG,aAAa;CAkBpE"}

package/esm/lib/auth-server.module.js

@@ -0,0 +1,67 @@
+var AuthServerModule_1;
+import { __decorate } from "tslib";
+import { Logger, Module } from '@nestjs/common';
+import { APP_GUARD, DiscoveryModule, DiscoveryService } from '@nestjs/core';
+import { accessAuditError, undeclaredAccess } from './access-audit';
+import { AuthGuard } from './auth.guard';
+import { AUTH_SERVER_OPTIONS, AUTH_TOKEN_VERIFIER } from './auth.tokens';
+import { syncPermissionCatalog } from './catalog-sync';
+import { KeycloakTokenVerifier } from './token-verifier';
+/**
+ * At start: every operation declares exactly one access, and the catalog reaches Keycloak.
+ *
+ * An operation without a declaration or with two stops the start and is named; the catalog sync
+ * creates the roles Keycloak lacks and names the extra ones in the log.
+ */
+export class AuthStartCheck {
+    #discovery;
+    #options;
+    #logger = new Logger('AuthServer');
+    constructor(discovery, options) {
+        this.#discovery = discovery;
+        this.#options = options;
+    }
+    async onApplicationBootstrap() {
+        const controllers = this.#discovery
+            .getControllers()
+            .map((wrapper) => wrapper.metatype)
+            .filter((metatype) => typeof metatype === 'function');
+        const faults = undeclaredAccess(controllers);
+        if (faults.length) {
+            throw accessAuditError(faults);
+        }
+        if (this.#options.sync) {
+            const result = await syncPermissionCatalog({ ...this.#options.sync, clientId: this.#options.clientId }, this.#options.catalog);
+            this.#logger.log(`catalog: ${this.#options.catalog.length} rights, created ${result.created.length}`);
+            if (result.extra.length) {
+                this.#logger.warn(`Keycloak holds rights the catalog lacks: ${result.extra.join(', ')}`);
+            }
+        }
+    }
+}
+/** The entry module of an admin server: the token check, the guard and the start check. */
+let AuthServerModule = AuthServerModule_1 = class AuthServerModule {
+    static forRoot(options) {
+        return {
+            module: AuthServerModule_1,
+            global: true,
+            imports: [DiscoveryModule],
+            providers: [
+                { provide: AUTH_SERVER_OPTIONS, useValue: options },
+                { provide: AUTH_TOKEN_VERIFIER, useValue: new KeycloakTokenVerifier(options) },
+                { provide: APP_GUARD, useClass: AuthGuard },
+                {
+                    provide: AuthStartCheck,
+                    useFactory: (discovery) => new AuthStartCheck(discovery, options),
+                    inject: [DiscoveryService],
+                },
+            ],
+            exports: [AUTH_SERVER_OPTIONS, AUTH_TOKEN_VERIFIER],
+        };
+    }
+};
+AuthServerModule = AuthServerModule_1 = __decorate([
+    Module({})
+], AuthServerModule);
+export { AuthServerModule };
+//# sourceMappingURL=auth-server.module.js.map

