@sync-in/server 1.11.0 → 2.0.0

package/server/authentication/guards/auth-token-access.guard.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.guard.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { sign } from '@fastify/cookie'\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { ConfigModule, ConfigService } from '@nestjs/config'\nimport { Reflector } from '@nestjs/core'\nimport { JwtModule, JwtService } from '@nestjs/jwt'\nimport { PassportModule } from '@nestjs/passport'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport crypto from 'node:crypto'\nimport { UsersManager } from '../../applications/users/services/users-manager.service'\nimport { WEB_DAV_CONTEXT, WebDAVContext } from '../../applications/webdav/decorators/webdav-context.decorator'\nimport { exportConfiguration } from '../../configuration/config.environment'\nimport { AuthConfig } from '../auth.config'\nimport { CSRF_ERROR } from '../constants/auth'\nimport { AuthTokenOptional } from '../decorators/auth-token-optional.decorator'\nimport { AUTH_TOKEN_SKIP, AuthTokenSkip } from '../decorators/auth-token-skip.decorator'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\nimport { AuthAnonymousGuard } from './auth-anonymous.guard'\nimport { AuthAnonymousStrategy } from './auth-anonymous.strategy'\nimport { AuthTokenAccessGuard } from './auth-token-access.guard'\nimport { AuthTokenAccessStrategy } from './auth-token-access.strategy'\n\ndescribe(AuthTokenAccessGuard.name, () => {\n  const csrfToken: string = crypto.randomUUID()\n  let authConfig: AuthConfig\n  let jwtService: JwtService\n  let authAccessGuard: AuthTokenAccessGuard\n  let authAnonymousGuard: AuthAnonymousGuard\n  let authAnonymousStrategy: AuthAnonymousStrategy\n  let reflector: Reflector\n  let accessTokenWithoutCSRF: string\n  let accessToken: string\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      imports: [\n        await ConfigModule.forRoot({\n          load: [exportConfiguration],\n          isGlobal: true\n        }),\n        JwtModule.register({ global: true }),\n        PassportModule\n      ],\n      providers: [\n        AuthTokenAccessStrategy,\n        AuthAnonymousStrategy,\n        AuthAnonymousGuard,\n        AuthManager,\n        { provide: UsersManager, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authConfig = module.get<ConfigService>(ConfigService).get<AuthConfig>('auth')\n    jwtService = module.get<JwtService>(JwtService)\n    reflector = new Reflector()\n    authAccessGuard = new AuthTokenAccessGuard(reflector)\n    authAnonymousStrategy = module.get<AuthAnonymousStrategy>(AuthAnonymousStrategy)\n    authAnonymousGuard = module.get<AuthAnonymousGuard>(AuthAnonymousGuard)\n    accessToken = await jwtService.signAsync({ identity: { id: 1, login: 'foo' }, [TOKEN_TYPE.CSRF]: csrfToken } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    accessTokenWithoutCSRF = await jwtService.signAsync({ identity: { id: 1, login: 'foo' } } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authConfig).toBeDefined()\n    expect(jwtService).toBeDefined()\n    expect(authAccessGuard).toBeDefined()\n    expect(authAnonymousGuard).toBeDefined()\n    expect(authAnonymousStrategy).toBeDefined()\n    expect(accessToken).toBeDefined()\n    expect(accessTokenWithoutCSRF).toBeDefined()\n    expect(csrfToken).toBeDefined()\n  })\n\n  it('should pass with a valid access token in cookies with CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: sign(csrfToken, authConfig.token.csrf.secret) },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass with a valid access token in request header with no CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer ${accessToken}`\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should throw an error with an invalid access token in cookies', async () => {\n    // Cookies test\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: 'bar'\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with an invalid access token in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_HEADERS))\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF claim in the access token', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken },\n      cookies: {\n        [authConfig.token.access.name]: accessTokenWithoutCSRF\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_JWT))\n  })\n\n  it('should throw an error with a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n\n  it('should pass with method GET and a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      method: 'GET',\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).resolves.not.toThrow()\n  })\n\n  it('should throw an error with method POST and a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      method: 'POST',\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n\n  it('should bypass access token when AuthTokenSkip decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    AuthTokenSkip()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should bypass access token with WebDAVContext decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    WebDAVContext()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(undefined)\n    expect(reflector.getAllAndOverride<boolean>(WEB_DAV_CONTEXT, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass without a valid access token when AuthTokenOptional is applied to context', async () => {\n    const spyAuthenticate = jest.spyOn(authAnonymousStrategy, 'authenticate')\n    context = createMock<ExecutionContext>()\n    AuthTokenOptional()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      authorization: `Bearer bar`\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n    expect(await authAnonymousGuard.canActivate(context)).toBe(true)\n    expect(spyAuthenticate).toHaveBeenCalledTimes(1)\n    spyAuthenticate.mockClear()\n  })\n})\n"],"names":["describe","AuthTokenAccessGuard","name","csrfToken","crypto","randomUUID","authConfig","jwtService","authAccessGuard","authAnonymousGuard","authAnonymousStrategy","reflector","accessTokenWithoutCSRF","accessToken","context","beforeAll","module","Test","createTestingModule","imports","ConfigModule","forRoot","load","exportConfiguration","isGlobal","JwtModule","register","global","PassportModule","providers","AuthTokenAccessStrategy","AuthAnonymousStrategy","AuthAnonymousGuard","AuthManager","provide","UsersManager","useValue","PinoLogger","assign","undefined","compile","get","ConfigService","JwtService","Reflector","signAsync","identity","id","login","TOKEN_TYPE","CSRF","secret","token","access","expiresIn","createMock","it","expect","toBeDefined","switchToHttp","getRequest","mockReturnValue","raw","user","headers","csrf","sign","cookies","canActivate","toBe","authorization","rejects","toThrow","RegExp","CSRF_ERROR","MISSING_HEADERS","MISSING_JWT","MISMATCH","method","resolves","not","AuthTokenSkip","getHandler","getAllAndOverride","AUTH_TOKEN_SKIP","getClass","WebDAVContext","WEB_DAV_CONTEXT","spyAuthenticate","jest","spyOn","AuthTokenOptional","toHaveBeenCalledTimes","mockClear"],"mappings":"AAAA;;;;CAIC;;;;wBAEoB;wBACkB;wBAEK;sBAClB;qBACY;0BACP;yBACK;4BACT;mEACR;qCACU;wCACkB;mCACX;sBAET;4CACO;wCACa;gCAEpB;oCACC;oCACO;uCACG;sCACD;yCACG;;;;;;AAExCA,SAASC,0CAAoB,CAACC,IAAI,EAAE;IAClC,MAAMC,YAAoBC,mBAAM,CAACC,UAAU;IAC3C,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,SAAS;gBACP,MAAMC,oBAAY,CAACC,OAAO,CAAC;oBACzBC,MAAM;wBAACC,sCAAmB;qBAAC;oBAC3BC,UAAU;gBACZ;gBACAC,cAAS,CAACC,QAAQ,CAAC;oBAAEC,QAAQ;gBAAK;gBAClCC,wBAAc;aACf;YACDC,WAAW;gBACTC,gDAAuB;gBACvBC,4CAAqB;gBACrBC,sCAAkB;gBAClBC,+BAAW;gBACX;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU,CAAC;gBAAE;gBACtC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEVlC,aAAaU,OAAOyB,GAAG,CAAgBC,qBAAa,EAAED,GAAG,CAAa;QACtElC,aAAaS,OAAOyB,GAAG,CAAaE,eAAU;QAC9ChC,YAAY,IAAIiC,eAAS;QACzBpC,kBAAkB,IAAIP,0CAAoB,CAACU;QAC3CD,wBAAwBM,OAAOyB,GAAG,CAAwBV,4CAAqB;QAC/EtB,qBAAqBO,OAAOyB,GAAG,CAAqBT,sCAAkB;QACtEnB,cAAc,MAAMN,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;YAAG,CAACC,0BAAU,CAACC,IAAI,CAAC,EAAE/C;QAAU,GAAiB;YAC1HgD,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACA1C,yBAAyB,MAAML,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;QAAE,GAAiB;YACvGG,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACAxC,UAAUyC,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAOnD,YAAYoD,WAAW;QAC9BD,OAAOlD,YAAYmD,WAAW;QAC9BD,OAAOjD,iBAAiBkD,WAAW;QACnCD,OAAOhD,oBAAoBiD,WAAW;QACtCD,OAAO/C,uBAAuBgD,WAAW;QACzCD,OAAO5C,aAAa6C,WAAW;QAC/BD,OAAO7C,wBAAwB8C,WAAW;QAC1CD,OAAOtD,WAAWuD,WAAW;IAC/B;IAEAF,GAAG,8DAA8D;QAC/D1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEgE,IAAAA,YAAI,EAAC/D,WAAWG,WAAW8C,KAAK,CAACa,IAAI,CAACd,MAAM;YAAE;YACvFgB,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEzD,aAAa;YACxC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,iEAAiE;QAClE,eAAe;QACf1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAE;YAClC;QACF;QACA,MAAMuD,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACA,MAAMb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,mGAAmG;QACpG1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACC,eAAe;IAC1G;IAEAnB,GAAG,2GAA2G;QAC5G1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC;YAAU;YACnDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEU;YAClC;QACF;QACA,MAAM6C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACE,WAAW;IACtG;IAEApB,GAAG,kFAAkF;QACnF1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACnG;IAEArB,GAAG,uFAAuF;QACxF1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDiB,QAAQ;YACRhB,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUiE,QAAQ,CAACC,GAAG,CAACR,OAAO;IACzE;IAEAhB,GAAG,kGAAkG;QACnG1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDiB,QAAQ;YACRhB,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACnG;IAEArB,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpB0B,IAAAA,qCAAa,IAAGnE,QAAQoE,UAAU;QAClCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpB+B,IAAAA,qCAAa,IAAGxE,QAAQoE,UAAU;QAClCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC9B;QAC/GkB,OAAO9C,UAAUwE,iBAAiB,CAAUI,uCAAe,EAAE;YAACzE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,yFAAyF;QAC1F,MAAMgC,kBAAkBC,KAAKC,KAAK,CAAChF,uBAAuB;QAC1DI,UAAUyC,IAAAA,kBAAU;QACpBoC,IAAAA,6CAAiB,IAAG7E,QAAQoE,UAAU;QACtCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBO,eAAe,CAAC,UAAU,CAAC;QAC7B;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAClDZ,OAAO,MAAMhD,mBAAmB2D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAC3DZ,OAAO+B,iBAAiBI,qBAAqB,CAAC;QAC9CJ,gBAAgBK,SAAS;IAC3B;AACF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.guard.spec.ts"],"sourcesContent":["import { sign } from '@fastify/cookie'\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { ConfigModule, ConfigService } from '@nestjs/config'\nimport { Reflector } from '@nestjs/core'\nimport { JwtModule, JwtService } from '@nestjs/jwt'\nimport { PassportModule } from '@nestjs/passport'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport crypto from 'node:crypto'\nimport { UsersManager } from '../../applications/users/services/users-manager.service'\nimport { WEB_DAV_CONTEXT, WebDAVContext } from '../../applications/webdav/decorators/webdav-context.decorator'\nimport { exportConfiguration } from '../../configuration/config.environment'\nimport { AuthConfig } from '../auth.config'\nimport { AuthManager } from '../auth.service'\nimport { CSRF_ERROR } from '../constants/auth'\nimport { AuthTokenOptional } from '../decorators/auth-token-optional.decorator'\nimport { AUTH_TOKEN_SKIP, AuthTokenSkip } from '../decorators/auth-token-skip.decorator'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthAnonymousGuard } from './auth-anonymous.guard'\nimport { AuthAnonymousStrategy } from './auth-anonymous.strategy'\nimport { AuthTokenAccessGuard } from './auth-token-access.guard'\nimport { AuthTokenAccessStrategy } from './auth-token-access.strategy'\n\ndescribe(AuthTokenAccessGuard.name, () => {\n  const csrfToken: string = crypto.randomUUID()\n  let authConfig: AuthConfig\n  let jwtService: JwtService\n  let authAccessGuard: AuthTokenAccessGuard\n  let authAnonymousGuard: AuthAnonymousGuard\n  let authAnonymousStrategy: AuthAnonymousStrategy\n  let reflector: Reflector\n  let accessTokenWithoutCSRF: string\n  let accessToken: string\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      imports: [\n        await ConfigModule.forRoot({\n          load: [exportConfiguration],\n          isGlobal: true\n        }),\n        JwtModule.register({ global: true }),\n        PassportModule\n      ],\n      providers: [\n        AuthTokenAccessStrategy,\n        AuthAnonymousStrategy,\n        AuthAnonymousGuard,\n        AuthManager,\n        { provide: UsersManager, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authConfig = module.get<ConfigService>(ConfigService).get<AuthConfig>('auth')\n    jwtService = module.get<JwtService>(JwtService)\n    reflector = new Reflector()\n    authAccessGuard = new AuthTokenAccessGuard(reflector)\n    authAnonymousStrategy = module.get<AuthAnonymousStrategy>(AuthAnonymousStrategy)\n    authAnonymousGuard = module.get<AuthAnonymousGuard>(AuthAnonymousGuard)\n    accessToken = await jwtService.signAsync({ identity: { id: 1, login: 'foo' }, [TOKEN_TYPE.CSRF]: csrfToken } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    accessTokenWithoutCSRF = await jwtService.signAsync({ identity: { id: 1, login: 'foo' } } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authConfig).toBeDefined()\n    expect(jwtService).toBeDefined()\n    expect(authAccessGuard).toBeDefined()\n    expect(authAnonymousGuard).toBeDefined()\n    expect(authAnonymousStrategy).toBeDefined()\n    expect(accessToken).toBeDefined()\n    expect(accessTokenWithoutCSRF).toBeDefined()\n    expect(csrfToken).toBeDefined()\n  })\n\n  it('should pass with a valid access token in cookies with CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: sign(csrfToken, authConfig.token.csrf.secret) },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass with a valid access token in request header with no CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer ${accessToken}`\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should throw an error with an invalid access token in cookies', async () => {\n    // Cookies test\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: 'bar'\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with an invalid access token in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_HEADERS))\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF claim in the access token', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken },\n      cookies: {\n        [authConfig.token.access.name]: accessTokenWithoutCSRF\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_JWT))\n  })\n\n  it('should throw an error with a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n\n  it('should pass with method GET and a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      method: 'GET',\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).resolves.not.toThrow()\n  })\n\n  it('should throw an error with method POST and a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      method: 'POST',\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n\n  it('should bypass access token when AuthTokenSkip decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    AuthTokenSkip()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should bypass access token with WebDAVContext decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    WebDAVContext()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(undefined)\n    expect(reflector.getAllAndOverride<boolean>(WEB_DAV_CONTEXT, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass without a valid access token when AuthTokenOptional is applied to context', async () => {\n    const spyAuthenticate = jest.spyOn(authAnonymousStrategy, 'authenticate')\n    context = createMock<ExecutionContext>()\n    AuthTokenOptional()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      authorization: `Bearer bar`\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n    expect(await authAnonymousGuard.canActivate(context)).toBe(true)\n    expect(spyAuthenticate).toHaveBeenCalledTimes(1)\n    spyAuthenticate.mockClear()\n  })\n})\n"],"names":["describe","AuthTokenAccessGuard","name","csrfToken","crypto","randomUUID","authConfig","jwtService","authAccessGuard","authAnonymousGuard","authAnonymousStrategy","reflector","accessTokenWithoutCSRF","accessToken","context","beforeAll","module","Test","createTestingModule","imports","ConfigModule","forRoot","load","exportConfiguration","isGlobal","JwtModule","register","global","PassportModule","providers","AuthTokenAccessStrategy","AuthAnonymousStrategy","AuthAnonymousGuard","AuthManager","provide","UsersManager","useValue","PinoLogger","assign","undefined","compile","get","ConfigService","JwtService","Reflector","signAsync","identity","id","login","TOKEN_TYPE","CSRF","secret","token","access","expiresIn","createMock","it","expect","toBeDefined","switchToHttp","getRequest","mockReturnValue","raw","user","headers","csrf","sign","cookies","canActivate","toBe","authorization","rejects","toThrow","RegExp","CSRF_ERROR","MISSING_HEADERS","MISSING_JWT","MISMATCH","method","resolves","not","AuthTokenSkip","getHandler","getAllAndOverride","AUTH_TOKEN_SKIP","getClass","WebDAVContext","WEB_DAV_CONTEXT","spyAuthenticate","jest","spyOn","AuthTokenOptional","toHaveBeenCalledTimes","mockClear"],"mappings":";;;;wBAAqB;wBACkB;wBAEK;sBAClB;qBACY;0BACP;yBACK;4BACT;mEACR;qCACU;wCACkB;mCACX;6BAER;sBACD;4CACO;wCACa;gCAEpB;oCACQ;uCACG;sCACD;yCACG;;;;;;AAExCA,SAASC,0CAAoB,CAACC,IAAI,EAAE;IAClC,MAAMC,YAAoBC,mBAAM,CAACC,UAAU;IAC3C,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,SAAS;gBACP,MAAMC,oBAAY,CAACC,OAAO,CAAC;oBACzBC,MAAM;wBAACC,sCAAmB;qBAAC;oBAC3BC,UAAU;gBACZ;gBACAC,cAAS,CAACC,QAAQ,CAAC;oBAAEC,QAAQ;gBAAK;gBAClCC,wBAAc;aACf;YACDC,WAAW;gBACTC,gDAAuB;gBACvBC,4CAAqB;gBACrBC,sCAAkB;gBAClBC,wBAAW;gBACX;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU,CAAC;gBAAE;gBACtC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEVlC,aAAaU,OAAOyB,GAAG,CAAgBC,qBAAa,EAAED,GAAG,CAAa;QACtElC,aAAaS,OAAOyB,GAAG,CAAaE,eAAU;QAC9ChC,YAAY,IAAIiC,eAAS;QACzBpC,kBAAkB,IAAIP,0CAAoB,CAACU;QAC3CD,wBAAwBM,OAAOyB,GAAG,CAAwBV,4CAAqB;QAC/EtB,qBAAqBO,OAAOyB,GAAG,CAAqBT,sCAAkB;QACtEnB,cAAc,MAAMN,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;YAAG,CAACC,0BAAU,CAACC,IAAI,CAAC,EAAE/C;QAAU,GAAiB;YAC1HgD,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACA1C,yBAAyB,MAAML,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;QAAE,GAAiB;YACvGG,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACAxC,UAAUyC,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAOnD,YAAYoD,WAAW;QAC9BD,OAAOlD,YAAYmD,WAAW;QAC9BD,OAAOjD,iBAAiBkD,WAAW;QACnCD,OAAOhD,oBAAoBiD,WAAW;QACtCD,OAAO/C,uBAAuBgD,WAAW;QACzCD,OAAO5C,aAAa6C,WAAW;QAC/BD,OAAO7C,wBAAwB8C,WAAW;QAC1CD,OAAOtD,WAAWuD,WAAW;IAC/B;IAEAF,GAAG,8DAA8D;QAC/D1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEgE,IAAAA,YAAI,EAAC/D,WAAWG,WAAW8C,KAAK,CAACa,IAAI,CAACd,MAAM;YAAE;YACvFgB,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEzD,aAAa;YACxC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,iEAAiE;QAClE,eAAe;QACf1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAE;YAClC;QACF;QACA,MAAMuD,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACA,MAAMb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,mGAAmG;QACpG1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACC,eAAe;IAC1G;IAEAnB,GAAG,2GAA2G;QAC5G1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC;YAAU;YACnDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEU;YAClC;QACF;QACA,MAAM6C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACE,WAAW;IACtG;IAEApB,GAAG,kFAAkF;QACnF1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACnG;IAEArB,GAAG,uFAAuF;QACxF1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDiB,QAAQ;YACRhB,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUiE,QAAQ,CAACC,GAAG,CAACR,OAAO;IACzE;IAEAhB,GAAG,kGAAkG;QACnG1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDiB,QAAQ;YACRhB,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACnG;IAEArB,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpB0B,IAAAA,qCAAa,IAAGnE,QAAQoE,UAAU;QAClCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpB+B,IAAAA,qCAAa,IAAGxE,QAAQoE,UAAU;QAClCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC9B;QAC/GkB,OAAO9C,UAAUwE,iBAAiB,CAAUI,uCAAe,EAAE;YAACzE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,yFAAyF;QAC1F,MAAMgC,kBAAkBC,KAAKC,KAAK,CAAChF,uBAAuB;QAC1DI,UAAUyC,IAAAA,kBAAU;QACpBoC,IAAAA,6CAAiB,IAAG7E,QAAQoE,UAAU;QACtCzB,OAAO9C,UAAUwE,iBAAiB,CAAUC,uCAAe,EAAE;YAACtE,QAAQoE,UAAU;YAAIpE,QAAQuE,QAAQ;SAAG,GAAGhB,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBO,eAAe,CAAC,UAAU,CAAC;QAC7B;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAClDZ,OAAO,MAAMhD,mBAAmB2D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAC3DZ,OAAO+B,iBAAiBI,qBAAqB,CAAC;QAC9CJ,gBAAgBK,SAAS;IAC3B;AACF"}

