@things-factory/auth-base 9.0.0-beta.0 → 9.0.0-beta.12

package/dist-server/router/oauth2/oauth2-router.js

@@ -7,16 +7,16 @@ const koa_compose_1 = tslib_1.__importDefault(require("koa-compose"));
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const shell_1 = require("@things-factory/shell");
-const middlewares_1 = require("../../middlewares");
-const application_1 = require("../../service/application/application");
-const user_1 = require("../../service/user/user");
-const access_token_cookie_1 = require("../../utils/access-token-cookie");
-const get_secret_1 = require("../../utils/get-secret");
-const oauth2_server_1 = require("./oauth2-server");
-const passport_oauth2_client_password_1 = require("./passport-oauth2-client-password");
+const index_js_1 = require("../../middlewares/index.js");
+const application_js_1 = require("../../service/application/application.js");
+const user_js_1 = require("../../service/user/user.js");
+const access_token_cookie_js_1 = require("../../utils/access-token-cookie.js");
+const get_secret_js_1 = require("../../utils/get-secret.js");
+const oauth2_server_js_1 = require("./oauth2-server.js");
+const passport_oauth2_client_password_js_1 = require("./passport-oauth2-client-password.js");
 exports.oauth2Router = new koa_router_1.default();
-koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_password_1.Strategy({}, (clientId, clientSecret, done) => {
-    (0, shell_1.getRepository)(application_1.Application)
+koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_password_js_1.Strategy({}, (clientId, clientSecret, done) => {
+    (0, shell_1.getRepository)(application_js_1.Application)
         .findOneBy({
         appKey: clientId
     })
@@ -35,7 +35,7 @@ koa_passport_1.default.use('oauth2-client-password', new passport_oauth2_client_
 // requested by a client application.  Based on the grant type requested by the
 // client, the above grant middleware configured above will be invoked to send
 // a response.
-exports.oauth2Router.post('/decision', middlewares_1.jwtAuthenticateMiddleware, (0, koa_compose_1.default)(oauth2_server_1.server.decision(async function (context) {
+exports.oauth2Router.post('/decision', index_js_1.jwtAuthenticateMiddleware, (0, koa_compose_1.default)(oauth2_server_js_1.server.decision(async function (context) {
     const { request } = context;
     return request.body;
 })));
@@ -45,19 +45,19 @@ exports.oauth2Router.post('/decision', middlewares_1.jwtAuthenticateMiddleware,
 // for access tokens.  Based on the grant type being exchanged, the above
 // exchange middleware will be invoked to handle the request.  Clients must
 // authenticate when making requests to this endpoint.
-exports.oauth2Router.post('/access-token', koa_passport_1.default.authenticate('oauth2-client-password', { session: false }), oauth2_server_1.server.token(), oauth2_server_1.server.errorHandler());
+exports.oauth2Router.post('/access-token', koa_passport_1.default.authenticate('oauth2-client-password', { session: false }), oauth2_server_js_1.server.token(), oauth2_server_js_1.server.errorHandler());
 exports.oauth2Router.post('/refresh-token', async (context, next) => {
     var _a, _b;
     const refreshToken = (_b = (_a = context.request) === null || _a === void 0 ? void 0 : _a.body) === null || _b === void 0 ? void 0 : _b.refreshToken;
     if (!refreshToken)
         throw new Error('Missing refresh token');
-    const appUser = await (0, shell_1.getRepository)(user_1.User).findOneBy({
+    const appUser = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({
         password: refreshToken
     });
     if (!appUser)
         throw new Error('App user is not found');
     try {
-        jsonwebtoken_1.default.verify(refreshToken, get_secret_1.SECRET);
+        jsonwebtoken_1.default.verify(refreshToken, get_secret_js_1.SECRET);
         const decoded = jsonwebtoken_1.default.decode(refreshToken);
         const subdomain = decoded.domain.subdomain;
         const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOne({
@@ -67,11 +67,11 @@ exports.oauth2Router.post('/refresh-token', async (context, next) => {
             throw new Error('Domain is not found');
         const appKey = decoded.application.appKey;
         const scopes = decoded.scope;
-        const newAccessToken = application_1.Application.generateAccessToken(domain, appUser, appKey, scopes);
-        const newRefreshToken = application_1.Application.generateRefreshToken(domain, appUser, appKey, scopes);
+        const newAccessToken = application_js_1.Application.generateAccessToken(domain, appUser, appKey, scopes);
+        const newRefreshToken = application_js_1.Application.generateRefreshToken(domain, appUser, appKey, scopes);
         appUser.password = newRefreshToken;
-        await (0, shell_1.getRepository)(user_1.User).save(appUser);
-        (0, access_token_cookie_1.setAccessTokenCookie)(context, newAccessToken);
+        await (0, shell_1.getRepository)(user_js_1.User).save(appUser);
+        (0, access_token_cookie_js_1.setAccessTokenCookie)(context, newAccessToken);
         context.body = {
             accessToken: newAccessToken,
             refreshToken: newRefreshToken
@@ -82,7 +82,7 @@ exports.oauth2Router.post('/refresh-token', async (context, next) => {
         context.body = e.message;
     }
 });
-exports.oauth2Router.get('/profile', middlewares_1.jwtAuthenticateMiddleware, async (context, next) => {
+exports.oauth2Router.get('/profile', index_js_1.jwtAuthenticateMiddleware, async (context, next) => {
     const { user, domain } = context.state;
     const { name, description, email, userType: type, locale } = user;
     const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {};
@@ -109,7 +109,7 @@ exports.oauth2Router.get('/profile', middlewares_1.jwtAuthenticateMiddleware, as
         }
     };
 });
-exports.oauth2Router.post('/disconnect', middlewares_1.jwtAuthenticateMiddleware, async (context, next) => {
+exports.oauth2Router.post('/disconnect', index_js_1.jwtAuthenticateMiddleware, async (context, next) => {
     try {
         let { user } = context.state;
         if (typeof process.oauthDisconnect === 'function') {
@@ -118,8 +118,8 @@ exports.oauth2Router.post('/disconnect', middlewares_1.jwtAuthenticateMiddleware
         else {
             user.domains = [];
             user.roles = [];
-            user.status = user_1.UserStatus.DELETED;
-            await (0, shell_1.getRepository)(user_1.User).save(user);
+            user.status = user_js_1.UserStatus.DELETED;
+            await (0, shell_1.getRepository)(user_js_1.User).save(user);
         }
         context.status = 200;
         context.body = 'ok';

package/dist-server/router/oauth2/oauth2-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-router.ts"],"names":[],"mappings":";;;;AAAA,wEAA8B;AAC9B,sEAAiC;AACjC,wEAAmC;AACnC,oEAA+B;AAE/B,iDAA6D;AAE7D,mDAA6D;AAC7D,uEAAmE;AACnE,kDAA0D;AAC1D,yEAAsE;AACtE,uDAA+C;AAC/C,mDAA6D;AAC7D,uFAAsF;AAUzE,QAAA,YAAY,GAAG,IAAI,oBAAM,EAAE,CAAA;AAExC,sBAAQ,CAAC,GAAG,CACV,wBAAwB,EACxB,IAAI,0CAAsB,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;IAC9D,IAAA,qBAAa,EAAC,yBAAW,CAAC;SACvB,SAAS,CAAC;QACT,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5B,CAAC,CAAC,CACH,CAAA;AAED,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AAEd,oBAAY,CAAC,IAAI,CACf,WAAW,EACX,uCAAyB,EACzB,IAAA,qBAAO,EACL,sBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,OAAO;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC,CAAC,CACH,CACF,CAAA;AAED,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AAEtD,oBAAY,CAAC,IAAI,CACf,eAAe,EACf,sBAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACnE,sBAAiB,CAAC,KAAK,EAAE,EACzB,sBAAiB,CAAC,YAAY,EAAE,CACjC,CAAA;AAED,oBAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;;IAC1D,MAAM,YAAY,GAAuB,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,0CAAE,YAAY,CAAA;IAC5E,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE3D,MAAM,OAAO,GAAqB,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,mBAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,CAAQ,CAAA;QAC/C,MAAM,SAAS,GAAW,OAAO,CAAC,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,MAAM,GAAuB,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QACjD,MAAM,MAAM,GAAU,OAAO,CAAC,KAAK,CAAA;QAEnC,MAAM,cAAc,GAAW,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/F,MAAM,eAAe,GAAW,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAEjG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAA;QAClC,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAA,0CAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAE7C,OAAO,CAAC,IAAI,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,GAAG,CAAC,UAAU,EAAE,uCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;IAEnG,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1B,wDAAwD;QACxD,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,KAAK;YACL,IAAI,CAAC,wCAAwC;YAC7C,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ;aACT;YACD,WAAW;SACZ;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,IAAI,CAAC,aAAa,EAAE,uCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,iBAAU,CAAC,OAAO,CAAA;YAChC,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import