@rt-tools/auth-server 0.0.0-stage → 0.2.0

package/esm/lib/connect-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-access.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/connect-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,UAAU,EAAE,WAAW,EAA+B,MAAM,qBAAqB,CAAC;AAEjI,OAAO,EAAiB,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACtF;AAED,iFAAiF;AACjF,MAAM,MAAM,qBAAqB,CAAC,OAAO,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,IAAI;IAAE,QAAQ,EAAE,MAAM,IAAI,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO;CAAE,CAAC;AAE3I,wFAAwF;AACxF,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC,OAAO,GAAG,IAAI,CAAmF,CAAC;AAE1I;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC1C,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAa9B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,qBAAqB,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,WAAW,CAmBpI"}

package/esm/lib/connect-access.js

@@ -0,0 +1,49 @@
+import { Code, ConnectError, createContextKey } from '@connectrpc/connect';
+import { hasPermission } from '@rt-tools/auth-contract';
+/** The caller the interceptor accepted, read by a procedure from its context values. */
+export const CONNECT_CALLER = createContextKey(null, { description: 'rt-tools.auth.caller' });
+/**
+ * The accesses of one service as entries `typeName/MethodName`, checked against its description.
+ *
+ * Every method declares exactly one access, and a key that names no method is refused too: both
+ * would otherwise show only to the person who calls the method.
+ */
+export function connectAccessEntries(service, access) {
+    const names = new Set(service.methods.map((method) => method.localName));
+    const missing = [...names].filter((name) => !(name in access));
+    const unknown = Object.keys(access).filter((name) => !names.has(name));
+    if (missing.length || unknown.length) {
+        throw new Error(`Every method of ${service.typeName} declares exactly one access; missing: ${missing.join(', ') || 'none'}; unknown: ${unknown.join(', ') || 'none'}`);
+    }
+    return service.methods.map((method) => [
+        `${service.typeName}/${method.name}`,
+        access[method.localName],
+    ]);
+}
+/**
+ * The Connect interceptor of an admin server: the same token check as the NestJS guard, and the
+ * same two refusals — `unauthenticated` and `permission_denied` — without naming the right.
+ *
+ * A method the map does not name is refused: the map is closed by default, as the guard is.
+ */
+export function createAuthInterceptor(verifier, entries) {
+    const accessOf = new Map(entries);
+    return (next) => async (request) => {
+        const access = accessOf.get(`${request.method.parent.typeName}/${request.method.name}`);
+        if (!access) {
+            throw new ConnectError('unauthenticated', Code.Unauthenticated);
+        }
+        if (access.kind !== 'public') {
+            const caller = await verifier.callerOf(request.header.get('authorization'));
+            if (!caller) {
+                throw new ConnectError('unauthenticated', Code.Unauthenticated);
+            }
+            if (access.kind === 'permission' && !hasPermission(caller, access.permission)) {
+                throw new ConnectError('permission denied', Code.PermissionDenied);
+            }
+            request.contextValues.set(CONNECT_CALLER, caller);
+        }
+        return next(request);
+    };
+}
+//# sourceMappingURL=connect-access.js.map

