@things-factory/auth-base 8.0.5 → 9.0.0-beta.12

package/dist-server/router/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/router/index.ts"],"names":[],"mappings":";;;AAAA,wEAA6C;AAC7C,uEAA4C;AAC5C,oEAAyC;AACzC,6DAAkC;AAClC,mDAAwB;AACxB,gEAAqC;AACrC,+DAAoC;AACpC,+DAAoC;AACpC,4DAAiC","sourcesContent":["export * from './auth-private-process-router'\nexport * from './auth-public-process-router'\nexport * from './path-base-domain-router'\nexport * from './site-root-router'\nexport * from './oauth2'\nexport * from './auth-checkin-router'\nexport * from './auth-signin-router'\nexport * from './auth-signup-router'\nexport * from './webauthn-router'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/router/index.ts"],"names":[],"mappings":";;;AAAA,2EAAgD;AAChD,0EAA+C;AAC/C,uEAA4C;AAC5C,gEAAqC;AACrC,4DAAiC;AACjC,mEAAwC;AACxC,kEAAuC;AACvC,kEAAuC;AACvC,+DAAoC","sourcesContent":["export * from './auth-private-process-router.js'\nexport * from './auth-public-process-router.js'\nexport * from './path-base-domain-router.js'\nexport * from './site-root-router.js'\nexport * from './oauth2/index.js'\nexport * from './auth-checkin-router.js'\nexport * from './auth-signin-router.js'\nexport * from './auth-signup-router.js'\nexport * from './webauthn-router.js'\n"]}

package/dist-server/router/oauth2/index.d.ts

@@ -1,2 +1,2 @@
-export * from './oauth2-authorize-router';
-export * from './oauth2-router';
+export * from './oauth2-authorize-router.js';
+export * from './oauth2-router.js';

package/dist-server/router/oauth2/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
-tslib_1.__exportStar(require("./oauth2-authorize-router"), exports);
-tslib_1.__exportStar(require("./oauth2-router"), exports);
+tslib_1.__exportStar(require("./oauth2-authorize-router.js"), exports);
+tslib_1.__exportStar(require("./oauth2-router.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist-server/router/oauth2/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/router/oauth2/index.ts"],"names":[],"mappings":";;;AAAA,oEAAyC;AACzC,0DAA+B","sourcesContent":["export * from './oauth2-authorize-router'\nexport * from './oauth2-router'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/router/oauth2/index.ts"],"names":[],"mappings":";;;AAAA,uEAA4C;AAC5C,6DAAkC","sourcesContent":["export * from './oauth2-authorize-router.js'\nexport * from './oauth2-router.js'\n"]}

package/dist-server/router/oauth2/oauth2-authorize-router.js

@@ -5,8 +5,8 @@ const tslib_1 = require("tslib");
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
-const application_1 = require("../../service/application/application");
-const oauth2_server_1 = require("./oauth2-server");
+const application_js_1 = require("../../service/application/application.js");
+const oauth2_server_js_1 = require("./oauth2-server.js");
 exports.oauth2AuthorizeRouter = new koa_router_1.default();
 const disableUserFavoredLanguage = env_1.config.get('i18n/disableUserFavoredLanguage', false);
 const languages = env_1.config.get('i18n/languages', false);
@@ -25,20 +25,20 @@ const languages = env_1.config.get('i18n/languages', false);
 // to obtain their approval (displaying details about the client requesting
 // authorization).  We accomplish that here by routing through `ensureLoggedIn()`
 // first, and rendering the `dialog` view.
-exports.oauth2AuthorizeRouter.get('/authorize', oauth2_server_1.server.authorize(async function (clientID, redirectURI) {
-    const client = await (0, shell_1.getRepository)(application_1.Application).findOneBy({
+exports.oauth2AuthorizeRouter.get('/authorize', oauth2_server_js_1.server.authorize(async function (clientID, redirectURI) {
+    const client = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({
         appKey: clientID
     });
     // CONFIRM-ME redirectUrl 의 허용 범위는 ?
     // if (!client.redirectUrl != redirectURI) {
     //   return false
     // }
-    return [client || oauth2_server_1.NonClient, redirectURI];
+    return [client || oauth2_server_js_1.NonClient, redirectURI];
 }), async function (context, next) {
     const { oauth2, user, domain } = context.state;
     let pageElement = 'oauth2-decision';
     let elementScript = '/oauth2/oauth2-decision-page.js';
-    if (oauth2.client.id === oauth2_server_1.NonClient.id) {
+    if (oauth2.client.id === oauth2_server_js_1.NonClient.id) {
         pageElement = 'oauth2-decision-error';
         elementScript = '/oauth2/oauth2-decision-error-page.js';
     }