jwt from 'jsonwebtoken'\nimport compose from 'koa-compose'\nimport passport from 'koa-passport'\nimport Router from 'koa-router'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { jwtAuthenticateMiddleware } from '../../middlewares'\nimport { Application } from '../../service/application/application'\nimport { User, UserStatus } from '../../service/user/user'\nimport { setAccessTokenCookie } from '../../utils/access-token-cookie'\nimport { SECRET } from '../../utils/get-secret'\nimport { server as oauth2orizeServer } from './oauth2-server'\nimport { Strategy as ClientPasswordStrategy } from './passport-oauth2-client-password'\n\ndeclare global {\n  namespace NodeJS {\n    interface Process {\n      oauthDisconnect: (user: User) => Promise<void>\n    }\n  }\n}\n\nexport const oauth2Router = new Router()\n\npassport.use(\n  'oauth2-client-password',\n  new ClientPasswordStrategy({}, (clientId, clientSecret, done) => {\n    getRepository(Application)\n      .findOneBy({\n        appKey: clientId\n      })\n      .then(client => {\n        if (!client || client.appSecret != clientSecret) {\n          done(null, false)\n          return\n        }\n\n        done(null, client)\n      })\n      .catch(err => done(err))\n  })\n)\n\n// user decision endpoint\n//\n// `decision` middleware processes a user's decision to allow or deny access\n// requested by a client application.  Based on the grant type requested by the\n// client, the above grant middleware configured above will be invoked to send\n// a response.\n\noauth2Router.post(\n  '/decision',\n  jwtAuthenticateMiddleware,\n  compose(\n    oauth2orizeServer.decision(async function (context) {\n      const { request } = context\n\n      return request.body\n    })\n  )\n)\n\n// token endpoint\n//\n// `token` middleware handles client requests to exchange authorization grants\n// for access tokens.  Based on the grant type being exchanged, the above\n// exchange middleware will be invoked to handle the request.  Clients must\n// authenticate when making requests to this endpoint.\n\noauth2Router.post(\n  '/access-token',\n  passport.authenticate('oauth2-client-password', { session: false }),\n  oauth2orizeServer.token(),\n  oauth2orizeServer.errorHandler()\n)\n\noauth2Router.post('/refresh-token', async (context, next) => {\n  const refreshToken: string | undefined = context.request?.body?.refreshToken\n  if (!refreshToken) throw new Error('Missing refresh token')\n\n  const appUser: User | undefined = await getRepository(User).findOneBy({\n    password: refreshToken\n  })\n\n  if (!appUser) throw new Error('App user is not found')\n\n  try {\n    jwt.verify(refreshToken, SECRET)\n    const decoded = jwt.decode(refreshToken) as any\n    const subdomain: string = decoded.domain.subdomain\n    const domain: Domain | undefined = await getRepository(Domain).findOne({\n      where: { subdomain }\n    })\n    if (!domain) throw new Error('Domain is not found')\n    const appKey: string = decoded.application.appKey\n    const scopes: any[] = decoded.scope\n\n    const newAccessToken: string = Application.generateAccessToken(domain, appUser, appKey, scopes)\n    const newRefreshToken: string = Application.generateRefreshToken(domain, appUser, appKey, scopes)\n\n    appUser.password = newRefreshToken\n    await getRepository(User).save(appUser)\n\n    setAccessTokenCookie(context, newAccessToken)\n\n    context.body = {\n      accessToken: newAccessToken,\n      refreshToken: newRefreshToken\n    }\n  } catch (e) {\n    context.status = 401\n    context.body = e.message\n  }\n})\n\noauth2Router.get('/profile', jwtAuthenticateMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const { name, description, email, userType: type, locale } = user\n  const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {}\n\n  var application = {}\n  if (type == 'application') {\n    /* user entity에 reference 필드가 추가되기 전까지, appKey취득 방법임. */\n    application['appKey'] = email.substr(0, email.lastIndexOf('@'))\n  }\n\n  context.body = {\n    profile: {\n      name,\n      description,\n      email,\n      type /* (admin|user|application|appliance) */,\n      domain: {\n        name: domainName,\n        subdomain,\n        brandName,\n        brandImage,\n        contentImage,\n        timezone\n      },\n      application\n    }\n  }\n})\n\noauth2Router.post('/disconnect', jwtAuthenticateMiddleware, async (context, next) => {\n  try {\n    let { user } = context.state\n\n    if (typeof process.oauthDisconnect === 'function') {\n      await process.oauthDisconnect(user)\n    } else {\n      user.domains = []\n      user.roles = []\n      user.status = UserStatus.DELETED\n      await getRepository(User).save(user)\n    }\n    context.status = 200\n    context.body = 'ok'\n  } catch (e) {\n    throw e\n  }\n})\n"]}
+{"version":3,"file":"oauth2-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-router.ts"],"names":[],"mappings":";;;;AAAA,wEAA8B;AAC9B,sEAAiC;AACjC,wEAAmC;AACnC,oEAA+B;AAE/B,iDAA6D;AAE7D,yDAAsE;AACtE,6EAAsE;AACtE,wDAA6D;AAC7D,+EAAyE;AACzE,6DAAkD;AAClD,yDAAgE;AAChE,6FAAyF;AAU5E,QAAA,YAAY,GAAG,IAAI,oBAAM,EAAE,CAAA;AAExC,sBAAQ,CAAC,GAAG,CACV,wBAAwB,EACxB,IAAI,6CAAsB,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;IAC9D,IAAA,qBAAa,EAAC,4BAAW,CAAC;SACvB,SAAS,CAAC;QACT,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5B,CAAC,CAAC,CACH,CAAA;AAED,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AAEd,oBAAY,CAAC,IAAI,CACf,WAAW,EACX,oCAAyB,EACzB,IAAA,qBAAO,EACL,yBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,OAAO;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC,CAAC,CACH,CACF,CAAA;AAED,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AAEtD,oBAAY,CAAC,IAAI,CACf,eAAe,EACf,sBAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACnE,yBAAiB,CAAC,KAAK,EAAE,EACzB,yBAAiB,CAAC,YAAY,EAAE,CACjC,CAAA;AAED,oBAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;;IAC1D,MAAM,YAAY,GAAuB,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,0CAAE,YAAY,CAAA;IAC5E,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE3D,MAAM,OAAO,GAAqB,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,CAAQ,CAAA;QAC/C,MAAM,SAAS,GAAW,OAAO,CAAC,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,MAAM,GAAuB,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QACjD,MAAM,MAAM,GAAU,OAAO,CAAC,KAAK,CAAA;QAEnC,MAAM,cAAc,GAAW,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAC/F,MAAM,eAAe,GAAW,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;QAEjG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAA;QAClC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAA,6CAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAE7C,OAAO,CAAC,IAAI,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,GAAG,CAAC,UAAU,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;IAEnG,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1B,wDAAwD;QACxD,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,KAAK;YACL,IAAI,CAAC,wCAAwC;YAC7C,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ;aACT;YACD,WAAW;SACZ;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,IAAI,CAAC,aAAa,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,OAAO,CAAA;YAChC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import jwt from 'jsonwebtoken'\nimport compose from 'koa-compose'\nimport passport from 'koa-passport'\nimport Router from 'koa-router'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { jwtAuthenticateMiddleware } from '../../middlewares/index.js'\nimport { Application } from '../../service/application/application.js'\nimport { User, UserStatus } from '../../service/user/user.js'\nimport { setAccessTokenCookie } from '../../utils/access-token-cookie.