package/esm/lib/connect-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-access.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/connect-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAwD,MAAM,qBAAqB,CAAC;AAEjI,OAAO,EAAE,aAAa,EAAW,MAAM,yBAAyB,CAAC;AAcjE,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAA+B,gBAAgB,CAAiB,IAAI,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAE1I;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAChC,OAA4B,EAC5B,MAAyC;IAEzC,MAAM,KAAK,GAAgB,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAA6B,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACrH,MAAM,OAAO,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,CAAC,QAAQ,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CACxJ,CAAC;IACN,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAA2C,EAAqB,EAAE,CAAC;QAC3F,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QACpC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KAC3B,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA+B,EAAE,OAAgD;IACnH,MAAM,QAAQ,GAAyB,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,IAAgC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAqC,EAAE,EAAE;QACzF,MAAM,MAAM,GAAwB,QAAQ,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmB,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC;AACN,CAAC","sourcesContent":["import { Code, ConnectError, createContextKey, ContextKey, Interceptor, UnaryRequest, StreamRequest } from '@connectrpc/connect';\n\nimport { hasPermission, ICaller } from '@rt-tools/auth-contract';\n\nimport { TAccess } from './access';\nimport { KeycloakTokenVerifier } from './token-verifier';\n\n/** The part of a Connect service description the access map is checked against. */\nexport interface IConnectServiceLike {\n    readonly typeName: string;\n    readonly methods: readonly { readonly name: string; readonly localName: string }[];\n}\n\n/** The access of every method of one service, keyed by the local method name. */\nexport type TConnectServiceAccess<SERVICE extends { readonly method: object }> = { readonly [METHOD in keyof SERVICE['method']]: TAccess };\n\n/** The caller the interceptor accepted, read by a procedure from its context values. */\nexport const CONNECT_CALLER: ContextKey<ICaller | null> = createContextKey<ICaller | null>(null, { description: 'rt-tools.auth.caller' });\n\n/**\n * The accesses of one service as entries `typeName/MethodName`, checked against its description.\n *\n * Every method declares exactly one access, and a key that names no method is refused too: both\n * would otherwise show only to the person who calls the method.\n */\nexport function connectAccessEntries(\n    service: IConnectServiceLike,\n    access: Readonly<Record<string, TAccess>>\n): readonly [string, TAccess][] {\n    const names: Set<string> = new Set(service.methods.map((method: { localName: string }): string => method.localName));\n    const missing: string[] = [...names].filter((name: string): boolean => !(name in access));\n    const unknown: string[] = Object.keys(access).filter((name: string): boolean => !names.has(name));\n    if (missing.length || unknown.length) {\n        throw new Error(\n            `Every method of ${service.typeName} declares exactly one access; missing: ${missing.join(', ') || 'none'}; unknown: ${unknown.join(', ') || 'none'}`\n        );\n    }\n    return service.methods.map((method: { name: string; localName: string }): [string, TAccess] => [\n        `${service.typeName}/${method.name}`,\n        access[method.localName],\n    ]);\n}\n\n/**\n * The Connect interceptor of an admin server: the same token check as the NestJS guard, and the\n * same two refusals — `unauthenticated` and `permission_denied` — without naming the right.\n *\n * A method the map does not name is refused: the map is closed by default, as the guard is.\n */\nexport function createAuthInterceptor(verifier: KeycloakTokenVerifier, entries: readonly (readonly [string, TAccess])[]): Interceptor {\n    const accessOf: Map<string, TAccess> = new Map(entries);\n    return (next: Parameters<Interceptor>[0]) => async (request: UnaryRequest | StreamRequest) => {\n        const access: TAccess | undefined = accessOf.get(`${request.method.parent.typeName}/${request.method.name}`);\n        if (!access) {\n            throw new ConnectError('unauthenticated', Code.Unauthenticated);\n        }\n        if (access.kind !== 'public') {\n            const caller: ICaller | null = await verifier.callerOf(request.header.get('authorization'));\n            if (!caller) {\n                throw new ConnectError('unauthenticated', Code.Unauthenticated);\n            }\n            if (access.kind === 'permission' && !hasPermission(caller, access.permission)) {\n                throw new ConnectError('permission denied', Code.PermissionDenied);\n            }\n            request.contextValues.set(CONNECT_CALLER, caller);\n        }\n        return next(request);\n    };\n}\n"]}

package/esm/lib/current-caller.decorator.d.ts

@@ -0,0 +1,6 @@
+import { ICaller } from '@rt-tools/auth-contract';
+/** The caller the guard accepted; `undefined` on an operation open to everyone. */
+export declare function callerOfRequest(request: object): ICaller | undefined;
+/** A handler parameter that receives the caller the guard accepted. */
+export declare const CurrentCaller: () => ParameterDecorator;
+//# sourceMappingURL=current-caller.decorator.d.ts.map

package/esm/lib/current-caller.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-caller.decorator.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/current-caller.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIlD,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAGpE;AAED,uEAAuE;AACvE,eAAO,MAAM,aAAa,EAAE,MAAM,kBAEjC,CAAC"}

package/esm/lib/current-caller.decorator.js

@@ -0,0 +1,10 @@
+import { createParamDecorator } from '@nestjs/common';
+import { REQUEST_CALLER } from './auth.tokens';
+/** The caller the guard accepted; `undefined` on an operation open to everyone. */
+export function callerOfRequest(request) {
+    const caller = Reflect.get(request, REQUEST_CALLER);
+    return caller === undefined ? undefined : caller;
+}
+/** A handler parameter that receives the caller the guard accepted. */
+export const CurrentCaller = createParamDecorator((_data, context) => callerOfRequest(context.switchToHttp().getRequest()));
+//# sourceMappingURL=current-caller.decorator.js.map

package/esm/lib/current-caller.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-caller.decorator.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/current-caller.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAoB,MAAM,gBAAgB,CAAC;AAIxE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAY,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,MAAkB,CAAC;AAClE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,aAAa,GAA6B,oBAAoB,CACvE,CAAC,KAAc,EAAE,OAAyB,EAAuB,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAU,CAAC,CACnI,CAAC","sourcesContent":["import { createParamDecorator, ExecutionContext } from '@nestjs/common';\n\nimport { ICaller } from '@rt-tools/auth-contract';\n\nimport { REQUEST_CALLER } from './auth.tokens';\n\n/** The caller the guard accepted; `undefined` on an operation open to everyone. */\nexport function callerOfRequest(request: object): ICaller | undefined {\n    const caller: unknown = Reflect.get(request, REQUEST_CALLER);\n    return caller === undefined ? undefined : (caller as ICaller);\n}\n\n/** A handler parameter that receives the caller the guard accepted. */\nexport const CurrentCaller: () => ParameterDecorator = createParamDecorator(\n    (_data: unknown, context: ExecutionContext): ICaller | undefined => callerOfRequest(context.switchToHttp().getRequest<object>())\n);\n"]}

