@sync-in/server 1.3.0

package/server/authentication/guards/auth-digest.strategy.js

@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ // import { Injectable } from '@nestjs/common'
+// import { PassportStrategy } from '@nestjs/passport'
+// import { PinoLogger } from 'nestjs-pino'
+// import { DigestStrategy, DigestStrategyOptions } from 'passport-http'
+// import { SERVER_NAME } from '../../app.constants'
+// import { AuthManager } from '../services/auth-manager.service'
+//
+// @Injectable()
+// export class AuthDigestStrategy extends PassportStrategy(DigestStrategy, 'digest') {
+//   constructor(
+//     private authManager: AuthManager,
+//     private readonly logger: PinoLogger
+//   ) {
+//     super({ realm: SERVER_NAME } satisfies DigestStrategyOptions)
+//   }
+//
+//   validate(loginOrEmail: string) {
+//     // return [loginOrEmail, { ha1: '4befe40c6af915eca11de84be07a1f21' }]
+//     return [loginOrEmail, 'password']
+//   }
+// }
+"use strict";
+
+//# sourceMappingURL=auth-digest.strategy.js.map

package/server/authentication/guards/auth-digest.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-digest.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\n// import { Injectable } from '@nestjs/common'\n// import { PassportStrategy } from '@nestjs/passport'\n// import { PinoLogger } from 'nestjs-pino'\n// import { DigestStrategy, DigestStrategyOptions } from 'passport-http'\n// import { SERVER_NAME } from '../../app.constants'\n// import { AuthManager } from '../services/auth-manager.service'\n//\n// @Injectable()\n// export class AuthDigestStrategy extends PassportStrategy(DigestStrategy, 'digest') {\n//   constructor(\n//     private authManager: AuthManager,\n//     private readonly logger: PinoLogger\n//   ) {\n//     super({ realm: SERVER_NAME } satisfies DigestStrategyOptions)\n//   }\n//\n//   validate(loginOrEmail: string) {\n//     // return [loginOrEmail, { ha1: '4befe40c6af915eca11de84be07a1f21' }]\n//     return [loginOrEmail, 'password']\n//   }\n// }\n"],"names":[],"mappings":"AAAA;;;;CAIC,GAED,8CAA8C;AAC9C,sDAAsD;AACtD,2CAA2C;AAC3C,wEAAwE;AACxE,oDAAoD;AACpD,iEAAiE;AACjE,EAAE;AACF,gBAAgB;AAChB,uFAAuF;AACvF,iBAAiB;AACjB,wCAAwC;AACxC,0CAA0C;AAC1C,QAAQ;AACR,oEAAoE;AACpE,MAAM;AACN,EAAE;AACF,qCAAqC;AACrC,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM;AACN,IAAI"}

package/server/authentication/guards/auth-local.guard.js

@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthLocalGuard", {
+    enumerable: true,
+    get: function() {
+        return AuthLocalGuard;
+    }
+});
+const _common = require("@nestjs/common");
+const _passport = require("@nestjs/passport");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+let AuthLocalGuard = class AuthLocalGuard extends (0, _passport.AuthGuard)('local') {
+    handleRequest(err, user, info, ctx, status) {
+        const req = this.getRequest(ctx);
+        req.raw.user = user?.login || 'unauthorized';
+        if (info) {
+            this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`);
+        }
+        return super.handleRequest(err, user, info, ctx, status);
+    }
+    constructor(...args){
+        super(...args), this.logger = new _common.Logger(AuthLocalGuard.name);
+    }
+};
+AuthLocalGuard = _ts_decorate([
+    (0, _common.Injectable)()
+], AuthLocalGuard);
+
+//# sourceMappingURL=auth-local.guard.js.map

package/server/authentication/guards/auth-local.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-local.guard.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { ExecutionContext, Injectable, Logger } from '@nestjs/common'\nimport { AuthGuard } from '@nestjs/passport'\nimport { IAuthGuard } from '@nestjs/passport/dist/auth.guard'\n\n@Injectable()\nexport class AuthLocalGuard extends AuthGuard('local') implements IAuthGuard {\n  private readonly logger = new Logger(AuthLocalGuard.name)\n\n  handleRequest<TUser = any>(err: any, user: any, info: Error, ctx: ExecutionContext, status?: any): TUser {\n    const req = this.getRequest(ctx)\n    req.raw.user = user?.login || 'unauthorized'\n    if (info) {\n      this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`)\n    }\n    return super.handleRequest(err, user, info, ctx, status)\n  }\n}\n"],"names":["AuthLocalGuard","AuthGuard","handleRequest","err","user","info","ctx","status","req","getRequest","raw","login","logger","warn","ip","Logger","name"],"mappings":"AAAA;;;;CAIC;;;;+BAOYA;;;eAAAA;;;wBALwC;0BAC3B;;;;;;;AAInB,IAAA,AAAMA,iBAAN,MAAMA,uBAAuBC,IAAAA,mBAAS,EAAC;IAG5CC,cAA2BC,GAAQ,EAAEC,IAAS,EAAEC,IAAW,EAAEC,GAAqB,EAAEC,MAAY,EAAS;QACvG,MAAMC,MAAM,IAAI,CAACC,UAAU,CAACH;QAC5BE,IAAIE,GAAG,CAACN,IAAI,GAAGA,MAAMO,SAAS;QAC9B,IAAIN,MAAM;YACR,IAAI,CAACO,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC,EAAEL,IAAIE,GAAG,CAACN,IAAI,CAAC,GAAG,EAAEI,IAAIM,EAAE,CAAC,EAAE,EAAET,MAAM;QAC1D;QACA,OAAO,KAAK,CAACH,cAAcC,KAAKC,MAAMC,MAAMC,KAAKC;IACnD;;QAVK,qBACYK,SAAS,IAAIG,cAAM,CAACf,eAAegB,IAAI;;AAU1D"}