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { server as oauth2orizeServer } from './oauth2-server.js'\nimport { Strategy as ClientPasswordStrategy } from './passport-oauth2-client-password.js'\n\ndeclare global {\n  namespace NodeJS {\n    interface Process {\n      oauthDisconnect: (user: User) => Promise<void>\n    }\n  }\n}\n\nexport const oauth2Router = new Router()\n\npassport.use(\n  'oauth2-client-password',\n  new ClientPasswordStrategy({}, (clientId, clientSecret, done) => {\n    getRepository(Application)\n      .findOneBy({\n        appKey: clientId\n      })\n      .then(client => {\n        if (!client || client.appSecret != clientSecret) {\n          done(null, false)\n          return\n        }\n\n        done(null, client)\n      })\n      .catch(err => done(err))\n  })\n)\n\n// user decision endpoint\n//\n// `decision` middleware processes a user's decision to allow or deny access\n// requested by a client application.  Based on the grant type requested by the\n// client, the above grant middleware configured above will be invoked to send\n// a response.\n\noauth2Router.post(\n  '/decision',\n  jwtAuthenticateMiddleware,\n  compose(\n    oauth2orizeServer.decision(async function (context) {\n      const { request } = context\n\n      return request.body\n    })\n  )\n)\n\n// token endpoint\n//\n// `token` middleware handles client requests to exchange authorization grants\n// for access tokens.  Based on the grant type being exchanged, the above\n// exchange middleware will be invoked to handle the request.  Clients must\n// authenticate when making requests to this endpoint.\n\noauth2Router.post(\n  '/access-token',\n  passport.authenticate('oauth2-client-password', { session: false }),\n  oauth2orizeServer.token(),\n  oauth2orizeServer.errorHandler()\n)\n\noauth2Router.post('/refresh-token', async (context, next) => {\n  const refreshToken: string | undefined = context.request?.body?.refreshToken\n  if (!refreshToken) throw new Error('Missing refresh token')\n\n  const appUser: User | undefined = await getRepository(User).findOneBy({\n    password: refreshToken\n  })\n\n  if (!appUser) throw new Error('App user is not found')\n\n  try {\n    jwt.verify(refreshToken, SECRET)\n    const decoded = jwt.decode(refreshToken) as any\n    const subdomain: string = decoded.domain.subdomain\n    const domain: Domain | undefined = await getRepository(Domain).findOne({\n      where: { subdomain }\n    })\n    if (!domain) throw new Error('Domain is not found')\n    const appKey: string = decoded.application.appKey\n    const scopes: any[] = decoded.scope\n\n    const newAccessToken: string = Application.generateAccessToken(domain, appUser, appKey, scopes)\n    const newRefreshToken: string = Application.generateRefreshToken(domain, appUser, appKey, scopes)\n\n    appUser.password = newRefreshToken\n    await getRepository(User).save(appUser)\n\n    setAccessTokenCookie(context, newAccessToken)\n\n    context.body = {\n      accessToken: newAccessToken,\n      refreshToken: newRefreshToken\n    }\n  } catch (e) {\n    context.status = 401\n    context.body = e.message\n  }\n})\n\noauth2Router.get('/profile', jwtAuthenticateMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const { name, description, email, userType: type, locale } = user\n  const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {}\n\n  var application = {}\n  if (type == 'application') {\n    /* user entity에 reference 필드가 추가되기 전까지, appKey취득 방법임. */\n    application['appKey'] = email.substr(0, email.lastIndexOf('@'))\n  }\n\n  context.body = {\n    profile: {\n      name,\n      description,\n      email,\n      type /* (admin|user|application|appliance) */,\n      domain: {\n        name: domainName,\n        subdomain,\n        brandName,\n        brandImage,\n        contentImage,\n        timezone\n      },\n      application\n    }\n  }\n})\n\noauth2Router.post('/disconnect', jwtAuthenticateMiddleware, async (context, next) => {\n  try {\n    let { user } = context.state\n\n    if (typeof process.oauthDisconnect === 'function') {\n      await process.oauthDisconnect(user)\n    } else {\n      user.domains = []\n      user.roles = []\n      user.status = UserStatus.DELETED\n      await getRepository(User).save(user)\n    }\n    context.status = 200\n    context.body = 'ok'\n  } catch (e) {\n    throw e\n  }\n})\n"]}

package/dist-server/router/oauth2/oauth2-server.js

@@ -6,9 +6,9 @@ const oauth2orize_koa_1 = tslib_1.__importDefault(require("oauth2orize-koa"));
 const typeorm_1 = require("typeorm");
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
-const application_1 = require("../../service/application/application");
-const role_1 = require("../../service/role/role");
-const user_1 = require("../../service/user/user");
+const application_js_1 = require("../../service/application/application.js");
+const role_js_1 = require("../../service/role/role.js");
+const user_js_1 = require("../../service/user/user.js");
 const crypto = require('crypto');
 exports.NOTFOUND = 'NOTFOUND';
 exports.NonClient = {
@@ -35,7 +35,7 @@ exports.server.deserializeClient(async function (id) {
     if (id == exports.NOTFOUND) {
         return {};
     }
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({ id });
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({ id });
     return application;
 });
 // Register supported grant types.
@@ -52,7 +52,7 @@ exports.server.deserializeClient(async function (id) {
 // values, and will be exchanged for an access token.
 exports.server.grant(oauth2orize_koa_1.default.grant.code(async (client, redirectUrl, user, ares, areq) => {
     const { email, appKey, subdomain, scopes, state } = ares;
-    return application_1.Application.generateAuthCode(email, appKey, subdomain, scopes, state);
+    return application_js_1.Application.generateAuthCode(email, appKey, subdomain, scopes, state);
 }));
 // Exchange authorization codes for access tokens.  The callback accepts the
 // `client`, which is exchanging `code` and any `redirectURI` from the
@@ -62,13 +62,13 @@ exports.server.grant(oauth2orize_koa_1.default.grant.code(async (client, redirec
 exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, code, redirectUrl) => {
     try {
         /* authorization code */
-        var decoded = application_1.Application.verifyAuthCode(code);
+        var decoded = application_js_1.Application.verifyAuthCode(code);
     }
     catch (e) {
         return false;
     }
     let { email, appKey, subdomain, scopes } = decoded;
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({
         appKey
     });
     if (!application) {
@@ -89,9 +89,9 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
     const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({
         subdomain
     });
-    const creator = await (0, shell_1.getRepository)(user_1.User).findOneBy({ email: (0, typeorm_1.ILike)(email) });
+    const creator = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({ email: (0, typeorm_1.ILike)(email) });
     const appuserEmail = `${crypto.randomUUID()}@${subdomain}`;
-    var appuser = await (0, shell_1.getRepository)(user_1.User).findOne({
+    var appuser = await (0, shell_1.getRepository)(user_js_1.User).findOne({
         where: {
             email: appuserEmail,
             reference: application.id,
@@ -99,7 +99,7 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
         },
         relations: ['domains', 'creator', 'updater']
     });
-    appuser = await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, (appuser || {})), { email: appuserEmail, name: application.name, userType: 'application', reference: application.id, domains: [domain], roles: scopes, status: user_1.UserStatus.ACTIVATED, updater: creator, creator }));
+    appuser = await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, (appuser || {})), { email: appuserEmail, name: application.name, userType: 'application', reference: application.id, domains: [domain], roles: scopes, status: user_js_1.UserStatus.ACTIVATED, updater: creator, creator }));
     // appuser = await getRepository(User).findOne({
     //   where: { email: ILike(appuserEmail) },
     //   relations: ['domains']
@@ -108,9 +108,9 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
     // await getRepository(User).save(appuser)
     // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.
     // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.