package/esm/lib/env-options.d.ts

@@ -0,0 +1,44 @@
+import { TPermission } from '@rt-tools/auth-contract';
+import type { IAuthServerOptions } from './auth-server.module';
+/** The environment variables the entry module is set up by; `process.env` fits it as it is. */
+export interface IAuthEnv {
+    readonly AUTH_ISSUER?: string;
+    readonly AUTH_CLIENT_ID?: string;
+    readonly AUTH_SYNC_SECRET?: string;
+    readonly AUTH_SYNC_CLIENT_ID?: string;
+    readonly AUTH_KEYS_URL?: string;
+    readonly AUTH_SERVICE_CLIENTS?: string;
+}
+/** The variables without which a server checks no token. */
+export declare const AUTH_ENV_VARIABLES: readonly (keyof IAuthEnv)[];
+/** What the browser part of an admin needs to sign a person in: the same realm and client as the server. */
+export interface IAuthClientSettings {
+    /** The Keycloak address, for example `https://sso.example.com`. */
+    readonly url: string;
+    readonly realm: string;
+    readonly clientId: string;
+}
+/** The Keycloak address and the realm of an issuer, or `null` when it is not the address of a realm. */
+export declare function realmOfIssuer(issuer: string): {
+    readonly url: string;
+    readonly realm: string;
+} | null;
+/**
+ * The settings the browser part signs in with, taken from the options of the server. The admin
+ * asks them at start instead of carrying its own copy: a copy built into the page drifts from the
+ * server at the first move of Keycloak to another address.
+ */
+export declare function clientSettingsOf(options: IAuthServerOptions): IAuthClientSettings;
+/**
+ * The options of the entry module from the environment of the server.
+ *
+ * The realm and the client belong to the stand, not to the code: a missing one stops the start by
+ * name instead of checking tokens against a guess. The catalog goes to Keycloak only when the
+ * environment holds the secret of the sync client (`AUTH_SYNC_SECRET`); `AUTH_SYNC_CLIENT_ID`
+ * names that client when it is not `rt-catalog-sync`. Without the secret the realm file of the
+ * stand declares the roles itself. `AUTH_KEYS_URL` names where the keys are read when the server
+ * reaches Keycloak by another address than the browser. `AUTH_SERVICE_CLIENTS` names, by commas, the
+ * service clients whose tokens the server accepts besides the client of the admin.
+ */
+export declare function authOptionsFromEnv(env: IAuthEnv, catalog: readonly TPermission[]): IAuthServerOptions;
+//# sourceMappingURL=env-options.d.ts.map

package/esm/lib/env-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-options.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/env-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,+FAA+F;AAC/F,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,EAAE,SAAS,CAAC,MAAM,QAAQ,CAAC,EAAsC,CAAC;AAQjG,4GAA4G;AAC5G,MAAM,WAAW,mBAAmB;IAChC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAGrG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CAMjF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,kBAAkB,CAmCrG"}

package/esm/lib/env-options.js

@@ -0,0 +1,71 @@
+/** The variables without which a server checks no token. */
+export const AUTH_ENV_VARIABLES = ['AUTH_ISSUER', 'AUTH_CLIENT_ID'];
+/** The service client of the realm allowed to create the roles of a client, unless named otherwise. */
+const SYNC_CLIENT_ID = 'rt-catalog-sync';
+/** The Keycloak address and the realm name, taken from the issuer: `https://sso.example.com/realms/rt`. */
+const ISSUER = /^(https?:\/\/.+)\/realms\/([^/]+)\/?$/;
+/** The Keycloak address and the realm of an issuer, or `null` when it is not the address of a realm. */
+export function realmOfIssuer(issuer) {
+    const match = ISSUER.exec(issuer);
+    return match ? { url: match[1], realm: match[2] } : null;
+}
+/**
+ * The settings the browser part signs in with, taken from the options of the server. The admin
+ * asks them at start instead of carrying its own copy: a copy built into the page drifts from the
+ * server at the first move of Keycloak to another address.
+ */
+export function clientSettingsOf(options) {
+    const realm = realmOfIssuer(options.issuer);
+    if (!realm) {
+        throw new Error(`The issuer is not the address of a Keycloak realm: ${options.issuer}`);
+    }
+    return { ...realm, clientId: options.clientId };
+}
+/**
+ * The options of the entry module from the environment of the server.
+ *
+ * The realm and the client belong to the stand, not to the code: a missing one stops the start by
+ * name instead of checking tokens against a guess. The catalog goes to Keycloak only when the
+ * environment holds the secret of the sync client (`AUTH_SYNC_SECRET`); `AUTH_SYNC_CLIENT_ID`
+ * names that client when it is not `rt-catalog-sync`. Without the secret the realm file of the
+ * stand declares the roles itself. `AUTH_KEYS_URL` names where the keys are read when the server
+ * reaches Keycloak by another address than the browser. `AUTH_SERVICE_CLIENTS` names, by commas, the
+ * service clients whose tokens the server accepts besides the client of the admin.
+ */
+export function authOptionsFromEnv(env, catalog) {
+    const missing = AUTH_ENV_VARIABLES.filter((name) => !env[name]);
+    if (missing.length) {
+        throw new Error(`The server needs ${missing.join(' and ')} in the environment`);
+    }
+    const issuer = String(env.AUTH_ISSUER);
+    const clientId = String(env.AUTH_CLIENT_ID);
+    const secret = env.AUTH_SYNC_SECRET;
+    const services = (env.AUTH_SERVICE_CLIENTS ?? '')
+        .split(',')
+        .map((name) => name.trim())
+        .filter(Boolean);
+    const keys = {
+        ...(env.AUTH_KEYS_URL ? { keysUrl: env.AUTH_KEYS_URL } : {}),
+        ...(services.length ? { serviceClients: services } : {}),
+    };
+    if (!secret) {
+        return { issuer, clientId, catalog, ...keys };
+    }
+    const realm = realmOfIssuer(issuer);
+    if (!realm) {
+        throw new Error(`AUTH_ISSUER is not the address of a Keycloak realm: ${issuer}`);
+    }
+    return {
+        issuer,
+        clientId,
+        catalog,
+        ...keys,
+        sync: {
+            baseUrl: realm.url,
+            realm: realm.realm,
+            syncClientId: env.AUTH_SYNC_CLIENT_ID || SYNC_CLIENT_ID,
+            syncClientSecret: secret,
+        },
+    };
+}
+//# sourceMappingURL=env-options.js.map