package/esm/lib/auth-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-server.module.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth-server.module.ts"],"names":[],"mappings":";;AAAA,OAAO,EAAiB,MAAM,EAAE,MAAM,EAA0B,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAK5E,OAAO,EAAE,gBAAgB,EAAoB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAA2C,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAsB,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAU7E;;;;;GAKG;AACH,MAAM,OAAO,cAAc;IACd,UAAU,CAAmB;IAC7B,QAAQ,CAAqB;IAC7B,OAAO,GAAW,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;IAEpD,YAAY,SAA2B,EAAE,OAA2B;QAChE,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,sBAAsB;QAC/B,MAAM,WAAW,GAAuB,IAAI,CAAC,UAAU;aAClD,cAAc,EAAE;aAChB,GAAG,CAAC,CAAC,OAAwB,EAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;aAC5D,MAAM,CAAC,CAAC,QAAiB,EAAgC,EAAE,CAAC,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC;QACjG,MAAM,MAAM,GAAsB,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAuB,MAAM,qBAAqB,CAC1D,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAC3D,IAAI,CAAC,QAAQ,CAAC,OAAO,CACxB,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,oBAAoB,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAED,2FAA2F;AAEpF,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAClB,MAAM,CAAC,OAAO,CAAC,OAA2B;QAC7C,OAAO;YACH,MAAM,EAAE,kBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE;gBACP,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnD,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE;gBAC9E,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE;gBAC3C;oBACI,OAAO,EAAE,cAAc;oBACvB,UAAU,EAAE,CAAC,SAA2B,EAAkB,EAAE,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC;oBACnG,MAAM,EAAE,CAAC,gBAAgB,CAAC;iBAC7B;aACJ;YACD,OAAO,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SACtD,CAAC;IACN,CAAC;CACJ,CAAA;AAnBY,gBAAgB;IAD5B,MAAM,CAAC,EAAE,CAAC;GACE,gBAAgB,CAmB5B","sourcesContent":["import { DynamicModule, Logger, Module, OnApplicationBootstrap } from '@nestjs/common';\nimport { APP_GUARD, DiscoveryModule, DiscoveryService } from '@nestjs/core';\nimport { InstanceWrapper } from '@nestjs/core/injector/instance-wrapper';\n\nimport { TPermission } from '@rt-tools/auth-contract';\n\nimport { accessAuditError, TControllerClass, undeclaredAccess } from './access-audit';\nimport { AuthGuard } from './auth.guard';\nimport { AUTH_SERVER_OPTIONS, AUTH_TOKEN_VERIFIER } from './auth.tokens';\nimport { ICatalogSyncOptions, ICatalogSyncResult, syncPermissionCatalog } from './catalog-sync';\nimport { ITokenCheckOptions, KeycloakTokenVerifier } from './token-verifier';\n\n/** What an admin server tells the module. */\nexport interface IAuthServerOptions extends ITokenCheckOptions {\n    /** Every right of this admin — `definePermissions(…)` of the contract. */\n    readonly catalog: readonly TPermission[];\n    /** Where the catalog is sent at start; without it nothing is sent. */\n    readonly sync?: Omit<ICatalogSyncOptions, 'clientId'>;\n}\n\n/**\n * At start: every operation declares exactly one access, and the catalog reaches Keycloak.\n *\n * An operation without a declaration or with two stops the start and is named; the catalog sync\n * creates the roles Keycloak lacks and names the extra ones in the log.\n */\nexport class AuthStartCheck implements OnApplicationBootstrap {\n    readonly #discovery: DiscoveryService;\n    readonly #options: IAuthServerOptions;\n    readonly #logger: Logger = new Logger('AuthServer');\n\n    constructor(discovery: DiscoveryService, options: IAuthServerOptions) {\n        this.#discovery = discovery;\n        this.#options = options;\n    }\n\n    public async onApplicationBootstrap(): Promise<void> {\n        const controllers: TControllerClass[] = this.#discovery\n            .getControllers()\n            .map((wrapper: InstanceWrapper): unknown => wrapper.metatype)\n            .filter((metatype: unknown): metatype is TControllerClass => typeof metatype === 'function');\n        const faults: readonly string[] = undeclaredAccess(controllers);\n        if (faults.length) {\n            throw accessAuditError(faults);\n        }\n        if (this.#options.sync) {\n            const result: ICatalogSyncResult = await syncPermissionCatalog(\n                { ...this.#options.sync, clientId: this.#options.clientId },\n                this.#options.catalog\n            );\n            this.#logger.log(`catalog: ${this.#options.catalog.length} rights, created ${result.created.length}`);\n            if (result.extra.length) {\n                this.#logger.warn(`Keycloak holds rights the catalog lacks: ${result.extra.join(', ')}`);\n            }\n        }\n    }\n}\n\n/** The entry module of an admin server: the token check, the guard and the start check. */\n@Module({})\nexport class AuthServerModule {\n    public static forRoot(options: IAuthServerOptions): DynamicModule {\n        return {\n            module: AuthServerModule,\n            global: true,\n            imports: [DiscoveryModule],\n            providers: [\n                { provide: AUTH_SERVER_OPTIONS, useValue: options },\n                { provide: AUTH_TOKEN_VERIFIER, useValue: new KeycloakTokenVerifier(options) },\n                { provide: APP_GUARD, useClass: AuthGuard },\n                {\n                    provide: AuthStartCheck,\n                    useFactory: (discovery: DiscoveryService): AuthStartCheck => new AuthStartCheck(discovery, options),\n                    inject: [DiscoveryService],\n                },\n            ],\n            exports: [AUTH_SERVER_OPTIONS, AUTH_TOKEN_VERIFIER],\n        };\n    }\n}\n"]}