package/server/authentication/guards/auth-token-access.strategy.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -18,8 +14,8 @@ const _nestjspino = require("nestjs-pino");
 const _passportjwt = require("passport-jwt");
 const _usermodel = require("../../applications/users/models/user.model");
 const _configenvironment = require("../../configuration/config.environment");
+const _authservice = require("../auth.service");
 const _tokeninterface = require("../interfaces/token.interface");
-const _authmanagerservice = require("../services/auth-manager.service");
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -60,7 +56,7 @@ AuthTokenAccessStrategy = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _authmanagerservice.AuthManager === "undefined" ? Object : _authmanagerservice.AuthManager,
+        typeof _authservice.AuthManager === "undefined" ? Object : _authservice.AuthManager,
         typeof _nestjspino.PinoLogger === "undefined" ? Object : _nestjspino.PinoLogger
     ])
 ], AuthTokenAccessStrategy);

package/server/authentication/guards/auth-token-access.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenAccessStrategy extends PassportStrategy(Strategy, 'tokenAccess') implements AbstractStrategy {\n  private static accessCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenAccessStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.access.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenAccessStrategy.accessCookieName = configuration.auth.token.access.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.ACCESS)\n    return new UserModel(jwtPayload.identity)\n  }\n\n  static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenAccessStrategy.accessCookieName] !== undefined) {\n      return req.cookies[AuthTokenAccessStrategy.accessCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenAccessStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","ACCESS","UserModel","extractJWTFromCookie","cookies","accessCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","access","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAcYA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;gCAEH;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,0BAAN,MAAMA,gCAAgCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBtEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,MAAM;QAClE,OAAO,IAAIC,oBAAS,CAACV,WAAWI,QAAQ;IAC1C;IAEA,OAAOO,qBAAqBZ,GAAmB,EAAiB;QAC9D,IAAI,OAAOA,IAAIa,OAAO,KAAK,YAAYb,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC,KAAKC,WAAW;YAC1G,OAAOf,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC;QAC9D;QACA,OAAO;IACT;IAxBA,YACE,AAAiBP,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJc,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACtB,wBAAwBgB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YAClIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACC,MAAM;YACnDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBpB,cAAAA,kBACAL,SAAAA;QAQjBN,wBAAwBkB,gBAAgB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACI,IAAI;IACjF;AAcF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.strategy.ts"],"sourcesContent":["import { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { AuthManager } from '../auth.service'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\n\n@Injectable()\nexport class AuthTokenAccessStrategy extends PassportStrategy(Strategy, 'tokenAccess') implements AbstractStrategy {\n  private static accessCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenAccessStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.access.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenAccessStrategy.accessCookieName = configuration.auth.token.access.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.ACCESS)\n    return new UserModel(jwtPayload.identity)\n  }\n\n  static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenAccessStrategy.accessCookieName] !== undefined) {\n      return req.cookies[AuthTokenAccessStrategy.accessCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenAccessStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","ACCESS","UserModel","extractJWTFromCookie","cookies","accessCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","access","secret","ignoreExpiration","passReqToCallback","name"],"mappings":";;;;+BAYaA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;6BACF;gCAED;;;;;;;;;;AAGpB,IAAA,AAAMA,0BAAN,MAAMA,gCAAgCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBtEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,MAAM;QAClE,OAAO,IAAIC,oBAAS,CAACV,WAAWI,QAAQ;IAC1C;IAEA,OAAOO,qBAAqBZ,GAAmB,EAAiB;QAC9D,IAAI,OAAOA,IAAIa,OAAO,KAAK,YAAYb,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC,KAAKC,WAAW;YAC1G,OAAOf,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC;QAC9D;QACA,OAAO;IACT;IAxBA,YACE,AAAiBP,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJc,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACtB,wBAAwBgB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YAClIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACC,MAAM;YACnDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBpB,cAAAA,kBACAL,SAAAA;QAQjBN,wBAAwBkB,gBAAgB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACI,IAAI;IACjF;AAcF"}

package/server/authentication/guards/auth-token-refresh.guard.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/guards/auth-token-refresh.guard.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.guard.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { ExecutionContext, Injectable, Logger } from '@nestjs/common'\nimport { AuthGuard, IAuthGuard } from '@nestjs/passport'\n\n@Injectable()\nexport class AuthTokenRefreshGuard extends AuthGuard('tokenRefresh') implements IAuthGuard {\n  private readonly logger = new Logger(AuthTokenRefreshGuard.name)\n\n  handleRequest(err: any, user: any, info: Error, ctx: ExecutionContext, status?: any) {\n    const req = this.getRequest(ctx)\n    req.raw.user = user?.login || 'unauthorized'\n    if (info) {\n      this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`)\n    }\n    return super.handleRequest(err, user, info, ctx, status)\n  }\n}\n"],"names":["AuthTokenRefreshGuard","AuthGuard","handleRequest","err","user","info","ctx","status","req","getRequest","raw","login","logger","warn","ip","Logger","name"],"mappings":"AAAA;;;;CAIC;;;;+BAMYA;;;eAAAA;;;wBAJwC;0BACf;;;;;;;AAG/B,IAAA,AAAMA,wBAAN,MAAMA,8BAA8BC,IAAAA,mBAAS,EAAC;IAGnDC,cAAcC,GAAQ,EAAEC,IAAS,EAAEC,IAAW,EAAEC,GAAqB,EAAEC,MAAY,EAAE;QACnF,MAAMC,MAAM,IAAI,CAACC,UAAU,CAACH;QAC5BE,IAAIE,GAAG,CAACN,IAAI,GAAGA,MAAMO,SAAS;QAC9B,IAAIN,MAAM;YACR,IAAI,CAACO,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC,EAAEL,IAAIE,GAAG,CAACN,IAAI,CAAC,GAAG,EAAEI,IAAIM,EAAE,CAAC,EAAE,EAAET,MAAM;QAC1D;QACA,OAAO,KAAK,CAACH,cAAcC,KAAKC,MAAMC,MAAMC,KAAKC;IACnD;;QAVK,qBACYK,SAAS,IAAIG,cAAM,CAACf,sBAAsBgB,IAAI;;AAUjE"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.guard.ts"],"sourcesContent":["import { ExecutionContext, Injectable, Logger } from '@nestjs/common'\nimport { AuthGuard, IAuthGuard } from '@nestjs/passport'\n\n@Injectable()\nexport class AuthTokenRefreshGuard extends AuthGuard('tokenRefresh') implements IAuthGuard {\n  private readonly logger = new Logger(AuthTokenRefreshGuard.name)\n\n  handleRequest(err: any, user: any, info: Error, ctx: ExecutionContext, status?: any) {\n    const req = this.getRequest(ctx)\n    req.raw.user = user?.login || 'unauthorized'\n    if (info) {\n      this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`)\n    }\n    return super.handleRequest(err, user, info, ctx, status)\n  }\n}\n"],"names":["AuthTokenRefreshGuard","AuthGuard","handleRequest","err","user","info","ctx","status","req","getRequest","raw","login","logger","warn","ip","Logger","name"],"mappings":";;;;+BAIaA;;;eAAAA;;;wBAJwC;0BACf;;;;;;;AAG/B,IAAA,AAAMA,wBAAN,MAAMA,8BAA8BC,IAAAA,mBAAS,EAAC;IAGnDC,cAAcC,GAAQ,EAAEC,IAAS,EAAEC,IAAW,EAAEC,GAAqB,EAAEC,MAAY,EAAE;QACnF,MAAMC,MAAM,IAAI,CAACC,UAAU,CAACH;QAC5BE,IAAIE,GAAG,CAACN,IAAI,GAAGA,MAAMO,SAAS;QAC9B,IAAIN,MAAM;YACR,IAAI,CAACO,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC,EAAEL,IAAIE,GAAG,CAACN,IAAI,CAAC,GAAG,EAAEI,IAAIM,EAAE,CAAC,EAAE,EAAET,MAAM;QAC1D;QACA,OAAO,KAAK,CAACH,cAAcC,KAAKC,MAAMC,MAAMC,KAAKC;IACnD;;QAVK,qBACYK,SAAS,IAAIG,cAAM,CAACf,sBAAsBgB,IAAI;;AAUjE"}