package/esm/lib/env-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-options.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/env-options.ts"],"names":[],"mappings":"AAcA,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAgC,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAEjG,uGAAuG;AACvG,MAAM,cAAc,GAAW,iBAAiB,CAAC;AAEjD,2GAA2G;AAC3G,MAAM,MAAM,GAAW,uCAAuC,CAAC;AAU/D,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAAC,MAAc;IACxC,MAAM,KAAK,GAA2B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IACxD,MAAM,KAAK,GAA4D,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAa,EAAE,OAA+B;IAC7E,MAAM,OAAO,GAAsB,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAoB,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAW,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAW,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,MAAM,GAAuB,GAAG,CAAC,gBAAgB,CAAC;IACxD,MAAM,QAAQ,GAAsB,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC/D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,IAAI,GAA+E;QACrF,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAA4D,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACH,MAAM;QACN,QAAQ;QACR,OAAO;QACP,GAAG,IAAI;QACP,IAAI,EAAE;YACF,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,GAAG,CAAC,mBAAmB,IAAI,cAAc;YACvD,gBAAgB,EAAE,MAAM;SAC3B;KACJ,CAAC;AACN,CAAC","sourcesContent":["import { TPermission } from '@rt-tools/auth-contract';\n\nimport type { IAuthServerOptions } from './auth-server.module';\n\n/** The environment variables the entry module is set up by; `process.env` fits it as it is. */\nexport interface IAuthEnv {\n    readonly AUTH_ISSUER?: string;\n    readonly AUTH_CLIENT_ID?: string;\n    readonly AUTH_SYNC_SECRET?: string;\n    readonly AUTH_SYNC_CLIENT_ID?: string;\n    readonly AUTH_KEYS_URL?: string;\n    readonly AUTH_SERVICE_CLIENTS?: string;\n}\n\n/** The variables without which a server checks no token. */\nexport const AUTH_ENV_VARIABLES: readonly (keyof IAuthEnv)[] = ['AUTH_ISSUER', 'AUTH_CLIENT_ID'];\n\n/** The service client of the realm allowed to create the roles of a client, unless named otherwise. */\nconst SYNC_CLIENT_ID: string = 'rt-catalog-sync';\n\n/** The Keycloak address and the realm name, taken from the issuer: `https://sso.example.com/realms/rt`. */\nconst ISSUER: RegExp = /^(https?:\\/\\/.+)\\/realms\\/([^/]+)\\/?$/;\n\n/** What the browser part of an admin needs to sign a person in: the same realm and client as the server. */\nexport interface IAuthClientSettings {\n    /** The Keycloak address, for example `https://sso.example.com`. */\n    readonly url: string;\n    readonly realm: string;\n    readonly clientId: string;\n}\n\n/** The Keycloak address and the realm of an issuer, or `null` when it is not the address of a realm. */\nexport function realmOfIssuer(issuer: string): { readonly url: string; readonly realm: string } | null {\n    const match: RegExpExecArray | null = ISSUER.exec(issuer);\n    return match ? { url: match[1], realm: match[2] } : null;\n}\n\n/**\n * The settings the browser part signs in with, taken from the options of the server. The admin\n * asks them at start instead of carrying its own copy: a copy built into the page drifts from the\n * server at the first move of Keycloak to another address.\n */\nexport function clientSettingsOf(options: IAuthServerOptions): IAuthClientSettings {\n    const realm: { readonly url: string; readonly realm: string } | null = realmOfIssuer(options.issuer);\n    if (!realm) {\n        throw new Error(`The issuer is not the address of a Keycloak realm: ${options.issuer}`);\n    }\n    return { ...realm, clientId: options.clientId };\n}\n\n/**\n * The options of the entry module from the environment of the server.\n *\n * The realm and the client belong to the stand, not to the code: a missing one stops the start by\n * name instead of checking tokens against a guess. The catalog goes to Keycloak only when the\n * environment holds the secret of the sync client (`AUTH_SYNC_SECRET`); `AUTH_SYNC_CLIENT_ID`\n * names that client when it is not `rt-catalog-sync`. Without the secret the realm file of the\n * stand declares the roles itself. `AUTH_KEYS_URL` names where the keys are read when the server\n * reaches Keycloak by another address than the browser. `AUTH_SERVICE_CLIENTS` names, by commas, the\n * service clients whose tokens the server accepts besides the client of the admin.\n */\nexport function authOptionsFromEnv(env: IAuthEnv, catalog: readonly TPermission[]): IAuthServerOptions {\n    const missing: readonly string[] = AUTH_ENV_VARIABLES.filter((name: keyof IAuthEnv): boolean => !env[name]);\n    if (missing.length) {\n        throw new Error(`The server needs ${missing.join(' and ')} in the environment`);\n    }\n    const issuer: string = String(env.AUTH_ISSUER);\n    const clientId: string = String(env.AUTH_CLIENT_ID);\n    const secret: string | undefined = env.AUTH_SYNC_SECRET;\n    const services: readonly string[] = (env.AUTH_SERVICE_CLIENTS ?? '')\n        .split(',')\n        .map((name: string): string => name.trim())\n        .filter(Boolean);\n    const keys: { readonly keysUrl?: string; readonly serviceClients?: readonly string[] } = {\n        ...(env.AUTH_KEYS_URL ? { keysUrl: env.AUTH_KEYS_URL } : {}),\n        ...(services.length ? { serviceClients: services } : {}),\n    };\n    if (!secret) {\n        return { issuer, clientId, catalog, ...keys };\n    }\n    const realm: { readonly url: string; readonly realm: string } | null = realmOfIssuer(issuer);\n    if (!realm) {\n        throw new Error(`AUTH_ISSUER is not the address of a Keycloak realm: ${issuer}`);\n    }\n    return {\n        issuer,\n        clientId,\n        catalog,\n        ...keys,\n        sync: {\n            baseUrl: realm.url,\n            realm: realm.realm,\n            syncClientId: env.AUTH_SYNC_CLIENT_ID || SYNC_CLIENT_ID,\n            syncClientSecret: secret,\n        },\n    };\n}\n"]}