package/esm/lib/auth.guard.d.ts

@@ -0,0 +1,15 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import type { KeycloakTokenVerifier } from './token-verifier';
+/**
+ * The only access check of an admin server. **Closed by default.**
+ *
+ * Two refusals, told apart by the question: no accepted token is «not signed in» (401) and is
+ * cured by signing in; a token without the right is «not allowed» (403) and is not. Neither names
+ * the missing right or what in the token did not match.
+ */
+export declare class AuthGuard implements CanActivate {
+    #private;
+    constructor(verifier: KeycloakTokenVerifier);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=auth.guard.d.ts.map

package/esm/lib/auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAiE,MAAM,gBAAgB,CAAC;AAM9H,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAQ9D;;;;;;GAMG;AACH,qBACa,SAAU,YAAW,WAAW;;gBAGA,QAAQ,EAAE,qBAAqB;IAI3D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAuBxE"}

package/esm/lib/auth.guard.js

@@ -0,0 +1,48 @@
+import { __decorate, __metadata, __param } from "tslib";
+import { ForbiddenException, Inject, Injectable, UnauthorizedException } from '@nestjs/common';
+import { hasPermission } from '@rt-tools/auth-contract';
+import { accessDeclarationsOf } from './access';
+import { AUTH_TOKEN_VERIFIER, REQUEST_CALLER } from './auth.tokens';
+/**
+ * The only access check of an admin server. **Closed by default.**
+ *
+ * Two refusals, told apart by the question: no accepted token is «not signed in» (401) and is
+ * cured by signing in; a token without the right is «not allowed» (403) and is not. Neither names
+ * the missing right or what in the token did not match.
+ */
+let AuthGuard = class AuthGuard {
+    #verifier;
+    constructor(verifier) {
+        this.#verifier = verifier;
+    }
+    async canActivate(context) {
+        const declared = accessDeclarationsOf(context.getHandler());
+        if (declared.length !== 1) {
+            // The start audit stops such an application; a handler that slipped past it is refused
+            // rather than opened by a guess.
+            throw new UnauthorizedException();
+        }
+        const access = declared[0];
+        if (access.kind === 'public') {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const header = request.headers['authorization'];
+        const caller = await this.#verifier.callerOf(typeof header === 'string' ? header : null);
+        if (!caller) {
+            throw new UnauthorizedException();
+        }
+        if (access.kind === 'permission' && !hasPermission(caller, access.permission)) {
+            throw new ForbiddenException();
+        }
+        request[REQUEST_CALLER] = caller;
+        return true;
+    }
+};
+AuthGuard = __decorate([
+    Injectable(),
+    __param(0, Inject(AUTH_TOKEN_VERIFIER)),
+    __metadata("design:paramtypes", [Function])
+], AuthGuard);
+export { AuthGuard };
+//# sourceMappingURL=auth.guard.js.map