package/server/authentication/guards/auth-local.guard.spec.js

@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _tsjest = require("@golevelup/ts-jest");
+const _testing = require("@nestjs/testing");
+const _nestjspino = require("nestjs-pino");
+const _usermodel = require("../../applications/users/models/user.model");
+const _test = require("../../applications/users/utils/test");
+const _authmethod = require("../models/auth-method");
+const _authlocalguard = require("./auth-local.guard");
+const _authlocalstrategy = require("./auth-local.strategy");
+describe(_authlocalguard.AuthLocalGuard.name, ()=>{
+    let authLocalGuard;
+    let authMethod;
+    let userTest;
+    let context;
+    beforeAll(async ()=>{
+        const module = await _testing.Test.createTestingModule({
+            providers: [
+                _authlocalguard.AuthLocalGuard,
+                _authlocalstrategy.AuthLocalStrategy,
+                {
+                    provide: _authmethod.AuthMethod,
+                    useValue: {}
+                },
+                {
+                    provide: _nestjspino.PinoLogger,
+                    useValue: {
+                        assign: ()=>undefined
+                    }
+                }
+            ]
+        }).compile();
+        authLocalGuard = module.get(_authlocalguard.AuthLocalGuard);
+        authMethod = module.get(_authmethod.AuthMethod);
+        userTest = new _usermodel.UserModel((0, _test.generateUserTest)(), false);
+        context = (0, _tsjest.createMock)();
+    });
+    it('should be defined', ()=>{
+        expect(authLocalGuard).toBeDefined();
+        expect(authMethod).toBeDefined();
+        expect(userTest).toBeDefined();
+    });
+    it('should validate the user authentication', async ()=>{
+        authMethod.validateUser = jest.fn().mockReturnValue(userTest);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            body: {
+                login: userTest.login,
+                password: userTest.password
+            }
+        });
+        expect(await authLocalGuard.canActivate(context)).toBeDefined();
+    });
+    it('should not validate the user authentication', async ()=>{
+        authMethod.validateUser = jest.fn().mockReturnValue(null);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            body: {
+                login: userTest.login,
+                password: userTest.password
+            }
+        });
+        await expect(authLocalGuard.canActivate(context)).rejects.toThrow();
+    });
+    it('should throw error due to malformed body', async ()=>{
+        authMethod.validateUser = jest.fn().mockReturnValue(null);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            body: null
+        });
+        await expect(authLocalGuard.canActivate(context)).rejects.toThrow();
+    });
+});
+
+//# sourceMappingURL=auth-local.guard.spec.js.map

package/server/authentication/guards/auth-local.guard.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-local.guard.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { generateUserTest } from '../../applications/users/utils/test'\nimport { AuthMethod } from '../models/auth-method'\nimport { AuthLocalGuard } from './auth-local.guard'\nimport { AuthLocalStrategy } from './auth-local.strategy'\n\ndescribe(AuthLocalGuard.name, () => {\n  let authLocalGuard: AuthLocalGuard\n  let authMethod: AuthMethod\n  let userTest: UserModel\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      providers: [\n        AuthLocalGuard,\n        AuthLocalStrategy,\n        { provide: AuthMethod, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authLocalGuard = module.get<AuthLocalGuard>(AuthLocalGuard)\n    authMethod = module.get<AuthMethod>(AuthMethod)\n    userTest = new UserModel(generateUserTest(), false)\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authLocalGuard).toBeDefined()\n    expect(authMethod).toBeDefined()\n    expect(userTest).toBeDefined()\n  })\n\n  it('should validate the user authentication', async () => {\n    authMethod.validateUser = jest.fn().mockReturnValue(userTest)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      body: {\n        login: userTest.login,\n        password: userTest.password\n      }\n    })\n    expect(await authLocalGuard.canActivate(context)).toBeDefined()\n  })\n\n  it('should not validate the user authentication', async () => {\n    authMethod.validateUser = jest.fn().mockReturnValue(null)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      body: {\n        login: userTest.login,\n        password: userTest.password\n      }\n    })\n    await expect(authLocalGuard.canActivate(context)).rejects.toThrow()\n  })\n\n  it('should throw error due to malformed body', async () => {\n    authMethod.validateUser = jest.fn().mockReturnValue(null)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      body: null\n    })\n    await expect(authLocalGuard.canActivate(context)).rejects.toThrow()\n  })\n})\n"],"names":["describe","AuthLocalGuard","name","authLocalGuard","authMethod","userTest","context","beforeAll","module","Test","createTestingModule","providers","AuthLocalStrategy","provide","AuthMethod","useValue","PinoLogger","assign","undefined","compile","get","UserModel","generateUserTest","createMock","it","expect","toBeDefined","validateUser","jest","fn","mockReturnValue","switchToHttp","getRequest","raw","user","body","login","password","canActivate","rejects","toThrow"],"mappings":"AAAA;;;;CAIC;;;;wBAEsC;yBAEH;4BACT;2BACD;sBACO;4BACN;gCACI;mCACG;AAElCA,SAASC,8BAAc,CAACC,IAAI,EAAE;IAC5B,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,WAAW;gBACTV,8BAAc;gBACdW,oCAAiB;gBACjB;oBAAEC,SAASC,sBAAU;oBAAEC,UAAU,CAAC;gBAAE;gBACpC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEVhB,iBAAiBK,OAAOY,GAAG,CAAiBnB,8BAAc;QAC1DG,aAAaI,OAAOY,GAAG,CAAaN,sBAAU;QAC9CT,WAAW,IAAIgB,oBAAS,CAACC,IAAAA,sBAAgB,KAAI;QAC7ChB,UAAUiB,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAOtB,gBAAgBuB,WAAW;QAClCD,OAAOrB,YAAYsB,WAAW;QAC9BD,OAAOpB,UAAUqB,WAAW;IAC9B;IAEAF,GAAG,2CAA2C;QAC5CpB,WAAWuB,YAAY,GAAGC,KAAKC,EAAE,GAAGC,eAAe,CAACzB;QACpDC,QAAQyB,YAAY,GAAGC,UAAU,CAACF,eAAe,CAAC;YAChDG,KAAK;gBAAEC,MAAM;YAAG;YAChBC,MAAM;gBACJC,OAAO/B,SAAS+B,KAAK;gBACrBC,UAAUhC,SAASgC,QAAQ;YAC7B;QACF;QACAZ,OAAO,MAAMtB,eAAemC,WAAW,CAAChC,UAAUoB,WAAW;IAC/D;IAEAF,GAAG,+CAA+C;QAChDpB,WAAWuB,YAAY,GAAGC,KAAKC,EAAE,GAAGC,eAAe,CAAC;QACpDxB,QAAQyB,YAAY,GAAGC,UAAU,CAACF,eAAe,CAAC;YAChDG,KAAK;gBAAEC,MAAM;YAAG;YAChBC,MAAM;gBACJC,OAAO/B,SAAS+B,KAAK;gBACrBC,UAAUhC,SAASgC,QAAQ;YAC7B;QACF;QACA,MAAMZ,OAAOtB,eAAemC,WAAW,CAAChC,UAAUiC,OAAO,CAACC,OAAO;IACnE;IAEAhB,GAAG,4CAA4C;QAC7CpB,WAAWuB,YAAY,GAAGC,KAAKC,EAAE,GAAGC,eAAe,CAAC;QACpDxB,QAAQyB,YAAY,GAAGC,UAAU,CAACF,eAAe,CAAC;YAChDG,KAAK;gBAAEC,MAAM;YAAG;YAChBC,MAAM;QACR;QACA,MAAMV,OAAOtB,eAAemC,WAAW,CAAChC,UAAUiC,OAAO,CAACC,OAAO;IACnE;AACF"}