package/dist-server/router/oauth2/oauth2-authorize-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-authorize-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-authorize-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,iDAAqD;AACrD,6CAA4C;AAE5C,uEAAmE;AACnE,mDAAwE;AAE3D,QAAA,qBAAqB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEjD,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,8BAA8B;AAC9B,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,0CAA0C;AAE1C,6BAAqB,CAAC,GAAG,CACvB,YAAY,EACZ,sBAAiB,CAAC,SAAS,CAAC,KAAK,WAAW,QAAQ,EAAE,WAAW;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC;QACxD,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;IACF,oCAAoC;IACpC,4CAA4C;IAC5C,iBAAiB;IACjB,IAAI;IAEJ,OAAO,CAAC,MAAM,IAAI,yBAAS,EAAE,WAAW,CAAC,CAAA;AAC3C,CAAC,CAAC,EACF,KAAK,WAAW,OAAO,EAAE,IAAI;IAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9C,IAAI,WAAW,GAAW,iBAAiB,CAAA;IAC3C,IAAI,aAAa,GAAW,iCAAiC,CAAA;IAE7D,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,yBAAS,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW,GAAG,uBAAuB,CAAA;QACrC,aAAa,GAAG,uCAAuC,CAAA;IACzD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAClC,WAAW;YACX,aAAa;YACb,IAAI,EAAE;gBACJ,MAAM;gBACN,MAAM,kCACD,MAAM,KACT,IAAI,EAAE;wBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;wBACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;qBACzB,GACF;gBACD,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;QACF,uCAAuC;QACvC,oBAAoB;QACpB,2HAA2H;QAC3H,oBAAoB;QACpB,KAAK;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { Application } from '../../service/application/application'\nimport { NonClient, server as oauth2orizeServer } from './oauth2-server'\n\nexport const oauth2AuthorizeRouter = new Router()\n\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\n// user authorization endpoint\n//\n// `authorization` middleware accepts a `validate` callback which is\n// responsible for validating the client making the authorization request.  In\n// doing so, is recommended that the `redirectURI` be checked against a\n// registered value, although security requirements may vary accross\n// implementations.  Once validated, the `done` callback must be invoked with\n// a `client` instance, as well as the `redirectURI` to which the user will be\n// redirected after an authorization decision is obtained.\n//\n// This middleware simply initializes a new authorization transaction.  It is\n// the application's responsibility to authenticate the user and render a dialog\n// to obtain their approval (displaying details about the client requesting\n// authorization).  We accomplish that here by routing through `ensureLoggedIn()`\n// first, and rendering the `dialog` view.\n\noauth2AuthorizeRouter.get(\n  '/authorize',\n  oauth2orizeServer.authorize(async function (clientID, redirectURI) {\n    const client = await getRepository(Application).findOneBy({\n      appKey: clientID\n    })\n    // CONFIRM-ME redirectUrl 의 허용 범위는 ?\n    // if (!client.redirectUrl != redirectURI) {\n    //   return false\n    // }\n\n    return [client || NonClient, redirectURI]\n  }),\n  async function (context, next) {\n    const { oauth2, user, domain } = context.state\n\n    let pageElement: string = 'oauth2-decision'\n    let elementScript: string = '/oauth2/oauth2-decision-page.js'\n\n    if (oauth2.client.id === NonClient.id) {\n      pageElement = 'oauth2-decision-error'\n      elementScript = '/oauth2/oauth2-decision-error-page.js'\n    }\n\n    try {\n      await context.render('oauth2-page', {\n        pageElement,\n        elementScript,\n        data: {\n          domain,\n          oauth2: {\n            ...oauth2,\n            user: {\n              id: oauth2.user.id,\n              name: oauth2.user.name,\n              email: oauth2.user.email\n            }\n          },\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n      // await context.render(decisionPage, {\n      //   domain: domain,\n      //   ...oauth2, // client, redirectURI, req { type, clientID, redirectURI, scope, state}, user, transactionID, info, locals\n      //   availableScopes\n      // })\n    } catch (e) {\n      throw e\n    }\n  }\n)\n"]}
+{"version":3,"file":"oauth2-authorize-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-authorize-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,iDAAqD;AACrD,6CAA4C;AAE5C,6EAAsE;AACtE,yDAA2E;AAE9D,QAAA,qBAAqB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEjD,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,8BAA8B;AAC9B,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,0CAA0C;AAE1C,6BAAqB,CAAC,GAAG,CACvB,YAAY,EACZ,yBAAiB,CAAC,SAAS,CAAC,KAAK,WAAW,QAAQ,EAAE,WAAW;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QACxD,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;IACF,oCAAoC;IACpC,4CAA4C;IAC5C,iBAAiB;IACjB,IAAI;IAEJ,OAAO,CAAC,MAAM,IAAI,4BAAS,EAAE,WAAW,CAAC,CAAA;AAC3C,CAAC,CAAC,EACF,KAAK,WAAW,OAAO,EAAE,IAAI;IAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9C,IAAI,WAAW,GAAW,iBAAiB,CAAA;IAC3C,IAAI,aAAa,GAAW,iCAAiC,CAAA;IAE7D,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,4BAAS,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW,GAAG,uBAAuB,CAAA;QACrC,aAAa,GAAG,uCAAuC,CAAA;IACzD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAClC,WAAW;YACX,aAAa;YACb,IAAI,EAAE;gBACJ,MAAM;gBACN,MAAM,kCACD,MAAM,KACT,IAAI,EAAE;wBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;wBACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;qBACzB,GACF;gBACD,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;QACF,uCAAuC;QACvC,oBAAoB;QACpB,2HAA2H;QAC3H,oBAAoB;QACpB,KAAK;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { Application } from '../../service/application/application.js'\nimport { NonClient, server as oauth2orizeServer } from './oauth2-server.js'\n\nexport const oauth2AuthorizeRouter = new Router()\n\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\n// user authorization endpoint\n//\n// `authorization` middleware accepts a `validate` callback which is\n// responsible for validating the client making the authorization request.  In\n// doing so, is recommended that the `redirectURI` be checked against a\n// registered value, although security requirements may vary accross\n// implementations.  Once validated, the `done` callback must be invoked with\n// a `client` instance, as well as the `redirectURI` to which the user will be\n// redirected after an authorization decision is obtained.\n//\n// This middleware simply initializes a new authorization transaction.  It is\n// the application's responsibility to authenticate the user and render a dialog\n// to obtain their approval (displaying details about the client requesting\n// authorization).  We accomplish that here by routing through `ensureLoggedIn()`\n// first, and rendering the `dialog` view.\n\noauth2AuthorizeRouter.get(\n  '/authorize',\n  oauth2orizeServer.authorize(async function (clientID, redirectURI) {\n    const client = await getRepository(Application).findOneBy({\n      appKey: clientID\n    })\n    // CONFIRM-ME redirectUrl 의 허용 범위는 ?\n    // if (!client.redirectUrl != redirectURI) {\n    //   return false\n    // }\n\n    return [client || NonClient, redirectURI]\n  }),\n  async function (context, next) {\n    const { oauth2, user, domain } = context.state\n\n    let pageElement: string = 'oauth2-decision'\n    let elementScript: string = '/oauth2/oauth2-decision-page.js'\n\n    if (oauth2.client.id === NonClient.id) {\n      pageElement = 'oauth2-decision-error'\n      elementScript = '/oauth2/oauth2-decision-error-page.js'\n    }\n\n    try {\n      await context.render('oauth2-page', {\n        pageElement,\n        elementScript,\n        data: {\n          domain,\n          oauth2: {\n            ...oauth2,\n            user: {\n              id: oauth2.user.id,\n              name: oauth2.user.name,\n              email: oauth2.user.email\n            }\n          },\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n      // await context.render(decisionPage, {\n      //   domain: domain,\n      //   ...oauth2, // client, redirectURI, req { type, clientID, redirectURI, scope, state}, user, transactionID, info, locals\n      //   availableScopes\n      // })\n    } catch (e) {\n      throw e\n    }\n  }\n)\n"]}

package/dist-server/router/oauth2/oauth2-router.d.ts

@@ -1,4 +1,4 @@
-import { User } from '../../service/user/user';
+import { User } from '../../service/user/user.js';
 declare global {
     namespace NodeJS {
         interface Process {