package/esm/lib/testing/keys.d.ts

@@ -0,0 +1,17 @@
+import { JWTVerifyGetKey } from 'jose';
+/** The realm of the tests. */
+export declare const TEST_ISSUER: string;
+export declare const TEST_CLIENT: string;
+/** A realm key pair and the key set the verifier reads, as a realm serves it. */
+export interface ITestRealm {
+    readonly keys: JWTVerifyGetKey;
+    sign(claims: Record<string, unknown>, options?: {
+        issuer?: string;
+        expiresIn?: string;
+        foreignKey?: boolean;
+    }): Promise<string>;
+}
+export declare function testRealm(): Promise<ITestRealm>;
+/** The claims of a person with the given roles in the test client, issued to it. */
+export declare function personClaims(roles: readonly string[], azp?: string): Record<string, unknown>;
+//# sourceMappingURL=keys.d.ts.map

package/esm/lib/testing/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../projects/auth-server/src/lib/testing/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsD,eAAe,EAAW,MAAM,MAAM,CAAC;AAEpG,8BAA8B;AAC9B,eAAO,MAAM,WAAW,EAAE,MAA2C,CAAC;AACtE,eAAO,MAAM,WAAW,EAAE,MAAuB,CAAC;AAElD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnI;AAED,wBAAsB,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,CAiBrD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,GAAE,MAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzG"}