package/server/authentication/guards/auth-local.strategy.js

@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthLocalStrategy", {
+    enumerable: true,
+    get: function() {
+        return AuthLocalStrategy;
+    }
+});
+const _common = require("@nestjs/common");
+const _passport = require("@nestjs/passport");
+const _nestjspino = require("nestjs-pino");
+const _passportlocal = require("passport-local");
+const _authmethod = require("../models/auth-method");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+let AuthLocalStrategy = class AuthLocalStrategy extends (0, _passport.PassportStrategy)(_passportlocal.Strategy, 'local') {
+    // not declared properly:  https://github.com/nestjs/passport/issues/929
+    async validate(req, loginOrEmail, password) {
+        this.logger.assign({
+            user: loginOrEmail
+        });
+        const user = await this.authMethod.validateUser(loginOrEmail, password, req.ip);
+        if (user) {
+            user.removePassword();
+            return user;
+        }
+        throw new _common.UnauthorizedException('Wrong login or password');
+    }
+    constructor(authMethod, logger){
+        super({
+            usernameField: 'login',
+            passwordField: 'password',
+            passReqToCallback: true
+        }), this.authMethod = authMethod, this.logger = logger;
+    }
+};
+AuthLocalStrategy = _ts_decorate([
+    (0, _common.Injectable)(),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authmethod.AuthMethod === "undefined" ? Object : _authmethod.AuthMethod,
+        typeof _nestjspino.PinoLogger === "undefined" ? Object : _nestjspino.PinoLogger
+    ])
+], AuthLocalStrategy);
+
+//# sourceMappingURL=auth-local.strategy.js.map

package/server/authentication/guards/auth-local.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-local.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable, UnauthorizedException } from '@nestjs/common'\nimport { PassportStrategy } from '@nestjs/passport'\nimport type { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { Strategy } from 'passport-local'\nimport type { UserModel } from '../../applications/users/models/user.model'\nimport { AuthMethod } from '../models/auth-method'\n\n@Injectable()\nexport class AuthLocalStrategy extends PassportStrategy(Strategy, 'local') implements Strategy {\n  constructor(\n    private readonly authMethod: AuthMethod,\n    private readonly logger: PinoLogger\n  ) {\n    super({ usernameField: 'login', passwordField: 'password', passReqToCallback: true })\n  }\n\n  // not declared properly:  https://github.com/nestjs/passport/issues/929\n  async validate(req: FastifyRequest, loginOrEmail: string, password: string): Promise<UserModel> {\n    this.logger.assign({ user: loginOrEmail })\n    const user: UserModel = await this.authMethod.validateUser(loginOrEmail, password, req.ip)\n    if (user) {\n      user.removePassword()\n      return user\n    }\n    throw new UnauthorizedException('Wrong login or password')\n  }\n}\n"],"names":["AuthLocalStrategy","PassportStrategy","Strategy","validate","req","loginOrEmail","password","logger","assign","user","authMethod","validateUser","ip","removePassword","UnauthorizedException","usernameField","passwordField","passReqToCallback"],"mappings":"AAAA;;;;CAIC;;;;+BAWYA;;;eAAAA;;;wBATqC;0BACjB;4BAEN;+BACF;4BAEE;;;;;;;;;;AAGpB,IAAA,AAAMA,oBAAN,MAAMA,0BAA0BC,IAAAA,0BAAgB,EAACC,uBAAQ,EAAE;IAQhE,wEAAwE;IACxE,MAAMC,SAASC,GAAmB,EAAEC,YAAoB,EAAEC,QAAgB,EAAsB;QAC9F,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMJ;QAAa;QACxC,MAAMI,OAAkB,MAAM,IAAI,CAACC,UAAU,CAACC,YAAY,CAACN,cAAcC,UAAUF,IAAIQ,EAAE;QACzF,IAAIH,MAAM;YACRA,KAAKI,cAAc;YACnB,OAAOJ;QACT;QACA,MAAM,IAAIK,6BAAqB,CAAC;IAClC;IAhBA,YACE,AAAiBJ,UAAsB,EACvC,AAAiBH,MAAkB,CACnC;QACA,KAAK,CAAC;YAAEQ,eAAe;YAASC,eAAe;YAAYC,mBAAmB;QAAK,SAHlEP,aAAAA,iBACAH,SAAAA;IAGnB;AAYF"}