package/esm/lib/auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.guard.ts"],"names":[],"mappings":";AAAA,OAAO,EAAiC,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAE9H,OAAO,EAAE,aAAa,EAAW,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAW,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AASpE;;;;;;GAMG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACT,SAAS,CAAwB;IAE1C,YAAyC,QAA+B;QACpE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,OAAyB;QAC9C,MAAM,QAAQ,GAAuB,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,uFAAuF;YACvF,iCAAiC;YACjC,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAY,QAAQ,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAiB,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAgB,CAAC;QAChF,MAAM,MAAM,GAAkC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAmB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;QACjC,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA9BY,SAAS;IADrB,UAAU,EAAE;IAII,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;;GAH/B,SAAS,CA8BrB","sourcesContent":["import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable, UnauthorizedException } from '@nestjs/common';\n\nimport { hasPermission, ICaller } from '@rt-tools/auth-contract';\n\nimport { accessDeclarationsOf, TAccess } from './access';\nimport { AUTH_TOKEN_VERIFIER, REQUEST_CALLER } from './auth.tokens';\nimport type { KeycloakTokenVerifier } from './token-verifier';\n\n/** The request as the guard reads it: the headers and the place for the caller. */\ninterface IAuthRequest {\n    headers: Record<string, string | string[] | undefined>;\n    [REQUEST_CALLER]?: ICaller;\n}\n\n/**\n * The only access check of an admin server. **Closed by default.**\n *\n * Two refusals, told apart by the question: no accepted token is «not signed in» (401) and is\n * cured by signing in; a token without the right is «not allowed» (403) and is not. Neither names\n * the missing right or what in the token did not match.\n */\n@Injectable()\nexport class AuthGuard implements CanActivate {\n    readonly #verifier: KeycloakTokenVerifier;\n\n    constructor(@Inject(AUTH_TOKEN_VERIFIER) verifier: KeycloakTokenVerifier) {\n        this.#verifier = verifier;\n    }\n\n    public async canActivate(context: ExecutionContext): Promise<boolean> {\n        const declared: readonly TAccess[] = accessDeclarationsOf(context.getHandler());\n        if (declared.length !== 1) {\n            // The start audit stops such an application; a handler that slipped past it is refused\n            // rather than opened by a guess.\n            throw new UnauthorizedException();\n        }\n        const access: TAccess = declared[0];\n        if (access.kind === 'public') {\n            return true;\n        }\n        const request: IAuthRequest = context.switchToHttp().getRequest<IAuthRequest>();\n        const header: string | string[] | undefined = request.headers['authorization'];\n        const caller: ICaller | null = await this.#verifier.callerOf(typeof header === 'string' ? header : null);\n        if (!caller) {\n            throw new UnauthorizedException();\n        }\n        if (access.kind === 'permission' && !hasPermission(caller, access.permission)) {\n            throw new ForbiddenException();\n        }\n        request[REQUEST_CALLER] = caller;\n        return true;\n    }\n}\n"]}

package/esm/lib/auth.tokens.d.ts

@@ -0,0 +1,7 @@
+/** The token check of the admin, provided by the module. */
+export declare const AUTH_TOKEN_VERIFIER: unique symbol;
+/** The options the module was configured with. */
+export declare const AUTH_SERVER_OPTIONS: unique symbol;
+/** The field of the request the guard puts the caller into. */
+export declare const REQUEST_CALLER: unique symbol;
+//# sourceMappingURL=auth.tokens.d.ts.map

package/esm/lib/auth.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.tokens.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.tokens.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAA+C,CAAC;AAEzF,kDAAkD;AAClD,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAAwC,CAAC;AAElF,+DAA+D;AAC/D,eAAO,MAAM,cAAc,EAAE,OAAO,MAAuC,CAAC"}

package/esm/lib/auth.tokens.js

@@ -0,0 +1,7 @@
+/** The token check of the admin, provided by the module. */
+export const AUTH_TOKEN_VERIFIER = Symbol('rt-tools.auth.token-verifier');
+/** The options the module was configured with. */
+export const AUTH_SERVER_OPTIONS = Symbol('rt-tools.auth.options');
+/** The field of the request the guard puts the caller into. */
+export const REQUEST_CALLER = Symbol('rt-tools.auth.caller');
+//# sourceMappingURL=auth.tokens.js.map