package/dist-server/router/oauth2/oauth2-router.js

@@ -7,16 +7,16 @@ const koa_compose_1 = tslib_1.__importDefault(require("koa-compose"));
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const shell_1 = require("@things-factory/shell");
-const middlewares_1 = require("../../middlewares");
-const application_1 = require("../../service/application/application");
-const user_1 = require("../../service/user/user");
-const access_token_cookie_1 = require("../../utils/access-token-cookie");
-const get_secret_1 = require("../../utils/get-secret");
-const oauth2_server_1 = require("./oauth2-server");
-const passport_oauth2_client_password_1 = require("./passport-oauth2-client-password");
+const index_js_1 = require("../../middlewares/index.js");
+const application_js_1 = require("../../service/application/application.js");
+const user_js_1 = require("../../service/user/user.js");
+const access_token_cookie_js_1 = require("../../utils/access-token-cookie.js");
+const get_secret_js_1 = require("../../utils/get-secret.js");
+const oauth2_server_js_1 = require("./oauth2-server.js");
+const passport_oauth2_client_password_js_1 = require("./passport-oauth2-client-password.js");
 exports.oauth2Router = new koa_router_1.default();
-koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_password_1.Strategy({}, (clientId, clientSecret, done) => {
-    (0, shell_1.getRepository)(application_1.Application)
+koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_password_js_1.Strategy({}, (clientId, clientSecret, done) => {
+    (0, shell_1.getRepository)(application_js_1.Application)
         .findOneBy({
         appKey: clientId
     })
@@ -35,7 +35,7 @@ koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_
 // requested by a client application.  Based on the grant type requested by the
 // client, the above grant middleware configured above will be invoked to send
 // a response.
-exports.oauth2Router.post('/decision', middlewares_1.jwtAuthenticateMiddleware, (0, koa_compose_1.default)(oauth2_server_1.server.decision(async function (context) {
+exports.oauth2Router.post('/decision', index_js_1.jwtAuthenticateMiddleware, (0, koa_compose_1.default)(oauth2_server_js_1.server.decision(async function (context) {
     const { request } = context;
     return request.body;
 })));
@@ -45,19 +45,19 @@ exports.oauth2Router.post('/decision', middlewares_1.jwtAuthenticateMiddleware,
 // for access tokens.  Based on the grant type being exchanged, the above
 // exchange middleware will be invoked to handle the request.  Clients must
 // authenticate when making requests to this endpoint.
-exports.oauth2Router.post('/access-token', koa_passport_1.default.authenticate('oauth2-client-password', { session: false }), oauth2_server_1.server.token(), oauth2_server_1.server.errorHandler());
+exports.oauth2Router.post('/access-token', koa_passport_1.default.authenticate('oauth2-client-password', { session: false }), oauth2_server_js_1.server.token(), oauth2_server_js_1.server.errorHandler());
 exports.oauth2Router.post('/refresh-token', async (context, next) => {
     var _a, _b;
     const refreshToken = (_b = (_a = context.request) === null || _a === void 0 ? void 0 : _a.body) === null || _b === void 0 ? void 0 : _b.refreshToken;
     if (!refreshToken)
         throw new Error('Missing refresh token');
-    const appUser = await (0, shell_1.getRepository)(user_1.User).findOneBy({
+    const appUser = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({
         password: refreshToken
     });
     if (!appUser)
         throw new Error('App user is not found');
     try {
-        jsonwebtoken_1.default.verify(refreshToken, get_secret_1.SECRET);
+        jsonwebtoken_1.default.verify(refreshToken, get_secret_js_1.SECRET);
         const decoded = jsonwebtoken_1.default.decode(refreshToken);
         const subdomain = decoded.domain.subdomain;
         const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOne({
@@ -67,11 +67,11 @@ exports.oauth2Router.post('/refresh-token', async (context, next) => {
             throw new Error('Domain is not found');
         const appKey = decoded.application.appKey;
         const scopes = decoded.scope;
-        const newAccessToken = application_1.Application.generateAccessToken(domain, appUser, appKey, scopes);
-        const newRefreshToken = application_1.Application.generateRefreshToken(domain, appUser, appKey, scopes);
+        const newAccessToken = application_js_1.Application.generateAccessToken(domain, appUser, appKey, scopes);
+        const newRefreshToken = application_js_1.Application.generateRefreshToken(domain, appUser, appKey, scopes);
         appUser.password = newRefreshToken;
-        await (0, shell_1.getRepository)(user_1.User).save(appUser);
-        (0, access_token_cookie_1.setAccessTokenCookie)(context, newAccessToken);
+        await (0, shell_1.getRepository)(user_js_1.User).save(appUser);
+        (0, access_token_cookie_js_1.setAccessTokenCookie)(context, newAccessToken);
         context.body = {
             accessToken: newAccessToken,
             refreshToken: newRefreshToken
@@ -82,7 +82,7 @@ exports.oauth2Router.post('/refresh-token', async (context, next) => {
         context.body = e.message;
     }
 });
-exports.oauth2Router.get('/profile', middlewares_1.jwtAuthenticateMiddleware, async (context, next) => {
+exports.oauth2Router.get('/profile', index_js_1.jwtAuthenticateMiddleware, async (context, next) => {
     const { user, domain } = context.state;
     const { name, description, email, userType: type, locale } = user;
     const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {};
@@ -109,7 +109,7 @@ exports.oauth2Router.get('/profile', middlewares_1.jwtAuthenticateMiddleware, as
         }
     };
 });
-exports.oauth2Router.post('/disconnect', middlewares_1.jwtAuthenticateMiddleware, async (context, next) => {
+exports.oauth2Router.post('/disconnect', index_js_1.jwtAuthenticateMiddleware, async (context, next) => {
     try {
         let { user } = context.state;
         if (typeof process.oauthDisconnect === 'function') {
@@ -118,8 +118,8 @@ exports.oauth2Router.post('/disconnect', middlewares_1.jwtAuthenticateMiddleware
         else {
             user.domains = [];
             user.roles = [];
-            user.status = user_1.UserStatus.DELETED;
-            await (0, shell_1.getRepository)(user_1.User).save(user);
+            user.status = user_js_1.UserStatus.DELETED;
+            await (0, shell_1.getRepository)(user_js_1.User).save(user);
         }
         context.status = 200;
         context.body = 'ok';

