@schemavaults/auth-server-sdk 0.22.1 → 0.22.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.cjs +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/route_guards/withAdminRouteGuard/withAdminApiRouteGuard.d.ts +5 -2
- package/dist/route_guards/withAdminRouteGuard/withAdminApiRouteGuard.js.map +1 -1
- package/dist/route_guards/withAdminRouteGuard/withAdminServerComponentRouteGuard.d.ts +4 -1
- package/dist/route_guards/withAdminRouteGuard/withAdminServerComponentRouteGuard.js +11 -1
- package/dist/route_guards/withAdminRouteGuard/withAdminServerComponentRouteGuard.js.map +1 -1
- package/dist/route_guards/withAuthenticatedRouteGuard/IBaseProtectedAuthenticatedServerComponentPageProps.d.ts +2 -0
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard.d.ts +3 -1
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard.js +40 -5
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard.js.map +1 -1
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.d.ts +3 -1
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.js +41 -9
- package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.js.map +1 -1
- package/package.json +3 -3
package/dist/cli.cjs
CHANGED
|
@@ -89,7 +89,7 @@ var init_resolve_codegen_templates_directory = __esm({
|
|
|
89
89
|
|
|
90
90
|
// src/NextjsAppDirectoryPlugin/codegen-marker.ts
|
|
91
91
|
function getCodegenMarkerComment() {
|
|
92
|
-
const version = true ? "0.22.
|
|
92
|
+
const version = true ? "0.22.4" : "unknown";
|
|
93
93
|
return `${CODEGEN_MARKER_PREFIX}${version}`;
|
|
94
94
|
}
|
|
95
95
|
function hasCodegenMarker(firstLine) {
|
|
@@ -296,7 +296,7 @@ async function main() {
|
|
|
296
296
|
return;
|
|
297
297
|
}
|
|
298
298
|
if (args.includes("--version") || args.includes("-v")) {
|
|
299
|
-
console.log(`${PACKAGE_NAME}@${"0.22.
|
|
299
|
+
console.log(`${PACKAGE_NAME}@${"0.22.4"}`);
|
|
300
300
|
return;
|
|
301
301
|
}
|
|
302
302
|
const command = args.find((arg) => !arg.startsWith("-")) ?? "codegen";
|
package/dist/index.d.ts
CHANGED
|
@@ -29,8 +29,8 @@ export type { IDecodeJWTsWithKeyManagerOutput } from "./decode-jwts-with-key-man
|
|
|
29
29
|
export { isUserInOrganization } from "./isUserInOrganization";
|
|
30
30
|
export { userDataSchema } from "@schemavaults/auth-common";
|
|
31
31
|
export type { UserData } from "@schemavaults/auth-common";
|
|
32
|
-
export { organizationIdSchema, organizationDefinitionSchema, isValidOrganizationID, SCHEMAVAULTS_ORGANIZATION_ID, } from "@schemavaults/auth-common";
|
|
33
|
-
export type { OrganizationID, OrganizationDefinition, } from "@schemavaults/auth-common";
|
|
32
|
+
export { organizationIdSchema, organizationDefinitionSchema, isValidOrganizationID, SCHEMAVAULTS_ORGANIZATION_ID, isValidOrganizationMembershipRoleType, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, } from "@schemavaults/auth-common/organizations";
|
|
33
|
+
export type { OrganizationID, OrganizationDefinition, OrganizationMembershipRoleType, } from "@schemavaults/auth-common/organizations";
|
|
34
34
|
export type { SchemaVaultsApp, SchemaVaultsAppDomainRef, } from "@schemavaults/app-definitions";
|
|
35
35
|
export type { SchemaVaultsApiServerDefinition, SchemaVaultsApiServerDomainRef, } from "@schemavaults/app-definitions";
|
|
36
36
|
export { getHardcodedApp, getHardcodedClientWebAppDomain, getHardcodedApiServer, getHardcodedApiServerDomain, getAuthServerUri, } from "@schemavaults/app-definitions";
|
package/dist/index.js
CHANGED
|
@@ -24,7 +24,7 @@ export { isUserInOrganization } from "./isUserInOrganization";
|
|
|
24
24
|
// Re-export user data types
|
|
25
25
|
export { userDataSchema } from "@schemavaults/auth-common";
|
|
26
26
|
// Re-export organization types
|
|
27
|
-
export { organizationIdSchema, organizationDefinitionSchema, isValidOrganizationID, SCHEMAVAULTS_ORGANIZATION_ID, } from "@schemavaults/auth-common";
|
|
27
|
+
export { organizationIdSchema, organizationDefinitionSchema, isValidOrganizationID, SCHEMAVAULTS_ORGANIZATION_ID, isValidOrganizationMembershipRoleType, organizationMembershipRoleTypes, organizationMembershipRoleTypeSchema, } from "@schemavaults/auth-common/organizations";
|
|
28
28
|
// Loading hardcoded apps/apis
|
|
29
29
|
export { getHardcodedApp, getHardcodedClientWebAppDomain, getHardcodedApiServer, getHardcodedApiServerDomain, getAuthServerUri, } from "@schemavaults/app-definitions";
|
|
30
30