package/server/authentication/guards/auth-token-refresh.guard.spec.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -16,9 +12,9 @@ const _nestjspino = require("nestjs-pino");
 const _nodecrypto = /*#__PURE__*/ _interop_require_default(require("node:crypto"));
 const _usersmanagerservice = require("../../applications/users/services/users-manager.service");
 const _configenvironment = require("../../configuration/config.environment");
+const _authservice = require("../auth.service");
 const _auth = require("../constants/auth");
 const _tokeninterface = require("../interfaces/token.interface");
-const _authmanagerservice = require("../services/auth-manager.service");
 const _authtokenrefreshguard = require("./auth-token-refresh.guard");
 const _authtokenrefreshstrategy = require("./auth-token-refresh.strategy");
 function _interop_require_default(obj) {
@@ -51,7 +47,7 @@ describe(_authtokenrefreshguard.AuthTokenRefreshGuard.name, ()=>{
             providers: [
                 _authtokenrefreshguard.AuthTokenRefreshGuard,
                 _authtokenrefreshstrategy.AuthTokenRefreshStrategy,
-                _authmanagerservice.AuthManager,
+                _authservice.AuthManager,
                 {
                     provide: _usersmanagerservice.UsersManager,
                     useValue: {}

package/server/authentication/guards/auth-token-refresh.guard.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.guard.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { sign } from '@fastify/cookie'\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { ConfigModule, ConfigService } from '@nestjs/config'\nimport { JwtModule, JwtService } from '@nestjs/jwt'\nimport { PassportModule } from '@nestjs/passport'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport crypto from 'node:crypto'\nimport { UsersManager } from '../../applications/users/services/users-manager.service'\nimport { exportConfiguration } from '../../configuration/config.environment'\nimport { AuthConfig } from '../auth.config'\nimport { CSRF_ERROR } from '../constants/auth'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\nimport { AuthTokenRefreshGuard } from './auth-token-refresh.guard'\nimport { AuthTokenRefreshStrategy } from './auth-token-refresh.strategy'\n\ndescribe(AuthTokenRefreshGuard.name, () => {\n  const csrfToken: string = crypto.randomUUID()\n  let authConfig: AuthConfig\n  let jwtService: JwtService\n  let authRefreshGuard: AuthTokenRefreshGuard\n  let refreshToken: string\n  let refreshTokenWithoutCSRF: string\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      imports: [await ConfigModule.forRoot({ load: [exportConfiguration], isGlobal: true }), JwtModule.register({ global: true }), PassportModule],\n      providers: [\n        AuthTokenRefreshGuard,\n        AuthTokenRefreshStrategy,\n        AuthManager,\n        { provide: UsersManager, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authConfig = module.get<ConfigService>(ConfigService).get<AuthConfig>('auth')\n    jwtService = module.get<JwtService>(JwtService)\n    authRefreshGuard = module.get<AuthTokenRefreshGuard>(AuthTokenRefreshGuard)\n    refreshToken = await jwtService.signAsync({ identity: { id: 1, login: 'foo' }, [TOKEN_TYPE.CSRF]: csrfToken } as JwtPayload, {\n      secret: authConfig.token.refresh.secret,\n      expiresIn: 30\n    })\n    refreshTokenWithoutCSRF = await jwtService.signAsync({ identity: { id: 1, login: 'foo' } } as JwtPayload, {\n      secret: authConfig.token.refresh.secret,\n      expiresIn: 30\n    })\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authConfig).toBeDefined()\n    expect(jwtService).toBeDefined()\n    expect(authRefreshGuard).toBeDefined()\n    expect(refreshToken).toBeDefined()\n    expect(refreshTokenWithoutCSRF).toBeDefined()\n    expect(csrfToken).toBeDefined()\n  })\n\n  it('should pass with a valid refresh token in cookies with CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: sign(csrfToken, authConfig.token.csrf.secret) },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    expect(await authRefreshGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass with a valid refresh token in request header with no CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer ${refreshToken}`\n      }\n    })\n    expect(await authRefreshGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should throw an error with an invalid refresh token in cookies', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.refresh.name]: 'bar'\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with an invalid refresh token in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a missing CSRF in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_HEADERS))\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a missing CSRF claim in the refresh token', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshTokenWithoutCSRF\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_JWT))\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n})\n"],"names":["describe","AuthTokenRefreshGuard","name","csrfToken","crypto","randomUUID","authConfig","jwtService","authRefreshGuard","refreshToken","refreshTokenWithoutCSRF","context","beforeAll","module","Test","createTestingModule","imports","ConfigModule","forRoot","load","exportConfiguration","isGlobal","JwtModule","register","global","PassportModule","providers","AuthTokenRefreshStrategy","AuthManager","provide","UsersManager","useValue","PinoLogger","assign","undefined","compile","get","ConfigService","JwtService","signAsync","identity","id","login","TOKEN_TYPE","CSRF","secret","token","refresh","expiresIn","createMock","it","expect","toBeDefined","switchToHttp","getRequest","mockReturnValue","raw","user","headers","csrf","sign","cookies","canActivate","toBe","authorization","rejects","toThrow","RegExp","CSRF_ERROR","MISSING_HEADERS","MISSING_JWT","MISMATCH"],"mappings":"AAAA;;;;CAIC;;;;wBAEoB;wBACkB;wBAEK;qBACN;0BACP;yBACK;4BACT;mEACR;qCACU;mCACO;sBAET;gCAEA;oCACC;uCACU;0CACG;;;;;;AAEzCA,SAASC,4CAAqB,CAACC,IAAI,EAAE;IACnC,MAAMC,YAAoBC,mBAAM,CAACC,UAAU;IAC3C,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,SAAS;gBAAC,MAAMC,oBAAY,CAACC,OAAO,CAAC;oBAAEC,MAAM;wBAACC,sCAAmB;qBAAC;oBAAEC,UAAU;gBAAK;gBAAIC,cAAS,CAACC,QAAQ,CAAC;oBAAEC,QAAQ;gBAAK;gBAAIC,wBAAc;aAAC;YAC5IC,WAAW;gBACTzB,4CAAqB;gBACrB0B,kDAAwB;gBACxBC,+BAAW;gBACX;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU,CAAC;gBAAE;gBACtC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEV7B,aAAaO,OAAOuB,GAAG,CAAgBC,qBAAa,EAAED,GAAG,CAAa;QACtE7B,aAAaM,OAAOuB,GAAG,CAAaE,eAAU;QAC9C9B,mBAAmBK,OAAOuB,GAAG,CAAwBnC,4CAAqB;QAC1EQ,eAAe,MAAMF,WAAWgC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;YAAG,CAACC,0BAAU,CAACC,IAAI,CAAC,EAAEzC;QAAU,GAAiB;YAC3H0C,QAAQvC,WAAWwC,KAAK,CAACC,OAAO,CAACF,MAAM;YACvCG,WAAW;QACb;QACAtC,0BAA0B,MAAMH,WAAWgC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;QAAE,GAAiB;YACxGG,QAAQvC,WAAWwC,KAAK,CAACC,OAAO,CAACF,MAAM;YACvCG,WAAW;QACb;QACArC,UAAUsC,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAO7C,YAAY8C,WAAW;QAC9BD,OAAO5C,YAAY6C,WAAW;QAC9BD,OAAO3C,kBAAkB4C,WAAW;QACpCD,OAAO1C,cAAc2C,WAAW;QAChCD,OAAOzC,yBAAyB0C,WAAW;QAC3CD,OAAOhD,WAAWiD,WAAW;IAC/B;IAEAF,GAAG,+DAA+D;QAChEvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAE0D,IAAAA,YAAI,EAACzD,WAAWG,WAAWwC,KAAK,CAACa,IAAI,CAACd,MAAM;YAAE;YACvFgB,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA0C,OAAO,MAAM3C,iBAAiBsD,WAAW,CAACnD,UAAUoD,IAAI,CAAC;IAC3D;IAEAb,GAAG,yEAAyE;QAC1EvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEvD,cAAc;YACzC;QACF;QACA0C,OAAO,MAAM3C,iBAAiBsD,WAAW,CAACnD,UAAUoD,IAAI,CAAC;IAC3D;IAEAb,GAAG,kEAAkE;QACnEvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAE;YACnC;QACF;QACA,MAAMiD,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC;IACtE;IAEAhB,GAAG,yEAAyE;QAC1EvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACA,MAAMb,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC;IACtE;IAEAhB,GAAG,oGAAoG;QACrGvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA,MAAM0C,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACC,eAAe;IAC3G;IAEAnB,GAAG,6GAA6G;QAC9GvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAEC;YAAU;YACnD0D,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEQ;YACnC;QACF;QACA,MAAMyC,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACE,WAAW;IACvG;IAEApB,GAAG,mFAAmF;QACpFvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzD0D,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA,MAAM0C,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACpG;AACF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.guard.spec.ts"],"sourcesContent":["import { sign } from '@fastify/cookie'\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { ConfigModule, ConfigService } from '@nestjs/config'\nimport { JwtModule, JwtService } from '@nestjs/jwt'\nimport { PassportModule } from '@nestjs/passport'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport crypto from 'node:crypto'\nimport { UsersManager } from '../../applications/users/services/users-manager.service'\nimport { exportConfiguration } from '../../configuration/config.environment'\nimport { AuthConfig } from '../auth.config'\nimport { AuthManager } from '../auth.service'\nimport { CSRF_ERROR } from '../constants/auth'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthTokenRefreshGuard } from './auth-token-refresh.guard'\nimport { AuthTokenRefreshStrategy } from './auth-token-refresh.strategy'\n\ndescribe(AuthTokenRefreshGuard.name, () => {\n  const csrfToken: string = crypto.randomUUID()\n  let authConfig: AuthConfig\n  let jwtService: JwtService\n  let authRefreshGuard: AuthTokenRefreshGuard\n  let refreshToken: string\n  let refreshTokenWithoutCSRF: string\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      imports: [await ConfigModule.forRoot({ load: [exportConfiguration], isGlobal: true }), JwtModule.register({ global: true }), PassportModule],\n      providers: [\n        AuthTokenRefreshGuard,\n        AuthTokenRefreshStrategy,\n        AuthManager,\n        { provide: UsersManager, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authConfig = module.get<ConfigService>(ConfigService).get<AuthConfig>('auth')\n    jwtService = module.get<JwtService>(JwtService)\n    authRefreshGuard = module.get<AuthTokenRefreshGuard>(AuthTokenRefreshGuard)\n    refreshToken = await jwtService.signAsync({ identity: { id: 1, login: 'foo' }, [TOKEN_TYPE.CSRF]: csrfToken } as JwtPayload, {\n      secret: authConfig.token.refresh.secret,\n      expiresIn: 30\n    })\n    refreshTokenWithoutCSRF = await jwtService.signAsync({ identity: { id: 1, login: 'foo' } } as JwtPayload, {\n      secret: authConfig.token.refresh.secret,\n      expiresIn: 30\n    })\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authConfig).toBeDefined()\n    expect(jwtService).toBeDefined()\n    expect(authRefreshGuard).toBeDefined()\n    expect(refreshToken).toBeDefined()\n    expect(refreshTokenWithoutCSRF).toBeDefined()\n    expect(csrfToken).toBeDefined()\n  })\n\n  it('should pass with a valid refresh token in cookies with CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: sign(csrfToken, authConfig.token.csrf.secret) },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    expect(await authRefreshGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass with a valid refresh token in request header with no CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer ${refreshToken}`\n      }\n    })\n    expect(await authRefreshGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should throw an error with an invalid refresh token in cookies', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.refresh.name]: 'bar'\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with an invalid refresh token in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a missing CSRF in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_HEADERS))\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a missing CSRF claim in the refresh token', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshTokenWithoutCSRF\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_JWT))\n  })\n\n  it('should throw an error with a valid refresh token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.refresh.name]: refreshToken\n      }\n    })\n    await expect(authRefreshGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n})\n"],"names":["describe","AuthTokenRefreshGuard","name","csrfToken","crypto","randomUUID","authConfig","jwtService","authRefreshGuard","refreshToken","refreshTokenWithoutCSRF","context","beforeAll","module","Test","createTestingModule","imports","ConfigModule","forRoot","load","exportConfiguration","isGlobal","JwtModule","register","global","PassportModule","providers","AuthTokenRefreshStrategy","AuthManager","provide","UsersManager","useValue","PinoLogger","assign","undefined","compile","get","ConfigService","JwtService","signAsync","identity","id","login","TOKEN_TYPE","CSRF","secret","token","refresh","expiresIn","createMock","it","expect","toBeDefined","switchToHttp","getRequest","mockReturnValue","raw","user","headers","csrf","sign","cookies","canActivate","toBe","authorization","rejects","toThrow","RegExp","CSRF_ERROR","MISSING_HEADERS","MISSING_JWT","MISMATCH"],"mappings":";;;;wBAAqB;wBACkB;wBAEK;qBACN;0BACP;yBACK;4BACT;mEACR;qCACU;mCACO;6BAER;sBACD;gCAEA;uCACW;0CACG;;;;;;AAEzCA,SAASC,4CAAqB,CAACC,IAAI,EAAE;IACnC,MAAMC,YAAoBC,mBAAM,CAACC,UAAU;IAC3C,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,SAAS;gBAAC,MAAMC,oBAAY,CAACC,OAAO,CAAC;oBAAEC,MAAM;wBAACC,sCAAmB;qBAAC;oBAAEC,UAAU;gBAAK;gBAAIC,cAAS,CAACC,QAAQ,CAAC;oBAAEC,QAAQ;gBAAK;gBAAIC,wBAAc;aAAC;YAC5IC,WAAW;gBACTzB,4CAAqB;gBACrB0B,kDAAwB;gBACxBC,wBAAW;gBACX;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU,CAAC;gBAAE;gBACtC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEV7B,aAAaO,OAAOuB,GAAG,CAAgBC,qBAAa,EAAED,GAAG,CAAa;QACtE7B,aAAaM,OAAOuB,GAAG,CAAaE,eAAU;QAC9C9B,mBAAmBK,OAAOuB,GAAG,CAAwBnC,4CAAqB;QAC1EQ,eAAe,MAAMF,WAAWgC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;YAAG,CAACC,0BAAU,CAACC,IAAI,CAAC,EAAEzC;QAAU,GAAiB;YAC3H0C,QAAQvC,WAAWwC,KAAK,CAACC,OAAO,CAACF,MAAM;YACvCG,WAAW;QACb;QACAtC,0BAA0B,MAAMH,WAAWgC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;QAAE,GAAiB;YACxGG,QAAQvC,WAAWwC,KAAK,CAACC,OAAO,CAACF,MAAM;YACvCG,WAAW;QACb;QACArC,UAAUsC,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAO7C,YAAY8C,WAAW;QAC9BD,OAAO5C,YAAY6C,WAAW;QAC9BD,OAAO3C,kBAAkB4C,WAAW;QACpCD,OAAO1C,cAAc2C,WAAW;QAChCD,OAAOzC,yBAAyB0C,WAAW;QAC3CD,OAAOhD,WAAWiD,WAAW;IAC/B;IAEAF,GAAG,+DAA+D;QAChEvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAE0D,IAAAA,YAAI,EAACzD,WAAWG,WAAWwC,KAAK,CAACa,IAAI,CAACd,MAAM;YAAE;YACvFgB,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA0C,OAAO,MAAM3C,iBAAiBsD,WAAW,CAACnD,UAAUoD,IAAI,CAAC;IAC3D;IAEAb,GAAG,yEAAyE;QAC1EvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEvD,cAAc;YACzC;QACF;QACA0C,OAAO,MAAM3C,iBAAiBsD,WAAW,CAACnD,UAAUoD,IAAI,CAAC;IAC3D;IAEAb,GAAG,kEAAkE;QACnEvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAE;YACnC;QACF;QACA,MAAMiD,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC;IACtE;IAEAhB,GAAG,yEAAyE;QAC1EvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACA,MAAMb,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC;IACtE;IAEAhB,GAAG,oGAAoG;QACrGvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA,MAAM0C,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACC,eAAe;IAC3G;IAEAnB,GAAG,6GAA6G;QAC9GvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAEC;YAAU;YACnD0D,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEQ;YACnC;QACF;QACA,MAAMyC,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACE,WAAW;IACvG;IAEApB,GAAG,mFAAmF;QACpFvC,QAAQ0C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAACpD,WAAWwC,KAAK,CAACa,IAAI,CAACzD,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzD0D,SAAS;gBACP,CAACvD,WAAWwC,KAAK,CAACC,OAAO,CAAC7C,IAAI,CAAC,EAAEO;YACnC;QACF;QACA,MAAM0C,OAAO3C,iBAAiBsD,WAAW,CAACnD,UAAUsD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACpG;AACF"}