package/dist-server/router/oauth2/oauth2-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-router.ts"],"names":[],"mappings":";;;;AAAA,wEAA8B;AAC9B,sEAAiC;AACjC,wEAAmC;AACnC,oEAA+B;AAE/B,iDAA6D;AAE7D,mDAA6D;AAC7D,uEAAmE;AACnE,kDAA0D;AAC1D,yEAAsE;AACtE,uDAA+C;AAC/C,mDAA6D;AAC7D,uFAAsF;AAUzE,QAAA,YAAY,GAAG,IAAI,oBAAM,EAAE,CAAA;AAExC,sBAAQ,CAAC,GAAG,CACV,wBAAwB,EACxB,IAAI,0CAAsB,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;IAC9D,IAAA,qBAAa,EAAC,yBAAW,CAAC;SACvB,SAAS,CAAC;QACT,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5B,CAAC,CAAC,CACH,CAAA;AAED,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AAEd,oBAAY,CAAC,IAAI,CACf,WAAW,EACX,uCAAyB,EACzB,IAAA,qBAAO,EACL,sBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,OAAO;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC,CAAC,CACH,CACF,CAAA;AAED,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AAEtD,oBAAY,CAAC,IAAI,CACf,eAAe,EACf,sBAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACnE,sBAAiB,CAAC,KAAK,EAAE,EACzB,sBAAiB,CAAC,YAAY,EAAE,CACjC,CAAA;AAED,oBAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;;IAC1D,MAAM,YAAY,GAAuB,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,0CAAE,YAAY,CAAA;IAC5E,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE3D,MAAM,OAAO,GAAqB,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,CAAQ,CAAA;QAC/C,MAAM,SAAS,GAAW,OAAO,CAAC,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,MAAM,GAAuB,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QACjD,MAAM,MAAM,GAAU,OAAO,CAAC,KAAK,CAAA;QAEnC,MAAM,cAAc,GAAW,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/F,MAAM,eAAe,GAAW,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAEjG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAA;QAClC,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAA,0CAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAE7C,OAAO,CAAC,IAAI,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,GAAG,CAAC,UAAU,EAAE,uCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;IAEnG,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1B,wDAAwD;QACxD,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,KAAK;YACL,IAAI,CAAC,wCAAwC;YAC7C,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ;aACT;YACD,WAAW;SACZ;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,IAAI,CAAC,aAAa,EAAE,uCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,iBAAU,CAAC,OAAO,CAAA;YAChC,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import jwt from 'jsonwebtoken'\nimport compose from 'koa-compose'\nimport passport from 'koa-passport'\nimport Router from 'koa-router'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { jwtAuthenticateMiddleware } from '../../middlewares'\nimport { Application } from '../../service/application/application'\nimport { User, UserStatus } from '../../service/user/user'\nimport { setAccessTokenCookie } from '../../utils/access-token-cookie'\nimport { SECRET } from '../../utils/get-secret'\nimport { server as oauth2orizeServer } from './oauth2-server'\nimport { Strategy as ClientPasswordStrategy } from './passport-oauth2-client-password'\n\ndeclare global {\n  namespace NodeJS {\n    interface Process {\n      oauthDisconnect: (user: User) => Promise<void>\n    }\n  }\n}\n\nexport const oauth2Router = new Router()\n\npassport.use(\n  'oauth2-client-password',\n  new ClientPasswordStrategy({}, (clientId, clientSecret, done) => {\n    getRepository(Application)\n      .findOneBy({\n        appKey: clientId\n      })\n      .then(client => {\n        if (!client || client.appSecret != clientSecret) {\n          done(null, false)\n          return\n        }\n\n        done(null, client)\n      })\n      .catch(err => done(err))\n  })\n)\n\n// user decision endpoint\n//\n// `decision` middleware processes a user's decision to allow or deny access\n// requested by a client application.  Based on the grant type requested by the\n// client, the above grant middleware configured above will be invoked to send\n// a response.\n\noauth2Router.post(\n  '/decision',\n  jwtAuthenticateMiddleware,\n  compose(\n    oauth2orizeServer.decision(async function (context) {\n      const { request } = context\n\n      return request.body\n    })\n  )\n)\n\n// token endpoint\n//\n// `token` middleware handles client requests to exchange authorization grants\n// for access tokens.  Based on the grant type being exchanged, the above\n// exchange middleware will be invoked to handle the request.  Clients must\n// authenticate when making requests to this endpoint.\n\noauth2Router.post(\n  '/access-token',\n  passport.authenticate('oauth2-client-password', { session: false }),\n  oauth2orizeServer.token(),\n  oauth2orizeServer.errorHandler()\n)\n\noauth2Router.post('/refresh-token', async (context, next) => {\n  const refreshToken: string | undefined = context.request?.body?.refreshToken\n  if (!refreshToken) throw new Error('Missing refresh token')\n\n  const appUser: User | undefined = await getRepository(User).findOneBy({\n    password: refreshToken\n  })\n\n  if (!appUser) throw new Error('App user is not found')\n\n  try {\n    jwt.verify(refreshToken, SECRET)\n    const decoded = jwt.decode(refreshToken) as any\n    const subdomain: string = decoded.domain.subdomain\n    const domain: Domain | undefined = await getRepository(Domain).findOne({\n      where: { subdomain }\n    })\n    if (!domain) throw new Error('Domain is not found')\n    const appKey: string = decoded.application.appKey\n    const scopes: any[] = decoded.scope\n\n    const newAccessToken: string = Application.generateAccessToken(domain, appUser, appKey, scopes)\n    const newRefreshToken: string = Application.generateRefreshToken(domain, appUser, appKey, scopes)\n\n    appUser.password = newRefreshToken\n    await getRepository(User).save(appUser)\n\n    setAccessTokenCookie(context, newAccessToken)\n\n    context.body = {\n      accessToken: newAccessToken,\n      refreshToken: newRefreshToken\n    }\n  } catch (e) {\n    context.status = 401\n    context.body = e.message\n  }\n})\n\noauth2Router.get('/profile', jwtAuthenticateMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const { name, description, email, userType: type, locale } = user\n  const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {}\n\n  var application = {}\n  if (type == 'application') {\n    /* user entity에 reference 필드가 추가되기 전까지, appKey취득 방법임. */\n    application['appKey'] = email.substr(0, email.lastIndexOf('@'))\n  }\n\n  context.body = {\n    profile: {\n      name,\n      description,\n      email,\n      type /* (admin|user|application|appliance) */,\n      domain: {\n        name: domainName,\n        subdomain,\n        brandName,\n        brandImage,\n        contentImage,\n        timezone\n      },\n      application\n    }\n  }\n})\n\noauth2Router.post('/disconnect', jwtAuthenticateMiddleware, async (context, next) => {\n  try {\n    let { user } = context.state\n\n    if (typeof process.oauthDisconnect === 'function') {\n      await process.oauthDisconnect(user)\n    } else {\n      user.domains = []\n      user.roles = []\n      user.status = UserStatus.DELETED\n      await getRepository(User).save(user)\n    }\n    context.status = 200\n    context.body = 'ok'\n  } catch (e) {\n    throw e\n  }\n})\n"]}
+{"version":3,"file":"oauth2-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-router.ts"],"names":[],"mappings":";;;;AAAA,wEAA8B;AAC9B,sEAAiC;AACjC,wEAAmC;AACnC,oEAA+B;AAE/B,iDAA6D;AAE7D,yDAAsE;AACtE,6EAAsE;AACtE,wDAA6D;AAC7D,+EAAyE;AACzE,6DAAkD;AAClD,yDAAgE;AAChE,6FAAyF;AAU5E,QAAA,YAAY,GAAG,IAAI,oBAAM,EAAE,CAAA;AAExC,sBAAQ,CAAC,GAAG,CACV,wBAAwB,EACxB,IAAI,6CAAsB,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;IAC9D,IAAA,qBAAa,EAAC,4BAAW,CAAC;SACvB,SAAS,CAAC;QACT,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5B,CAAC,CAAC,CACH,CAAA;AAED,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AAEd,oBAAY,CAAC,IAAI,CACf,WAAW,EACX,oCAAyB,EACzB,IAAA,qBAAO,EACL,yBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,OAAO;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC,CAAC,CACH,CACF,CAAA;AAED,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AAEtD,oBAAY,CAAC,IAAI,CACf,eAAe,EACf,sBAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACnE,yBAAiB,CAAC,KAAK,EAAE,EACzB,yBAAiB,CAAC,YAAY,EAAE,CACjC,CAAA;AAED,oBAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;;IAC1D,MAAM,YAAY,GAAuB,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,0CAAE,YAAY,CAAA;IAC5E,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE3D,MAAM,OAAO,GAAqB,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,CAAQ,CAAA;QAC/C,MAAM,SAAS,GAAW,OAAO,CAAC,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,MAAM,GAAuB,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QACjD,MAAM,MAAM,GAAU,OAAO,CAAC,KAAK,CAAA;QAEnC,MAAM,cAAc,GAAW,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/F,MAAM,eAAe,GAAW,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAEjG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAA;QAClC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAA,6CAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAE7C,OAAO,CAAC,IAAI,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,GAAG,CAAC,UAAU,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;IAEnG,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1B,wDAAwD;QACxD,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,KAAK;YACL,IAAI,CAAC,wCAAwC;YAC7C,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ;aACT;YACD,WAAW;SACZ;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,IAAI,CAAC,aAAa,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,OAAO,CAAA;YAChC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import jwt from 'jsonwebtoken'\nimport compose from 'koa-compose'\nimport passport from 'koa-passport'\nimport Router from 'koa-router'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { jwtAuthenticateMiddleware } from '../../middlewares/index.js'\nimport { Application } from '../../service/application/application.js'\nimport { User, UserStatus } from '../../service/user/user.js'\nimport { setAccessTokenCookie } from '../../utils/access-token-cookie.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { server as oauth2orizeServer } from './oauth2-server.js'\nimport { Strategy as ClientPasswordStrategy } from './passport-oauth2-client-password.js'\n\ndeclare global {\n  namespace NodeJS {\n    interface Process {\n      oauthDisconnect: (user: User) => Promise<void>\n    }\n  }\n}\n\nexport const oauth2Router = new Router()\n\npassport.use(\n  'oauth2-client-password',\n  new ClientPasswordStrategy({}, (clientId, clientSecret, done) => {\n    getRepository(Application)\n      .findOneBy({\n        appKey: clientId\n      })\n      .then(client => {\n        if (!client || client.appSecret != clientSecret) {\n          done(null, false)\n          return\n        }\n\n        done(null, client)\n      })\n      .catch(err => done(err))\n  })\n)\n\n// user decision endpoint\n//\n// `decision` middleware processes a user's decision to allow or deny access\n// requested by a client application.  Based on the grant type requested by the\n// client, the above grant middleware configured above will be invoked to send\n// a response.\n\noauth2Router.post(\n  '/decision',\n  jwtAuthenticateMiddleware,\n  compose(\n    oauth2orizeServer.decision(async function (context) {\n      const { request } = context\n\n      return request.body\n    })\n  )\n)\n\n// token endpoint\n//\n// `token` middleware handles client requests to exchange authorization grants\n// for access tokens.  Based on the grant type being exchanged, the above\n// exchange middleware will be invoked to handle the request.  Clients must\n// authenticate when making requests to this endpoint.\n\noauth2Router.post(\n  '/access-token',\n  passport.authenticate('oauth2-client-password', { session: false }),\n  oauth2orizeServer.token(),\n  oauth2orizeServer.errorHandler()\n)\n\noauth2Router.post('/refresh-token', async (context, next) => {\n  const refreshToken: string | undefined = context.request?.body?.refreshToken\n  if (!refreshToken) throw new Error('Missing refresh token')\n\n  const appUser: User | undefined = await getRepository(User).findOneBy({\n    password: refreshToken\n  })\n\n  if (!appUser) throw new Error('App user is not found')\n\n  try {\n    jwt.verify(refreshToken, SECRET)\n    const decoded = jwt.decode(refreshToken) as any\n    const subdomain: string = decoded.domain.subdomain\n    const domain: Domain | undefined = await getRepository(Domain).findOne({\n      where: { subdomain }\n    })\n    if (!domain) throw new Error('Domain is not found')\n    const appKey: string = decoded.application.appKey\n    const scopes: any[] = decoded.scope\n\n    const newAccessToken: string = Application.generateAccessToken(domain, appUser, appKey, scopes)\n    const newRefreshToken: string = Application.generateRefreshToken(domain, appUser, appKey, scopes)\n\n    appUser.password = newRefreshToken\n    await getRepository(User).save(appUser)\n\n    setAccessTokenCookie(context, newAccessToken)\n\n    context.body = {\n      accessToken: newAccessToken,\n      refreshToken: newRefreshToken\n    }\n  } catch (e) {\n    context.status = 401\n    context.body = e.message\n  }\n})\n\noauth2Router.get('/profile', jwtAuthenticateMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const { name, description, email, userType: type, locale } = user\n  const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {}\n\n  var application = {}\n  if (type == 'application') {\n    /* user entity에 reference 필드가 추가되기 전까지, appKey취득 방법임. */\n    application['appKey'] = email.substr(0, email.lastIndexOf('@'))\n  }\n\n  context.body = {\n    profile: {\n      name,\n      description,\n      email,\n      type /* (admin|user|application|appliance) */,\n      domain: {\n        name: domainName,\n        subdomain,\n        brandName,\n        brandImage,\n        contentImage,\n        timezone\n      },\n      application\n    }\n  }\n})\n\noauth2Router.post('/disconnect', jwtAuthenticateMiddleware, async (context, next) => {\n  try {\n    let { user } = context.state\n\n    if (typeof process.oauthDisconnect === 'function') {\n      await process.oauthDisconnect(user)\n    } else {\n      user.domains = []\n      user.roles = []\n      user.status = UserStatus.DELETED\n      await getRepository(User).save(user)\n    }\n    context.status = 200\n    context.body = 'ok'\n  } catch (e) {\n    throw e\n  }\n})\n"]}