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,qCAAqC,CAAC;AAG7C,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,iBAAiB;AACjB,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E,OAAO,EACL,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,yBAAyB;AACzB,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,WAAW,EACX,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAEvC,eAAe;AACf,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,gBAAgB;AAChB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D,+BAA+B;AAC/B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,iBAAiB,CAAC;AAGhC,cAAc,yBAAyB,CAAC;AAGxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,OAAO,EACL,qBAAqB,EACrB,cAAc,GACf,MAAM,qCAAqC,CAAC;AAG7C,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,iBAAiB;AACjB,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAE9E,OAAO,EACL,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAEvC,yBAAyB;AACzB,OAAO,EAAE,kCAAkC,EAAE,MAAM,0CAA0C,CAAC;AAE9F,OAAO,EACL,WAAW,EACX,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAEvC,eAAe;AACf,OAAO,EACL,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,gBAAgB;AAChB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAG1E,6EAA6E;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAG3D,+BAA+B;AAC/B,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,EAC5B,qCAAqC,EACrC,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,yCAAyC,CAAC;AAmBjD,8BAA8B;AAC9B,OAAO,EACL,eAAe,EACf,8BAA8B,EAC9B,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,+BAA+B,CAAC"}
|
|
@@ -1,7 +1,10 @@
|
|
|
1
1
|
import { type TProtectedAuthenticatedApiRoute, type IBaseProtectedAuthenticatedApiRouteInputs } from "../../route_guards/withAuthenticatedRouteGuard";
|
|
2
2
|
import type { NextRequest, NextResponse } from "next/server";
|
|
3
|
-
import { IWithAuthenticatedApiRouteGuardAdditionalOptions } from "../withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard";
|
|
3
|
+
import type { IWithAuthenticatedApiRouteGuardAdditionalOptions } from "../withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard";
|
|
4
4
|
type TAdditionalRouteInputs<TRouteInputs extends IBaseProtectedAuthenticatedApiRouteInputs = IBaseProtectedAuthenticatedApiRouteInputs> = Omit<TRouteInputs, keyof IBaseProtectedAuthenticatedApiRouteInputs>;
|
|
5
|
-
export
|
|
5
|
+
export interface IWithAdminApiRouteGuardAdditionalOptions extends Omit<IWithAuthenticatedApiRouteGuardAdditionalOptions, "route_guard_type"> {
|
|
6
|
+
route_guard_type?: "admin";
|
|
7
|
+
}
|
|
8
|
+
export declare function withAdminApiRouteGuard<TRouteInputs extends IBaseProtectedAuthenticatedApiRouteInputs = IBaseProtectedAuthenticatedApiRouteInputs>(api_route_handler: TProtectedAuthenticatedApiRoute<TRouteInputs>, additional_custom_api_route_inputs?: TAdditionalRouteInputs<TRouteInputs> | undefined, opts?: IWithAdminApiRouteGuardAdditionalOptions): (req: NextRequest) => Promise<NextResponse>;
|
|
6
9
|
export default withAdminApiRouteGuard;
|
|
7
10
|
export type { TProtectedAuthenticatedApiRoute as TProtectedAdminApiRoute, IBaseProtectedAuthenticatedApiRouteInputs as IBaseProtectedAdminApiRouteInputs, } from "../../route_guards/withAuthenticatedRouteGuard";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"withAdminApiRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAdminRouteGuard/withAdminApiRouteGuard.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"withAdminApiRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAdminRouteGuard/withAdminApiRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,8BAA8B,GAE/B,MAAM,4CAA4C,CAAC;AAgBpD,MAAM,UAAU,sBAAsB,CAIpC,iBAAgE,EAChE,qCAEgB,SAAS,EACzB,IAA+C;IAE/C,OAAO,8BAA8B,CACnC,iBAAiB,EACjB,kCAAkC,EAClC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CACvC,CAAC;AACJ,CAAC;AAED,eAAe,sBAAsB,CAAC"}
|
|
@@ -2,5 +2,8 @@ import { type IBaseProtectedAuthenticatedServerComponentPageProps, type TProtect
|
|
|
2
2
|
import type { ReactElement } from "react";
|
|
3
3
|
import type { IWithAuthenticatedServerComponentRouteGuardAdditionalOptions } from "../../route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard";
|
|
4
4
|
type TAdditionalProps<TProps extends IBaseProtectedAuthenticatedServerComponentPageProps = IBaseProtectedAuthenticatedServerComponentPageProps> = Omit<TProps, keyof IBaseProtectedAuthenticatedServerComponentPageProps>;
|
|
5
|
-
export
|
|
5
|
+
export interface IWithAdminApiRouteGuardAdditionalOptions extends Omit<IWithAuthenticatedServerComponentRouteGuardAdditionalOptions, "route_guard_type"> {
|
|
6
|
+
route_guard_type?: "admin";
|
|
7
|
+
}
|
|
8
|
+
export declare function withAdminServerComponentRouteGuard<TProps extends IBaseProtectedAuthenticatedServerComponentPageProps = IBaseProtectedAuthenticatedServerComponentPageProps>(server_component: TProtectedAuthenticatedPageServerComponent<TProps>, additional_custom_server_component_props?: TAdditionalProps<TProps> | undefined, opts?: IWithAdminApiRouteGuardAdditionalOptions): Promise<ReactElement>;
|
|
6
9
|
export type { TProtectedAuthenticatedPageServerComponent as TProtectedAdminPageServerComponent, IBaseProtectedAuthenticatedServerComponentPageProps as IBaseProtectedAdminServerComponentPageProps, } from "../../route_guards/withAuthenticatedRouteGuard";