package/server/authentication/guards/auth-token-access.guard.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthTokenAccessGuard", {
+    enumerable: true,
+    get: function() {
+        return AuthTokenAccessGuard;
+    }
+});
+const _common = require("@nestjs/common");
+const _core = require("@nestjs/core");
+const _passport = require("@nestjs/passport");
+const _onlyoffice = require("../../applications/files/constants/only-office");
+const _webdavcontextdecorator = require("../../applications/webdav/decorators/webdav-context.decorator");
+const _authtokenskipdecorator = require("../decorators/auth-token-skip.decorator");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+let AuthTokenAccessGuard = class AuthTokenAccessGuard extends (0, _passport.AuthGuard)('tokenAccess') {
+    canActivate(ctx) {
+        const authTokenSkip = this.reflector.getAllAndOverride(_authtokenskipdecorator.AUTH_TOKEN_SKIP, [
+            ctx.getHandler(),
+            ctx.getClass()
+        ]);
+        const webDAVContext = this.reflector.getAllAndOverride(_webdavcontextdecorator.WEB_DAV_CONTEXT, [
+            ctx.getHandler(),
+            ctx.getClass()
+        ]);
+        const onlyOfficeContext = this.reflector.getAllAndOverride(_onlyoffice.ONLY_OFFICE_CONTEXT, [
+            ctx.getHandler(),
+            ctx.getClass()
+        ]);
+        return authTokenSkip || webDAVContext || onlyOfficeContext || super.canActivate(ctx);
+    }
+    handleRequest(err, user, info, ctx, status) {
+        const req = this.getRequest(ctx);
+        req.raw.user = user?.login || 'unauthorized';
+        if (info) {
+            this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`);
+        }
+        return super.handleRequest(err, user, info, ctx, status);
+    }
+    constructor(reflector){
+        super(), this.reflector = reflector, this.logger = new _common.Logger(AuthTokenAccessGuard.name);
+    }
+};
+AuthTokenAccessGuard = _ts_decorate([
+    (0, _common.Injectable)(),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _core.Reflector === "undefined" ? Object : _core.Reflector
+    ])
+], AuthTokenAccessGuard);
+
+//# sourceMappingURL=auth-token-access.guard.js.map

package/server/authentication/guards/auth-token-access.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.guard.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { ExecutionContext, Injectable, Logger } from '@nestjs/common'\nimport { Reflector } from '@nestjs/core'\nimport { AuthGuard, IAuthGuard } from '@nestjs/passport'\nimport { ONLY_OFFICE_CONTEXT } from '../../applications/files/constants/only-office'\nimport { WEB_DAV_CONTEXT } from '../../applications/webdav/decorators/webdav-context.decorator'\nimport { AUTH_TOKEN_SKIP } from '../decorators/auth-token-skip.decorator'\n\n@Injectable()\nexport class AuthTokenAccessGuard extends AuthGuard('tokenAccess') implements IAuthGuard {\n  private readonly logger = new Logger(AuthTokenAccessGuard.name)\n\n  constructor(private readonly reflector: Reflector) {\n    super()\n  }\n\n  canActivate(ctx: ExecutionContext) {\n    const authTokenSkip: boolean = this.reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [ctx.getHandler(), ctx.getClass()])\n    const webDAVContext: boolean = this.reflector.getAllAndOverride<boolean>(WEB_DAV_CONTEXT, [ctx.getHandler(), ctx.getClass()])\n    const onlyOfficeContext: boolean = this.reflector.getAllAndOverride<boolean>(ONLY_OFFICE_CONTEXT, [ctx.getHandler(), ctx.getClass()])\n    return authTokenSkip || webDAVContext || onlyOfficeContext || super.canActivate(ctx)\n  }\n\n  handleRequest<TUser = any>(err: any, user: any, info: Error, ctx: ExecutionContext, status?: any): TUser {\n    const req = this.getRequest(ctx)\n    req.raw.user = user?.login || 'unauthorized'\n    if (info) {\n      this.logger.warn(`<${req.raw.user}> <${req.ip}> ${info}`)\n    }\n    return super.handleRequest(err, user, info, ctx, status)\n  }\n}\n"],"names":["AuthTokenAccessGuard","AuthGuard","canActivate","ctx","authTokenSkip","reflector","getAllAndOverride","AUTH_TOKEN_SKIP","getHandler","getClass","webDAVContext","WEB_DAV_CONTEXT","onlyOfficeContext","ONLY_OFFICE_CONTEXT","handleRequest","err","user","info","status","req","getRequest","raw","login","logger","warn","ip","Logger","name"],"mappings":"AAAA;;;;CAIC;;;;+BAUYA;;;eAAAA;;;wBARwC;sBAC3B;0BACY;4BACF;wCACJ;wCACA;;;;;;;;;;AAGzB,IAAA,AAAMA,uBAAN,MAAMA,6BAA6BC,IAAAA,mBAAS,EAAC;IAOlDC,YAAYC,GAAqB,EAAE;QACjC,MAAMC,gBAAyB,IAAI,CAACC,SAAS,CAACC,iBAAiB,CAAUC,uCAAe,EAAE;YAACJ,IAAIK,UAAU;YAAIL,IAAIM,QAAQ;SAAG;QAC5H,MAAMC,gBAAyB,IAAI,CAACL,SAAS,CAACC,iBAAiB,CAAUK,uCAAe,EAAE;YAACR,IAAIK,UAAU;YAAIL,IAAIM,QAAQ;SAAG;QAC5H,MAAMG,oBAA6B,IAAI,CAACP,SAAS,CAACC,iBAAiB,CAAUO,+BAAmB,EAAE;YAACV,IAAIK,UAAU;YAAIL,IAAIM,QAAQ;SAAG;QACpI,OAAOL,iBAAiBM,iBAAiBE,qBAAqB,KAAK,CAACV,YAAYC;IAClF;IAEAW,cAA2BC,GAAQ,EAAEC,IAAS,EAAEC,IAAW,EAAEd,GAAqB,EAAEe,MAAY,EAAS;QACvG,MAAMC,MAAM,IAAI,CAACC,UAAU,CAACjB;QAC5BgB,IAAIE,GAAG,CAACL,IAAI,GAAGA,MAAMM,SAAS;QAC9B,IAAIL,MAAM;YACR,IAAI,CAACM,MAAM,CAACC,IAAI,CAAC,CAAC,CAAC,EAAEL,IAAIE,GAAG,CAACL,IAAI,CAAC,GAAG,EAAEG,IAAIM,EAAE,CAAC,EAAE,EAAER,MAAM;QAC1D;QACA,OAAO,KAAK,CAACH,cAAcC,KAAKC,MAAMC,MAAMd,KAAKe;IACnD;IAlBA,YAAY,AAAiBb,SAAoB,CAAE;QACjD,KAAK,SADsBA,YAAAA,gBAFZkB,SAAS,IAAIG,cAAM,CAAC1B,qBAAqB2B,IAAI;IAI9D;AAiBF"}