package/dist-server/router/oauth2/oauth2-server.js

@@ -6,9 +6,9 @@ const oauth2orize_koa_1 = tslib_1.__importDefault(require("oauth2orize-koa"));
 const typeorm_1 = require("typeorm");
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const application_1 = require("../../service/application/application");
-const role_1 = require("../../service/role/role");
-const user_1 = require("../../service/user/user");
+const application_js_1 = require("../../service/application/application.js");
+const role_js_1 = require("../../service/role/role.js");
+const user_js_1 = require("../../service/user/user.js");
 const crypto = require('crypto');
 exports.NOTFOUND = 'NOTFOUND';
 exports.NonClient = {
@@ -35,7 +35,7 @@ exports.server.deserializeClient(async function (id) {
     if (id == exports.NOTFOUND) {
         return {};
     }
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({ id });
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({ id });
     return application;
 });
 // Register supported grant types.
@@ -52,7 +52,7 @@ exports.server.deserializeClient(async function (id) {
 // values, and will be exchanged for an access token.
 exports.server.grant(oauth2orize_koa_1.default.grant.code(async (client, redirectUrl, user, ares, areq) => {
     const { email, appKey, subdomain, scopes, state } = ares;
-    return application_1.Application.generateAuthCode(email, appKey, subdomain, scopes, state);
+    return application_js_1.Application.generateAuthCode(email, appKey, subdomain, scopes, state);
 }));
 // Exchange authorization codes for access tokens.  The callback accepts the
 // `client`, which is exchanging `code` and any `redirectURI` from the
@@ -62,13 +62,13 @@ exports.server.grant(oauth2orize_koa_1.default.grant.code(async (client, redirec
 exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, code, redirectUrl) => {
     try {
         /* authorization code */
-        var decoded = application_1.Application.verifyAuthCode(code);
+        var decoded = application_js_1.Application.verifyAuthCode(code);
     }
     catch (e) {
         return false;
     }
     let { email, appKey, subdomain, scopes } = decoded;
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({
         appKey
     });
     if (!application) {
@@ -89,9 +89,9 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
     const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({
         subdomain
     });
-    const creator = await (0, shell_1.getRepository)(user_1.User).findOneBy({ email: (0, typeorm_1.ILike)(email) });
+    const creator = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({ email: (0, typeorm_1.ILike)(email) });
     const appuserEmail = `${crypto.randomUUID()}@${subdomain}`;
-    var appuser = await (0, shell_1.getRepository)(user_1.User).findOne({
+    var appuser = await (0, shell_1.getRepository)(user_js_1.User).findOne({
         where: {
             email: appuserEmail,
             reference: application.id,
@@ -99,7 +99,7 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
         },
         relations: ['domains', 'creator', 'updater']
     });
-    appuser = await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, (appuser || {})), { email: appuserEmail, name: application.name, userType: 'application', reference: application.id, domains: [domain], roles: scopes, status: user_1.UserStatus.ACTIVATED, updater: creator, creator }));
+    appuser = await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, (appuser || {})), { email: appuserEmail, name: application.name, userType: 'application', reference: application.id, domains: [domain], roles: scopes, status: user_js_1.UserStatus.ACTIVATED, updater: creator, creator }));
     // appuser = await getRepository(User).findOne({
     //   where: { email: ILike(appuserEmail) },
     //   relations: ['domains']
@@ -108,9 +108,9 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
     // await getRepository(User).save(appuser)
     // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.
     // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.
-    var accessToken = application_1.Application.generateAccessToken(domain, appuser, appKey, scopes);
-    var refreshToken = application_1.Application.generateRefreshToken(domain, appuser, appKey, scopes);
-    await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, appuser), { password: refreshToken }));
+    var accessToken = application_js_1.Application.generateAccessToken(domain, appuser, appKey, scopes);
+    var refreshToken = application_js_1.Application.generateRefreshToken(domain, appuser, appKey, scopes);
+    await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, appuser), { password: refreshToken }));
     return [
         accessToken,
         refreshToken,
@@ -124,14 +124,14 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
 exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (client, refreshToken, scope) => {
     try {
         /* refresh token */
-        var decoded = application_1.Application.verifyAuthCode(refreshToken);
+        var decoded = application_js_1.Application.verifyAuthCode(refreshToken);
     }
     catch (e) {
         env_1.logger.error(e);
         return false;
     }
     const { id, userType, email, application: { appKey }, domain: { subdomain }, scope: originalScope, exp: expires_in } = decoded;
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({
         appKey
     });
     if (!application) {
@@ -145,12 +145,12 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (c
     const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({
         subdomain
     });
-    const creator = await (0, shell_1.getRepository)(user_1.User).findOneBy({
+    const creator = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({
         id,
         userType
     });
     const appuserEmail = `${appKey}@${subdomain}`;
-    var appuser = await (0, shell_1.getRepository)(user_1.User).findOne({
+    var appuser = await (0, shell_1.getRepository)(user_js_1.User).findOne({
         where: {
             email: appuserEmail,
             reference: application.id,
@@ -173,13 +173,13 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (c
         env_1.logger.error(`additional scope(${additionalScope}) required`);
         return false;
     }
-    const roles = await (0, shell_1.getRepository)(role_1.Role).findBy({
+    const roles = await (0, shell_1.getRepository)(role_js_1.Role).findBy({
         name: (0, typeorm_1.In)(scopes),
         domain: { id: domain.id }
     });
-    var accessToken = application_1.Application.generateAccessToken(domain, appuser, appKey, scope);
-    var refreshToken = application_1.Application.generateRefreshToken(domain, appuser, appKey, scope);
-    await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, appuser), { roles, password: refreshToken }));
+    var accessToken = application_js_1.Application.generateAccessToken(domain, appuser, appKey, scope);
+    var refreshToken = application_js_1.Application.generateRefreshToken(domain, appuser, appKey, scope);
+    await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, appuser), { roles, password: refreshToken }));
     return [
         accessToken,
         refreshToken,