package/esm/lib/testing/keys.js

@@ -0,0 +1,23 @@
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from 'jose';
+/** The realm of the tests. */
+export const TEST_ISSUER = 'http://localhost:58080/realms/rt';
+export const TEST_CLIENT = 'orders-admin';
+export async function testRealm() {
+    const own = await generateKeyPair('RS256');
+    const foreign = await generateKeyPair('RS256');
+    const jwk = { ...(await exportJWK(own.publicKey)), kid: 'own', alg: 'RS256', use: 'sig' };
+    return {
+        keys: createLocalJWKSet({ keys: [jwk] }),
+        sign: async (claims, options = {}) => new SignJWT(claims)
+            .setProtectedHeader({ alg: 'RS256', kid: 'own' })
+            .setIssuer(options.issuer ?? TEST_ISSUER)
+            .setIssuedAt()
+            .setExpirationTime(options.expiresIn ?? '5m')
+            .sign(options.foreignKey ? foreign.privateKey : own.privateKey),
+    };
+}
+/** The claims of a person with the given roles in the test client, issued to it. */
+export function personClaims(roles, azp = TEST_CLIENT) {
+    return { sub: 'p-1', email: 'anna@example.com', resource_access: { [TEST_CLIENT]: { roles } }, azp };
+}
+//# sourceMappingURL=keys.js.map

package/esm/lib/testing/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../projects/auth-server/src/lib/testing/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAwB,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpG,8BAA8B;AAC9B,MAAM,CAAC,MAAM,WAAW,GAAW,kCAAkC,CAAC;AACtE,MAAM,CAAC,MAAM,WAAW,GAAW,cAAc,CAAC;AAQlD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC3B,MAAM,GAAG,GAAkB,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAkB,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAQ,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC/F,OAAO;QACH,IAAI,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,KAAK,EACP,MAA+B,EAC/B,UAAyE,EAAE,EAC5D,EAAE,CACjB,IAAI,OAAO,CAAC,MAAM,CAAC;aACd,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAChD,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;aACxC,WAAW,EAAE;aACb,iBAAiB,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;aAC5C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;KAC1E,CAAC;AACN,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,MAAc,WAAW;IAC5E,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACzG,CAAC","sourcesContent":["import { createLocalJWKSet, exportJWK, generateKeyPair, JWK, JWTVerifyGetKey, SignJWT } from 'jose';\n\n/** The realm of the tests. */\nexport const TEST_ISSUER: string = 'http://localhost:58080/realms/rt';\nexport const TEST_CLIENT: string = 'orders-admin';\n\n/** A realm key pair and the key set the verifier reads, as a realm serves it. */\nexport interface ITestRealm {\n    readonly keys: JWTVerifyGetKey;\n    sign(claims: Record<string, unknown>, options?: { issuer?: string; expiresIn?: string; foreignKey?: boolean }): Promise<string>;\n}\n\nexport async function testRealm(): Promise<ITestRealm> {\n    const own: CryptoKeyPair = await generateKeyPair('RS256');\n    const foreign: CryptoKeyPair = await generateKeyPair('RS256');\n    const jwk: JWK = { ...(await exportJWK(own.publicKey)), kid: 'own', alg: 'RS256', use: 'sig' };\n    return {\n        keys: createLocalJWKSet({ keys: [jwk] }),\n        sign: async (\n            claims: Record<string, unknown>,\n            options: { issuer?: string; expiresIn?: string; foreignKey?: boolean } = {}\n        ): Promise<string> =>\n            new SignJWT(claims)\n                .setProtectedHeader({ alg: 'RS256', kid: 'own' })\n                .setIssuer(options.issuer ?? TEST_ISSUER)\n                .setIssuedAt()\n                .setExpirationTime(options.expiresIn ?? '5m')\n                .sign(options.foreignKey ? foreign.privateKey : own.privateKey),\n    };\n}\n\n/** The claims of a person with the given roles in the test client, issued to it. */\nexport function personClaims(roles: readonly string[], azp: string = TEST_CLIENT): Record<string, unknown> {\n    return { sub: 'p-1', email: 'anna@example.com', resource_access: { [TEST_CLIENT]: { roles } }, azp };\n}\n"]}

package/esm/lib/token-verifier.d.ts

@@ -0,0 +1,41 @@
+import { JWTVerifyGetKey } from 'jose';
+import { ICaller } from '@rt-tools/auth-contract';
+/** Where the tokens of an admin come from: the realm and the client of this admin. */
+export interface ITokenCheckOptions {
+    /** The realm issuer, for example `https://sso.example.com/realms/rt`. */
+    readonly issuer: string;
+    /** The client of this admin in the realm. A token issued to another client is refused. */
+    readonly clientId: string;
+    /**
+     * The service clients whose tokens this admin accepts too: commands that call it without a
+     * person. Their rights are the roles of `clientId` on their service account, the same place the
+     * rights of a person are read from.
+     */
+    readonly serviceClients?: readonly string[];
+    /**
+     * Where the server reads the keys of the realm, when it reaches Keycloak by another address than
+     * the browser does: an inner network, a container. By default — the key set of the issuer.
+     */
+    readonly keysUrl?: string;
+}
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+export declare function bearerToken(authorization: string | null | undefined): string | null;
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin or to a service client it names (`azp`). Every other
+ * case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+export declare class KeycloakTokenVerifier {
+    #private;
+    constructor(options: ITokenCheckOptions, keys?: JWTVerifyGetKey);
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    callerOf(authorization: string | null | undefined): Promise<ICaller | null>;
+}
+//# sourceMappingURL=token-verifier.d.ts.map