|
|
@@ -3,7 +3,17 @@ export async function withAdminServerComponentRouteGuard(server_component, addit
|
|
|
3
3
|
return await withAuthenticatedServerComponentRouteGuard(server_component, additional_custom_server_component_props, {
|
|
4
4
|
...opts,
|
|
5
5
|
route_guard_type: "admin",
|
|
6
|
-
custom_is_authorized_check: async (
|
|
6
|
+
custom_is_authorized_check: async (props) => {
|
|
7
|
+
if (!props.user.admin) {
|
|
8
|
+
return false;
|
|
9
|
+
}
|
|
10
|
+
if (typeof opts?.custom_is_authorized_check === "function") {
|
|
11
|
+
return (await opts.custom_is_authorized_check(props)) ? true : false;
|
|
12
|
+
}
|
|
13
|
+
else {
|
|
14
|
+
return props.user.admin ? true : false;
|
|
15
|
+
}
|
|
16
|
+
},
|
|
7
17
|
});
|
|
8
18
|
}
|
|
9
19
|
//# sourceMappingURL=withAdminServerComponentRouteGuard.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"withAdminServerComponentRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAdminRouteGuard/withAdminServerComponentRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,GAG3C,MAAM,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"withAdminServerComponentRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAdminRouteGuard/withAdminServerComponentRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0CAA0C,GAG3C,MAAM,4CAA4C,CAAC;AAgBpD,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,gBAAoE,EACpE,2CAEgB,SAAS,EACzB,IAA+C;IAE/C,OAAO,MAAM,0CAA0C,CACrD,gBAAgB,EAChB,wCAAwC,EACxC;QACE,GAAG,IAAI;QACP,gBAAgB,EAAE,OAAO;QACzB,0BAA0B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,OAAO,IAAI,EAAE,0BAA0B,KAAK,UAAU,EAAE,CAAC;gBAC3D,OAAO,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACN,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
import type { SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
|
|
2
|
+
import type { OrganizationID, OrganizationMembershipRoleType } from "@schemavaults/auth-common/organizations";
|
|
2
3
|
import type { UserData } from "@schemavaults/auth-common";
|
|
3
4
|
export interface IBaseProtectedAuthenticatedServerComponentPageProps {
|
|
4
5
|
user: UserData;
|
|
5
6
|
environment: SchemaVaultsAppEnvironment;
|
|
7
|
+
isUserInOrganization: (user: UserData, org_id: OrganizationID) => Promise<OrganizationMembershipRoleType | false>;
|
|
6
8
|
}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type ApiServerId } from "@schemavaults/app-definitions";
|
|
2
|
-
import type
|
|
2
|
+
import { type UserData } from "@schemavaults/auth-common";
|
|
3
|
+
import type { OrganizationID, OrganizationMembershipRoleType } from "@schemavaults/auth-common/organizations";
|
|
3
4
|
import type { NextRequest, NextResponse } from "next/server";
|
|
4
5
|
import type { IJwtKeyManager } from "../../JwtKeyManager";
|
|
5
6
|
import type { IBaseProtectedAuthenticatedApiRouteInputs } from "./IBaseProtectedAuthenticatedApiRouteInputs";
|
|
@@ -11,6 +12,7 @@ export interface IWithAuthenticatedApiRouteGuardAdditionalOptions<TRouteInputs e
|
|
|
11
12
|
api_server_id?: ApiServerId;
|
|
12
13
|
custom_is_authorized_check?: (props: TRouteInputs) => Promise<boolean>;
|
|
13
14
|
required_organization?: OrganizationID;
|
|
15
|
+
custom_is_user_in_organization?: (user: UserData, org_id: OrganizationID) => Promise<OrganizationMembershipRoleType | false>;
|
|
14
16
|
}
|
|
15
17
|
export declare function withAuthenticatedApiRouteGuard<TRouteInputs extends IBaseProtectedAuthenticatedApiRouteInputs = IBaseProtectedAuthenticatedApiRouteInputs>(api_route_handler: TProtectedAuthenticatedApiRoute<TRouteInputs>, additional_custom_api_route_inputs?: TAdditionalRouteInputs<TRouteInputs> | undefined, opts?: IWithAuthenticatedApiRouteGuardAdditionalOptions): (req: NextRequest) => Promise<NextResponse>;
|
|
16
18
|
export default withAuthenticatedApiRouteGuard;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { SCHEMAVAULTS_AUTH_APP_ID, getAppEnvironment, } from "@schemavaults/app-definitions";
|
|
2
|
-
import { accessTokenDataSchema, } from "@schemavaults/auth-common";
|
|
3
|
-
import
|
|
2
|
+
import { accessTokenDataSchema, organizationIdSchema, userDataSchema, } from "@schemavaults/auth-common";
|
|
3
|
+
import isUserInOrganizationFromAuthServer from "../../isUserInOrganization";
|
|
4
4
|
import getSchemaVaultsAuthServerUri from "../../get-schemavaults-auth-server-uri";
|
|
5
5
|
import loadJwksAccessPrivateKey from "../../env/loadJwksAccessPrivateKey/loadJwksAccessPrivateKey";
|
|
6
6
|
import RouteGuardFactory from "../../route_guards/route-guard-factory";
|
|
@@ -153,6 +153,13 @@ export function withAuthenticatedApiRouteGuard(api_route_handler, additional_cus
|
|
|
153
153
|
}, { status: 401 });
|
|