package/dist-server/router/oauth2/oauth2-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-server.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-server.ts"],"names":[],"mappings":";;;;AAAA,8EAAyC;AACzC,qCAAmC;AAEnC,6CAA4C;AAC5C,iDAA6D;AAE7D,uEAAmE;AACnE,kDAA8C;AAC9C,kDAA0D;AAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnB,QAAA,QAAQ,GAAG,UAAU,CAAA;AACrB,QAAA,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAQ;CACb,CAAA;AAED,0BAA0B;AACb,QAAA,MAAM,GAAG,yBAAW,CAAC,YAAY,EAAE,CAAA;AAEhD,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,sCAAsC;AAEtC,cAAM,CAAC,eAAe,CAAC,KAAK,WAAW,MAAM;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC,CAAC,CAAA;AAEF,cAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW,EAAE;IACzC,IAAI,EAAE,IAAI,gBAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,OAAO,WAAW,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AAEjC,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AAErD,cAAM,CAAC,KAAK,CACV,yBAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAExD,OAAO,yBAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC,CAAC,CACH,CAAA;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,8EAA8E;AAC9E,QAAQ;AAER,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,OAAO,GAAQ,yBAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAElD,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,sGAAsG;IACtG,kBAAkB;IAClB,wFAAwF;IACxF,mBAAmB;IACnB,8BAA8B;IAC9B,MAAM;IACN,oBAAoB;IACpB,yBAAyB;IACzB,uIAAuI;IACvI,MAAM;IACN,IAAI;IAEJ,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,CAAA;IAE1D,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QAED,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACnC,CAAC,OAAO,IAAI,EAAE,CAAC,KAClB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EACtB,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,WAAW,CAAC,EAAE,EACzB,OAAO,EAAE,CAAC,MAAM,CAAC,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,iBAAU,CAAC,SAAS,EAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,IACP,CAAA;IAEF,gDAAgD;IAChD,2CAA2C;IAC3C,2BAA2B;IAC3B,KAAK;IAEL,8CAA8C;IAC9C,0CAA0C;IAC1C,yEAAyE;IACzE,qEAAqE;IAErE,IAAI,WAAW,GAAG,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAClF,IAAI,YAAY,GAAG,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpF,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,mBAAmB;QACnB,IAAI,OAAO,GAAQ,yBAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EACJ,EAAE,EACF,QAAQ,EACR,KAAK,EACL,WAAW,EAAE,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EACrB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,EAChB,GAAG,OAAO,CAAA;IAEX,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC;QACxD,EAAE;QACF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAA;IAE7C,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IAEH,KAAK,GAAG,KAAK,IAAI,aAAa,CAAA;IAE9B,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,YAAM,CAAC,KAAK,CAAC,oBAAoB,eAAe,YAAY,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,WAAW,GAAG,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjF,IAAI,YAAY,GAAQ,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAExF,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,KAAK,EACL,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;SACrB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA","sourcesContent":["import oauth2orize from 'oauth2orize-koa'\nimport { ILike, In } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Application } from '../../service/application/application'\nimport { Role } from '../../service/role/role'\nimport { User, UserStatus } from '../../service/user/user'\n\nconst crypto = require('crypto')\n\nexport const NOTFOUND = 'NOTFOUND'\nexport const NonClient = {\n  id: NOTFOUND\n}\n\n// create OAuth 2.0 server\nexport const server = oauth2orize.createServer()\n\n// Register serialialization and deserialization functions.\n//\n// When a client redirects a user to user authorization endpoint, an\n// authorization transaction is initiated.  To complete the transaction, the\n// user must authenticate and approve the authorization request.  Because this\n// may involve multiple HTTP request/response exchanges, the transaction is\n// stored in the session.\n//\n// An application must supply serialization functions, which determine how the\n// client object is serialized into the session.  Typically this will be a\n// simple matter of serializing the client's ID, and deserializing by finding\n// the client by ID from the database.\n\nserver.serializeClient(async function (client) {\n  return client.id\n})\n\nserver.deserializeClient(async function (id) {\n  if (id == NOTFOUND) {\n    return {}\n  }\n\n  const application = await getRepository(Application).findOneBy({ id })\n  return application\n})\n\n// Register supported grant types.\n//\n// OAuth 2.0 specifies a framework that allows users to grant client\n// applications limited access to their protected resources.  It does this\n// through a process of the user granting access, and the client exchanging\n// the grant for an access token.\n\n// Grant authorization codes.  The callback takes the `client` requesting\n// authorization, the `redirectURI` (which is used as a verifier in the\n// subsequent exchange), the authenticated `user` granting access, and\n// their response, which contains approved scope, duration, etc. as parsed by\n// the application.  The application issues a code, which is bound to these\n// values, and will be exchanged for an access token.\n\nserver.grant(\n  oauth2orize.grant.code(async (client, redirectUrl, user, ares, areq) => {\n    const { email, appKey, subdomain, scopes, state } = ares\n\n    return Application.generateAuthCode(email, appKey, subdomain, scopes, state)\n  })\n)\n\n// Exchange authorization codes for access tokens.  The callback accepts the\n// `client`, which is exchanging `code` and any `redirectURI` from the\n// authorization request for verification.  If these values are validated, the\n// application issues an access token on behalf of the user who authorized the\n// code.\n\nserver.exchange(\n  oauth2orize.exchange.code(async (client, code, redirectUrl) => {\n    try {\n      /* authorization code */\n      var decoded: any = Application.verifyAuthCode(code)\n    } catch (e) {\n      return false\n    }\n    let { email, appKey, subdomain, scopes } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      return false\n    }\n\n    /* DONT-FORGET uncomment after test */\n    // if (redirectUrl !== application.redirectUrl && redirectUrl.indexOf(application.redirectUrl) != 0) {\n    //   logger.error(\n    //     'oauth2 exchange error - redirectUrl should begins with the application setting',\n    //     redirectUrl,\n    //     application.redirectUrl\n    //   )\n    //   // return false\n    //   throw new TypeError(\n    //     `oauth2 exchange error - redirectUrl should begins with the application setting : '${redirectUrl}':'${application.redirectUrl}'`\n    //   )\n    // }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({ email: ILike(email) })\n\n    const appuserEmail = `${crypto.randomUUID()}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n\n      relations: ['domains', 'creator', 'updater']\n    })\n\n    appuser = await getRepository(User).save({\n      ...(appuser || {}),\n      email: appuserEmail,\n      name: application.name,\n      userType: 'application',\n      reference: application.id,\n      domains: [domain],\n      roles: scopes,\n      status: UserStatus.ACTIVATED,\n      updater: creator,\n      creator\n    })\n\n    // appuser = await getRepository(User).findOne({\n    //   where: { email: ILike(appuserEmail) },\n    //   relations: ['domains']\n    // })\n\n    // appuser.domains = Promise.resolve([domain])\n    // await getRepository(User).save(appuser)\n    // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.\n    // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scopes)\n    var refreshToken = Application.generateRefreshToken(domain, appuser, appKey, scopes)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer',\n        centerId: subdomain\n      }\n    ]\n  })\n)\n\nserver.exchange(\n  oauth2orize.exchange.refreshToken(async (client, refreshToken, scope) => {\n    try {\n      /* refresh token */\n      var decoded: any = Application.verifyAuthCode(refreshToken)\n    } catch (e) {\n      logger.error(e)\n      return false\n    }\n    const {\n      id,\n      userType,\n      email,\n      application: { appKey },\n      domain: { subdomain },\n      scope: originalScope,\n      exp: expires_in\n    } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      logger.error('application is not exist')\n      return false\n    }\n\n    if (Date.now() > expires_in * 1000) {\n      logger.error('refresh token is expired')\n      return false\n    }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({\n      id,\n      userType\n    })\n\n    const appuserEmail = `${appKey}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n      relations: ['domain', 'creator', 'updater']\n    })\n\n    if (!appuser) {\n      logger.error('application is not bound')\n      return false\n    }\n\n    /*\n     * `scope` is the scope of access requested by the client, which must not include any scope not originally granted.\n     */\n\n    scope = scope || originalScope\n\n    const scopes: string[] = scope.split(',')\n    const originalScopes = (originalScope || '').split(',')\n    const additionalScope = scopes.find(scope => originalScopes.indexOf(scope) === -1)\n    if (additionalScope) {\n      logger.error(`additional scope(${additionalScope}) required`)\n      return false\n    }\n\n    const roles = await getRepository(Role).findBy({\n      name: In(scopes),\n      domain: { id: domain.id }\n    })\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scope)\n    var refreshToken: any = Application.generateRefreshToken(domain, appuser, appKey, scope)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      roles,\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer'\n      }\n    ]\n  })\n)\n"]}