package/server/authentication/guards/auth-token-refresh.strategy.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -18,8 +14,8 @@ const _nestjspino = require("nestjs-pino");
 const _passportjwt = require("passport-jwt");
 const _usermodel = require("../../applications/users/models/user.model");
 const _configenvironment = require("../../configuration/config.environment");
+const _authservice = require("../auth.service");
 const _tokeninterface = require("../interfaces/token.interface");
-const _authmanagerservice = require("../services/auth-manager.service");
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -64,7 +60,7 @@ AuthTokenRefreshStrategy = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _authmanagerservice.AuthManager === "undefined" ? Object : _authmanagerservice.AuthManager,
+        typeof _authservice.AuthManager === "undefined" ? Object : _authservice.AuthManager,
         typeof _nestjspino.PinoLogger === "undefined" ? Object : _nestjspino.PinoLogger
     ])
 ], AuthTokenRefreshStrategy);

package/server/authentication/guards/auth-token-refresh.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenRefreshStrategy extends PassportStrategy(Strategy, 'tokenRefresh') implements AbstractStrategy {\n  private static refreshCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenRefreshStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.refresh.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenRefreshStrategy.refreshCookieName = configuration.auth.token.refresh.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.REFRESH)\n    // jwt expiration is used later to refresh cookies\n    return new UserModel({ ...jwtPayload.identity, exp: jwtPayload.exp })\n  }\n\n  private static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenRefreshStrategy.refreshCookieName] !== undefined) {\n      return req.cookies[AuthTokenRefreshStrategy.refreshCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenRefreshStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","REFRESH","UserModel","exp","extractJWTFromCookie","cookies","refreshCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","refresh","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAcYA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;gCAEH;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,2BAAN,MAAMA,iCAAiCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBvEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,OAAO;QACnE,kDAAkD;QAClD,OAAO,IAAIC,oBAAS,CAAC;YAAE,GAAGV,WAAWI,QAAQ;YAAEO,KAAKX,WAAWW,GAAG;QAAC;IACrE;IAEA,OAAeC,qBAAqBb,GAAmB,EAAiB;QACtE,IAAI,OAAOA,IAAIc,OAAO,KAAK,YAAYd,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC,KAAKC,WAAW;YAC5G,OAAOhB,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC;QAChE;QACA,OAAO;IACT;IAzBA,YACE,AAAiBR,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJe,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACvB,yBAAyBiB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YACnIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACC,MAAM;YACpDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBrB,cAAAA,kBACAL,SAAAA;QAQjBN,yBAAyBmB,iBAAiB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACI,IAAI;IACpF;AAeF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.strategy.ts"],"sourcesContent":["import { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { AuthManager } from '../auth.service'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\n\n@Injectable()\nexport class AuthTokenRefreshStrategy extends PassportStrategy(Strategy, 'tokenRefresh') implements AbstractStrategy {\n  private static refreshCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenRefreshStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.refresh.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenRefreshStrategy.refreshCookieName = configuration.auth.token.refresh.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.REFRESH)\n    // jwt expiration is used later to refresh cookies\n    return new UserModel({ ...jwtPayload.identity, exp: jwtPayload.exp })\n  }\n\n  private static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenRefreshStrategy.refreshCookieName] !== undefined) {\n      return req.cookies[AuthTokenRefreshStrategy.refreshCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenRefreshStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","REFRESH","UserModel","exp","extractJWTFromCookie","cookies","refreshCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","refresh","secret","ignoreExpiration","passReqToCallback","name"],"mappings":";;;;+BAYaA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;6BACF;gCAED;;;;;;;;;;AAGpB,IAAA,AAAMA,2BAAN,MAAMA,iCAAiCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBvEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,OAAO;QACnE,kDAAkD;QAClD,OAAO,IAAIC,oBAAS,CAAC;YAAE,GAAGV,WAAWI,QAAQ;YAAEO,KAAKX,WAAWW,GAAG;QAAC;IACrE;IAEA,OAAeC,qBAAqBb,GAAmB,EAAiB;QACtE,IAAI,OAAOA,IAAIc,OAAO,KAAK,YAAYd,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC,KAAKC,WAAW;YAC5G,OAAOhB,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC;QAChE;QACA,OAAO;IACT;IAzBA,YACE,AAAiBR,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJe,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACvB,yBAAyBiB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YACnIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACC,MAAM;YACpDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBrB,cAAAA,kBACAL,SAAAA;QAQjBN,yBAAyBmB,iBAAiB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACI,IAAI;IACpF;AAeF"}