154
154
|
}
|
|
155
155
|
const user = route_guard.user;
|
|
156
|
+
if (user.disabled) {
|
|
157
|
+
return json({
|
|
158
|
+
success: false,
|
|
159
|
+
error: true,
|
|
160
|
+
message: "Your account is disabled!",
|
|
161
|
+
}, { status: 403 });
|
|
162
|
+
}
|
|
156
163
|
if (!route_guard.isAccessAllowed() || !route_guard.user) {
|
|
157
164
|
return json({
|
|
158
165
|
success: false,
|
|
@@ -160,11 +167,38 @@ export function withAuthenticatedApiRouteGuard(api_route_handler, additional_cus
|
|
|
160
167
|
message: "Access is not allowed",
|
|
161
168
|
}, { status: 403 });
|
|
162
169
|
}
|
|
170
|
+
if (!user.admin && route_guard_type === "admin") {
|
|
171
|
+
return json({
|
|
172
|
+
success: false,
|
|
173
|
+
error: true,
|
|
174
|
+
message: "You must be an admin to use this resource",
|
|
175
|
+
}, { status: 403 });
|
|
176
|
+
}
|
|
177
|
+
async function isUserInOrganization(user, org_id) {
|
|
178
|
+
if (!(await userDataSchema.safeParseAsync(user)).success) {
|
|
179
|
+
throw new TypeError("Invalid user data object to lookup organization role for!");
|
|
180
|
+
}
|
|
181
|
+
else if (!(await organizationIdSchema.safeParseAsync(org_id)).success) {
|
|
182
|
+
throw new TypeError("Invalid organization ID to check user's role for!");
|
|
183
|
+
}
|
|
184
|
+
const custom_is_user_in_organization = opts?.custom_is_user_in_organization;
|
|
185
|
+
if (api_server_id === SCHEMAVAULTS_AUTH_APP_ID &&
|
|
186
|
+
typeof custom_is_user_in_organization !== "function") {
|
|
187
|
+
throw new TypeError("A 'custom_is_user_in_organization' method must be passed to route guard when used for @schemavaults/auth-server!");
|
|
188
|
+
}
|
|
189
|
+
if (typeof custom_is_user_in_organization === "function") {
|
|
190
|
+
const org_role = await custom_is_user_in_organization(user, org_id);
|
|
191
|
+
return org_role;
|
|
192
|
+
}
|
|
193
|
+
const auth_server_url = getSchemaVaultsAuthServerUri();
|
|
194
|
+
const jwks_access_private_key = await loadJwksAccessPrivateKey();
|
|
195
|
+
// this is not the auth-server! we need to ask the auth-server if user is in org
|
|
196
|
+
const org_role = await isUserInOrganizationFromAuthServer(auth_server_url, api_server_id, jwks_access_private_key, user.uid, org_id);
|
|
197
|
+
return org_role;
|
|
198
|
+
}
|
|
163
199
|
if (opts?.required_organization) {
|
|
164
200
|
try {
|
|
165
|
-
const
|
|
166
|
-
const jwks_access_private_key = await loadJwksAccessPrivateKey();
|
|
167
|
-
const org_role = await isUserInOrganization(auth_server_url, api_server_id, jwks_access_private_key, user.uid, opts.required_organization);
|
|
201
|
+
const org_role = await isUserInOrganization(user, opts.required_organization);
|
|
168
202
|
if (org_role === false) {
|
|
169
203
|
return json({
|
|
170
204
|
success: false,
|
|
@@ -186,6 +220,7 @@ export function withAuthenticatedApiRouteGuard(api_route_handler, additional_cus
|
|
|
186
220
|
req,
|
|
187
221
|
user,
|
|
188
222
|
environment,
|
|
223
|
+
isUserInOrganization,
|
|
189
224
|
};
|
|
190
225
|
const final_route_inputs = typeof additional_custom_api_route_inputs === "object" &&
|
|
191
226
|
additional_custom_api_route_inputs
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"withAuthenticatedApiRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAExB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,qBAAqB,
|
|
1
|
+
{"version":3,"file":"withAuthenticatedApiRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAuthenticatedRouteGuard/withAuthenticatedApiRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAExB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAEL,qBAAqB,EACrB,oBAAoB,EAGpB,cAAc,GACf,MAAM,2BAA2B,CAAC;AAKnC,OAAO,kCAAkC,MAAM,wBAAwB,CAAC;AACxE,OAAO,4BAA4B,MAAM,oCAAoC,CAAC;AAC9E,OAAO,wBAAwB,MAAM,yDAAyD,CAAC;AAE/F,OAAO,iBAAiB,MAAM,oCAAoC,CAAC;AAEnE,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,wBAAwB,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,0BAA0B,MAAM,kCAAkC,CAAC;AAE1E,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AAEjF,OAAO,kDAAkD,MAAM,sDAAsD,CAAC;AActH,KAAK,UAAU,wBAAwB;IACrC,MAAM,WAAW,GAAkC,MAAM,CAAC,aAAa,CAAC;SACrE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;SAC/B,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC;IAC3C,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAiBD,MAAM,UAAU,8BAA8B,CAI5C,iBAAgE,EAChE,qCAEgB,SAAS,EACzB,IAAuD;IAEvD,MAAM,gBAAgB,GACpB,IAAI,EAAE,gBAAgB,IAAI,eAAe,CAAC;IAC5C,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,MAAM,qBAAqB,GACzB,iBAAiB,CAAC;IACpB,OAAO,KAAK,UAAU,8BAA8B,CAClD,GAAgB;QAEhB,MAAM,WAAW,GAA+B,iBAAiB,EAAE,CAAC;QAEpE,MAAM,aAAa,GACjB,IAAI,EAAE,aAAa,IAAI,0BAA0B,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,IAAI,SAAS,CACjB,qDAAqD,CACtD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