+{"version":3,"file":"oauth2-server.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-server.ts"],"names":[],"mappings":";;;;AAAA,8EAAyC;AACzC,qCAAmC;AAEnC,6CAA4C;AAC5C,iDAA6D;AAE7D,6EAAsE;AACtE,wDAAiD;AACjD,wDAA6D;AAE7D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnB,QAAA,QAAQ,GAAG,UAAU,CAAA;AACrB,QAAA,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAQ;CACb,CAAA;AAED,0BAA0B;AACb,QAAA,MAAM,GAAG,yBAAW,CAAC,YAAY,EAAE,CAAA;AAEhD,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,sCAAsC;AAEtC,cAAM,CAAC,eAAe,CAAC,KAAK,WAAW,MAAM;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC,CAAC,CAAA;AAEF,cAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW,EAAE;IACzC,IAAI,EAAE,IAAI,gBAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,OAAO,WAAW,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AAEjC,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AAErD,cAAM,CAAC,KAAK,CACV,yBAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAExD,OAAO,4BAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC,CAAC,CACH,CAAA;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,8EAA8E;AAC9E,QAAQ;AAER,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAElD,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,sGAAsG;IACtG,kBAAkB;IAClB,wFAAwF;IACxF,mBAAmB;IACnB,8BAA8B;IAC9B,MAAM;IACN,oBAAoB;IACpB,yBAAyB;IACzB,uIAAuI;IACvI,MAAM;IACN,IAAI;IAEJ,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,CAAA;IAE1D,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QAED,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACnC,CAAC,OAAO,IAAI,EAAE,CAAC,KAClB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EACtB,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,WAAW,CAAC,EAAE,EACzB,OAAO,EAAE,CAAC,MAAM,CAAC,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,oBAAU,CAAC,SAAS,EAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,IACP,CAAA;IAEF,gDAAgD;IAChD,2CAA2C;IAC3C,2BAA2B;IAC3B,KAAK;IAEL,8CAA8C;IAC9C,0CAA0C;IAC1C,yEAAyE;IACzE,qEAAqE;IAErE,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAClF,IAAI,YAAY,GAAG,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,mBAAmB;QACnB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EACJ,EAAE,EACF,QAAQ,EACR,KAAK,EACL,WAAW,EAAE,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EACrB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,EAChB,GAAG,OAAO,CAAA;IAEX,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACxD,EAAE;QACF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAA;IAE7C,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IAEH,KAAK,GAAG,KAAK,IAAI,aAAa,CAAA;IAE9B,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,YAAM,CAAC,KAAK,CAAC,oBAAoB,eAAe,YAAY,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjF,IAAI,YAAY,GAAQ,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAExF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,KAAK,EACL,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;SACrB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA","sourcesContent":["import oauth2orize from 'oauth2orize-koa'\nimport { ILike, In } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Application } from '../../service/application/application.js'\nimport { Role } from '../../service/role/role.js'\nimport { User, UserStatus } from '../../service/user/user.js'\n\nconst crypto = require('crypto')\n\nexport const NOTFOUND = 'NOTFOUND'\nexport const NonClient = {\n  id: NOTFOUND\n}\n\n// create OAuth 2.0 server\nexport const server = oauth2orize.createServer()\n\n// Register serialialization and deserialization functions.\n//\n// When a client redirects a user to user authorization endpoint, an\n// authorization transaction is initiated.  To complete the transaction, the\n// user must authenticate and approve the authorization request.  Because this\n// may involve multiple HTTP request/response exchanges, the transaction is\n// stored in the session.\n//\n// An application must supply serialization functions, which determine how the\n// client object is serialized into the session.  Typically this will be a\n// simple matter of serializing the client's ID, and deserializing by finding\n// the client by ID from the database.\n\nserver.serializeClient(async function (client) {\n  return client.id\n})\n\nserver.deserializeClient(async function (id) {\n  if (id == NOTFOUND) {\n    return {}\n  }\n\n  const application = await getRepository(Application).findOneBy({ id })\n  return application\n})\n\n// Register supported grant types.\n//\n// OAuth 2.0 specifies a framework that allows users to grant client\n// applications limited access to their protected resources.  It does this\n// through a process of the user granting access, and the client exchanging\n// the grant for an access token.\n\n// Grant authorization codes.  The callback takes the `client` requesting\n// authorization, the `redirectURI` (which is used as a verifier in the\n// subsequent exchange), the authenticated `user` granting access, and\n// their response, which contains approved scope, duration, etc. as parsed by\n// the application.  The application issues a code, which is bound to these\n// values, and will be exchanged for an access token.\n\nserver.grant(\n  oauth2orize.grant.code(async (client, redirectUrl, user, ares, areq) => {\n    const { email, appKey, subdomain, scopes, state } = ares\n\n    return Application.generateAuthCode(email, appKey, subdomain, scopes, state)\n  })\n)\n\n// Exchange authorization codes for access tokens.  The callback accepts the\n// `client`, which is exchanging `code` and any `redirectURI` from the\n// authorization request for verification.  If these values are validated, the\n// application issues an access token on behalf of the user who authorized the\n// code.\n\nserver.exchange(\n  oauth2orize.exchange.code(async (client, code, redirectUrl) => {\n    try {\n      /* authorization code */\n      var decoded: any = Application.verifyAuthCode(code)\n    } catch (e) {\n      return false\n    }\n    let { email, appKey, subdomain, scopes } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      return false\n    }\n\n    /* DONT-FORGET uncomment after test */\n    // if (redirectUrl !== application.redirectUrl && redirectUrl.indexOf(application.redirectUrl) != 0) {\n    //   logger.error(\n    //     'oauth2 exchange error - redirectUrl should begins with the application setting',\n    //     redirectUrl,\n    //     application.redirectUrl\n    //   )\n    //   // return false\n    //   throw new TypeError(\n    //     `oauth2 exchange error - redirectUrl should begins with the application setting : '${redirectUrl}':'${application.redirectUrl}'`\n    //   )\n    // }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({ email: ILike(email) })\n\n    const appuserEmail = `${crypto.randomUUID()}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n\n      relations: ['domains', 'creator', 'updater']\n    })\n\n    appuser = await getRepository(User).save({\n      ...(appuser || {}),\n      email: appuserEmail,\n      name: application.name,\n      userType: 'application',\n      reference: application.id,\n      domains: [domain],\n      roles: scopes,\n      status: UserStatus.ACTIVATED,\n      updater: creator,\n      creator\n    })\n\n    // appuser = await getRepository(User).findOne({\n    //   where: { email: ILike(appuserEmail) },\n    //   relations: ['domains']\n    // })\n\n    // appuser.domains = Promise.resolve([domain])\n    // await getRepository(User).save(appuser)\n    // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.\n    // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scopes)\n    var refreshToken = Application.generateRefreshToken(domain, appuser, appKey, scopes)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer',\n        centerId: subdomain\n      }\n    ]\n  })\n)\n\nserver.exchange(\n  oauth2orize.exchange.refreshToken(async (client, refreshToken, scope) => {\n    try {\n      /* refresh token */\n      var decoded: any = Application.verifyAuthCode(refreshToken)\n    } catch (e) {\n      logger.error(e)\n      return false\n    }\n    const {\n      id,\n      userType,\n      email,\n      application: { appKey },\n      domain: { subdomain },\n      scope: originalScope,\n      exp: expires_in\n    } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      logger.error('application is not exist')\n      return false\n    }\n\n    if (Date.now() > expires_in * 1000) {\n      logger.error('refresh token is expired')\n      return false\n    }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({\n      id,\n      userType\n    })\n\n    const appuserEmail = `${appKey}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n      relations: ['domain', 'creator', 'updater']\n    })\n\n    if (!appuser) {\n      logger.error('application is not bound')\n      return false\n    }\n\n    /*\n     * `scope` is the scope of access requested by the client, which must not include any scope not originally granted.\n     */\n\n    scope = scope || originalScope\n\n    const scopes: string[] = scope.split(',')\n    const originalScopes = (originalScope || '').split(',')\n    const additionalScope = scopes.find(scope => originalScopes.indexOf(scope) === -1)\n    if (additionalScope) {\n      logger.error(`additional scope(${additionalScope}) required`)\n      return false\n    }\n\n    const roles = await getRepository(Role).findBy({\n      name: In(scopes),\n      domain: { id: domain.id }\n    })\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scope)\n    var refreshToken: any = Application.generateRefreshToken(domain, appuser, appKey, scope)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      roles,\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer'\n      }\n    ]\n  })\n)\n"]}