-    var accessToken = application_1.Application.generateAccessToken(domain, appuser, appKey, scopes);
-    var refreshToken = application_1.Application.generateRefreshToken(domain, appuser, appKey, scopes);
-    await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, appuser), { password: refreshToken }));
+    var accessToken = application_js_1.Application.generateAccessToken(domain, appuser, appKey, scopes);
+    var refreshToken = application_js_1.Application.generateRefreshToken(domain, appuser, appKey, scopes);
+    await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, appuser), { password: refreshToken }));
     return [
         accessToken,
         refreshToken,
@@ -124,14 +124,14 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.code(async (client, c
 exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (client, refreshToken, scope) => {
     try {
         /* refresh token */
-        var decoded = application_1.Application.verifyAuthCode(refreshToken);
+        var decoded = application_js_1.Application.verifyAuthCode(refreshToken);
     }
     catch (e) {
         env_1.logger.error(e);
         return false;
     }
     const { id, userType, email, application: { appKey }, domain: { subdomain }, scope: originalScope, exp: expires_in } = decoded;
-    const application = await (0, shell_1.getRepository)(application_1.Application).findOneBy({
+    const application = await (0, shell_1.getRepository)(application_js_1.Application).findOneBy({
         appKey
     });
     if (!application) {
@@ -145,12 +145,12 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (c
     const domain = await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({
         subdomain
     });
-    const creator = await (0, shell_1.getRepository)(user_1.User).findOneBy({
+    const creator = await (0, shell_1.getRepository)(user_js_1.User).findOneBy({
         id,
         userType
     });
     const appuserEmail = `${appKey}@${subdomain}`;
-    var appuser = await (0, shell_1.getRepository)(user_1.User).findOne({
+    var appuser = await (0, shell_1.getRepository)(user_js_1.User).findOne({
         where: {
             email: appuserEmail,
             reference: application.id,
@@ -173,13 +173,13 @@ exports.server.exchange(oauth2orize_koa_1.default.exchange.refreshToken(async (c
         env_1.logger.error(`additional scope(${additionalScope}) required`);
         return false;
     }
-    const roles = await (0, shell_1.getRepository)(role_1.Role).findBy({
+    const roles = await (0, shell_1.getRepository)(role_js_1.Role).findBy({
         name: (0, typeorm_1.In)(scopes),
         domain: { id: domain.id }
     });
-    var accessToken = application_1.Application.generateAccessToken(domain, appuser, appKey, scope);
-    var refreshToken = application_1.Application.generateRefreshToken(domain, appuser, appKey, scope);
-    await (0, shell_1.getRepository)(user_1.User).save(Object.assign(Object.assign({}, appuser), { roles, password: refreshToken }));
+    var accessToken = application_js_1.Application.generateAccessToken(domain, appuser, appKey, scope);
+    var refreshToken = application_js_1.Application.generateRefreshToken(domain, appuser, appKey, scope);
+    await (0, shell_1.getRepository)(user_js_1.User).save(Object.assign(Object.assign({}, appuser), { roles, password: refreshToken }));
     return [
         accessToken,
         refreshToken,

package/dist-server/router/oauth2/oauth2-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-server.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-server.ts"],"names":[],"mappings":";;;;AAAA,8EAAyC;AACzC,qCAAmC;AAEnC,6CAA4C;AAC5C,iDAA6D;AAE7D,uEAAmE;AACnE,kDAA8C;AAC9C,kDAA0D;AAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnB,QAAA,QAAQ,GAAG,UAAU,CAAA;AACrB,QAAA,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAQ;CACb,CAAA;AAED,0BAA0B;AACb,QAAA,MAAM,GAAG,yBAAW,CAAC,YAAY,EAAE,CAAA;AAEhD,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,sCAAsC;AAEtC,cAAM,CAAC,eAAe,CAAC,KAAK,WAAW,MAAM;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC,CAAC,CAAA;AAEF,cAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW,EAAE;IACzC,IAAI,EAAE,IAAI,gBAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,OAAO,WAAW,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AAEjC,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AAErD,cAAM,CAAC,KAAK,CACV,yBAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAExD,OAAO,yBAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC,CAAC,CACH,CAAA;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,8EAA8E;AAC9E,QAAQ;AAER,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,OAAO,GAAQ,yBAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAElD,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,sGAAsG;IACtG,kBAAkB;IAClB,wFAAwF;IACxF,mBAAmB;IACnB,8BAA8B;IAC9B,MAAM;IACN,oBAAoB;IACpB,yBAAyB;IACzB,uIAAuI;IACvI,MAAM;IACN,IAAI;IAEJ,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,CAAA;IAE1D,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QAED,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACnC,CAAC,OAAO,IAAI,EAAE,CAAC,KAClB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EACtB,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,WAAW,CAAC,EAAE,EACzB,OAAO,EAAE,CAAC,MAAM,CAAC,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,iBAAU,CAAC,SAAS,EAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,IACP,CAAA;IAEF,gDAAgD;IAChD,2CAA2C;IAC3C,2BAA2B;IAC3B,KAAK;IAEL,8CAA8C;IAC9C,0CAA0C;IAC1C,yEAAyE;IACzE,qEAAqE;IAErE,IAAI,WAAW,GAAG,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAClF,IAAI,YAAY,GAAG,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpF,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,mBAAmB;QACnB,IAAI,OAAO,GAAQ,yBAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EACJ,EAAE,EACF,QAAQ,EACR,KAAK,EACL,WAAW,EAAE,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EACrB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,EAChB,GAAG,OAAO,CAAA;IAEX,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,yBAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,SAAS,CAAC;QACxD,EAAE;QACF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAA;IAE7C,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IAEH,KAAK,GAAG,KAAK,IAAI,aAAa,CAAA;IAE9B,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,YAAM,CAAC,KAAK,CAAC,oBAAoB,eAAe,YAAY,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,WAAW,GAAG,yBAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjF,IAAI,YAAY,GAAQ,yBAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAExF,MAAM,IAAA,qBAAa,EAAC,WAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,KAAK,EACL,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;SACrB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA","sourcesContent":["import oauth2orize from 'oauth2orize-koa'\nimport { ILike, In } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Application } from '../../service/application/application'\nimport { Role } from '../../service/role/role'\nimport { User, UserStatus } from '../../service/user/user'\n\nconst crypto = require('crypto')\n\nexport const NOTFOUND = 'NOTFOUND'\nexport const NonClient = {\n  id: NOTFOUND\n}\n\n// create OAuth 2.0 server\nexport const server = oauth2orize.createServer()\n\n// Register serialialization and deserialization functions.\n//\n// When a client redirects a user to user authorization endpoint, an\n// authorization transaction is initiated.  To complete the transaction, the\n// user must authenticate and approve the authorization request.  Because this\n// may involve multiple HTTP request/response exchanges, the transaction is\n// stored in the session.\n//\n// An application must supply serialization functions, which determine how the\n// client object is serialized into the session.  Typically this will be a\n// simple matter of serializing the client's ID, and deserializing by finding\n// the client by ID from the database.\n\nserver.serializeClient(async function (client) {\n  return client.id\n})\n\nserver.deserializeClient(async function (id) {\n  if (id == NOTFOUND) {\n    return {}\n  }\n\n  const application = await getRepository(Application).findOneBy({ id })\n  return application\n})\n\n// Register supported grant types.\n//\n// OAuth 2.0 specifies a framework that allows users to grant client\n// applications limited access to their protected resources.  It does this\n// through a process of the user granting access, and the client exchanging\n// the grant for an access token.\n\n// Grant authorization codes.  The callback takes the `client` requesting\n// authorization, the `redirectURI` (which is used as a verifier in the\n// subsequent exchange), the authenticated `user` granting access, and\n// their response, which contains approved scope, duration, etc. as parsed by\n// the application.  The application issues a code, which is bound to these\n// values, and will be exchanged for an access token.\n\nserver.grant(\n  oauth2orize.grant.code(async (client, redirectUrl, user, ares, areq) => {\n    const { email, appKey, subdomain, scopes, state } = ares\n\n    return Application.generateAuthCode(email, appKey, subdomain, scopes, state)\n  })\n)\n\n// Exchange authorization codes for access tokens.  The callback accepts the\n// `client`, which is exchanging `code` and any `redirectURI` from the\n// authorization request for verification.  If these values are validated, the\n// application issues an access token on behalf of the user who authorized the\n// code.\n\nserver.exchange(\n  oauth2orize.exchange.code(async (client, code, redirectUrl) => {\n    try {\n      /* authorization code */\n      var decoded: any = Application.verifyAuthCode(code)\n    } catch (e) {\n      return false\n    }\n    let { email, appKey, subdomain, scopes } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      return false\n    }\n\n    /* DONT-FORGET uncomment after test */\n    // if (redirectUrl !