package/server/authentication/guards/implementations/http-basic.strategy.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2026 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/guards/implementations/http-basic.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/guards/implementations/http-basic.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2026 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Strategy as PassportStrategy } from 'passport-strategy'\n\nexport type BasicVerifyCallback = (err?: any, user?: any) => void\n\nexport type BasicVerifyFunction = (userid: string, password: string, done: BasicVerifyCallback) => void\n\nexport type BasicVerifyFunctionWithRequest = (req: any, userid: string, password: string, done: BasicVerifyCallback) => void\n\nfunction splitFirst(str: string, sep: string): [string] | [string, string] {\n  const i = str.indexOf(sep)\n  if (i < 0) return [str]\n  return [str.substring(0, i), str.substring(i + 1)]\n}\n\nexport interface HttpBasicStrategyOptions {\n  realm?: string\n  passReqToCallback?: boolean\n}\n\n/**\n * Pure HTTP Basic authentication strategy\n **/\nexport class HttpBasicStrategy extends PassportStrategy {\n  name = 'basic'\n\n  private readonly verify: BasicVerifyFunction | BasicVerifyFunctionWithRequest\n  private readonly realm: string\n  private readonly passReqToCallback: boolean\n\n  constructor(options: HttpBasicStrategyOptions = {}, verify: BasicVerifyFunction | BasicVerifyFunctionWithRequest) {\n    super()\n\n    if (!verify) {\n      throw new TypeError('HttpBasicStrategy requires a verify callback')\n    }\n\n    this.verify = verify\n    this.realm = options.realm ?? 'Sync-in'\n    this.passReqToCallback = !!options.passReqToCallback\n  }\n\n  authenticate(req: any): void {\n    const authorization: string | undefined = req?.headers?.authorization\n    if (!authorization) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const parts = authorization.split(' ')\n    if (parts.length !== 2) {\n      return this.fail(400)\n    }\n\n    if (!/^Basic$/i.test(parts[0])) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    let decoded: string\n    try {\n      decoded = Buffer.from(parts[1], 'base64').toString()\n    } catch {\n      return this.fail(400)\n    }\n\n    const [userid, password] = splitFirst(decoded, ':')\n    if (password === undefined) {\n      return this.fail(400)\n    }\n\n    const verified: BasicVerifyCallback = (err, user) => {\n      if (err) return this.error(err)\n      if (!user) return this.fail(this.challenge(), 401)\n      return this.success(user)\n    }\n\n    if (this.passReqToCallback) {\n      ;(this.verify as BasicVerifyFunctionWithRequest)(req, userid, password, verified)\n    } else {\n      ;(this.verify as BasicVerifyFunction)(userid, password, verified)\n    }\n  }\n\n  private challenge(): string {\n    return `Basic realm=\"${this.realm}\"`\n  }\n}\n"],"names":["HttpBasicStrategy","splitFirst","str","sep","i","indexOf","substring","PassportStrategy","authenticate","req","authorization","headers","fail","challenge","parts","split","length","test","decoded","Buffer","from","toString","userid","password","undefined","verified","err","user","error","success","passReqToCallback","verify","realm","options","name","TypeError"],"mappings":"AAAA;;;;CAIC;;;;+BAwBYA;;;eAAAA;;;kCAtBgC;AAQ7C,SAASC,WAAWC,GAAW,EAAEC,GAAW;IAC1C,MAAMC,IAAIF,IAAIG,OAAO,CAACF;IACtB,IAAIC,IAAI,GAAG,OAAO;QAACF;KAAI;IACvB,OAAO;QAACA,IAAII,SAAS,CAAC,GAAGF;QAAIF,IAAII,SAAS,CAACF,IAAI;KAAG;AACpD;AAUO,IAAA,AAAMJ,oBAAN,MAAMA,0BAA0BO,0BAAgB;IAmBrDC,aAAaC,GAAQ,EAAQ;QAC3B,MAAMC,gBAAoCD,KAAKE,SAASD;QACxD,IAAI,CAACA,eAAe;YAClB,OAAO,IAAI,CAACE,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMC,QAAQJ,cAAcK,KAAK,CAAC;QAClC,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,OAAO,IAAI,CAACJ,IAAI,CAAC;QACnB;QAEA,IAAI,CAAC,WAAWK,IAAI,CAACH,KAAK,CAAC,EAAE,GAAG;YAC9B,OAAO,IAAI,CAACF,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,IAAIK;QACJ,IAAI;YACFA,UAAUC,OAAOC,IAAI,CAACN,KAAK,CAAC,EAAE,EAAE,UAAUO,QAAQ;QACpD,EAAE,OAAM;YACN,OAAO,IAAI,CAACT,IAAI,CAAC;QACnB;QAEA,MAAM,CAACU,QAAQC,SAAS,GAAGtB,WAAWiB,SAAS;QAC/C,IAAIK,aAAaC,WAAW;YAC1B,OAAO,IAAI,CAACZ,IAAI,CAAC;QACnB;QAEA,MAAMa,WAAgC,CAACC,KAAKC;YAC1C,IAAID,KAAK,OAAO,IAAI,CAACE,KAAK,CAACF;YAC3B,IAAI,CAACC,MAAM,OAAO,IAAI,CAACf,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YAC9C,OAAO,IAAI,CAACgB,OAAO,CAACF;QACtB;QAEA,IAAI,IAAI,CAACG,iBAAiB,EAAE;;YACxB,IAAI,CAACC,MAAM,CAAoCtB,KAAKa,QAAQC,UAAUE;QAC1E,OAAO;;YACH,IAAI,CAACM,MAAM,CAAyBT,QAAQC,UAAUE;QAC1D;IACF;IAEQZ,YAAoB;QAC1B,OAAO,CAAC,aAAa,EAAE,IAAI,CAACmB,KAAK,CAAC,CAAC,CAAC;IACtC;IAtDA,YAAYC,UAAoC,CAAC,CAAC,EAAEF,MAA4D,CAAE;QAChH,KAAK,SAPPG,OAAO;QASL,IAAI,CAACH,QAAQ;YACX,MAAM,IAAII,UAAU;QACtB;QAEA,IAAI,CAACJ,MAAM,GAAGA;QACd,IAAI,CAACC,KAAK,GAAGC,QAAQD,KAAK,IAAI;QAC9B,IAAI,CAACF,iBAAiB,GAAG,CAAC,CAACG,QAAQH,iBAAiB;IACtD;AA6CF"}
+{"version":3,"sources":["../../../../../backend/src/authentication/guards/implementations/http-basic.strategy.ts"],"sourcesContent":["import { Strategy as PassportStrategy } from 'passport-strategy'\n\nexport type BasicVerifyCallback = (err?: any, user?: any) => void\n\nexport type BasicVerifyFunction = (userid: string, password: string, done: BasicVerifyCallback) => void\n\nexport type BasicVerifyFunctionWithRequest = (req: any, userid: string, password: string, done: BasicVerifyCallback) => void\n\nfunction splitFirst(str: string, sep: string): [string] | [string, string] {\n  const i = str.indexOf(sep)\n  if (i < 0) return [str]\n  return [str.substring(0, i), str.substring(i + 1)]\n}\n\nexport interface HttpBasicStrategyOptions {\n  realm?: string\n  passReqToCallback?: boolean\n}\n\n/**\n * Pure HTTP Basic authentication strategy\n **/\nexport class HttpBasicStrategy extends PassportStrategy {\n  name = 'basic'\n\n  private readonly verify: BasicVerifyFunction | BasicVerifyFunctionWithRequest\n  private readonly realm: string\n  private readonly passReqToCallback: boolean\n\n  constructor(options: HttpBasicStrategyOptions = {}, verify: BasicVerifyFunction | BasicVerifyFunctionWithRequest) {\n    super()\n\n    if (!verify) {\n      throw new TypeError('HttpBasicStrategy requires a verify callback')\n    }\n\n    this.verify = verify\n    this.realm = options.realm ?? 'Sync-in'\n    this.passReqToCallback = !!options.passReqToCallback\n  }\n\n  authenticate(req: any): void {\n    const authorization: string | undefined = req?.headers?.authorization\n    if (!authorization) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const parts = authorization.split(' ')\n    if (parts.length !== 2) {\n      return this.fail(400)\n    }\n\n    if (!/^Basic$/i.test(parts[0])) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    let decoded: string\n    try {\n      decoded = Buffer.from(parts[1], 'base64').toString()\n    } catch {\n      return this.fail(400)\n    }\n\n    const [userid, password] = splitFirst(decoded, ':')\n    if (password === undefined) {\n      return this.fail(400)\n    }\n\n    const verified: BasicVerifyCallback = (err, user) => {\n      if (err) return this.error(err)\n      if (!user) return this.fail(this.challenge(), 401)\n      return this.success(user)\n    }\n\n    if (this.passReqToCallback) {\n      ;(this.verify as BasicVerifyFunctionWithRequest)(req, userid, password, verified)\n    } else {\n      ;(this.verify as BasicVerifyFunction)(userid, password, verified)\n    }\n  }\n\n  private challenge(): string {\n    return `Basic realm=\"${this.realm}\"`\n  }\n}\n"],"names":["HttpBasicStrategy","splitFirst","str","sep","i","indexOf","substring","PassportStrategy","authenticate","req","authorization","headers","fail","challenge","parts","split","length","test","decoded","Buffer","from","toString","userid","password","undefined","verified","err","user","error","success","passReqToCallback","verify","realm","options","name","TypeError"],"mappings":";;;;+BAsBaA;;;eAAAA;;;kCAtBgC;AAQ7C,SAASC,WAAWC,GAAW,EAAEC,GAAW;IAC1C,MAAMC,IAAIF,IAAIG,OAAO,CAACF;IACtB,IAAIC,IAAI,GAAG,OAAO;QAACF;KAAI;IACvB,OAAO;QAACA,IAAII,SAAS,CAAC,GAAGF;QAAIF,IAAII,SAAS,CAACF,IAAI;KAAG;AACpD;AAUO,IAAA,AAAMJ,oBAAN,MAAMA,0BAA0BO,0BAAgB;IAmBrDC,aAAaC,GAAQ,EAAQ;QAC3B,MAAMC,gBAAoCD,KAAKE,SAASD;QACxD,IAAI,CAACA,eAAe;YAClB,OAAO,IAAI,CAACE,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMC,QAAQJ,cAAcK,KAAK,CAAC;QAClC,IAAID,MAAME,MAAM,KAAK,GAAG;YACtB,OAAO,IAAI,CAACJ,IAAI,CAAC;QACnB;QAEA,IAAI,CAAC,WAAWK,IAAI,CAACH,KAAK,CAAC,EAAE,GAAG;YAC9B,OAAO,IAAI,CAACF,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,IAAIK;QACJ,IAAI;YACFA,UAAUC,OAAOC,IAAI,CAACN,KAAK,CAAC,EAAE,EAAE,UAAUO,QAAQ;QACpD,EAAE,OAAM;YACN,OAAO,IAAI,CAACT,IAAI,CAAC;QACnB;QAEA,MAAM,CAACU,QAAQC,SAAS,GAAGtB,WAAWiB,SAAS;QAC/C,IAAIK,aAAaC,WAAW;YAC1B,OAAO,IAAI,CAACZ,IAAI,CAAC;QACnB;QAEA,MAAMa,WAAgC,CAACC,KAAKC;YAC1C,IAAID,KAAK,OAAO,IAAI,CAACE,KAAK,CAACF;YAC3B,IAAI,CAACC,MAAM,OAAO,IAAI,CAACf,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YAC9C,OAAO,IAAI,CAACgB,OAAO,CAACF;QACtB;QAEA,IAAI,IAAI,CAACG,iBAAiB,EAAE;;YACxB,IAAI,CAACC,MAAM,CAAoCtB,KAAKa,QAAQC,UAAUE;QAC1E,OAAO;;YACH,IAAI,CAACM,MAAM,CAAyBT,QAAQC,UAAUE;QAC1D;IACF;IAEQZ,YAAoB;QAC1B,OAAO,CAAC,aAAa,EAAE,IAAI,CAACmB,KAAK,CAAC,CAAC,CAAC;IACtC;IAtDA,YAAYC,UAAoC,CAAC,CAAC,EAAEF,MAA4D,CAAE;QAChH,KAAK,SAPPG,OAAO;QASL,IAAI,CAACH,QAAQ;YACX,MAAM,IAAII,UAAU;QACtB;QAEA,IAAI,CAACJ,MAAM,GAAGA;QACd,IAAI,CAACC,KAAK,GAAGC,QAAQD,KAAK,IAAI;QAC9B,IAAI,CAACF,iBAAiB,GAAG,CAAC,CAACG,QAAQH,iBAAiB;IACtD;AA6CF"}