D,CAAC,CACF,CAAC;YACF,MAAM,IAAI,GAAyB,MAAM,wBAAwB,EAAE,CAAC;YACpE,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,uBAAuB;aACjC,EACD;gBACE,MAAM,EAAE,GAAG;aACZ,CACF,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GACpB,IAAI,EAAE,gBAAgB;YACtB,kDAAkD,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CACX,8FAA8F,CAC/F,CAAC;YACF,MAAM,IAAI,GAAyB,MAAM,wBAAwB,EAAE,CAAC;YACpE,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,uBAAuB;aACjC,EACD;gBACE,MAAM,EAAE,GAAG;aACZ,CACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAkC,EAAE,CAAC;QAExD,4CAA4C;QAC5C,IAAI,aAAa,KAAK,wBAAwB,EAAE,CAAC;YAC/C,MAAM,oBAAoB,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAC1C,sBAAsB,CAAC,wBAAwB,CAAC,CACjD,CAAC;YACF,IACE,OAAO,oBAAoB,EAAE,KAAK,KAAK,QAAQ;gBAC/C,oBAAoB,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;gBACtC,iBAAiB,CAAC,oBAAoB,CAAC,KAAK,CAAC;oBAC3C,wBAAwB,EAC1B,CAAC;gBACD,aAAa,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,2BAA2B;oBACvC,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,oBAAoB,CAAC,KAAsB;iBACnD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CACV,yEAAyE,CAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,gHAAgH;QAChH,MAAM,CAAC,KAAK,UAAU,wCAAwC;YAC5D,MAAM,wBAAwB,GAC5B,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACvC,MAAM,mBAAmB,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACtE,IACE,OAAO,mBAAmB,EAAE,KAAK,KAAK,QAAQ;gBAC9C,mBAAmB,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;gBACrC,iBAAiB,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,wBAAwB,EACxE,CAAC;gBACD,IAAI,UAAU,GAAkB,IAAI,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,cAAc,CACvD,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CACtC,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACpB,MAAM,MAAM,CAAC,KAAK,CAAC;oBACrB,CAAC;oBACD,MAAM,0BAA0B,GAAgB,MAAM,CAAC,IAAI,CAAC;oBAC5D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC,GAAG,EAAE,CAAC;wBAChD,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;oBAC1B,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;gBACzC,CAAC;gBACD,IAAI,UAAU,EAAE,CAAC;oBACf,aAAa,CAAC,IAAI,CAAC;wBACjB,UAAU,EAAE,6BAA6B,wBAAwB,GAAG;wBACpE,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,UAAU;qBAClB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,8CAA8C;QAC9C,CAAC,SAAS,4CAA4C;YACpD,IACE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBAChC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAChC,CAAC;gBACD,MAAM,WAAW,GACf,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBACvE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;gBACJ,CAAC;gBACD,MAAM,wBAAwB,GAC5B,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;oBAClE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;oBACrC,CAAC,CAAC,EAAE,CAAC;gBACT,IAAI,CAAC,wBAAwB,EAAE,CAAC;oBAC9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACjE,CAAC;gBACD,aAAa,CAAC,IAAI,CAAC;oBACjB,UAAU,EAAE,+CAA+C;oBAC3D,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,wBAAyC;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,MAAM,IAAI,GAAyB,MAAM,wBAAwB,EAAE,CAAC;QAEpE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC9D,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,2DAA2D;aACrE,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAgB,MAAM,IAAI,iBAAiB,CAAC;YAC3D,WAAW;YACX,cAAc,EAAE,aAAa,KAAK,wBAAwB;YAC1D,gBAAgB;SACjB,CAAC,CAAC,2BAA2B,CAC5B,gBAAgB,EAChB,aAAa,EACb,aAAa,CACd,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,qCAAqC;aAC/C,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAa,WAAW,CAAC,IAAI,CAAC;QAExC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,2BAA2B;aACrC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACxD,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,uBAAuB;aACjC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YAChD,OAAO,IAAI,CACT;gBACE,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,2CAA2C;aACrD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;QACJ,CAAC;QAED,KAAK,UAAU,oBAAoB,CACjC,IAAc,EACd,MAAsB;YAEtB,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACzD,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;YACJ,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxE,MAAM,IAAI,SAAS,CACjB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YAED,MAAM,8BAA8B,GAClC,IAAI,EAAE,8BAA8B,CAAC;YAEvC,IACE,aAAa,KAAK,wBAAwB;gBAC1C,OAAO,8BAA8B,KAAK,UAAU,EACpD,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,kHAAkH,CACnH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,8BAA8B,KAAK,UAAU,EAAE,CAAC;gBACzD,MAAM,QAAQ,GACZ,MAAM,8BAA8B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,eAAe,GAAG,4BAA4B,EAAE,CAAC;YACvD,MAAM,uBAAuB,GAAG,MAAM,wBAAwB,EAAE,CAAC;YAEjE,gFAAgF;YAChF,MAAM,QAAQ,GACZ,MAAM,kCAAkC,CACtC,eAAe,EACf,aAAa,EACb,uBAAuB,EACvB,IAAI,CAAC,GAAG,EACR,MAAM,CACP,CAAC;YACJ,