== application.redirectUrl && redirectUrl.indexOf(application.redirectUrl) != 0) {\n    //   logger.error(\n    //     'oauth2 exchange error - redirectUrl should begins with the application setting',\n    //     redirectUrl,\n    //     application.redirectUrl\n    //   )\n    //   // return false\n    //   throw new TypeError(\n    //     `oauth2 exchange error - redirectUrl should begins with the application setting : '${redirectUrl}':'${application.redirectUrl}'`\n    //   )\n    // }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({ email: ILike(email) })\n\n    const appuserEmail = `${crypto.randomUUID()}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n\n      relations: ['domains', 'creator', 'updater']\n    })\n\n    appuser = await getRepository(User).save({\n      ...(appuser || {}),\n      email: appuserEmail,\n      name: application.name,\n      userType: 'application',\n      reference: application.id,\n      domains: [domain],\n      roles: scopes,\n      status: UserStatus.ACTIVATED,\n      updater: creator,\n      creator\n    })\n\n    // appuser = await getRepository(User).findOne({\n    //   where: { email: ILike(appuserEmail) },\n    //   relations: ['domains']\n    // })\n\n    // appuser.domains = Promise.resolve([domain])\n    // await getRepository(User).save(appuser)\n    // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.\n    // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scopes)\n    var refreshToken = Application.generateRefreshToken(domain, appuser, appKey, scopes)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer',\n        centerId: subdomain\n      }\n    ]\n  })\n)\n\nserver.exchange(\n  oauth2orize.exchange.refreshToken(async (client, refreshToken, scope) => {\n    try {\n      /* refresh token */\n      var decoded: any = Application.verifyAuthCode(refreshToken)\n    } catch (e) {\n      logger.error(e)\n      return false\n    }\n    const {\n      id,\n      userType,\n      email,\n      application: { appKey },\n      domain: { subdomain },\n      scope: originalScope,\n      exp: expires_in\n    } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      logger.error('application is not exist')\n      return false\n    }\n\n    if (Date.now() > expires_in * 1000) {\n      logger.error('refresh token is expired')\n      return false\n    }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({\n      id,\n      userType\n    })\n\n    const appuserEmail = `${appKey}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n      relations: ['domain', 'creator', 'updater']\n    })\n\n    if (!appuser) {\n      logger.error('application is not bound')\n      return false\n    }\n\n    /*\n     * `scope` is the scope of access requested by the client, which must not include any scope not originally granted.\n     */\n\n    scope = scope || originalScope\n\n    const scopes: string[] = scope.split(',')\n    const originalScopes = (originalScope || '').split(',')\n    const additionalScope = scopes.find(scope => originalScopes.indexOf(scope) === -1)\n    if (additionalScope) {\n      logger.error(`additional scope(${additionalScope}) required`)\n      return false\n    }\n\n    const roles = await getRepository(Role).findBy({\n      name: In(scopes),\n      domain: { id: domain.id }\n    })\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scope)\n    var refreshToken: any = Application.generateRefreshToken(domain, appuser, appKey, scope)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      roles,\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer'\n      }\n    ]\n  })\n)\n"]}
+{"version":3,"file":"oauth2-server.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-server.ts"],"names":[],"mappings":";;;;AAAA,8EAAyC;AACzC,qCAAmC;AAEnC,6CAA4C;AAC5C,iDAA6D;AAE7D,6EAAsE;AACtE,wDAAiD;AACjD,wDAA6D;AAE7D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnB,QAAA,QAAQ,GAAG,UAAU,CAAA;AACrB,QAAA,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAQ;CACb,CAAA;AAED,0BAA0B;AACb,QAAA,MAAM,GAAG,yBAAW,CAAC,YAAY,EAAE,CAAA;AAEhD,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,sCAAsC;AAEtC,cAAM,CAAC,eAAe,CAAC,KAAK,WAAW,MAAM;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC,CAAC,CAAA;AAEF,cAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW,EAAE;IACzC,IAAI,EAAE,IAAI,gBAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,OAAO,WAAW,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AAEjC,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AAErD,cAAM,CAAC,KAAK,CACV,yBAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAExD,OAAO,4BAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC,CAAC,CACH,CAAA;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,8EAA8E;AAC9E,QAAQ;AAER,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAElD,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,sGAAsG;IACtG,kBAAkB;IAClB,wFAAwF;IACxF,mBAAmB;IACnB,8BAA8B;IAC9B,MAAM;IACN,oBAAoB;IACpB,yBAAyB;IACzB,uIAAuI;IACvI,MAAM;IACN,IAAI;IAEJ,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,CAAA;IAE1D,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QAED,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACnC,CAAC,OAAO,IAAI,EAAE,CAAC,KAClB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,CAAC,IAAI,EACtB,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,WAAW,CAAC,EAAE,EACzB,OAAO,EAAE,CAAC,MAAM,CAAC,EACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,oBAAU,CAAC,SAAS,EAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,IACP,CAAA;IAEF,gDAAgD;IAChD,2CAA2C;IAC3C,2BAA2B;IAC3B,KAAK;IAEL,8CAA8C;IAC9C,0CAA0C;IAC1C,yEAAyE;IACzE,qEAAqE;IAErE,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAClF,IAAI,YAAY,GAAG,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAEpF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,mBAAmB;QACnB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EACJ,EAAE,EACF,QAAQ,EACR,KAAK,EACL,WAAW,EAAE,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EACrB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,EAChB,GAAG,OAAO,CAAA;IAEX,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACxD,EAAE;QACF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAA;IAE7C,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IAEH,KAAK,GAAG,KAAK,IAAI,aAAa,CAAA;IAE9B,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,YAAM,CAAC,KAAK,CAAC,oBAAoB,eAAe,YAAY,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IACjF,IAAI,YAAY,GAAQ,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAExF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,iCACxB,OAAe,KACnB,KAAK,EACL,QAAQ,EAAE,YAAY,IACtB,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;SACrB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA","sourcesContent":["import oauth2orize from 'oauth2orize-koa'\nimport { ILike, In } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Application } from '../../service/application/application.js'\nimport { Role } from '../../service/role/role.js'\nimport { User, UserStatus } from '../../service/user/user.js'\n\nconst crypto = require('crypto')\n\nexport const NOTFOUND = 'NOTFOUND'\nexport const NonClient = {\n  id: NOTFOUND\n}\n\n// create OAuth 2.0 server\nexport const server = oauth2orize.createServer()\n\n// Register serialialization and deserialization functions.\n//\n// When a client redirects a user to user authorization endpoint, an\n// authorization transaction is initiated.  To complete the transaction, the\n// user must authenticate and approve the authorization request.  Because this\n// may involve multiple HTTP request/response exchanges, the transaction is\n// stored in the session.\n//\n// An application must supply serialization functions, which determine how the\n// client object is serialized into the session.  Typically this will be a\n// simple matter of serializing the client's ID, and deserializing by finding\n// the client by ID from the database.\n\nserver.serializeClient(async function (client) {\n  return client.id\n})\n\nserver.deserializeClient(async function (id) {\n  if (id == NOTFOUND) {\n    return {}\n  }\n\n  const application = await getRepository(Application).findOneBy({ id })\n  return application\n})\n\n// Register supported grant types.\n//\n// OAuth 2.0 specifies a framework that allows users to grant client\n// applications limited access to their protected resources.  It does this\n// through a process of the user granting access, and the client exchanging\n// the grant for an access token.\n\n// Grant authorization codes.  The callback takes the `client` requesting\n// authorization, the `redirectURI` (which is used as a verifier in the\n// subsequent exchange), the authenticated `user` granting access, and\n// their response, which contains approved scope, duration, etc. as parsed by\n// the application.  The application issues a code, which is bound to these\n// values, and will be exchanged for an access token.\n\nserver.grant(\n  oauth2orize.grant.code(async (client, redirectUrl, user, ares, areq) => {\n    const { email, appKey, subdomain, scopes, state } = ares\n\n    return Application.generateAuthCode(email, appKey, subdomain, scopes, state)\n  })\n)\n\n// Exchange authorization codes for access tokens.  The callback accepts the\n// `client`, which is exchanging `code` and any `redirectURI` from the\n// authorization request for verification.  If these values are validated, the\n// application issues an access token on behalf of the user who authorized the\n// code.\n\nserver.exchange(\n  oauth2orize.exchange.code(async (client, code, redirectUrl) => {\n    try {\n      /* authorization code */\n      var decoded: any = Application.verifyAuthCode(code)\n    } catch (e) {\n      return false\n    }\n    let { email, appKey, subdomain, scopes } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      return false\n    }\n\n    /* DONT-FORGET uncomment after test */\n    // if (redirectUrl !