package/server/authentication/guards/implementations/http-digest.strategy.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2026 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/guards/implementations/http-digest.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/guards/implementations/http-digest.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2026 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport crypto from 'node:crypto'\nimport { Strategy as PassportStrategy } from 'passport-strategy'\n\nexport interface DigestValidateParams {\n  nonce?: string\n  cnonce?: string\n  nc?: string\n  opaque?: string\n}\n\nexport type DigestValidateCallback = (err?: any, valid?: boolean) => void\n\n// ⚠️ verify (secret callback) : on attend un \"user container\" qui contient aussi le secret\nexport type DigestVerifyCallback = (err?: any, result?: any) => void\n\nexport type DigestVerifyFunction = (username: string, done: DigestVerifyCallback) => void\nexport type DigestVerifyFunctionWithRequest = (req: any, username: string, done: DigestVerifyCallback) => void\n\nexport type DigestSecret =\n  | string // password en clair (rare)\n  | { ha1: string } // recommandé : HA1 = MD5(username:realm:password)\n\nexport interface DigestVerifyResult {\n  user: any\n  secret: DigestSecret\n}\n\nexport interface HttpDigestStrategyOptionsBase {\n  realm?: string\n  domain?: string | string[]\n  opaque?: string\n  algorithm?: 'MD5' | 'MD5-sess'\n  qop?: ('auth' | 'auth-int')[] | 'auth' | 'auth-int'\n  // optionnel : anti-replay\n  validate?: (params: DigestValidateParams, done: DigestValidateCallback) => void\n}\n\nexport type HttpDigestStrategyOptionsWithReq = HttpDigestStrategyOptionsBase & {\n  passReqToCallback: true\n}\n\nexport type HttpDigestStrategyOptionsNoReq = HttpDigestStrategyOptionsBase & {\n  passReqToCallback?: false | undefined\n}\n\nfunction md5(str: string, encoding: crypto.BinaryToTextEncoding = 'hex'): string {\n  return crypto.createHash('md5').update(str).digest(encoding)\n}\n\nfunction nonce(len: number): string {\n  const buf: string[] = []\n  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'\n  const charlen = chars.length\n  for (let i = 0; i < len; ++i) {\n    buf.push(chars[(Math.random() * charlen) | 0])\n  }\n  return buf.join('')\n}\n\n// parsing identique à digest.js\nfunction parse(params: string): Record<string, string> {\n  const opts: Record<string, string> = {}\n  const tokens = params.split(/,(?=(?:[^\"]|\"[^\"]*\")*$)/)\n  for (const token of tokens) {\n    const m = /(\\w+)=[\"]?([^\"]+)[\"]?$/.exec(token)\n    if (m) opts[m[1]] = m[2]\n  }\n  return opts\n}\n\nexport class HttpDigestStrategy extends PassportStrategy {\n  name = 'digest'\n\n  private readonly realm: string\n  private readonly domain?: string[]\n  private readonly opaque?: string\n  private readonly algorithm?: 'MD5' | 'MD5-sess'\n  private readonly qop?: ('auth' | 'auth-int')[]\n  private readonly passReqToCallback: boolean\n  private readonly validateCb?: (params: DigestValidateParams, done: DigestValidateCallback) => void\n\n  private readonly verify: DigestVerifyFunction | DigestVerifyFunctionWithRequest\n\n  // overloads typés selon passReqToCallback\n  constructor(options: HttpDigestStrategyOptionsWithReq, verify: DigestVerifyFunctionWithRequest)\n  constructor(options?: HttpDigestStrategyOptionsNoReq, verify?: DigestVerifyFunction)\n  constructor(\n    options: HttpDigestStrategyOptionsWithReq | HttpDigestStrategyOptionsNoReq = {},\n    verify?: DigestVerifyFunction | DigestVerifyFunctionWithRequest\n  ) {\n    super()\n    if (!verify) throw new Error('HTTP Digest authentication strategy requires a secret function')\n\n    this.verify = verify\n    this.realm = options.realm ?? 'Users'\n\n    if (options.domain) this.domain = Array.isArray(options.domain) ? options.domain : [options.domain]\n    this.opaque = options.opaque\n    this.algorithm = options.algorithm\n    this.qop = options.qop ? (Array.isArray(options.qop) ? options.qop : [options.qop]) : undefined\n\n    this.validateCb = options.validate\n    this.passReqToCallback = (options as HttpDigestStrategyOptionsWithReq).passReqToCallback === true\n  }\n\n  authenticate(req: any): void {\n    const authorization: string | undefined = req?.headers?.authorization\n    if (!authorization) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const parts = authorization.split(' ')\n    if (parts.length < 2) return this.fail(400 as any)\n\n    const scheme = parts[0]\n    const params = parts.slice(1).join(' ')\n    if (!/Digest/i.test(scheme)) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const creds = parse(params)\n    if (Object.keys(creds).length === 0) return this.fail(400 as any)\n    if (!creds.username) return this.fail(this.challenge(), 401)\n\n    // Même check que digest.js : req.url doit matcher creds.uri\n    // (en Fastify, req.url inclut la querystring, ce qui est généralement OK)\n    if (req.url !== creds.uri) return this.fail(400 as any)\n\n    const verified: DigestVerifyCallback = (err, result) => {\n      if (err) return this.error(err)\n      if (!result || !result.user) return this.fail(this.challenge(), 401)\n\n      const { user, secret } = result as DigestVerifyResult\n      if (!secret) return this.fail(400 as any)\n\n      // compute HA1\n      let ha1: string\n      const algo = creds.algorithm || 'MD5'\n      if (algo === 'MD5') {\n        if (typeof secret === 'object' && (secret as any).ha1) {\n          ha1 = (secret as any).ha1\n        } else {\n          // password en clair (peu probable)\n          ha1 = md5(`${creds.username}:${creds.realm}:${String(secret)}`)\n        }\n      } else if (algo === 'MD5-sess') {\n        // idem digest.js (note: nonce/cnonce init non gérés)\n        const base =\n          typeof secret === 'object' && (secret as any).ha1 ? (secret as any).ha1 : md5(`${creds.username}:${creds.realm}:${String(secret)}`)\n        ha1 = md5(`${base}:${creds.nonce}:${creds.cnonce}`)\n      } else {\n        return this.fail(400 as any)\n      }\n\n      // compute HA2\n      let ha2: string\n      if (!creds.qop || creds.qop === 'auth') {\n        ha2 = md5(`${req.method}:${creds.uri}`)\n      } else if (creds.qop === 'auth-int') {\n        return this.error(new Error('auth-int not implemented'))\n      } else {\n        return this.fail(400 as any)\n      }\n\n      // compute expected digest\n      let digest: string\n      if (!creds.qop) {\n        digest = md5(`${ha1}:${creds.nonce}:${ha2}`)\n      } else if (creds.qop === 'auth' || creds.qop === 'auth-int') {\n        digest = md5(`${ha1}:${creds.nonce}:${creds.nc}:${creds.cnonce}:${creds.qop}:${ha2}`)\n      } else {\n        return this.fail(400 as any)\n      }\n\n      if (creds.response !== digest) {\n        return this.fail(this.challenge(), 401)\n      }\n\n      if (this.validateCb) {\n        return this.validateCb({ nonce: creds.nonce, cnonce: creds.cnonce, nc: creds.nc, opaque: creds.opaque }, (e, ok) => {\n          if (e) return this.error(e)\n          if (!ok) return this.fail(this.challenge(), 401)\n          return this.success(user)\n        })\n      }\n\n      return this.success(user)\n    }\n\n    if (this.passReqToCallback) {\n      ;(this.verify as DigestVerifyFunctionWithRequest)(req, creds.username, verified)\n    } else {\n      ;(this.verify as DigestVerifyFunction)(creds.username, verified)\n    }\n  }\n\n  private challenge(): string {\n    let challenge = `Digest realm=\"${this.realm}\"`\n    if (this.domain) challenge += `, domain=\"${this.domain.join(' ')}\"`\n    challenge += `, nonce=\"${nonce(32)}\"`\n    if (this.opaque) challenge += `, opaque=\"${this.opaque}\"`\n    if (this.algorithm) challenge += `, algorithm=${this.algorithm}`\n    if (this.qop) challenge += `, qop=\"${this.qop.join(',')}\"`\n    return challenge\n  }\n}\n"],"names":["HttpDigestStrategy","md5","str","encoding","crypto","createHash","update","digest","nonce","len","buf","chars","charlen","length","i","push","Math","random","join","parse","params","opts","tokens","split","token","m","exec","PassportStrategy","authenticate","req","authorization","headers","fail","challenge","parts","scheme","slice","test","creds","Object","keys","username","url","uri","verified","err","result","error","user","secret","ha1","algo","algorithm","realm","String","base","cnonce","ha2","qop","method","Error","nc","response","validateCb","opaque","e","ok","success","passReqToCallback","verify","domain","options","name","Array","isArray","undefined","validate"],"mappings":"AAAA;;;;CAIC;;;;+BAwEYA;;;eAAAA;;;mEAtEM;kCAC0B;;;;;;AA4C7C,SAASC,IAAIC,GAAW,EAAEC,WAAwC,KAAK;IACrE,OAAOC,mBAAM,CAACC,UAAU,CAAC,OAAOC,MAAM,CAACJ,KAAKK,MAAM,CAACJ;AACrD;AAEA,SAASK,MAAMC,GAAW;IACxB,MAAMC,MAAgB,EAAE;IACxB,MAAMC,QAAQ;IACd,MAAMC,UAAUD,MAAME,MAAM;IAC5B,IAAK,IAAIC,IAAI,GAAGA,IAAIL,KAAK,EAAEK,EAAG;QAC5BJ,IAAIK,IAAI,CAACJ,KAAK,CAAC,AAACK,KAAKC,MAAM,KAAKL,UAAW,EAAE;IAC/C;IACA,OAAOF,IAAIQ,IAAI,CAAC;AAClB;AAEA,gCAAgC;AAChC,SAASC,MAAMC,MAAc;IAC3B,MAAMC,OAA+B,CAAC;IACtC,MAAMC,SAASF,OAAOG,KAAK,CAAC;IAC5B,KAAK,MAAMC,SAASF,OAAQ;QAC1B,MAAMG,IAAI,yBAAyBC,IAAI,CAACF;QACxC,IAAIC,GAAGJ,IAAI,CAACI,CAAC,CAAC,EAAE,CAAC,GAAGA,CAAC,CAAC,EAAE;IAC1B;IACA,OAAOJ;AACT;AAEO,IAAA,AAAMrB,qBAAN,MAAMA,2BAA2B2B,0BAAgB;IAmCtDC,aAAaC,GAAQ,EAAQ;QAC3B,MAAMC,gBAAoCD,KAAKE,SAASD;QACxD,IAAI,CAACA,eAAe;YAClB,OAAO,IAAI,CAACE,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMC,QAAQJ,cAAcP,KAAK,CAAC;QAClC,IAAIW,MAAMrB,MAAM,GAAG,GAAG,OAAO,IAAI,CAACmB,IAAI,CAAC;QAEvC,MAAMG,SAASD,KAAK,CAAC,EAAE;QACvB,MAAMd,SAASc,MAAME,KAAK,CAAC,GAAGlB,IAAI,CAAC;QACnC,IAAI,CAAC,UAAUmB,IAAI,CAACF,SAAS;YAC3B,OAAO,IAAI,CAACH,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMK,QAAQnB,MAAMC;QACpB,IAAImB,OAAOC,IAAI,CAACF,OAAOzB,MAAM,KAAK,GAAG,OAAO,IAAI,CAACmB,IAAI,CAAC;QACtD,IAAI,CAACM,MAAMG,QAAQ,EAAE,OAAO,IAAI,CAACT,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QAExD,4DAA4D;QAC5D,0EAA0E;QAC1E,IAAIJ,IAAIa,GAAG,KAAKJ,MAAMK,GAAG,EAAE,OAAO,IAAI,CAACX,IAAI,CAAC;QAE5C,MAAMY,WAAiC,CAACC,KAAKC;YAC3C,IAAID,KAAK,OAAO,IAAI,CAACE,KAAK,CAACF;YAC3B,IAAI,CAACC,UAAU,CAACA,OAAOE,IAAI,EAAE,OAAO,IAAI,CAAChB,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YAEhE,MAAM,EAAEe,IAAI,EAAEC,MAAM,EAAE,GAAGH;YACzB,IAAI,CAACG,QAAQ,OAAO,IAAI,CAACjB,IAAI,CAAC;YAE9B,cAAc;YACd,IAAIkB;YACJ,MAAMC,OAAOb,MAAMc,SAAS,IAAI;YAChC,IAAID,SAAS,OAAO;gBAClB,IAAI,OAAOF,WAAW,YAAY,AAACA,OAAeC,GAAG,EAAE;oBACrDA,MAAM,AAACD,OAAeC,GAAG;gBAC3B,OAAO;oBACL,mCAAmC;oBACnCA,MAAMjD,IAAI,GAAGqC,MAAMG,QAAQ,CAAC,CAAC,EAAEH,MAAMe,KAAK,CAAC,CAAC,EAAEC,OAAOL,SAAS;gBAChE;YACF,OAAO,IAAIE,SAAS,YAAY;gBAC9B,qDAAqD;gBACrD,MAAMI,OACJ,OAAON,WAAW,YAAY,AAACA,OAAeC,GAAG,GAAG,AAACD,OAAeC,GAAG,GAAGjD,IAAI,GAAGqC,MAAMG,QAAQ,CAAC,CAAC,EAAEH,MAAMe,KAAK,CAAC,CAAC,EAAEC,OAAOL,SAAS;gBACpIC,MAAMjD,IAAI,GAAGsD,KAAK,CAAC,EAAEjB,MAAM9B,KAAK,CAAC,CAAC,EAAE8B,MAAMkB,MAAM,EAAE;YACpD,OAAO;gBACL,OAAO,IAAI,CAACxB,IAAI,CAAC;YACnB;YAEA,cAAc;YACd,IAAIyB;YACJ,IAAI,CAACnB,MAAMoB,GAAG,IAAIpB,MAAMoB,GAAG,KAAK,QAAQ;gBACtCD,MAAMxD,IAAI,GAAG4B,IAAI8B,MAAM,CAAC,CAAC,EAAErB,MAAMK,GAAG,EAAE;YACxC,OAAO,IAAIL,MAAMoB,GAAG,KAAK,YAAY;gBACnC,OAAO,IAAI,CAACX,KAAK,CAAC,IAAIa,MAAM;YAC9B,OAAO;gBACL,OAAO,IAAI,CAAC5B,IAAI,CAAC;YACnB;YAEA,0BAA0B;YAC1B,IAAIzB;YACJ,IAAI,CAAC+B,MAAMoB,GAAG,EAAE;gBACdnD,SAASN,IAAI,GAAGiD,IAAI,CAAC,EAAEZ,MAAM9B,KAAK,CAAC,CAAC,EAAEiD,KAAK;YAC7C,OAAO,IAAInB,MAAMoB,GAAG,KAAK,UAAUpB,MAAMoB,GAAG,KAAK,YAAY;gBAC3DnD,SAASN,IAAI,GAAGiD,IAAI,CAAC,EAAEZ,MAAM9B,KAAK,CAAC,CAAC,EAAE8B,MAAMuB,EAAE,CAAC,CAAC,EAAEvB,MAAMkB,MAAM,CAAC,CAAC,EAAElB,MAAMoB,GAAG,CAAC,CAAC,EAAED,KAAK;YACtF,OAAO;gBACL,OAAO,IAAI,CAACzB,IAAI,CAAC;YACnB;YAEA,IAAIM,MAAMwB,QAAQ,KAAKvD,QAAQ;gBAC7B,OAAO,IAAI,CAACyB,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YACrC;YAEA,IAAI,IAAI,CAAC8B,UAAU,EAAE;gBACnB,OAAO,IAAI,CAACA,UAAU,CAAC;oBAAEvD,OAAO8B,MAAM9B,KAAK;oBAAEgD,QAAQlB,MAAMkB,MAAM;oBAAEK,IAAIvB,MAAMuB,EAAE;oBAAEG,QAAQ1B,MAAM0B,MAAM;gBAAC,GAAG,CAACC,GAAGC;oBAC3G,IAAID,GAAG,OAAO,IAAI,CAAClB,KAAK,CAACkB;oBACzB,IAAI,CAACC,IAAI,OAAO,IAAI,CAAClC,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;oBAC5C,OAAO,IAAI,CAACkC,OAAO,CAACnB;gBACtB;YACF;YAEA,OAAO,IAAI,CAACmB,OAAO,CAACnB;QACtB;QAEA,IAAI,IAAI,CAACoB,iBAAiB,EAAE;;YACxB,IAAI,CAACC,MAAM,CAAqCxC,KAAKS,MAAMG,QAAQ,EAAEG;QACzE,OAAO;;YACH,IAAI,CAACyB,MAAM,CAA0B/B,MAAMG,QAAQ,EAAEG;QACzD;IACF;IAEQX,YAAoB;QAC1B,IAAIA,YAAY,CAAC,cAAc,EAAE,IAAI,CAACoB,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAACiB,MAAM,EAAErC,aAAa,CAAC,UAAU,EAAE,IAAI,CAACqC,MAAM,CAACpD,IAAI,CAAC,KAAK,CAAC,CAAC;QACnEe,aAAa,CAAC,SAAS,EAAEzB,MAAM,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAACwD,MAAM,EAAE/B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC+B,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAACZ,SAAS,EAAEnB,aAAa,CAAC,YAAY,EAAE,IAAI,CAACmB,SAAS,EAAE;QAChE,IAAI,IAAI,CAACM,GAAG,EAAEzB,aAAa,CAAC,OAAO,EAAE,IAAI,CAACyB,GAAG,CAACxC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAOe;IACT;IAtHA,YACEsC,UAA6E,CAAC,CAAC,EAC/EF,MAA+D,CAC/D;QACA,KAAK,SAnBPG,OAAO;QAoBL,IAAI,CAACH,QAAQ,MAAM,IAAIT,MAAM;QAE7B,IAAI,CAACS,MAAM,GAAGA;QACd,IAAI,CAAChB,KAAK,GAAGkB,QAAQlB,KAAK,IAAI;QAE9B,IAAIkB,QAAQD,MAAM,EAAE,IAAI,CAACA,MAAM,GAAGG,MAAMC,OAAO,CAACH,QAAQD,MAAM,IAAIC,QAAQD,MAAM,GAAG;YAACC,QAAQD,MAAM;SAAC;QACnG,IAAI,CAACN,MAAM,GAAGO,QAAQP,MAAM;QAC5B,IAAI,CAACZ,SAAS,GAAGmB,QAAQnB,SAAS;QAClC,IAAI,CAACM,GAAG,GAAGa,QAAQb,GAAG,GAAIe,MAAMC,OAAO,CAACH,QAAQb,GAAG,IAAIa,QAAQb,GAAG,GAAG;YAACa,QAAQb,GAAG;SAAC,GAAIiB;QAEtF,IAAI,CAACZ,UAAU,GAAGQ,QAAQK,QAAQ;QAClC,IAAI,CAACR,iBAAiB,GAAG,AAACG,QAA6CH,iBAAiB,KAAK;IAC/F;AAsGF"}