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,QAAQ,GACZ,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBAC/D,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACvB,OAAO,IAAI,CACT;wBACE,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,IAAI;wBACX,OAAO,EAAE,mDAAmD;qBAC7D,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CACX,yEAAyE,EACzE,CAAC,CACF,CAAC;gBACF,OAAO,IAAI,CACT;oBACE,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,8CAA8C;iBACxD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,qBAAqB,GAA8C;YACvE,GAAG;YACH,IAAI;YACJ,WAAW;YACX,oBAAoB;SACrB,CAAC;QAEF,MAAM,kBAAkB,GACtB,OAAO,kCAAkC,KAAK,QAAQ;YACtD,kCAAkC;YAChC,CAAC,CAAE;gBACC,GAAG,qBAAqB;gBACxB,GAAG,kCAAkC;aACV;YAC/B,CAAC,CAAE,qBAAiD,CAAC;QAEzD,MAAM,0BAA0B,GAEhB,IAAI,EAAE,0BAA0B,CAAC;QACjD,IAAI,OAAO,0BAA0B,KAAK,UAAU,EAAE,CAAC;YACrD,IAAI,aAAa,GAAY,KAAK,CAAC;YACnC,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;gBACpE,OAAO,IAAI,CACT;oBACE,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,2CAA2C;iBACrD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,IAAI,CACT;oBACE,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,uBAAuB;iBACjC,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,qBAAqB,CACjC,kBAAkB,CACnB,CAAwB,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED,eAAe,8BAA8B,CAAC"}
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import { type ApiServerId } from "@schemavaults/app-definitions";
|
|
2
|
-
import type
|
|
2
|
+
import { type UserData } from "@schemavaults/auth-common";
|
|
3
|
+
import type { OrganizationID, OrganizationMembershipRoleType } from "@schemavaults/auth-common/organizations";
|
|
3
4
|
import type { ReactElement } from "react";
|
|
4
5
|
import type { IJwtKeyManager } from "../../JwtKeyManager";
|
|
5
6
|
import type { IBaseProtectedAuthenticatedServerComponentPageProps } from "./IBaseProtectedAuthenticatedServerComponentPageProps";
|
|
@@ -11,6 +12,7 @@ export interface IWithAuthenticatedServerComponentRouteGuardAdditionalOptions<TP
|
|
|
11
12
|
api_server_id?: ApiServerId;
|
|
12
13
|
custom_is_authorized_check?: (props: TProps) => Promise<boolean>;
|
|
13
14
|
required_organization?: OrganizationID;
|
|
15
|
+
custom_is_user_in_organization?: (user: UserData, org_id: OrganizationID) => Promise<OrganizationMembershipRoleType | false>;
|
|
14
16
|
}
|
|
15
17
|
export declare function withAuthenticatedServerComponentRouteGuard<TProps extends IBaseProtectedAuthenticatedServerComponentPageProps = IBaseProtectedAuthenticatedServerComponentPageProps>(server_component: TProtectedAuthenticatedPageServerComponent<TProps>, additional_custom_server_component_props?: TAdditionalProps<TProps> | undefined, opts?: IWithAuthenticatedServerComponentRouteGuardAdditionalOptions): Promise<ReactElement>;
|
|
16
18
|
export default withAuthenticatedServerComponentRouteGuard;
|
package/dist/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
|
-
import { SCHEMAVAULTS_AUTH_APP_ID, getAppEnvironment, } from "@schemavaults/app-definitions";
|
|
2
|
-
import
|
|
1
|
+
import { SCHEMAVAULTS_AUTH_APP_ID, apiServerIdSchema, getAppEnvironment, } from "@schemavaults/app-definitions";
|
|
2
|
+
import { organizationIdSchema, userDataSchema, } from "@schemavaults/auth-common";
|
|
3
|
+
import isUserInOrganizationFromAuthServer from "../../isUserInOrganization";
|
|
3
4
|
import getSchemaVaultsAuthServerUri from "../../get-schemavaults-auth-server-uri";
|
|
4
5
|
import loadJwksAccessPrivateKey from "../../env/loadJwksAccessPrivateKey/loadJwksAccessPrivateKey";
|
|
5
6
|
import { redirectWithError } from "../../redirect-with-error";
|
|
@@ -28,16 +29,20 @@ additional_custom_server_component_props = undefined, opts) {
|
|
|
28
29
|
else if (typeof redirect !== "function") {
|
|
29
30
|
throw new TypeError("Expected 'redirect' to be a function");
|
|
30
31
|
}
|
|
31
|
-
|
|
32
|
+
let extracted_api_server_id;
|
|
32
33
|
try {
|
|
33
|
-
|
|
34
|
-
|
|
34
|
+
const parsed_api_server_id = await apiServerIdSchema.safeParseAsync(opts?.api_server_id ?? getSchemavaultsApiServerId());
|
|
35
|
+
if (!parsed_api_server_id.success) {
|
|
36
|
+
console.error("[withAuthenticatedServerComponentRouteGuard] getApiServerId() failed with bad ID: ", parsed_api_server_id.error);
|
|
37
|
+
throw parsed_api_server_id.error;
|
|
35
38
|
}
|
|
39
|
+
extracted_api_server_id = parsed_api_server_id.data;
|
|
36
40
|
}
|
|
37
41
|
catch (e) {
|
|
38
|
-
console.error("[withAuthenticatedServerComponentRouteGuard]
|
|
42
|
+
console.error("[withAuthenticatedServerComponentRouteGuard] Failed to load API server ID: ", e);
|
|
39
43
|
redirectWithError(redirect, 500, "server_misconfiguration");
|
|
40
44
|
}
|
|
45
|
+
const api_server_id = extracted_api_server_id;
|
|
41
46
|
const jwt_keys_manager = opts?.jwt_keys_manager ??