== application.redirectUrl && redirectUrl.indexOf(application.redirectUrl) != 0) {\n    //   logger.error(\n    //     'oauth2 exchange error - redirectUrl should begins with the application setting',\n    //     redirectUrl,\n    //     application.redirectUrl\n    //   )\n    //   // return false\n    //   throw new TypeError(\n    //     `oauth2 exchange error - redirectUrl should begins with the application setting : '${redirectUrl}':'${application.redirectUrl}'`\n    //   )\n    // }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({ email: ILike(email) })\n\n    const appuserEmail = `${crypto.randomUUID()}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n\n      relations: ['domains', 'creator', 'updater']\n    })\n\n    appuser = await getRepository(User).save({\n      ...(appuser || {}),\n      email: appuserEmail,\n      name: application.name,\n      userType: 'application',\n      reference: application.id,\n      domains: [domain],\n      roles: scopes,\n      status: UserStatus.ACTIVATED,\n      updater: creator,\n      creator\n    })\n\n    // appuser = await getRepository(User).findOne({\n    //   where: { email: ILike(appuserEmail) },\n    //   relations: ['domains']\n    // })\n\n    // appuser.domains = Promise.resolve([domain])\n    // await getRepository(User).save(appuser)\n    // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.\n    // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scopes)\n    var refreshToken = Application.generateRefreshToken(domain, appuser, appKey, scopes)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer',\n        centerId: subdomain\n      }\n    ]\n  })\n)\n\nserver.exchange(\n  oauth2orize.exchange.refreshToken(async (client, refreshToken, scope) => {\n    try {\n      /* refresh token */\n      var decoded: any = Application.verifyAuthCode(refreshToken)\n    } catch (e) {\n      logger.error(e)\n      return false\n    }\n    const {\n      id,\n      userType,\n      email,\n      application: { appKey },\n      domain: { subdomain },\n      scope: originalScope,\n      exp: expires_in\n    } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      logger.error('application is not exist')\n      return false\n    }\n\n    if (Date.now() > expires_in * 1000) {\n      logger.error('refresh token is expired')\n      return false\n    }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({\n      id,\n      userType\n    })\n\n    const appuserEmail = `${appKey}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n      relations: ['domain', 'creator', 'updater']\n    })\n\n    if (!appuser) {\n      logger.error('application is not bound')\n      return false\n    }\n\n    /*\n     * `scope` is the scope of access requested by the client, which must not include any scope not originally granted.\n     */\n\n    scope = scope || originalScope\n\n    const scopes: string[] = scope.split(',')\n    const originalScopes = (originalScope || '').split(',')\n    const additionalScope = scopes.find(scope => originalScopes.indexOf(scope) === -1)\n    if (additionalScope) {\n      logger.error(`additional scope(${additionalScope}) required`)\n      return false\n    }\n\n    const roles = await getRepository(Role).findBy({\n      name: In(scopes),\n      domain: { id: domain.id }\n    })\n\n    var accessToken = Application.generateAccessToken(domain, appuser, appKey, scope)\n    var refreshToken: any = Application.generateRefreshToken(domain, appuser, appKey, scope)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      roles,\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer'\n      }\n    ]\n  })\n)\n"]}

package/dist-server/router/site-root-router.js

@@ -6,15 +6,15 @@ const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const koa_passport_1 = tslib_1.__importDefault(require("koa-passport"));
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
-const user_1 = require("../service/user/user");
-const get_user_domains_1 = require("../utils/get-user-domains");
+const user_js_1 = require("../service/user/user.js");
+const get_user_domains_js_1 = require("../utils/get-user-domains.js");
 const PUBLIC_HOME_ROUTE = env_1.config.get('publicHomeRoute', '/public/home');
 exports.siteRootRouter = new koa_router_1.default();
 async function findAuth(context, next) {
     return await koa_passport_1.default.authenticate('jwt', { session: false }, async (err, decoded, info) => {
         if (decoded) {
             try {
-                const user = await user_1.User.checkAuth(decoded);
+                const user = await user_js_1.User.checkAuth(decoded);
                 context.state.user = user;
             }
             catch (e) { }
@@ -26,7 +26,7 @@ exports.siteRootRouter.get('/', findAuth, shell_1.domainMiddleware, async (conte
     const { user, domain } = context.state;
     const subdomain = domain === null || domain === void 0 ? void 0 : domain.subdomain;
     if (user && subdomain) {
-        const userDomains = await (0, get_user_domains_1.getUserDomains)(user);
+        const userDomains = await (0, get_user_domains_js_1.getUserDomains)(user);
         if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {
             return await next();
         }

package/dist-server/router/site-root-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,+CAA2C;AAC3C,gEAA0D;AAE1D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IACnC,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,iCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user'\nimport { getUserDomains } from '../utils/get-user-domains'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\nasync function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}
+{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,qDAA8C;AAC9C,sEAA6D;AAE7D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IACnC,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\nasync function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}

package/dist-server/router/webauthn-router.js

@@ -6,9 +6,9 @@ const koa_router_1 = tslib_1.__importDefault(require("koa-router"));
 const shell_1 = require("@things-factory/shell");
 const env_1 = require("@things-factory/env");
 const server_1 = require("@simplewebauthn/server");
-const web_auth_credential_1 = require("../service/web-auth-credential/web-auth-credential");
-const access_token_cookie_1 = require("../utils/access-token-cookie");
-const webauthn_middleware_1 = require("../middlewares/webauthn-middleware");
+const web_auth_credential_js_1 = require("../service/web-auth-credential/web-auth-credential.js");
+const access_token_cookie_js_1 = require("../utils/access-token-cookie.js");
+const webauthn_middleware_js_1 = require("../middlewares/webauthn-middleware.js");
 exports.webAuthnGlobalPublicRouter = new koa_router_1.default();
 exports.webAuthnGlobalPrivateRouter = new koa_router_1.default();
 const { name: rpName } = env_1.appPackage;
@@ -21,7 +21,7 @@ exports.webAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async
         context.body = { error: 'User not authenticated' };
         return;
     }
-    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential).find({
+    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({
         where: { user: { id: user.id } }
     });
     if (webAuthCredentials.length === 0) {
@@ -43,7 +43,7 @@ exports.webAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async
 // Verify biometric authentication
 exports.webAuthnGlobalPrivateRouter.post('/auth/verify-webauthn', 
 /* reuse webauthn-login as webauthn-verify strategy */
-(0, webauthn_middleware_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
+(0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
     const { user } = context.state;
     const { request } = context;
     const { body: reqBody } = request;
@@ -62,7 +62,7 @@ exports.webAuthnGlobalPrivateRouter.post('/auth/verify-webauthn',
 exports.webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {
     const { user } = context.state;
     const rpID = context.hostname;
-    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_1.WebAuthCredential).find({
+    const webAuthCredentials = await (0, shell_1.getRepository)(web_auth_credential_js_1.WebAuthCredential).find({
         where: {
             user: { id: user.id }
         }
@@ -93,7 +93,7 @@ exports.webAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', asy
     context.body = options;
 });
 // Verify registration
-exports.webAuthnGlobalPrivateRouter.post('/auth/verify-registration', (0, webauthn_middleware_1.createWebAuthnMiddleware)('webauthn-register'));
+exports.webAuthnGlobalPrivateRouter.post('/auth/verify-registration', (0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-register'));
 // Generate sign-in challenge
 exports.webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {
     const rpID = context.hostname;
@@ -105,12 +105,12 @@ exports.webAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async
     context.body = options;
 });
 // Sign in with biometric authentication
-exports.webAuthnGlobalPublicRouter.post('/auth/signin-webauthn', (0, webauthn_middleware_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
+exports.webAuthnGlobalPublicRouter.post('/auth/signin-webauthn', (0, webauthn_middleware_js_1.createWebAuthnMiddleware)('webauthn-login'), async (context, next) => {
     const { domain, user } = context.state;
     const { request } = context;
     const { body: reqBody } = request;
     const token = await user.sign({ subdomain: domain === null || domain === void 0 ? void 0 : domain.subdomain });
-    (0, access_token_cookie_1.setAccessTokenCookie)(context, token);
+    (0, access_token_cookie_js_1.setAccessTokenCookie)(context, token);