package/esm/lib/token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,eAAe,EAAa,MAAM,MAAM,CAAC;AAElF,OAAO,EAAoB,OAAO,EAAmB,MAAM,yBAAyB,CAAC;AAErF,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGnF;AA0BD;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAqB;;gBAIlB,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,eAAe;IAK/D,0FAA0F;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;CAoB3F"}

package/esm/lib/token-verifier.js

@@ -0,0 +1,72 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { callerFromClaims } from '@rt-tools/auth-contract';
+const BEARER = /^Bearer ([A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+)$/;
+/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */
+export function bearerToken(authorization) {
+    const match = BEARER.exec(authorization?.trim() ?? '');
+    return match ? match[1] : null;
+}
+function resourceAccessOf(value) {
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const access = {};
+    for (const [clientId, entry] of Object.entries(value)) {
+        const roles = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;
+        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role) => typeof role === 'string') : [] };
+    }
+    return access;
+}
+/** The claims the caller is read from, taken from a verified payload by their shape. */
+function claimsOf(payload) {
+    return {
+        sub: String(payload.sub),
+        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,
+        email_verified: payload['email_verified'] === true,
+        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,
+        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,
+        resource_access: resourceAccessOf(payload['resource_access']),
+    };
+}
+/**
+ * The token check of one admin, shared by the NestJS guard and the Connect interceptor.
+ *
+ * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and
+ * it was issued to the client of this admin or to a service client it names (`azp`). Every other
+ * case answers `null` and nothing
+ * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens
+ * come close.
+ *
+ * The keys are fetched from the key set address of the realm and cached by `jose`; a key the
+ * realm rotates in is picked up without a restart.
+ */
+export class KeycloakTokenVerifier {
+    #options;
+    #keys;
+    constructor(options, keys) {
+        this.#options = options;
+        this.#keys = keys ?? createRemoteJWKSet(new URL(options.keysUrl ?? `${options.issuer}/protocol/openid-connect/certs`));
+    }
+    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */
+    async callerOf(authorization) {
+        const token = bearerToken(authorization);
+        if (!token) {
+            return null;
+        }
+        try {
+            const { payload } = await jwtVerify(token, this.#keys, { issuer: this.#options.issuer });
+            if (!this.#accepts(payload['azp']) || typeof payload.sub !== 'string') {
+                return null;
+            }
+            return callerFromClaims(claimsOf(payload), this.#options.clientId);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Whether a token issued to this client is accepted: the client of this admin or a service client it names. */
+    #accepts(azp) {
+        return azp === this.#options.clientId || (typeof azp === 'string' && (this.#options.serviceClients ?? []).includes(azp));
+    }
+}
+//# sourceMappingURL=token-verifier.js.map