|
|
42
47
|
initDefaultJwtKeyManagerForAuthenticatedRouteGuard();
|
|
43
48
|
if (!jwt_keys_manager.isConfigured()) {
|
|
@@ -97,16 +102,45 @@ additional_custom_server_component_props = undefined, opts) {
|
|
|
97
102
|
redirectToLogin(redirect);
|
|
98
103
|
}
|
|
99
104
|
const user = route_guard.user;
|
|
105
|
+
if (user.disabled) {
|
|
106
|
+
return redirectWithError(redirect, 403, "account_disabled");
|
|
107
|
+
}
|
|
100
108
|
if (!route_guard.isAccessAllowed()) {
|
|
101
109
|
redirectWithError(redirect, 403, "forbidden");
|
|
102
110
|
}
|
|
111
|
+
if (!user.admin && route_guard_type === "admin") {
|
|
112
|
+
redirectWithError(redirect, 403, "forbidden");
|
|
113
|
+
}
|
|
103
114
|
if (typeof server_component !== "function") {
|
|
104
115
|
throw new TypeError("Expected 'server_component' passed to withAuthenticatedServerComponentRouteGuard to be a function");
|
|
105
116
|
}
|
|
106
117
|
const ProtectedAuthenticatedPageServerComponent = server_component;
|
|
118
|
+
async function isUserInOrganization(user, org_id) {
|
|
119
|
+
if (!(await userDataSchema.safeParseAsync(user)).success) {
|
|
120
|
+
throw new TypeError("Invalid user data object to lookup organization role for!");
|
|
121
|
+
}
|
|
122
|
+
else if (!(await organizationIdSchema.safeParseAsync(org_id)).success) {
|
|
123
|
+
throw new TypeError("Invalid organization ID to check user's role for!");
|
|
124
|
+
}
|
|
125
|
+
const custom_is_user_in_organization = opts?.custom_is_user_in_organization;
|
|
126
|
+
if (api_server_id === SCHEMAVAULTS_AUTH_APP_ID &&
|
|
127
|
+
typeof custom_is_user_in_organization !== "function") {
|
|
128
|
+
throw new TypeError("A 'custom_is_user_in_organization' method must be passed to route guard when used for @schemavaults/auth-server!");
|
|
129
|
+
}
|
|
130
|
+
if (typeof custom_is_user_in_organization === "function") {
|
|
131
|
+
const org_role = await custom_is_user_in_organization(user, org_id);
|
|
132
|
+
return org_role;
|
|
133
|
+
}
|
|
134
|
+
const auth_server_url = getSchemaVaultsAuthServerUri();
|
|
135
|
+
const jwks_access_private_key = await loadJwksAccessPrivateKey();
|
|
136
|
+
// this is not the auth-server! we need to ask the auth-server if user is in org
|
|
137
|
+
const org_role = await isUserInOrganizationFromAuthServer(auth_server_url, api_server_id, jwks_access_private_key, user.uid, org_id);
|
|
138
|
+
return org_role;
|
|
139
|
+
}
|
|
107
140
|
const base_server_component_props = {
|
|
108
141
|
user,
|
|
109
142
|
environment,
|
|
143
|
+
isUserInOrganization,
|
|
110
144
|
};
|
|
111
145
|
const final_server_component_props = typeof additional_custom_server_component_props === "object" &&
|
|
112
146
|
additional_custom_server_component_props
|
|
@@ -117,9 +151,7 @@ additional_custom_server_component_props = undefined, opts) {
|
|
|
117
151
|
: base_server_component_props;
|
|
118
152
|
if (opts?.required_organization) {
|
|
119
153
|
try {
|
|
120
|
-
const
|
|
121
|
-
const jwks_access_private_key = await loadJwksAccessPrivateKey();
|
|
122
|
-
const org_role = await isUserInOrganization(auth_server_url, api_server_id, jwks_access_private_key, user.uid, opts.required_organization);
|
|
154
|
+
const org_role = await isUserInOrganization(user, opts.required_organization);
|
|
123
155
|
if (org_role === false) {
|
|
124
156
|
redirectWithError(redirect, 403, "forbidden");
|
|
125
157
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"withAuthenticatedServerComponentRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAExB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"withAuthenticatedServerComponentRouteGuard.js","sourceRoot":"","sources":["../../../src/route_guards/withAuthenticatedRouteGuard/withAuthenticatedServerComponentRouteGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAExB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,oBAAoB,EACpB,cAAc,GAGf,MAAM,2BAA2B,CAAC;AAKnC,OAAO,kCAAkC,MAAM,wBAAwB,CAAC;AACxE,OAAO,4BAA4B,MAAM,oCAAoC,CAAC;AAC9E,OAAO,wBAAwB,MAAM,yDAAyD,CAAC;AAG/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,iBAAiB,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,0BAA0B,MAAM,kCAAkC,CAAC;AAE1E,OAAO,eAAe,MAAM,qBAAqB,CAAC;AAClD,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AAEjF,OAAO,kDAAkD,MAAM,sDAAsD,CAAC;AA+BtH,MAAM,CAAC,KAAK,UAAU,0CAA0C;AAI9D,iCAAiC;AACjC,gBAAoE;AAEpE,sGAAsG;AACtG,2CAEgB,SAAS,EACzB,IAAmE;IAEnE,MAAM,gBAAgB,GACpB,IAAI,EAAE,gBAAgB,IAAI,eAAe,CAAC;IAC5C,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;IAE5C,MAAM,WAAW,GAA+B,iBAAiB,EAAE,CAAC;IAEpE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;QACjD,MAAM,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,uBAAoC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,MAAM,iBAAiB,CAAC,cAAc,CACjE,IAAI,EAAE,aAAa,IAAI,0BAA0B,EAAE,CACpD,CAAC;QACF,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CACX,oFAAoF,EACpF,oBAAoB,CAAC,KAAK,CAC3B,CAAC;YACF,MAAM,oBAAoB,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,uBAAuB,GAAG,oBAAoB,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,6EAA6E,EAC7E,CAAC,CACF,CAAC;QACF,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,aAAa,GAAgB,uBAAuB,CAAC;IAE3D,MAAM,gBAAgB,GACpB,IAAI,EAAE,gBAAgB;QACtB,kDAAkD,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,EAAE,CAAC;QACrC,OAAO,CAAC,KAAK,CACX,0GAA0G,CAC3G,CAAC;QACF,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAmB,MAAM,WAAW,EAAE,CAAC;IACpD,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAkC,EAAE,CAAC;IAExD,qCAAqC;IACrC,IAAI,aAAa,KAAK,wBAAwB,EAAE,CAAC;QAC/C,MAAM,oBAAoB,GAAG,OAAO,CAAC,GAAG,CACtC,sBAAsB,CAAC,wBAAwB,CAAC,CACjD,CAAC;QACF,IAAI,OAAO,oBAAoB,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,aAAa,CAAC,IAAI,CAAC;gBACjB,UAAU,EAAE,2BAA2B;gBACvC,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,oBAAoB,CAAC,KAAK;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,MAAM,wBAAwB,GAAW,qBAAqB,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAClE,IACE,OAAO,mBAAmB,EAAE,KAAK,KAAK,QAAQ;QAC9C,mBAAmB,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,EACrC,CAAC;QACD,IAAI,UAAU,GAAkB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC/C,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0BAA0B;YAC1B,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;QACzC,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,CAAC,IAAI,CAAC;gBACjB,UAAU,EAAE,6BAA6B,wBAAyC,GAAG;gBACrF,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,UAAU;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,CAAC;QAChD,WAAW;QACX,cAAc,EAAE,aAAa,KAAK,wBAAwB;QAC1D,gBAAgB;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GACf,MAAM,mBAAmB,CAAC,2BAA2B,CACnD,gBAAgB,EAChB,aAAa,EACb,aAAa,CACd,CAAC;IAEJ,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACtB,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAa,WAAW,CAAC,IAAI,CAAC;IAExC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC;QACnC,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;QAChD,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CACjB,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,yCAAyC,GAAG,gBAAgB,CAAC;IAEnE,KAAK,UAAU,oBAAoB,CACjC,IAAc,EACd,MAAsB;QAEtB,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CACjB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACxE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,8BAA8B,GAAG,IAAI,EAAE,8BAA8B,CAAC;QAE5E,IACE,aAAa,KAAK,wBAAwB;YAC1C,OAAO,8BAA8B,KAAK,UAAU,EACpD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,kHAAkH,CACnH,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,8BAA8B,KAAK,UAAU,EAAE,CAAC;YACzD,MAAM,QAAQ,GACZ,MAAM,8BAA8B,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,eAAe,GAAG,4BAA4B,EAAE,CAAC;QACvD,MAAM,uBAAuB,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAEjE,gFAAgF;QAChF,MAAM,QAAQ,GACZ,MAAM,kCAAkC,CACtC,eAAe,EACf,aAAa,EACb,uBAAuB,EACvB,IAAI,CAAC,GAAG,EACR,MAAM,CACP,CAAC;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,2BAA2B,GAC/B;QACE,IAAI;QACJ,WAAW;QACX,oBAAoB;KACrB,CAAC;IAEJ,MAAM,4BAA4B,GAChC,OAAO,wCAAwC,KAAK,QAAQ;QAC5D,wCAAwC;QACtC,CAAC,CAAE;YACC,GAAG,2BAA2B;YAC9B,GAAG,wCAAwC;SACtB;QACzB,CAAC,CAAE,2BAAiD,CAAC;IAEzD,IAAI,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,IAAI,EACJ,IAAI,CAAC,qBAAqB,CAC3B,CAAC;YACF,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACvB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CACX,qFAAqF,EACrF,CAAC,CACF,CAAC;YACF,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,EAAE,0BAA0B,KAAK,UAAU,EAAE,CAAC;QAC3D,IAAI,aAAa,GAAY,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,0BAA0B,GAAG,IAAI,CAAC,0BAA0B,CAAC;YACnE,aAAa,GAAG,MAAM,0BAA0B,CAC9C,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,CAAC,CAAC,CAAC;YACpE,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,yCAAyC,CACrD,4BAA4B,CAC7B,CAAwB,CAAC;AAC5B,CAAC;AAED,eAAe,0CAA0C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@schemavaults/auth-server-sdk",
|
|
3
3
|
"description": "TypeScript SDK for building authenticated endpoints/middlewares for the Auth Server and Resource Servers",
|
|
4
|
-
"version": "0.22.
|
|
4
|
+
"version": "0.22.4",
|
|
5
5
|
"license": "UNLICENSED",
|
|
6
6
|
"private": false,
|
|
7
7
|
"repository": {
|
|
@@ -18,8 +18,8 @@
|
|
|
18
18
|
},
|
|
19
19
|
"dependencies": {
|
|
20
20
|
"zod": "3.25.8",
|
|
21
|
-
"@schemavaults/jwt": "0.7.
|
|
22
|
-
"@schemavaults/auth-common": "0.10.
|
|
21
|
+
"@schemavaults/jwt": "0.7.2",
|
|
22
|
+
"@schemavaults/auth-common": "0.10.3",
|
|
23
23
|
"@schemavaults/app-definitions": "0.6.22"
|
|
24
24
|
},
|
|
25
25
|
"scripts": {
|