package/dist-server/router/site-root-router.js

@@ -6,15 +6,15 @@ const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
-const user_1 = require("../service/user/user");
-const get_user_domains_1 = require("../utils/get-user-domains");
+const user_js_1 = require("../service/user/user.js");
+const get_user_domains_js_1 = require("../utils/get-user-domains.js");
 const PUBLIC_HOME_ROUTE = env_1.config.get('publicHomeRoute', '/public/home');
 exports.siteRootRouter = new koa_router_1.default();
 async function findAuth(context, next) {
     return await koa_passport_1.default.authenticate('jwt', { session: false }, async (err, decoded, info) => {
         if (decoded) {
             try {
-                const user = await user_1.User.checkAuth(decoded);
+                const user = await user_js_1.User.checkAuth(decoded);
                 context.state.user = user;
             }
             catch (e) { }
@@ -26,7 +26,7 @@ exports.siteRootRouter.get('/', findAuth, shell_1.domainMiddleware, async (conte
     const { user, domain } = context.state;
     const subdomain = domain === null || domain === void 0 ? void 0 : domain.subdomain;
     if (user && subdomain) {
-        const userDomains = await (0, get_user_domains_1.getUserDomains)(user);
+        const userDomains = await (0, get_user_domains_js_1.getUserDomains)(user);
         if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {
             return await next();
         }

package/dist-server/router/site-root-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,+CAA2C;AAC3C,gEAA0D;AAE1D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IACnC,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,iCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user'\nimport { getUserDomains } from '../utils/get-user-domains'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\nasync function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}
+{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,qDAA8C;AAC9C,sEAA6D;AAE7D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IACnC,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\nasync function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}

package/dist-server/router/webauthn-router.js

@@ -6,16 +6,63 @@ const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
 const server_1 = require("@simplewebauthn/server");
-const web_auth_credential_1 = require("../service/web-auth-credential/web-auth-credential");
-const access_token_cookie_1 = require("../utils/access-token-cookie");
-const webauthn_middleware_1 = require("../middlewares/webauthn-middleware");
+const web_auth_credential_js_1 = require("../service/web-auth-credential/web-auth-credential.js");
+const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
+const webauthn_middleware_js_1 = require("../middlewares/webauthn-middleware.js");
 exports.webAuthnGlobalPublicRouter = new koa_router_1.default();
 exports.webAuthnGlobalPrivateRouter = new koa_router_1.default();
 const { name: rpName } = env_1.appPackage;
+// Generate authentication challenge for the currently logged-in user
+exports.webAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async (context, next) => {
+    const { user } = context.state;
+    const rpID = context.hostname;
+    if (!user) {
+        context.status = 401;
+        context.body = { error: 'User not authenticated' };
+        return;
+    }
+    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({
+        where: { user: { id: user.id } }
+    });
+    if (webAuthCredentials.length === 0) {
+        context.status = 400;
+        context.body = { error: 'No biometric credentials registered for this user' };
+        return;
+    }
+    const options = await (0, server_1.generateAuthenticationOptions)({
+        rpID,
+        userVerification: 'preferred',
+        allowCredentials: webAuthCredentials.map(credential => ({
+            id: credential.credentialId,
+            type: 'public-key'
+        }))
+    });
+    context.session.challenge = options.challenge;
+    context.body = options;
+});
+// Verify biometric authentication
+exports.webAuthnGlobalPrivateRouter.post('/auth/verify-webauthn', 
+/* reuse webauthn-login as webauthn-verify strategy */
+(0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
+    const { user } = context.state;
+    const { request } = context;
+    const { body: reqBody } = request;
+    if (!user) {
+        context.status = 401;
+        context.body = { verified: false, message: 'User not authenticated' };
+        return;
+    }
+    context.body = {
+        verified: true,
+        message: 'Biometric authentication successful'
+    };
+    await next();
+});
+// Generate registration challenge for the currently logged-in user
 exports.webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {
     const { user } = context.state;
     const rpID = context.hostname;
-    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential).find({
+    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({
         where: {
             user: { id: user.id }
         }
@@ -45,7 +92,9 @@ exports.webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', asy
     context.session.challenge = options.challenge;
     context.body = options;
 });
-exports.webAuthnGlobalPrivateRouter.post('/auth/verify-registration', (0, webauthn_middleware_1.createWebAuthnMiddleware)('webauthn-register'));
+// Verify registration
+exports.webAuthnGlobalPrivateRouter.post('/auth/verify-registration', (0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-register'));
+// Generate sign-in challenge
 exports.webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {
     const rpID = context.hostname;
     const options = await (0, server_1.generateAuthenticationOptions)({
@@ -55,14 +104,15 @@ exports.webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async
     context.session.challenge = options.challenge;
     context.body = options;
 });
-exports.webAuthnGlobalPublicRouter.post('/auth/signin-webauthn', (0, webauthn_middleware_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
+// Sign in with biometric authentication
+exports.webAuthnGlobalPublicRouter.post('/auth/signin-webauthn', (0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
     const { domain, user } = context.state;
     const { request } = context;
     const { body: reqBody } = request;
     const token = await user.sign({ subdomain: domain === null || domain === void 0 ? void 0 : domain.subdomain });
-    (0, access_token_cookie_1.setAccessTokenCookie)(context, token);
+    (0, access_token_cookie_js_1.setAccessTokenCookie)(context, token);
     var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`;
-    /* 2단계 인터렉션 때문에 브라우저에서 fetch(...)로 진행될 것이므로, redirect(3xx) 응답으로 처리할 수 없다. 따라서, 데이타로 redirectURL를 응답한다. */
+    /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */
     context.body = { redirectURL, verified: true };
     await next();
 });