     var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`;
     /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */
     context.body = { redirectURL, verified: true };

package/dist-server/router/webauthn-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"webauthn-router.js","sourceRoot":"","sources":["../../server/router/webauthn-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,iDAAqD;AACrD,6CAAgD;AAEhD,mDAAmG;AAEnG,4FAAsF;AAEtF,sEAAmE;AACnE,4EAA6E;AAEhE,QAAA,0BAA0B,GAAG,IAAI,oBAAM,EAAE,CAAA;AACzC,QAAA,2BAA2B,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAiB,CAAA;AAE1C,qEAAqE;AACrE,mCAA2B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAA;QAClD,OAAM;IACR,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,qBAAa,EAAC,uCAAiB,CAAC,CAAC,IAAI,CAAC;QACrE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAA;QAC7E,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;QAClD,IAAI;QACJ,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;KACJ,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,mCAA2B,CAAC,IAAI,CAC9B,uBAAuB;AACvB,sDAAsD;AACtD,IAAA,8CAAwB,EAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACrE,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,qCAAqC;KAC/C,CAAA;IAED,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA;AAED,mEAAmE;AACnE,mCAA2B,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,MAAM,kBAAkB,GAAG,MAAM,IAAA,qBAAa,EAAC,uCAAiB,CAAC,CAAC,IAAI,CAAC;QACrE,KAAK,EAAE;YACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;SACtB;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAA2C,MAAM,IAAA,oCAA2B,EAAC;QACxF,MAAM;QACN,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,wEAAwE;QACxE,gCAAgC;QAChC,eAAe,EAAE,MAAM;QACvB,4DAA4D;QAC5D,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACxD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,WAAW;YACX,oCAAoC;SACrC,CAAC,CAAC;QACH,sBAAsB,EAAE;YACtB,WAAW;YACX,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;YAC7B,WAAW;YACX,uBAAuB,EAAE,UAAU;SACpC;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,sBAAsB;AACtB,mCAA2B,CAAC,IAAI,CAAC,2BAA2B,EAAE,IAAA,8CAAwB,EAAC,mBAAmB,CAAC,CAAC,CAAA;AAE5G,6BAA6B;AAC7B,kCAA0B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;QAClD,IAAI;QACJ,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,wCAAwC;AACxC,kCAA0B,CAAC,IAAI,CAC7B,uBAAuB,EACvB,IAAA,8CAAwB,EAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACtC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,IAAA,0CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,IAAI,WAAW,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAA;IAErI,6LAA6L;IAC7L,OAAO,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAE9C,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { getRepository } from '@things-factory/shell'\nimport { appPackage } from '@things-factory/env'\n\nimport { generateRegistrationOptions, generateAuthenticationOptions } from '@simplewebauthn/server'\n\nimport { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential'\nimport { PublicKeyCredentialCreationOptionsJSON } from '@simplewebauthn/server/script/deps'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie'\nimport { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware'\n\nexport const webAuthnGlobalPublicRouter = new Router()\nexport const webAuthnGlobalPrivateRouter = new Router()\n\nconst { name: rpName } = appPackage as any\n\n// Generate authentication challenge for the currently logged-in user\nwebAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async (context, next) => {\n  const { user } = context.state\n  const rpID = context.hostname\n\n  if (!user) {\n    context.status = 401\n    context.body = { error: 'User not authenticated' }\n    return\n  }\n\n  const webAuthCredentials = await getRepository(WebAuthCredential).find({\n    where: { user: { id: user.id } }\n  })\n\n  if (webAuthCredentials.length === 0) {\n    context.status = 400\n    context.body = { error: 'No biometric credentials registered for this user' }\n    return\n  }\n\n  const options = await generateAuthenticationOptions({\n    rpID,\n    userVerification: 'preferred',\n    allowCredentials: webAuthCredentials.map(credential => ({\n      id: credential.credentialId,\n      type: 'public-key'\n    }))\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Verify biometric authentication\nwebAuthnGlobalPrivateRouter.post(\n  '/auth/verify-webauthn',\n  /* reuse webauthn-login as webauthn-verify strategy */\n  createWebAuthnMiddleware('webauthn-login'),\n  async (context, next) => {\n    const { user } = context.state\n    const { request } = context\n    const { body: reqBody } = request\n\n    if (!user) {\n      context.status = 401\n      context.body = { verified: false, message: 'User not authenticated' }\n      return\n    }\n\n    context.body = {\n      verified: true,\n      message: 'Biometric authentication successful'\n    }\n\n    await next()\n  }\n)\n\n// Generate registration challenge for the currently logged-in user\nwebAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {\n  const { user } = context.state\n  const rpID = context.hostname\n\n  const webAuthCredentials = await getRepository(WebAuthCredential).find({\n    where: {\n      user: { id: user.id }\n    }\n  })\n\n  const options: PublicKeyCredentialCreationOptionsJSON = await generateRegistrationOptions({\n    rpName,\n    rpID,\n    userName: user.email,\n    userDisplayName: user.name,\n    // Don't prompt users for additional information about the authenticator\n    // (Recommended for smoother UX)\n    attestationType: 'none',\n    // Prevent users from re-registering existing authenticators\n    excludeCredentials: webAuthCredentials.map(credential => ({\n      id: credential.credentialId\n      // Optional\n      // transports: credential.transports\n    })),\n    authenticatorSelection: {\n      // Defaults\n      residentKey: 'preferred',\n      userVerification: 'preferred',\n      // Optional\n      authenticatorAttachment: 'platform'\n    }\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Verify registration\nwebAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'))\n\n// Generate sign-in challenge\nwebAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {\n  const rpID = context.hostname\n\n  const options = await generateAuthenticationOptions({\n    rpID,\n    userVerification: 'preferred'\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Sign in with biometric authentication\nwebAuthnGlobalPublicRouter.post(\n  '/auth/signin-webauthn',\n  createWebAuthnMiddleware('webauthn-login'),\n  async (context, next) => {\n    const { domain, user } = context.state\n    const { request } = context\n    const { body: reqBody } = request\n\n    const token = await user.sign({ subdomain: domain?.subdomain })\n    setAccessTokenCookie(context, token)\n\n    var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`\n\n    /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */\n    context.body = { redirectURL, verified: true }\n\n    await next()\n  }\n)\n"]}
+{"version":3,"file":"webauthn-router.js","sourceRoot":"","sources":["../../server/router/webauthn-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,iDAAqD;AACrD,6CAAgD;AAEhD,mDAI+B;AAE/B,kGAAyF;AACzF,4EAAsE;AACtE,kFAAgF;AAEnE,QAAA,0BAA0B,GAAG,IAAI,oBAAM,EAAE,CAAA;AACzC,QAAA,2BAA2B,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAiB,CAAA;AAE1C,qEAAqE;AACrE,mCAA2B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAA;QAClD,OAAM;IACR,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC;QACrE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;KACjC,CAAC,CAAA;IAEF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAA;QAC7E,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;QAClD,IAAI;QACJ,gBAAgB,EAAE,WAAW;QAC7B,gBAAgB,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACtD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;KACJ,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,mCAA2B,CAAC,IAAI,CAC9B,uBAAuB;AACvB,sDAAsD;AACtD,IAAA,iDAAwB,EAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;QACrE,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,qCAAqC;KAC/C,CAAA;IAED,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA;AAED,mEAAmE;AACnE,mCAA2B,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,MAAM,kBAAkB,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,CAAC,CAAC,IAAI,CAAC;QACrE,KAAK,EAAE;YACL,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;SACtB;KACF,CAAC,CAAA;IAEF,MAAM,OAAO,GAA2C,MAAM,IAAA,oCAA2B,EAAC;QACxF,MAAM;QACN,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI,CAAC,IAAI;QAC1B,wEAAwE;QACxE,gCAAgC;QAChC,eAAe,EAAE,MAAM;QACvB,4DAA4D;QAC5D,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACxD,EAAE,EAAE,UAAU,CAAC,YAAY;YAC3B,WAAW;YACX,oCAAoC;SACrC,CAAC,CAAC;QACH,sBAAsB,EAAE;YACtB,WAAW;YACX,WAAW,EAAE,WAAW;YACxB,gBAAgB,EAAE,WAAW;YAC7B,WAAW;YACX,uBAAuB,EAAE,UAAU;SACpC;KACF,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,sBAAsB;AACtB,mCAA2B,CAAC,IAAI,CAAC,2BAA2B,EAAE,IAAA,iDAAwB,EAAC,mBAAmB,CAAC,CAAC,CAAA;AAE5G,6BAA6B;AAC7B,kCAA0B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAA;IAE7B,MAAM,OAAO,GAAG,MAAM,IAAA,sCAA6B,EAAC;QAClD,IAAI;QACJ,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAA;IAEF,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,wCAAwC;AACxC,kCAA0B,CAAC,IAAI,CAC7B,uBAAuB,EACvB,IAAA,iDAAwB,EAAC,gBAAgB,CAAC,EAC1C,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACtC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE,CAAC,CAAA;IAC/D,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,IAAI,WAAW,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAA;IAErI,6LAA6L;IAC7L,OAAO,CAAC,IAAI,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAE9C,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { getRepository } from '@things-factory/shell'\nimport { appPackage } from '@things-factory/env'\n\nimport {\n  PublicKeyCredentialCreationOptionsJSON,\n  generateRegistrationOptions,\n  generateAuthenticationOptions\n} from '@simplewebauthn/server'\n\nimport { WebAuthCredential } from '../service/web-auth-credential/web-auth-credential.