package/esm/lib/auth.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.tokens.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/auth.tokens.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAEzF,kDAAkD;AAClD,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAElF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAkB,MAAM,CAAC,sBAAsB,CAAC,CAAC","sourcesContent":["/** The token check of the admin, provided by the module. */\nexport const AUTH_TOKEN_VERIFIER: unique symbol = Symbol('rt-tools.auth.token-verifier');\n\n/** The options the module was configured with. */\nexport const AUTH_SERVER_OPTIONS: unique symbol = Symbol('rt-tools.auth.options');\n\n/** The field of the request the guard puts the caller into. */\nexport const REQUEST_CALLER: unique symbol = Symbol('rt-tools.auth.caller');\n"]}

package/esm/lib/catalog-sync.d.ts

@@ -0,0 +1,27 @@
+import { TPermission } from '@rt-tools/auth-contract';
+/** Where the catalog goes and with what it is let in. */
+export interface ICatalogSyncOptions {
+    /** The Keycloak address, for example `https://sso.example.com`. */
+    readonly baseUrl: string;
+    readonly realm: string;
+    /** The client of this admin; its roles are its rights. */
+    readonly clientId: string;
+    /** A client of the realm with a service account allowed to manage clients. */
+    readonly syncClientId: string;
+    readonly syncClientSecret: string;
+}
+/** What the sync did: the roles it created and the roles Keycloak holds beyond the catalog. */
+export interface ICatalogSyncResult {
+    readonly created: readonly string[];
+    readonly extra: readonly string[];
+}
+type TFetch = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * Sends the rights of an admin to Keycloak as roles of its client.
+ *
+ * Creates the roles Keycloak lacks and removes none: removing a role takes it from every person
+ * who holds it. The rights Keycloak holds beyond the catalog come back as `extra` for the log.
+ */
+export declare function syncPermissionCatalog(options: ICatalogSyncOptions, catalog: readonly TPermission[], request?: TFetch): Promise<ICatalogSyncResult>;
+export {};
+//# sourceMappingURL=catalog-sync.d.ts.map

package/esm/lib/catalog-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-sync.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/catalog-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEpE,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAChC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACrC;AAED,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AASvE;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,GAAE,MAAc,GACxB,OAAO,CAAC,kBAAkB,CAAC,CA2C7B"}

package/esm/lib/catalog-sync.js

@@ -0,0 +1,48 @@
+import { isPermission } from '@rt-tools/auth-contract';
+async function answer(response, step) {
+    if (!response.ok) {
+        throw new Error(`The catalog sync stopped at ${step}: Keycloak answered ${response.status}`);
+    }
+    return (await response.json());
+}
+/**
+ * Sends the rights of an admin to Keycloak as roles of its client.
+ *
+ * Creates the roles Keycloak lacks and removes none: removing a role takes it from every person
+ * who holds it. The rights Keycloak holds beyond the catalog come back as `extra` for the log.
+ */
+export async function syncPermissionCatalog(options, catalog, request = fetch) {
+    const base = `${options.baseUrl}/realms/${options.realm}`;
+    const admin = `${options.baseUrl}/admin/realms/${options.realm}`;
+    const token = await answer(await request(`${base}/protocol/openid-connect/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'client_credentials',
+            client_id: options.syncClientId,
+            client_secret: options.syncClientSecret,
+        }),
+    }), 'the token');
+    const headers = { authorization: `Bearer ${token.access_token}`, 'content-type': 'application/json' };
+    const clients = await answer(await request(`${admin}/clients?clientId=${encodeURIComponent(options.clientId)}`, { headers }), 'the client');
+    if (clients.length !== 1) {
+        throw new Error(`The catalog sync stopped at the client: the realm has no client ${options.clientId}`);
+    }
+    const rolesUrl = `${admin}/clients/${clients[0].id}/roles`;
+    const held = new Set((await answer(await request(rolesUrl, { headers }), 'the roles')).map((role) => role.name));
+    const created = [];
+    for (const permission of catalog) {
+        if (held.has(permission)) {
+            continue;
+        }
+        const response = await request(rolesUrl, { method: 'POST', body: JSON.stringify({ name: permission }), headers });
+        if (!response.ok && response.status !== 409) {
+            throw new Error(`The catalog sync stopped at the role ${permission}: Keycloak answered ${response.status}`);
+        }
+        created.push(permission);
+    }
+    const wanted = new Set(catalog);
+    // Keycloak adds roles of its own to a client; only a role of the right shape counts as extra.
+    return { extra: [...held].filter((role) => isPermission(role) && !wanted.has(role)), created };
+}
+//# sourceMappingURL=catalog-sync.js.map