package/server/authentication/guards/auth-token-access.guard.spec.js

@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _cookie = require("@fastify/cookie");
+const _tsjest = require("@golevelup/ts-jest");
+const _config = require("@nestjs/config");
+const _core = require("@nestjs/core");
+const _jwt = require("@nestjs/jwt");
+const _passport = require("@nestjs/passport");
+const _testing = require("@nestjs/testing");
+const _nestjspino = require("nestjs-pino");
+const _nodecrypto = /*#__PURE__*/ _interop_require_default(require("node:crypto"));
+const _usersmanagerservice = require("../../applications/users/services/users-manager.service");
+const _webdavcontextdecorator = require("../../applications/webdav/decorators/webdav-context.decorator");
+const _configenvironment = require("../../configuration/config.environment");
+const _auth = require("../constants/auth");
+const _authtokenoptionaldecorator = require("../decorators/auth-token-optional.decorator");
+const _authtokenskipdecorator = require("../decorators/auth-token-skip.decorator");
+const _tokeninterface = require("../interfaces/token.interface");
+const _authmanagerservice = require("../services/auth-manager.service");
+const _authanonymousguard = require("./auth-anonymous.guard");
+const _authanonymousstrategy = require("./auth-anonymous.strategy");
+const _authtokenaccessguard = require("./auth-token-access.guard");
+const _authtokenaccessstrategy = require("./auth-token-access.strategy");
+function _interop_require_default(obj) {
+    return obj && obj.__esModule ? obj : {
+        default: obj
+    };
+}
+describe(_authtokenaccessguard.AuthTokenAccessGuard.name, ()=>{
+    const csrfToken = _nodecrypto.default.randomUUID();
+    let authConfig;
+    let jwtService;
+    let authAccessGuard;
+    let authAnonymousGuard;
+    let authAnonymousStrategy;
+    let reflector;
+    let accessTokenWithoutCSRF;
+    let accessToken;
+    let context;
+    beforeAll(async ()=>{
+        const module = await _testing.Test.createTestingModule({
+            imports: [
+                await _config.ConfigModule.forRoot({
+                    load: [
+                        _configenvironment.exportConfiguration
+                    ],
+                    isGlobal: true
+                }),
+                _jwt.JwtModule.register({
+                    global: true
+                }),
+                _passport.PassportModule
+            ],
+            providers: [
+                _authtokenaccessstrategy.AuthTokenAccessStrategy,
+                _authanonymousstrategy.AuthAnonymousStrategy,
+                _authanonymousguard.AuthAnonymousGuard,
+                _authmanagerservice.AuthManager,
+                {
+                    provide: _usersmanagerservice.UsersManager,
+                    useValue: {}
+                },
+                {
+                    provide: _nestjspino.PinoLogger,
+                    useValue: {
+                        assign: ()=>undefined
+                    }
+                }
+            ]
+        }).compile();
+        authConfig = module.get(_config.ConfigService).get('auth');
+        jwtService = module.get(_jwt.JwtService);
+        reflector = new _core.Reflector();
+        authAccessGuard = new _authtokenaccessguard.AuthTokenAccessGuard(reflector);
+        authAnonymousStrategy = module.get(_authanonymousstrategy.AuthAnonymousStrategy);
+        authAnonymousGuard = module.get(_authanonymousguard.AuthAnonymousGuard);
+        accessToken = await jwtService.signAsync({
+            identity: {
+                id: 1,
+                login: 'foo'
+            },
+            [_tokeninterface.TOKEN_TYPE.CSRF]: csrfToken
+        }, {
+            secret: authConfig.token.access.secret,
+            expiresIn: 30
+        });
+        accessTokenWithoutCSRF = await jwtService.signAsync({
+            identity: {
+                id: 1,
+                login: 'foo'
+            }
+        }, {
+            secret: authConfig.token.access.secret,
+            expiresIn: 30
+        });
+        context = (0, _tsjest.createMock)();
+    });
+    it('should be defined', ()=>{
+        expect(authConfig).toBeDefined();
+        expect(jwtService).toBeDefined();
+        expect(authAccessGuard).toBeDefined();
+        expect(authAnonymousGuard).toBeDefined();
+        expect(authAnonymousStrategy).toBeDefined();
+        expect(accessToken).toBeDefined();
+        expect(accessTokenWithoutCSRF).toBeDefined();
+        expect(csrfToken).toBeDefined();
+    });
+    it('should pass with a valid access token in cookies with CSRF', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                [authConfig.token.csrf.name]: (0, _cookie.sign)(csrfToken, authConfig.token.csrf.secret)
+            },
+            cookies: {
+                [authConfig.token.access.name]: accessToken
+            }
+        });
+        expect(await authAccessGuard.canActivate(context)).toBe(true);
+    });
+    it('should pass with a valid access token in request header with no CSRF', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                authorization: `Bearer ${accessToken}`
+            }
+        });
+        expect(await authAccessGuard.canActivate(context)).toBe(true);
+    });
+    it('should throw an error with an invalid access token in cookies', async ()=>{
+        // Cookies test
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {},
+            cookies: {
+                [authConfig.token.access.name]: 'bar'
+            }
+        });
+        await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized');
+    });
+    it('should throw an error with an invalid access token in request header', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                authorization: `Bearer bar`
+            }
+        });
+        await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized');
+    });
+    it('should throw an error with a valid access token in cookies and a missing CSRF in request header', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {},
+            cookies: {
+                [authConfig.token.access.name]: accessToken
+            }
+        });
+        await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(_auth.CSRF_ERROR.MISSING_HEADERS));
+    });
+    it('should throw an error with a valid access token in cookies and a missing CSRF claim in the access token', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                [authConfig.token.csrf.name]: csrfToken
+            },
+            cookies: {
+                [authConfig.token.access.name]: accessTokenWithoutCSRF
+            }
+        });
+        await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(_auth.CSRF_ERROR.MISSING_JWT));
+    });
+    it('should throw an error with a valid access token in cookies and a mismatch CSRF', async ()=>{
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                [authConfig.token.csrf.name]: csrfToken + '*'
+            },
+            cookies: {
+                [authConfig.token.access.name]: accessToken
+            }
+        });
+        await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(_auth.CSRF_ERROR.MISMATCH));
+    });
+    it('should bypass access token when AuthTokenSkip decorator is applied to context', ()=>{
+        context = (0, _tsjest.createMock)();
+        (0, _authtokenskipdecorator.AuthTokenSkip)()(context.getHandler());
+        expect(reflector.getAllAndOverride(_authtokenskipdecorator.AUTH_TOKEN_SKIP, [
+            context.getHandler(),
+            context.getClass()
+        ])).toBe(true);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                authorization: `Bearer bar`
+            }
+        });
+        expect(authAccessGuard.canActivate(context)).toBe(true);
+    });
+    it('should bypass access token with WebDAVContext decorator is applied to context', ()=>{
+        context = (0, _tsjest.createMock)();
+        (0, _webdavcontextdecorator.WebDAVContext)()(context.getHandler());
+        expect(reflector.getAllAndOverride(_authtokenskipdecorator.AUTH_TOKEN_SKIP, [
+            context.getHandler(),
+            context.getClass()
+        ])).toBe(undefined);
+        expect(reflector.getAllAndOverride(_webdavcontextdecorator.WEB_DAV_CONTEXT, [
+            context.getHandler(),
+            context.getClass()
+        ])).toBe(true);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            headers: {
+                authorization: `Bearer bar`
+            }
+        });
+        expect(authAccessGuard.canActivate(context)).toBe(true);
+    });
+    it('should pass without a valid access token when AuthTokenOptional is applied to context', async ()=>{
+        const spyAuthenticate = jest.spyOn(authAnonymousStrategy, 'authenticate');
+        context = (0, _tsjest.createMock)();
+        (0, _authtokenoptionaldecorator.AuthTokenOptional)()(context.getHandler());
+        expect(reflector.getAllAndOverride(_authtokenskipdecorator.AUTH_TOKEN_SKIP, [
+            context.getHandler(),
+            context.getClass()
+        ])).toBe(true);
+        context.switchToHttp().getRequest.mockReturnValue({
+            raw: {
+                user: ''
+            },
+            authorization: `Bearer bar`
+        });
+        expect(authAccessGuard.canActivate(context)).toBe(true);
+        expect(await authAnonymousGuard.canActivate(context)).toBe(true);
+        expect(spyAuthenticate).toHaveBeenCalledTimes(1);
+        spyAuthenticate.mockClear();
+    });
+});
+
+//# sourceMappingURL=auth-token-access.guard.spec.js.map