+{"version":3,"sources":["../../../../../backend/src/authentication/guards/implementations/http-digest.strategy.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { Strategy as PassportStrategy } from 'passport-strategy'\n\nexport interface DigestValidateParams {\n  nonce?: string\n  cnonce?: string\n  nc?: string\n  opaque?: string\n}\n\nexport type DigestValidateCallback = (err?: any, valid?: boolean) => void\n\n// ⚠️ verify (secret callback) : on attend un \"user container\" qui contient aussi le secret\nexport type DigestVerifyCallback = (err?: any, result?: any) => void\n\nexport type DigestVerifyFunction = (username: string, done: DigestVerifyCallback) => void\nexport type DigestVerifyFunctionWithRequest = (req: any, username: string, done: DigestVerifyCallback) => void\n\nexport type DigestSecret =\n  | string // password en clair (rare)\n  | { ha1: string } // recommandé : HA1 = MD5(username:realm:password)\n\nexport interface DigestVerifyResult {\n  user: any\n  secret: DigestSecret\n}\n\nexport interface HttpDigestStrategyOptionsBase {\n  realm?: string\n  domain?: string | string[]\n  opaque?: string\n  algorithm?: 'MD5' | 'MD5-sess'\n  qop?: ('auth' | 'auth-int')[] | 'auth' | 'auth-int'\n  // optionnel : anti-replay\n  validate?: (params: DigestValidateParams, done: DigestValidateCallback) => void\n}\n\nexport type HttpDigestStrategyOptionsWithReq = HttpDigestStrategyOptionsBase & {\n  passReqToCallback: true\n}\n\nexport type HttpDigestStrategyOptionsNoReq = HttpDigestStrategyOptionsBase & {\n  passReqToCallback?: false | undefined\n}\n\nfunction md5(str: string, encoding: crypto.BinaryToTextEncoding = 'hex'): string {\n  return crypto.createHash('md5').update(str).digest(encoding)\n}\n\nfunction nonce(len: number): string {\n  const buf: string[] = []\n  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'\n  const charlen = chars.length\n  for (let i = 0; i < len; ++i) {\n    buf.push(chars[(Math.random() * charlen) | 0])\n  }\n  return buf.join('')\n}\n\n// parsing identique à digest.js\nfunction parse(params: string): Record<string, string> {\n  const opts: Record<string, string> = {}\n  const tokens = params.split(/,(?=(?:[^\"]|\"[^\"]*\")*$)/)\n  for (const token of tokens) {\n    const m = /(\\w+)=[\"]?([^\"]+)[\"]?$/.exec(token)\n    if (m) opts[m[1]] = m[2]\n  }\n  return opts\n}\n\nexport class HttpDigestStrategy extends PassportStrategy {\n  name = 'digest'\n\n  private readonly realm: string\n  private readonly domain?: string[]\n  private readonly opaque?: string\n  private readonly algorithm?: 'MD5' | 'MD5-sess'\n  private readonly qop?: ('auth' | 'auth-int')[]\n  private readonly passReqToCallback: boolean\n  private readonly validateCb?: (params: DigestValidateParams, done: DigestValidateCallback) => void\n\n  private readonly verify: DigestVerifyFunction | DigestVerifyFunctionWithRequest\n\n  // overloads typés selon passReqToCallback\n  constructor(options: HttpDigestStrategyOptionsWithReq, verify: DigestVerifyFunctionWithRequest)\n  constructor(options?: HttpDigestStrategyOptionsNoReq, verify?: DigestVerifyFunction)\n  constructor(\n    options: HttpDigestStrategyOptionsWithReq | HttpDigestStrategyOptionsNoReq = {},\n    verify?: DigestVerifyFunction | DigestVerifyFunctionWithRequest\n  ) {\n    super()\n    if (!verify) throw new Error('HTTP Digest authentication strategy requires a secret function')\n\n    this.verify = verify\n    this.realm = options.realm ?? 'Users'\n\n    if (options.domain) this.domain = Array.isArray(options.domain) ? options.domain : [options.domain]\n    this.opaque = options.opaque\n    this.algorithm = options.algorithm\n    this.qop = options.qop ? (Array.isArray(options.qop) ? options.qop : [options.qop]) : undefined\n\n    this.validateCb = options.validate\n    this.passReqToCallback = (options as HttpDigestStrategyOptionsWithReq).passReqToCallback === true\n  }\n\n  authenticate(req: any): void {\n    const authorization: string | undefined = req?.headers?.authorization\n    if (!authorization) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const parts = authorization.split(' ')\n    if (parts.length < 2) return this.fail(400 as any)\n\n    const scheme = parts[0]\n    const params = parts.slice(1).join(' ')\n    if (!/Digest/i.test(scheme)) {\n      return this.fail(this.challenge(), 401)\n    }\n\n    const creds = parse(params)\n    if (Object.keys(creds).length === 0) return this.fail(400 as any)\n    if (!creds.username) return this.fail(this.challenge(), 401)\n\n    // Même check que digest.js : req.url doit matcher creds.uri\n    // (en Fastify, req.url inclut la querystring, ce qui est généralement OK)\n    if (req.url !== creds.uri) return this.fail(400 as any)\n\n    const verified: DigestVerifyCallback = (err, result) => {\n      if (err) return this.error(err)\n      if (!result || !result.user) return this.fail(this.challenge(), 401)\n\n      const { user, secret } = result as DigestVerifyResult\n      if (!secret) return this.fail(400 as any)\n\n      // compute HA1\n      let ha1: string\n      const algo = creds.algorithm || 'MD5'\n      if (algo === 'MD5') {\n        if (typeof secret === 'object' && (secret as any).ha1) {\n          ha1 = (secret as any).ha1\n        } else {\n          // password en clair (peu probable)\n          ha1 = md5(`${creds.username}:${creds.realm}:${String(secret)}`)\n        }\n      } else if (algo === 'MD5-sess') {\n        // idem digest.js (note: nonce/cnonce init non gérés)\n        const base =\n          typeof secret === 'object' && (secret as any).ha1 ? (secret as any).ha1 : md5(`${creds.username}:${creds.realm}:${String(secret)}`)\n        ha1 = md5(`${base}:${creds.nonce}:${creds.cnonce}`)\n      } else {\n        return this.fail(400 as any)\n      }\n\n      // compute HA2\n      let ha2: string\n      if (!creds.qop || creds.qop === 'auth') {\n        ha2 = md5(`${req.method}:${creds.uri}`)\n      } else if (creds.qop === 'auth-int') {\n        return this.error(new Error('auth-int not implemented'))\n      } else {\n        return this.fail(400 as any)\n      }\n\n      // compute expected digest\n      let digest: string\n      if (!creds.qop) {\n        digest = md5(`${ha1}:${creds.nonce}:${ha2}`)\n      } else if (creds.qop === 'auth' || creds.qop === 'auth-int') {\n        digest = md5(`${ha1}:${creds.nonce}:${creds.nc}:${creds.cnonce}:${creds.qop}:${ha2}`)\n      } else {\n        return this.fail(400 as any)\n      }\n\n      if (creds.response !== digest) {\n        return this.fail(this.challenge(), 401)\n      }\n\n      if (this.validateCb) {\n        return this.validateCb({ nonce: creds.nonce, cnonce: creds.cnonce, nc: creds.nc, opaque: creds.opaque }, (e, ok) => {\n          if (e) return this.error(e)\n          if (!ok) return this.fail(this.challenge(), 401)\n          return this.success(user)\n        })\n      }\n\n      return this.success(user)\n    }\n\n    if (this.passReqToCallback) {\n      ;(this.verify as DigestVerifyFunctionWithRequest)(req, creds.username, verified)\n    } else {\n      ;(this.verify as DigestVerifyFunction)(creds.username, verified)\n    }\n  }\n\n  private challenge(): string {\n    let challenge = `Digest realm=\"${this.realm}\"`\n    if (this.domain) challenge += `, domain=\"${this.domain.join(' ')}\"`\n    challenge += `, nonce=\"${nonce(32)}\"`\n    if (this.opaque) challenge += `, opaque=\"${this.opaque}\"`\n    if (this.algorithm) challenge += `, algorithm=${this.algorithm}`\n    if (this.qop) challenge += `, qop=\"${this.qop.join(',')}\"`\n    return challenge\n  }\n}\n"],"names":["HttpDigestStrategy","md5","str","encoding","crypto","createHash","update","digest","nonce","len","buf","chars","charlen","length","i","push","Math","random","join","parse","params","opts","tokens","split","token","m","exec","PassportStrategy","authenticate","req","authorization","headers","fail","challenge","parts","scheme","slice","test","creds","Object","keys","username","url","uri","verified","err","result","error","user","secret","ha1","algo","algorithm","realm","String","base","cnonce","ha2","qop","method","Error","nc","response","validateCb","opaque","e","ok","success","passReqToCallback","verify","domain","options","name","Array","isArray","undefined","validate"],"mappings":";;;;+BAsEaA;;;eAAAA;;;mEAtEM;kCAC0B;;;;;;AA4C7C,SAASC,IAAIC,GAAW,EAAEC,WAAwC,KAAK;IACrE,OAAOC,mBAAM,CAACC,UAAU,CAAC,OAAOC,MAAM,CAACJ,KAAKK,MAAM,CAACJ;AACrD;AAEA,SAASK,MAAMC,GAAW;IACxB,MAAMC,MAAgB,EAAE;IACxB,MAAMC,QAAQ;IACd,MAAMC,UAAUD,MAAME,MAAM;IAC5B,IAAK,IAAIC,IAAI,GAAGA,IAAIL,KAAK,EAAEK,EAAG;QAC5BJ,IAAIK,IAAI,CAACJ,KAAK,CAAC,AAACK,KAAKC,MAAM,KAAKL,UAAW,EAAE;IAC/C;IACA,OAAOF,IAAIQ,IAAI,CAAC;AAClB;AAEA,gCAAgC;AAChC,SAASC,MAAMC,MAAc;IAC3B,MAAMC,OAA+B,CAAC;IACtC,MAAMC,SAASF,OAAOG,KAAK,CAAC;IAC5B,KAAK,MAAMC,SAASF,OAAQ;QAC1B,MAAMG,IAAI,yBAAyBC,IAAI,CAACF;QACxC,IAAIC,GAAGJ,IAAI,CAACI,CAAC,CAAC,EAAE,CAAC,GAAGA,CAAC,CAAC,EAAE;IAC1B;IACA,OAAOJ;AACT;AAEO,IAAA,AAAMrB,qBAAN,MAAMA,2BAA2B2B,0BAAgB;IAmCtDC,aAAaC,GAAQ,EAAQ;QAC3B,MAAMC,gBAAoCD,KAAKE,SAASD;QACxD,IAAI,CAACA,eAAe;YAClB,OAAO,IAAI,CAACE,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMC,QAAQJ,cAAcP,KAAK,CAAC;QAClC,IAAIW,MAAMrB,MAAM,GAAG,GAAG,OAAO,IAAI,CAACmB,IAAI,CAAC;QAEvC,MAAMG,SAASD,KAAK,CAAC,EAAE;QACvB,MAAMd,SAASc,MAAME,KAAK,CAAC,GAAGlB,IAAI,CAAC;QACnC,IAAI,CAAC,UAAUmB,IAAI,CAACF,SAAS;YAC3B,OAAO,IAAI,CAACH,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QACrC;QAEA,MAAMK,QAAQnB,MAAMC;QACpB,IAAImB,OAAOC,IAAI,CAACF,OAAOzB,MAAM,KAAK,GAAG,OAAO,IAAI,CAACmB,IAAI,CAAC;QACtD,IAAI,CAACM,MAAMG,QAAQ,EAAE,OAAO,IAAI,CAACT,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;QAExD,4DAA4D;QAC5D,0EAA0E;QAC1E,IAAIJ,IAAIa,GAAG,KAAKJ,MAAMK,GAAG,EAAE,OAAO,IAAI,CAACX,IAAI,CAAC;QAE5C,MAAMY,WAAiC,CAACC,KAAKC;YAC3C,IAAID,KAAK,OAAO,IAAI,CAACE,KAAK,CAACF;YAC3B,IAAI,CAACC,UAAU,CAACA,OAAOE,IAAI,EAAE,OAAO,IAAI,CAAChB,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YAEhE,MAAM,EAAEe,IAAI,EAAEC,MAAM,EAAE,GAAGH;YACzB,IAAI,CAACG,QAAQ,OAAO,IAAI,CAACjB,IAAI,CAAC;YAE9B,cAAc;YACd,IAAIkB;YACJ,MAAMC,OAAOb,MAAMc,SAAS,IAAI;YAChC,IAAID,SAAS,OAAO;gBAClB,IAAI,OAAOF,WAAW,YAAY,AAACA,OAAeC,GAAG,EAAE;oBACrDA,MAAM,AAACD,OAAeC,GAAG;gBAC3B,OAAO;oBACL,mCAAmC;oBACnCA,MAAMjD,IAAI,GAAGqC,MAAMG,QAAQ,CAAC,CAAC,EAAEH,MAAMe,KAAK,CAAC,CAAC,EAAEC,OAAOL,SAAS;gBAChE;YACF,OAAO,IAAIE,SAAS,YAAY;gBAC9B,qDAAqD;gBACrD,MAAMI,OACJ,OAAON,WAAW,YAAY,AAACA,OAAeC,GAAG,GAAG,AAACD,OAAeC,GAAG,GAAGjD,IAAI,GAAGqC,MAAMG,QAAQ,CAAC,CAAC,EAAEH,MAAMe,KAAK,CAAC,CAAC,EAAEC,OAAOL,SAAS;gBACpIC,MAAMjD,IAAI,GAAGsD,KAAK,CAAC,EAAEjB,MAAM9B,KAAK,CAAC,CAAC,EAAE8B,MAAMkB,MAAM,EAAE;YACpD,OAAO;gBACL,OAAO,IAAI,CAACxB,IAAI,CAAC;YACnB;YAEA,cAAc;YACd,IAAIyB;YACJ,IAAI,CAACnB,MAAMoB,GAAG,IAAIpB,MAAMoB,GAAG,KAAK,QAAQ;gBACtCD,MAAMxD,IAAI,GAAG4B,IAAI8B,MAAM,CAAC,CAAC,EAAErB,MAAMK,GAAG,EAAE;YACxC,OAAO,IAAIL,MAAMoB,GAAG,KAAK,YAAY;gBACnC,OAAO,IAAI,CAACX,KAAK,CAAC,IAAIa,MAAM;YAC9B,OAAO;gBACL,OAAO,IAAI,CAAC5B,IAAI,CAAC;YACnB;YAEA,0BAA0B;YAC1B,IAAIzB;YACJ,IAAI,CAAC+B,MAAMoB,GAAG,EAAE;gBACdnD,SAASN,IAAI,GAAGiD,IAAI,CAAC,EAAEZ,MAAM9B,KAAK,CAAC,CAAC,EAAEiD,KAAK;YAC7C,OAAO,IAAInB,MAAMoB,GAAG,KAAK,UAAUpB,MAAMoB,GAAG,KAAK,YAAY;gBAC3DnD,SAASN,IAAI,GAAGiD,IAAI,CAAC,EAAEZ,MAAM9B,KAAK,CAAC,CAAC,EAAE8B,MAAMuB,EAAE,CAAC,CAAC,EAAEvB,MAAMkB,MAAM,CAAC,CAAC,EAAElB,MAAMoB,GAAG,CAAC,CAAC,EAAED,KAAK;YACtF,OAAO;gBACL,OAAO,IAAI,CAACzB,IAAI,CAAC;YACnB;YAEA,IAAIM,MAAMwB,QAAQ,KAAKvD,QAAQ;gBAC7B,OAAO,IAAI,CAACyB,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;YACrC;YAEA,IAAI,IAAI,CAAC8B,UAAU,EAAE;gBACnB,OAAO,IAAI,CAACA,UAAU,CAAC;oBAAEvD,OAAO8B,MAAM9B,KAAK;oBAAEgD,QAAQlB,MAAMkB,MAAM;oBAAEK,IAAIvB,MAAMuB,EAAE;oBAAEG,QAAQ1B,MAAM0B,MAAM;gBAAC,GAAG,CAACC,GAAGC;oBAC3G,IAAID,GAAG,OAAO,IAAI,CAAClB,KAAK,CAACkB;oBACzB,IAAI,CAACC,IAAI,OAAO,IAAI,CAAClC,IAAI,CAAC,IAAI,CAACC,SAAS,IAAI;oBAC5C,OAAO,IAAI,CAACkC,OAAO,CAACnB;gBACtB;YACF;YAEA,OAAO,IAAI,CAACmB,OAAO,CAACnB;QACtB;QAEA,IAAI,IAAI,CAACoB,iBAAiB,EAAE;;YACxB,IAAI,CAACC,MAAM,CAAqCxC,KAAKS,MAAMG,QAAQ,EAAEG;QACzE,OAAO;;YACH,IAAI,CAACyB,MAAM,CAA0B/B,MAAMG,QAAQ,EAAEG;QACzD;IACF;IAEQX,YAAoB;QAC1B,IAAIA,YAAY,CAAC,cAAc,EAAE,IAAI,CAACoB,KAAK,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAACiB,MAAM,EAAErC,aAAa,CAAC,UAAU,EAAE,IAAI,CAACqC,MAAM,CAACpD,IAAI,CAAC,KAAK,CAAC,CAAC;QACnEe,aAAa,CAAC,SAAS,EAAEzB,MAAM,IAAI,CAAC,CAAC;QACrC,IAAI,IAAI,CAACwD,MAAM,EAAE/B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC+B,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAACZ,SAAS,EAAEnB,aAAa,CAAC,YAAY,EAAE,IAAI,CAACmB,SAAS,EAAE;QAChE,IAAI,IAAI,CAACM,GAAG,EAAEzB,aAAa,CAAC,OAAO,EAAE,IAAI,CAACyB,GAAG,CAACxC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAOe;IACT;IAtHA,YACEsC,UAA6E,CAAC,CAAC,EAC/EF,MAA+D,CAC/D;QACA,KAAK,SAnBPG,OAAO;QAoBL,IAAI,CAACH,QAAQ,MAAM,IAAIT,MAAM;QAE7B,IAAI,CAACS,MAAM,GAAGA;QACd,IAAI,CAAChB,KAAK,GAAGkB,QAAQlB,KAAK,IAAI;QAE9B,IAAIkB,QAAQD,MAAM,EAAE,IAAI,CAACA,MAAM,GAAGG,MAAMC,OAAO,CAACH,QAAQD,MAAM,IAAIC,QAAQD,MAAM,GAAG;YAACC,QAAQD,MAAM;SAAC;QACnG,IAAI,CAACN,MAAM,GAAGO,QAAQP,MAAM;QAC5B,IAAI,CAACZ,SAAS,GAAGmB,QAAQnB,SAAS;QAClC,IAAI,CAACM,GAAG,GAAGa,QAAQb,GAAG,GAAIe,MAAMC,OAAO,CAACH,QAAQb,GAAG,IAAIa,QAAQb,GAAG,GAAG;YAACa,QAAQb,GAAG;SAAC,GAAIiB;QAEtF,IAAI,CAACZ,UAAU,GAAGQ,QAAQK,QAAQ;QAClC,IAAI,CAACR,iBAAiB,GAAG,AAACG,QAA6CH,iBAAiB,KAAK;IAC/F;AAsGF"}