package/esm/lib/catalog-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-sync.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/catalog-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,yBAAyB,CAAC;AAsBpE,KAAK,UAAU,MAAM,CAAI,QAAkB,EAAE,IAAY;IACrD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,OAA4B,EAC5B,OAA+B,EAC/B,UAAkB,KAAK;IAEvB,MAAM,IAAI,GAAW,GAAG,OAAO,CAAC,OAAO,WAAW,OAAO,CAAC,KAAK,EAAE,CAAC;IAClE,MAAM,KAAK,GAAW,GAAG,OAAO,CAAC,OAAO,iBAAiB,OAAO,CAAC,KAAK,EAAE,CAAC;IACzE,MAAM,KAAK,GAA6B,MAAM,MAAM,CAChD,MAAM,OAAO,CAAC,GAAG,IAAI,gCAAgC,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACtB,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,OAAO,CAAC,YAAY;YAC/B,aAAa,EAAE,OAAO,CAAC,gBAAgB;SAC1C,CAAC;KACL,CAAC,EACF,WAAW,CACd,CAAC;IACF,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC9H,MAAM,OAAO,GAAqB,MAAM,MAAM,CAC1C,MAAM,OAAO,CAAC,GAAG,KAAK,qBAAqB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAC/F,YAAY,CACf,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,mEAAmE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,QAAQ,GAAW,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACnE,MAAM,IAAI,GAAgB,IAAI,GAAG,CAC7B,CAAC,MAAM,MAAM,CAAqB,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CACrF,CAAC,IAAsB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAChD,CACJ,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACvB,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAa,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5H,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,wCAAwC,UAAU,uBAAuB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAgB,IAAI,GAAG,CAAS,OAAO,CAAC,CAAC;IACrD,8FAA8F;IAC9F,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AACpH,CAAC","sourcesContent":["import { isPermission, TPermission } from '@rt-tools/auth-contract';\n\n/** Where the catalog goes and with what it is let in. */\nexport interface ICatalogSyncOptions {\n    /** The Keycloak address, for example `https://sso.example.com`. */\n    readonly baseUrl: string;\n    readonly realm: string;\n    /** The client of this admin; its roles are its rights. */\n    readonly clientId: string;\n    /** A client of the realm with a service account allowed to manage clients. */\n    readonly syncClientId: string;\n    readonly syncClientSecret: string;\n}\n\n/** What the sync did: the roles it created and the roles Keycloak holds beyond the catalog. */\nexport interface ICatalogSyncResult {\n    readonly created: readonly string[];\n    readonly extra: readonly string[];\n}\n\ntype TFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\nasync function answer<T>(response: Response, step: string): Promise<T> {\n    if (!response.ok) {\n        throw new Error(`The catalog sync stopped at ${step}: Keycloak answered ${response.status}`);\n    }\n    return (await response.json()) as T;\n}\n\n/**\n * Sends the rights of an admin to Keycloak as roles of its client.\n *\n * Creates the roles Keycloak lacks and removes none: removing a role takes it from every person\n * who holds it. The rights Keycloak holds beyond the catalog come back as `extra` for the log.\n */\nexport async function syncPermissionCatalog(\n    options: ICatalogSyncOptions,\n    catalog: readonly TPermission[],\n    request: TFetch = fetch\n): Promise<ICatalogSyncResult> {\n    const base: string = `${options.baseUrl}/realms/${options.realm}`;\n    const admin: string = `${options.baseUrl}/admin/realms/${options.realm}`;\n    const token: { access_token: string } = await answer(\n        await request(`${base}/protocol/openid-connect/token`, {\n            method: 'POST',\n            headers: { 'content-type': 'application/x-www-form-urlencoded' },\n            body: new URLSearchParams({\n                grant_type: 'client_credentials',\n                client_id: options.syncClientId,\n                client_secret: options.syncClientSecret,\n            }),\n        }),\n        'the token'\n    );\n    const headers: Record<string, string> = { authorization: `Bearer ${token.access_token}`, 'content-type': 'application/json' };\n    const clients: { id: string }[] = await answer(\n        await request(`${admin}/clients?clientId=${encodeURIComponent(options.clientId)}`, { headers }),\n        'the client'\n    );\n    if (clients.length !== 1) {\n        throw new Error(`The catalog sync stopped at the client: the realm has no client ${options.clientId}`);\n    }\n    const rolesUrl: string = `${admin}/clients/${clients[0].id}/roles`;\n    const held: Set<string> = new Set(\n        (await answer<{ name: string }[]>(await request(rolesUrl, { headers }), 'the roles')).map(\n            (role: { name: string }): string => role.name\n        )\n    );\n    const created: string[] = [];\n    for (const permission of catalog) {\n        if (held.has(permission)) {\n            continue;\n        }\n        const response: Response = await request(rolesUrl, { method: 'POST', body: JSON.stringify({ name: permission }), headers });\n        if (!response.ok && response.status !== 409) {\n            throw new Error(`The catalog sync stopped at the role ${permission}: Keycloak answered ${response.status}`);\n        }\n        created.push(permission);\n    }\n    const wanted: Set<string> = new Set<string>(catalog);\n    // Keycloak adds roles of its own to a client; only a role of the right shape counts as extra.\n    return { extra: [...held].filter((role: string): boolean => isPermission(role) && !wanted.has(role)), created };\n}\n"]}