package/esm/lib/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../../../projects/auth-server/src/lib/token-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA+B,SAAS,EAAE,MAAM,MAAM,CAAC;AAElF,OAAO,EAAE,gBAAgB,EAA4B,MAAM,yBAAyB,CAAC;AAqBrF,MAAM,MAAM,GAAW,8DAA8D,CAAC;AAEtF,uGAAuG;AACvG,MAAM,UAAU,WAAW,CAAC,aAAwC;IAChE,MAAM,KAAK,GAA2B,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxI,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,OAAmB;IACjC,OAAO;QACH,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,cAAc,EAAE,OAAO,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAClD,IAAI,EAAE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,kBAAkB,EAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;QACjH,eAAe,EAAE,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;KAChE,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAqB;IACrB,QAAQ,CAAqB;IAC7B,KAAK,CAAkB;IAEhC,YAAY,OAA2B,EAAE,IAAsB;QAC3D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC;IAC3H,CAAC;IAED,0FAA0F;IACnF,KAAK,CAAC,QAAQ,CAAC,aAAwC;QAC1D,MAAM,KAAK,GAAkB,WAAW,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,gHAAgH;IAChH,QAAQ,CAAC,GAAY;QACjB,OAAO,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7H,CAAC;CACJ","sourcesContent":["import { createRemoteJWKSet, JWTPayload, JWTVerifyGetKey, jwtVerify } from 'jose';\n\nimport { callerFromClaims, ICaller, IKeycloakClaims } from '@rt-tools/auth-contract';\n\n/** Where the tokens of an admin come from: the realm and the client of this admin. */\nexport interface ITokenCheckOptions {\n    /** The realm issuer, for example `https://sso.example.com/realms/rt`. */\n    readonly issuer: string;\n    /** The client of this admin in the realm. A token issued to another client is refused. */\n    readonly clientId: string;\n    /**\n     * The service clients whose tokens this admin accepts too: commands that call it without a\n     * person. Their rights are the roles of `clientId` on their service account, the same place the\n     * rights of a person are read from.\n     */\n    readonly serviceClients?: readonly string[];\n    /**\n     * Where the server reads the keys of the realm, when it reaches Keycloak by another address than\n     * the browser does: an inner network, a container. By default — the key set of the issuer.\n     */\n    readonly keysUrl?: string;\n}\n\nconst BEARER: RegExp = /^Bearer ([A-Za-z0-9\\-_]+\\.[A-Za-z0-9\\-_]+\\.[A-Za-z0-9\\-_]+)$/;\n\n/** The token of the `Authorization` header, or `null` when the header is absent or of another form. */\nexport function bearerToken(authorization: string | null | undefined): string | null {\n    const match: RegExpExecArray | null = BEARER.exec(authorization?.trim() ?? '');\n    return match ? match[1] : null;\n}\n\nfunction resourceAccessOf(value: unknown): IKeycloakClaims['resource_access'] {\n    if (typeof value !== 'object' || value === null) {\n        return undefined;\n    }\n    const access: Record<string, { roles?: readonly string[] }> = {};\n    for (const [clientId, entry] of Object.entries(value)) {\n        const roles: unknown = typeof entry === 'object' && entry !== null ? Reflect.get(entry, 'roles') : undefined;\n        access[clientId] = { roles: Array.isArray(roles) ? roles.filter((role: unknown): role is string => typeof role === 'string') : [] };\n    }\n    return access;\n}\n\n/** The claims the caller is read from, taken from a verified payload by their shape. */\nfunction claimsOf(payload: JWTPayload): IKeycloakClaims {\n    return {\n        sub: String(payload.sub),\n        email: typeof payload['email'] === 'string' ? payload['email'] : undefined,\n        email_verified: payload['email_verified'] === true,\n        name: typeof payload['name'] === 'string' ? payload['name'] : undefined,\n        preferred_username: typeof payload['preferred_username'] === 'string' ? payload['preferred_username'] : undefined,\n        resource_access: resourceAccessOf(payload['resource_access']),\n    };\n}\n\n/**\n * The token check of one admin, shared by the NestJS guard and the Connect interceptor.\n *\n * A token is accepted when a key of the realm signed it, the realm issued it, its term holds and\n * it was issued to the client of this admin or to a service client it names (`azp`). Every other\n * case answers `null` and nothing\n * more: the reason of a refusal is not told to the caller, so the answers do not show which tokens\n * come close.\n *\n * The keys are fetched from the key set address of the realm and cached by `jose`; a key the\n * realm rotates in is picked up without a restart.\n */\nexport class KeycloakTokenVerifier {\n    readonly #options: ITokenCheckOptions;\n    readonly #keys: JWTVerifyGetKey;\n\n    constructor(options: ITokenCheckOptions, keys?: JWTVerifyGetKey) {\n        this.#options = options;\n        this.#keys = keys ?? createRemoteJWKSet(new URL(options.keysUrl ?? `${options.issuer}/protocol/openid-connect/certs`));\n    }\n\n    /** The caller of the `Authorization` header, or `null` when the token is not accepted. */\n    public async callerOf(authorization: string | null | undefined): Promise<ICaller | null> {\n        const token: string | null = bearerToken(authorization);\n        if (!token) {\n            return null;\n        }\n        try {\n            const { payload } = await jwtVerify(token, this.#keys, { issuer: this.#options.issuer });\n            if (!this.#accepts(payload['azp']) || typeof payload.sub !== 'string') {\n                return null;\n            }\n            return callerFromClaims(claimsOf(payload), this.#options.clientId);\n        } catch {\n            return null;\n        }\n    }\n\n    /** Whether a token issued to this client is accepted: the client of this admin or a service client it names. */\n    #accepts(azp: unknown): boolean {\n        return azp === this.#options.clientId || (typeof azp === 'string' && (this.#options.serviceClients ?? []).includes(azp));\n    }\n}\n"]}

package/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@rt-tools/auth-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Keycloak token check, access declarations and the rights catalog sync for NestJS controllers and Connect procedures",
+  "author": "RT Team",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/nickmdf/rt-tools.git",
+    "directory": "projects/auth-server"
+  },
+  "homepage": "https://github.com/nickmdf/rt-tools/tree/main/projects/auth-server",
+  "bugs": {
+    "url": "https://github.com/nickmdf/rt-tools/issues"
+  },
+  "keywords": [
+    "nestjs",
+    "connect",
+    "keycloak",
+    "oidc",
+    "permissions"
+  ],
+  "dependencies": {
+    "@rt-tools/auth-contract": "^0.1.0",
+    "jose": "^6.2.12",
+    "tslib": "^2.3.0"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@connectrpc/connect": "^2.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0"
+  },
+  "devDependencies": {
+    "@connectrpc/connect": "2.2.0"
+  },
+  "sideEffects": false,
+  "main": "./cjs/index.js",
+  "types": "./esm/index.d.ts",
+  "module": "./esm/index.js",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./esm/index.d.ts",
+      "import": "./esm/index.js",
+      "require": "./cjs/index.js"
+    }
+  }
+}