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { createWebAuthnMiddleware } from '../middlewares/webauthn-middleware.js'\n\nexport const webAuthnGlobalPublicRouter = new Router()\nexport const webAuthnGlobalPrivateRouter = new Router()\n\nconst { name: rpName } = appPackage as any\n\n// Generate authentication challenge for the currently logged-in user\nwebAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async (context, next) => {\n  const { user } = context.state\n  const rpID = context.hostname\n\n  if (!user) {\n    context.status = 401\n    context.body = { error: 'User not authenticated' }\n    return\n  }\n\n  const webAuthCredentials = await getRepository(WebAuthCredential).find({\n    where: { user: { id: user.id } }\n  })\n\n  if (webAuthCredentials.length === 0) {\n    context.status = 400\n    context.body = { error: 'No biometric credentials registered for this user' }\n    return\n  }\n\n  const options = await generateAuthenticationOptions({\n    rpID,\n    userVerification: 'preferred',\n    allowCredentials: webAuthCredentials.map(credential => ({\n      id: credential.credentialId,\n      type: 'public-key'\n    }))\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Verify biometric authentication\nwebAuthnGlobalPrivateRouter.post(\n  '/auth/verify-webauthn',\n  /* reuse webauthn-login as webauthn-verify strategy */\n  createWebAuthnMiddleware('webauthn-login'),\n  async (context, next) => {\n    const { user } = context.state\n    const { request } = context\n    const { body: reqBody } = request\n\n    if (!user) {\n      context.status = 401\n      context.body = { verified: false, message: 'User not authenticated' }\n      return\n    }\n\n    context.body = {\n      verified: true,\n      message: 'Biometric authentication successful'\n    }\n\n    await next()\n  }\n)\n\n// Generate registration challenge for the currently logged-in user\nwebAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async (context, next) => {\n  const { user } = context.state\n  const rpID = context.hostname\n\n  const webAuthCredentials = await getRepository(WebAuthCredential).find({\n    where: {\n      user: { id: user.id }\n    }\n  })\n\n  const options: PublicKeyCredentialCreationOptionsJSON = await generateRegistrationOptions({\n    rpName,\n    rpID,\n    userName: user.email,\n    userDisplayName: user.name,\n    // Don't prompt users for additional information about the authenticator\n    // (Recommended for smoother UX)\n    attestationType: 'none',\n    // Prevent users from re-registering existing authenticators\n    excludeCredentials: webAuthCredentials.map(credential => ({\n      id: credential.credentialId\n      // Optional\n      // transports: credential.transports\n    })),\n    authenticatorSelection: {\n      // Defaults\n      residentKey: 'preferred',\n      userVerification: 'preferred',\n      // Optional\n      authenticatorAttachment: 'platform'\n    }\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Verify registration\nwebAuthnGlobalPrivateRouter.post('/auth/verify-registration', createWebAuthnMiddleware('webauthn-register'))\n\n// Generate sign-in challenge\nwebAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async (context, next) => {\n  const rpID = context.hostname\n\n  const options = await generateAuthenticationOptions({\n    rpID,\n    userVerification: 'preferred'\n  })\n\n  context.session.challenge = options.challenge\n  context.body = options\n})\n\n// Sign in with biometric authentication\nwebAuthnGlobalPublicRouter.post(\n  '/auth/signin-webauthn',\n  createWebAuthnMiddleware('webauthn-login'),\n  async (context, next) => {\n    const { domain, user } = context.state\n    const { request } = context\n    const { body: reqBody } = request\n\n    const token = await user.sign({ subdomain: domain?.subdomain })\n    setAccessTokenCookie(context, token)\n\n    var redirectURL = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(reqBody.redirectTo || '/')}`\n\n    /* Due to the two-step interaction, it will be processed by fetch(...) in the browser, so it cannot be handled with a redirect(3xx) response. Therefore, respond with redirectURL as data. */\n    context.body = { redirectURL, verified: true }\n\n    await next()\n  }\n)\n"]}

package/dist-server/routes.js

@@ -1,48 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const env_1 = require("@things-factory/env");
-const middlewares_1 = require("./middlewares");
-const router_1 = require("./router");
-const access_token_cookie_1 = require("./utils/access-token-cookie");
+const index_js_1 = require("./middlewares/index.js");
+const index_js_2 = require("./router/index.js");
+const access_token_cookie_js_1 = require("./utils/access-token-cookie.js");
 const isPathBaseDomain = !env_1.config.get('subdomain') && !env_1.config.get('useVirtualHostBasedDomain');
 process.on('bootstrap-module-global-public-route', (app, globalPublicRouter) => {
-    globalPublicRouter.use(router_1.siteRootRouter.routes(), router_1.siteRootRouter.allowedMethods());
-    globalPublicRouter.use(router_1.authPublicProcessRouter.routes(), router_1.authPublicProcessRouter.allowedMethods());
+    globalPublicRouter.use(index_js_2.siteRootRouter.routes(), index_js_2.siteRootRouter.allowedMethods());
+    globalPublicRouter.use(index_js_2.authPublicProcessRouter.routes(), index_js_2.authPublicProcessRouter.allowedMethods());
     /* ssoMiddleware가 정의되어있다면, /auth/sso-signin 패스를 활성화한다. */
     if (app.ssoMiddlewares.length > 0) {
-        router_1.authSigninRouter.get('/auth/sso-signin', app.ssoMiddlewares[0], async (context) => {
+        index_js_2.authSigninRouter.get('/auth/sso-signin', app.ssoMiddlewares[0], async (context) => {
             const { user } = context.state;
             const token = await user.sign();
-            (0, access_token_cookie_1.setAccessTokenCookie)(context, token);
+            (0, access_token_cookie_js_1.setAccessTokenCookie)(context, token);
             context.redirect('/auth/checkin');
         });
     }
 });
 process.on('bootstrap-module-global-private-route', (app, globalPrivateRouter) => {
-    globalPrivateRouter.use(middlewares_1.jwtAuthenticateMiddleware);
+    globalPrivateRouter.use(index_js_1.jwtAuthenticateMiddleware);
     /* globalPrivateRouter based nested-routers */
-    globalPrivateRouter.use(router_1.authCheckinRouter.routes(), router_1.authCheckinRouter.allowedMethods());
-    globalPrivateRouter.use(router_1.authPrivateProcessRouter.routes(), router_1.authPrivateProcessRouter.allowedMethods());
-    globalPrivateRouter.use(router_1.webAuthnGlobalPrivateRouter.routes(), router_1.webAuthnGlobalPrivateRouter.allowedMethods());
+    globalPrivateRouter.use(index_js_2.authCheckinRouter.routes(), index_js_2.authCheckinRouter.allowedMethods());
+    globalPrivateRouter.use(index_js_2.authPrivateProcessRouter.routes(), index_js_2.authPrivateProcessRouter.allowedMethods());
+    globalPrivateRouter.use(index_js_2.webAuthnGlobalPrivateRouter.routes(), index_js_2.webAuthnGlobalPrivateRouter.allowedMethods());
 });
 process.on('bootstrap-module-domain-public-route', (app, domainPublicRouter) => {
     /* domainPublicRouter based nested-routers */
-    domainPublicRouter.use(router_1.authSigninRouter.routes(), router_1.authSigninRouter.allowedMethods());
-    domainPublicRouter.use(router_1.authSignupRouter.routes(), router_1.authSignupRouter.allowedMethods());
-    domainPublicRouter.use(router_1.webAuthnGlobalPublicRouter.routes(), router_1.webAuthnGlobalPublicRouter.allowedMethods());
+    domainPublicRouter.use(index_js_2.authSigninRouter.routes(), index_js_2.authSigninRouter.allowedMethods());
+    domainPublicRouter.use(index_js_2.authSignupRouter.routes(), index_js_2.authSignupRouter.allowedMethods());
+    domainPublicRouter.use(index_js_2.webAuthnGlobalPublicRouter.routes(), index_js_2.webAuthnGlobalPublicRouter.allowedMethods());
     /* path '/admin/oauth/...' is deprecated. should use path '/oauth/...' for oauth2 related routing */
-    domainPublicRouter.use('/oauth', router_1.oauth2Router.routes(), router_1.oauth2Router.allowedMethods()); // if i use context
+    domainPublicRouter.use('/oauth', index_js_2.oauth2Router.routes(), index_js_2.oauth2Router.allowedMethods()); // if i use context
 });
 process.on('bootstrap-module-domain-private-route', (app, domainPrivateRouter) => {
-    domainPrivateRouter.use(middlewares_1.jwtAuthenticateMiddleware);
-    domainPrivateRouter.use(middlewares_1.domainAuthenticateMiddleware);
+    domainPrivateRouter.use(index_js_1.jwtAuthenticateMiddleware);
+    domainPrivateRouter.use(index_js_1.domainAuthenticateMiddleware);
     /* domainPrivateRouter based nested-routers */
     if (isPathBaseDomain) {
         // pathBaseDomainRouter는 history-fallback의 경우에 인증 처리를 하기 위한 라우터이다.
         // (보통, URL 링크등을 통해서 domain path URL로 바로 요청하는 경우에 해당한다.)
         // pathBaseDomainRouter는 domain path를 domain-private-router를 사용하는 것을 전제로 한다.
-        domainPrivateRouter.use('/domain/:domain/oauth', router_1.oauth2AuthorizeRouter.routes(), router_1.oauth2AuthorizeRouter.allowedMethods());
-        domainPrivateRouter.use('/domain', router_1.pathBaseDomainRouter.routes(), router_1.pathBaseDomainRouter.allowedMethods());
+        domainPrivateRouter.use('/domain/:domain/oauth', index_js_2.oauth2AuthorizeRouter.routes(), index_js_2.oauth2AuthorizeRouter.allowedMethods());
+        domainPrivateRouter.use('/domain', index_js_2.pathBaseDomainRouter.routes(), index_js_2.pathBaseDomainRouter.allowedMethods());
     }
     // Client Routing : path 확장자가 없는 경우는 대부분 client 라우팅에 해당한다.
     // 즉, browser-history-fallback 으로 index.html을 send 하는 경우에, 사용자 로그인이 필요한 경우에,