package/esm/lib/connect-access.d.ts

@@ -0,0 +1,35 @@
+import { ContextKey, Interceptor } from '@connectrpc/connect';
+import { ICaller } from '@rt-tools/auth-contract';
+import { TAccess } from './access';
+import { KeycloakTokenVerifier } from './token-verifier';
+/** The part of a Connect service description the access map is checked against. */
+export interface IConnectServiceLike {
+    readonly typeName: string;
+    readonly methods: readonly {
+        readonly name: string;
+        readonly localName: string;
+    }[];
+}
+/** The access of every method of one service, keyed by the local method name. */
+export type TConnectServiceAccess<SERVICE extends {
+    readonly method: object;
+}> = {
+    readonly [METHOD in keyof SERVICE['method']]: TAccess;
+};
+/** The caller the interceptor accepted, read by a procedure from its context values. */
+export declare const CONNECT_CALLER: ContextKey<ICaller | null>;
+/**
+ * The accesses of one service as entries `typeName/MethodName`, checked against its description.
+ *
+ * Every method declares exactly one access, and a key that names no method is refused too: both
+ * would otherwise show only to the person who calls the method.
+ */
+export declare function connectAccessEntries(service: IConnectServiceLike, access: Readonly<Record<string, TAccess>>): readonly [string, TAccess][];
+/**
+ * The Connect interceptor of an admin server: the same token check as the NestJS guard, and the
+ * same two refusals — `unauthenticated` and `permission_denied` — without naming the right.
+ *
+ * A method the map does not name is refused: the map is closed by default, as the guard is.
+ */
+export declare function createAuthInterceptor(verifier: KeycloakTokenVerifier, entries: readonly (readonly [string, TAccess])[]): Interceptor;
+//# sourceMappingURL=connect-access.d.ts.map