package/server/authentication/interfaces/auth-request.interface.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/interfaces/auth-request.interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/interfaces/auth-request.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { FastifyRequest } from 'fastify'\nimport { UserModel } from '../../applications/users/models/user.model'\n\nexport interface FastifyAuthenticatedRequest extends FastifyRequest {\n  user: UserModel\n}\n"],"names":[],"mappings":"AAAA;;;;CAIC"}
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/auth-request.interface.ts"],"names":[],"mappings":""}

package/server/authentication/interfaces/jwt-payload.interface.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/interfaces/jwt-payload.interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/interfaces/jwt-payload.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport class JwtIdentityPayload {\n  id: number\n  login: string\n  email: string\n  fullName: string\n  language: string\n  role: number\n  applications: string[]\n  impersonatedFromId?: number\n  impersonatedClientId?: string\n  clientId?: string\n  twoFaEnabled?: boolean\n}\n\nexport class JwtIdentity2FaPayload {\n  id: number\n  login: string\n  language: string\n  role: number\n  twoFaEnabled: true\n}\n\nexport class JwtPayload {\n  identity: JwtIdentityPayload\n  csrf?: string\n  iat?: number\n  exp: number\n}\n"],"names":["JwtIdentity2FaPayload","JwtIdentityPayload","JwtPayload"],"mappings":"AAAA;;;;CAIC;;;;;;;;;;;QAgBYA;eAAAA;;QAdAC;eAAAA;;QAsBAC;eAAAA;;;AAtBN,IAAA,AAAMD,qBAAN,MAAMA;AAYb;AAEO,IAAA,AAAMD,wBAAN,MAAMA;AAMb;AAEO,IAAA,AAAME,aAAN,MAAMA;AAKb"}
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/jwt-payload.interface.ts"],"sourcesContent":["export class JwtIdentityPayload {\n  id: number\n  login: string\n  email: string\n  fullName: string\n  language: string\n  role: number\n  applications: string[]\n  impersonatedFromId?: number\n  impersonatedClientId?: string\n  clientId?: string\n  twoFaEnabled?: boolean\n}\n\nexport class JwtIdentity2FaPayload {\n  id: number\n  login: string\n  language: string\n  role: number\n  twoFaEnabled: true\n}\n\nexport class JwtPayload {\n  identity: JwtIdentityPayload\n  csrf?: string\n  iat?: number\n  exp: number\n}\n"],"names":["JwtIdentity2FaPayload","JwtIdentityPayload","JwtPayload"],"mappings":";;;;;;;;;;;QAcaA;eAAAA;;QAdAC;eAAAA;;QAsBAC;eAAAA;;;AAtBN,IAAA,AAAMD,qBAAN,MAAMA;AAYb;AAEO,IAAA,AAAMD,wBAAN,MAAMA;AAMb;AAEO,IAAA,AAAME,aAAN,MAAMA;AAKb"}

package/server/authentication/interfaces/token.interface.js

@@ -1,8 +1,4 @@
-/*
- * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
- * This file is part of Sync-in | The open source file sync and share solution
- * See the LICENSE file for licensing details
- */ "use strict";
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });

package/server/authentication/interfaces/token.interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/interfaces/token.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport enum TOKEN_TYPE {\n  ACCESS = 'access',\n  ACCESS_2FA = 'access_2fa',\n  REFRESH = 'refresh',\n  WS = 'ws',\n  CSRF = 'csrf',\n  CSRF_2FA = 'csrf_2fa'\n}\n"],"names":["TOKEN_TYPE"],"mappings":"AAAA;;;;CAIC;;;;+BAEWA;;;eAAAA;;;AAAL,IAAA,AAAKA,oCAAAA;;;;;;;WAAAA"}
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/token.interface.ts"],"sourcesContent":["export enum TOKEN_TYPE {\n  ACCESS = 'access',\n  ACCESS_2FA = 'access_2fa',\n  REFRESH = 'refresh',\n  WS = 'ws',\n  CSRF = 'csrf',\n  CSRF_2FA = 'csrf_2fa'\n}\n"],"names":["TOKEN_TYPE"],"mappings":";;;;+BAAYA;;;eAAAA;;;AAAL,IAAA,AAAKA,oCAAAA;;;;;;;WAAAA"}

package/server/authentication/providers/auth-providers.constants.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AUTH_PROVIDER", {
+    enumerable: true,
+    get: function() {
+        return AUTH_PROVIDER;
+    }
+});
+var AUTH_PROVIDER = /*#__PURE__*/ function(AUTH_PROVIDER) {
+    AUTH_PROVIDER["MYSQL"] = "mysql";
+    AUTH_PROVIDER["LDAP"] = "ldap";
+    AUTH_PROVIDER["OIDC"] = "oidc";
+    return AUTH_PROVIDER;
+}({});
+
+//# sourceMappingURL=auth-providers.constants.js.map

package/server/authentication/providers/auth-providers.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/providers/auth-providers.constants.ts"],"sourcesContent":["export enum AUTH_PROVIDER {\n  MYSQL = 'mysql',\n  LDAP = 'ldap',\n  OIDC = 'oidc'\n}\n"],"names":["AUTH_PROVIDER"],"mappings":";;;;+BAAYA;;;eAAAA;;;AAAL,IAAA,AAAKA,uCAAAA;;;;WAAAA"}

package/server/authentication/providers/auth-providers.models.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthProvider", {
+    enumerable: true,
+    get: function() {
+        return AuthProvider;
+    }
+});
+let AuthProvider = class AuthProvider {
+};
+
+//# sourceMappingURL=auth-providers.models.js.map

package/server/authentication/providers/auth-providers.models.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/providers/auth-providers.models.ts"],"sourcesContent":["import type { UserModel } from '../../applications/users/models/user.model'\nimport type { AUTH_SCOPE } from '../constants/scope'\n\nexport abstract class AuthProvider {\n  abstract validateUser(loginOrEmail: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel>\n}\n"],"names":["AuthProvider"],"mappings":";;;;+BAGsBA;;;eAAAA;;;AAAf,IAAA,AAAeA,eAAf,MAAeA;AAEtB"}

package/server/authentication/providers/auth-providers.utils.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "selectAuthProvider", {
+    enumerable: true,
+    get: function() {
+        return selectAuthProvider;
+    }
+});
+const _authprovidersconstants = require("./auth-providers.constants");
+const _authprovidersmodels = require("./auth-providers.models");
+const _authproviderldapservice = require("./ldap/auth-provider-ldap.service");
+const _authprovidermysqlservice = require("./mysql/auth-provider-mysql.service");
+const _authprovideroidcservice = require("./oidc/auth-provider-oidc.service");
+function selectAuthProvider(provider) {
+    switch(provider){
+        case _authprovidersconstants.AUTH_PROVIDER.OIDC:
+            // `AuthProviderOIDC` is already provided by `AuthProviderOIDCModule`
+            return {
+                provide: _authprovidersmodels.AuthProvider,
+                useExisting: _authprovideroidcservice.AuthProviderOIDC
+            };
+        case _authprovidersconstants.AUTH_PROVIDER.LDAP:
+            return {
+                provide: _authprovidersmodels.AuthProvider,
+                useClass: _authproviderldapservice.AuthProviderLDAP
+            };
+        case _authprovidersconstants.AUTH_PROVIDER.MYSQL:
+            return {
+                provide: _authprovidersmodels.AuthProvider,
+                useClass: _authprovidermysqlservice.AuthProviderMySQL
+            };
+        default:
+            return {
+                provide: _authprovidersmodels.AuthProvider,
+                useClass: _authprovidermysqlservice.AuthProviderMySQL
+            };
+    }
+}
+
+//# sourceMappingURL=auth-providers.utils.js.map

package/server/authentication/providers/auth-providers.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/providers/auth-providers.utils.ts"],"sourcesContent":["import { Provider } from '@nestjs/common'\nimport { AUTH_PROVIDER } from './auth-providers.constants'\n\nimport { AuthProvider } from './auth-providers.models'\nimport { AuthProviderLDAP } from './ldap/auth-provider-ldap.service'\nimport { AuthProviderMySQL } from './mysql/auth-provider-mysql.service'\nimport { AuthProviderOIDC } from './oidc/auth-provider-oidc.service'\n\nexport function selectAuthProvider(provider: AUTH_PROVIDER): Provider {\n  switch (provider) {\n    case AUTH_PROVIDER.OIDC:\n      // `AuthProviderOIDC` is already provided by `AuthProviderOIDCModule`\n      return { provide: AuthProvider, useExisting: AuthProviderOIDC }\n\n    case AUTH_PROVIDER.LDAP:\n      return { provide: AuthProvider, useClass: AuthProviderLDAP }\n\n    case AUTH_PROVIDER.MYSQL:\n      return { provide: AuthProvider, useClass: AuthProviderMySQL }\n\n    default:\n      return { provide: AuthProvider, useClass: AuthProviderMySQL }\n  }\n}\n"],"names":["selectAuthProvider","provider","AUTH_PROVIDER","OIDC","provide","AuthProvider","useExisting","AuthProviderOIDC","LDAP","useClass","AuthProviderLDAP","MYSQL","AuthProviderMySQL"],"mappings":";;;;+BAQgBA;;;eAAAA;;;wCAPc;qCAED;yCACI;0CACC;yCACD;AAE1B,SAASA,mBAAmBC,QAAuB;IACxD,OAAQA;QACN,KAAKC,qCAAa,CAACC,IAAI;YACrB,qEAAqE;YACrE,OAAO;gBAAEC,SAASC,iCAAY;gBAAEC,aAAaC,yCAAgB;YAAC;QAEhE,KAAKL,qCAAa,CAACM,IAAI;YACrB,OAAO;gBAAEJ,SAASC,iCAAY;gBAAEI,UAAUC,yCAAgB;YAAC;QAE7D,KAAKR,qCAAa,CAACS,KAAK;YACtB,OAAO;gBAAEP,SAASC,iCAAY;gBAAEI,UAAUG,2CAAiB;YAAC;QAE9D;YACE,OAAO;gBAAER,SAASC,iCAAY;gBAAEI,UAAUG,2CAAiB;YAAC;IAChE;AACF"}