package/server/authentication/guards/auth-token-access.guard.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.guard.spec.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { sign } from '@fastify/cookie'\nimport { createMock, DeepMocked } from '@golevelup/ts-jest'\nimport { ExecutionContext } from '@nestjs/common'\nimport { ConfigModule, ConfigService } from '@nestjs/config'\nimport { Reflector } from '@nestjs/core'\nimport { JwtModule, JwtService } from '@nestjs/jwt'\nimport { PassportModule } from '@nestjs/passport'\nimport { Test, TestingModule } from '@nestjs/testing'\nimport { PinoLogger } from 'nestjs-pino'\nimport crypto from 'node:crypto'\nimport { UsersManager } from '../../applications/users/services/users-manager.service'\nimport { WEB_DAV_CONTEXT, WebDAVContext } from '../../applications/webdav/decorators/webdav-context.decorator'\nimport { exportConfiguration } from '../../configuration/config.environment'\nimport { AuthConfig } from '../auth.config'\nimport { CSRF_ERROR } from '../constants/auth'\nimport { AuthTokenOptional } from '../decorators/auth-token-optional.decorator'\nimport { AUTH_TOKEN_SKIP, AuthTokenSkip } from '../decorators/auth-token-skip.decorator'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\nimport { AuthAnonymousGuard } from './auth-anonymous.guard'\nimport { AuthAnonymousStrategy } from './auth-anonymous.strategy'\nimport { AuthTokenAccessGuard } from './auth-token-access.guard'\nimport { AuthTokenAccessStrategy } from './auth-token-access.strategy'\n\ndescribe(AuthTokenAccessGuard.name, () => {\n  const csrfToken: string = crypto.randomUUID()\n  let authConfig: AuthConfig\n  let jwtService: JwtService\n  let authAccessGuard: AuthTokenAccessGuard\n  let authAnonymousGuard: AuthAnonymousGuard\n  let authAnonymousStrategy: AuthAnonymousStrategy\n  let reflector: Reflector\n  let accessTokenWithoutCSRF: string\n  let accessToken: string\n  let context: DeepMocked<ExecutionContext>\n\n  beforeAll(async () => {\n    const module: TestingModule = await Test.createTestingModule({\n      imports: [\n        await ConfigModule.forRoot({\n          load: [exportConfiguration],\n          isGlobal: true\n        }),\n        JwtModule.register({ global: true }),\n        PassportModule\n      ],\n      providers: [\n        AuthTokenAccessStrategy,\n        AuthAnonymousStrategy,\n        AuthAnonymousGuard,\n        AuthManager,\n        { provide: UsersManager, useValue: {} },\n        {\n          provide: PinoLogger,\n          useValue: {\n            assign: () => undefined\n          }\n        }\n      ]\n    }).compile()\n\n    authConfig = module.get<ConfigService>(ConfigService).get<AuthConfig>('auth')\n    jwtService = module.get<JwtService>(JwtService)\n    reflector = new Reflector()\n    authAccessGuard = new AuthTokenAccessGuard(reflector)\n    authAnonymousStrategy = module.get<AuthAnonymousStrategy>(AuthAnonymousStrategy)\n    authAnonymousGuard = module.get<AuthAnonymousGuard>(AuthAnonymousGuard)\n    accessToken = await jwtService.signAsync({ identity: { id: 1, login: 'foo' }, [TOKEN_TYPE.CSRF]: csrfToken } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    accessTokenWithoutCSRF = await jwtService.signAsync({ identity: { id: 1, login: 'foo' } } as JwtPayload, {\n      secret: authConfig.token.access.secret,\n      expiresIn: 30\n    })\n    context = createMock<ExecutionContext>()\n  })\n\n  it('should be defined', () => {\n    expect(authConfig).toBeDefined()\n    expect(jwtService).toBeDefined()\n    expect(authAccessGuard).toBeDefined()\n    expect(authAnonymousGuard).toBeDefined()\n    expect(authAnonymousStrategy).toBeDefined()\n    expect(accessToken).toBeDefined()\n    expect(accessTokenWithoutCSRF).toBeDefined()\n    expect(csrfToken).toBeDefined()\n  })\n\n  it('should pass with a valid access token in cookies with CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: sign(csrfToken, authConfig.token.csrf.secret) },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass with a valid access token in request header with no CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer ${accessToken}`\n      }\n    })\n    expect(await authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should throw an error with an invalid access token in cookies', async () => {\n    // Cookies test\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: 'bar'\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with an invalid access token in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow('Unauthorized')\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF in request header', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {},\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_HEADERS))\n  })\n\n  it('should throw an error with a valid access token in cookies and a missing CSRF claim in the access token', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken },\n      cookies: {\n        [authConfig.token.access.name]: accessTokenWithoutCSRF\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISSING_JWT))\n  })\n\n  it('should throw an error with a valid access token in cookies and a mismatch CSRF', async () => {\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: { [authConfig.token.csrf.name]: csrfToken + '*' },\n      cookies: {\n        [authConfig.token.access.name]: accessToken\n      }\n    })\n    await expect(authAccessGuard.canActivate(context)).rejects.toThrow(new RegExp(CSRF_ERROR.MISMATCH))\n  })\n\n  it('should bypass access token when AuthTokenSkip decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    AuthTokenSkip()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should bypass access token with WebDAVContext decorator is applied to context', () => {\n    context = createMock<ExecutionContext>()\n    WebDAVContext()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(undefined)\n    expect(reflector.getAllAndOverride<boolean>(WEB_DAV_CONTEXT, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      headers: {\n        authorization: `Bearer bar`\n      }\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n  })\n\n  it('should pass without a valid access token when AuthTokenOptional is applied to context', async () => {\n    const spyAuthenticate = jest.spyOn(authAnonymousStrategy, 'authenticate')\n    context = createMock<ExecutionContext>()\n    AuthTokenOptional()(context.getHandler())\n    expect(reflector.getAllAndOverride<boolean>(AUTH_TOKEN_SKIP, [context.getHandler(), context.getClass()])).toBe(true)\n    context.switchToHttp().getRequest.mockReturnValue({\n      raw: { user: '' },\n      authorization: `Bearer bar`\n    })\n    expect(authAccessGuard.canActivate(context)).toBe(true)\n    expect(await authAnonymousGuard.canActivate(context)).toBe(true)\n    expect(spyAuthenticate).toHaveBeenCalledTimes(1)\n    spyAuthenticate.mockClear()\n  })\n})\n"],"names":["describe","AuthTokenAccessGuard","name","csrfToken","crypto","randomUUID","authConfig","jwtService","authAccessGuard","authAnonymousGuard","authAnonymousStrategy","reflector","accessTokenWithoutCSRF","accessToken","context","beforeAll","module","Test","createTestingModule","imports","ConfigModule","forRoot","load","exportConfiguration","isGlobal","JwtModule","register","global","PassportModule","providers","AuthTokenAccessStrategy","AuthAnonymousStrategy","AuthAnonymousGuard","AuthManager","provide","UsersManager","useValue","PinoLogger","assign","undefined","compile","get","ConfigService","JwtService","Reflector","signAsync","identity","id","login","TOKEN_TYPE","CSRF","secret","token","access","expiresIn","createMock","it","expect","toBeDefined","switchToHttp","getRequest","mockReturnValue","raw","user","headers","csrf","sign","cookies","canActivate","toBe","authorization","rejects","toThrow","RegExp","CSRF_ERROR","MISSING_HEADERS","MISSING_JWT","MISMATCH","AuthTokenSkip","getHandler","getAllAndOverride","AUTH_TOKEN_SKIP","getClass","WebDAVContext","WEB_DAV_CONTEXT","spyAuthenticate","jest","spyOn","AuthTokenOptional","toHaveBeenCalledTimes","mockClear"],"mappings":"AAAA;;;;CAIC;;;;wBAEoB;wBACkB;wBAEK;sBAClB;qBACY;0BACP;yBACK;4BACT;mEACR;qCACU;wCACkB;mCACX;sBAET;4CACO;wCACa;gCAEpB;oCACC;oCACO;uCACG;sCACD;yCACG;;;;;;AAExCA,SAASC,0CAAoB,CAACC,IAAI,EAAE;IAClC,MAAMC,YAAoBC,mBAAM,CAACC,UAAU;IAC3C,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJC,UAAU;QACR,MAAMC,SAAwB,MAAMC,aAAI,CAACC,mBAAmB,CAAC;YAC3DC,SAAS;gBACP,MAAMC,oBAAY,CAACC,OAAO,CAAC;oBACzBC,MAAM;wBAACC,sCAAmB;qBAAC;oBAC3BC,UAAU;gBACZ;gBACAC,cAAS,CAACC,QAAQ,CAAC;oBAAEC,QAAQ;gBAAK;gBAClCC,wBAAc;aACf;YACDC,WAAW;gBACTC,gDAAuB;gBACvBC,4CAAqB;gBACrBC,sCAAkB;gBAClBC,+BAAW;gBACX;oBAAEC,SAASC,iCAAY;oBAAEC,UAAU,CAAC;gBAAE;gBACtC;oBACEF,SAASG,sBAAU;oBACnBD,UAAU;wBACRE,QAAQ,IAAMC;oBAChB;gBACF;aACD;QACH,GAAGC,OAAO;QAEVlC,aAAaU,OAAOyB,GAAG,CAAgBC,qBAAa,EAAED,GAAG,CAAa;QACtElC,aAAaS,OAAOyB,GAAG,CAAaE,eAAU;QAC9ChC,YAAY,IAAIiC,eAAS;QACzBpC,kBAAkB,IAAIP,0CAAoB,CAACU;QAC3CD,wBAAwBM,OAAOyB,GAAG,CAAwBV,4CAAqB;QAC/EtB,qBAAqBO,OAAOyB,GAAG,CAAqBT,sCAAkB;QACtEnB,cAAc,MAAMN,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;YAAG,CAACC,0BAAU,CAACC,IAAI,CAAC,EAAE/C;QAAU,GAAiB;YAC1HgD,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACA1C,yBAAyB,MAAML,WAAWsC,SAAS,CAAC;YAAEC,UAAU;gBAAEC,IAAI;gBAAGC,OAAO;YAAM;QAAE,GAAiB;YACvGG,QAAQ7C,WAAW8C,KAAK,CAACC,MAAM,CAACF,MAAM;YACtCG,WAAW;QACb;QACAxC,UAAUyC,IAAAA,kBAAU;IACtB;IAEAC,GAAG,qBAAqB;QACtBC,OAAOnD,YAAYoD,WAAW;QAC9BD,OAAOlD,YAAYmD,WAAW;QAC9BD,OAAOjD,iBAAiBkD,WAAW;QACnCD,OAAOhD,oBAAoBiD,WAAW;QACtCD,OAAO/C,uBAAuBgD,WAAW;QACzCD,OAAO5C,aAAa6C,WAAW;QAC/BD,OAAO7C,wBAAwB8C,WAAW;QAC1CD,OAAOtD,WAAWuD,WAAW;IAC/B;IAEAF,GAAG,8DAA8D;QAC/D1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEgE,IAAAA,YAAI,EAAC/D,WAAWG,WAAW8C,KAAK,CAACa,IAAI,CAACd,MAAM;YAAE;YACvFgB,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,OAAO,EAAEzD,aAAa;YACxC;QACF;QACA4C,OAAO,MAAMjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IAC1D;IAEAb,GAAG,iEAAiE;QAClE,eAAe;QACf1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAE;YAClC;QACF;QACA,MAAMuD,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,wEAAwE;QACzE1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACA,MAAMb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC;IACrE;IAEAhB,GAAG,mGAAmG;QACpG1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS,CAAC;YACVG,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACC,eAAe;IAC1G;IAEAnB,GAAG,2GAA2G;QAC5G1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC;YAAU;YACnDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEU;YAClC;QACF;QACA,MAAM6C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACE,WAAW;IACtG;IAEApB,GAAG,kFAAkF;QACnF1C,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBAAE,CAAC1D,WAAW8C,KAAK,CAACa,IAAI,CAAC/D,IAAI,CAAC,EAAEC,YAAY;YAAI;YACzDgE,SAAS;gBACP,CAAC7D,WAAW8C,KAAK,CAACC,MAAM,CAACnD,IAAI,CAAC,EAAEW;YAClC;QACF;QACA,MAAM4C,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUyD,OAAO,CAACC,OAAO,CAAC,IAAIC,OAAOC,gBAAU,CAACG,QAAQ;IACnG;IAEArB,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpBuB,IAAAA,qCAAa,IAAGhE,QAAQiE,UAAU;QAClCtB,OAAO9C,UAAUqE,iBAAiB,CAAUC,uCAAe,EAAE;YAACnE,QAAQiE,UAAU;YAAIjE,QAAQoE,QAAQ;SAAG,GAAGb,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,iFAAiF;QAClF1C,UAAUyC,IAAAA,kBAAU;QACpB4B,IAAAA,qCAAa,IAAGrE,QAAQiE,UAAU;QAClCtB,OAAO9C,UAAUqE,iBAAiB,CAAUC,uCAAe,EAAE;YAACnE,QAAQiE,UAAU;YAAIjE,QAAQoE,QAAQ;SAAG,GAAGb,IAAI,CAAC9B;QAC/GkB,OAAO9C,UAAUqE,iBAAiB,CAAUI,uCAAe,EAAE;YAACtE,QAAQiE,UAAU;YAAIjE,QAAQoE,QAAQ;SAAG,GAAGb,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBC,SAAS;gBACPM,eAAe,CAAC,UAAU,CAAC;YAC7B;QACF;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;IACpD;IAEAb,GAAG,yFAAyF;QAC1F,MAAM6B,kBAAkBC,KAAKC,KAAK,CAAC7E,uBAAuB;QAC1DI,UAAUyC,IAAAA,kBAAU;QACpBiC,IAAAA,6CAAiB,IAAG1E,QAAQiE,UAAU;QACtCtB,OAAO9C,UAAUqE,iBAAiB,CAAUC,uCAAe,EAAE;YAACnE,QAAQiE,UAAU;YAAIjE,QAAQoE,QAAQ;SAAG,GAAGb,IAAI,CAAC;QAC/GvD,QAAQ6C,YAAY,GAAGC,UAAU,CAACC,eAAe,CAAC;YAChDC,KAAK;gBAAEC,MAAM;YAAG;YAChBO,eAAe,CAAC,UAAU,CAAC;QAC7B;QACAb,OAAOjD,gBAAgB4D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAClDZ,OAAO,MAAMhD,mBAAmB2D,WAAW,CAACtD,UAAUuD,IAAI,CAAC;QAC3DZ,OAAO4B,iBAAiBI,qBAAqB,CAAC;QAC9CJ,gBAAgBK,SAAS;IAC3B;AACF"}