@uniorganization/uni-lib 4.0.50 → 4.1.1

package/dist/modules/tenant/tenant-authorization.service.js

@@ -0,0 +1,235 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var TenantAuthorizationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantAuthorizationService = exports.TENANT_AUTHORIZATION_TTL_SECONDS = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const client_entity_1 = require("../../entities/client.entity");
+const user_roles_entity_1 = require("../../entities/user-roles.entity");
+const usr_entity_1 = require("../../entities/usr.entity");
+const tenant_constants_1 = require("./tenant.constants");
+const tenant_authorization_keys_1 = require("./tenant-authorization.keys");
+const tenant_authorization_store_1 = require("./tenant-authorization.store");
+exports.TENANT_AUTHORIZATION_TTL_SECONDS = 60;
+let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuthorizationService {
+    constructor(store, userRepository, clientRepository, userRoleRepository) {
+        this.store = store;
+        this.userRepository = userRepository;
+        this.clientRepository = clientRepository;
+        this.userRoleRepository = userRoleRepository;
+        this.logger = new common_1.Logger(TenantAuthorizationService_1.name);
+    }
+    resolve(userId, clientId, expectedHomeClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertPositiveInteger(userId);
+            this.assertPositiveInteger(clientId);
+            this.assertPositiveInteger(expectedHomeClientId);
+            const key = (0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId);
+            const cached = yield this.readCache(key);
+            if (cached &&
+                cached.userId === userId &&
+                cached.clientId === clientId &&
+                cached.homeClientId === expectedHomeClientId &&
+                ((_a = cached.identity) === null || _a === void 0 ? void 0 : _a.id) === userId &&
+                cached.identity.homeClientId === expectedHomeClientId &&
+                this.isFresh(cached.cachedAt) &&
+                cached.roles.length > 0) {
+                return { identity: cached.identity, snapshot: cached };
+            }
+            const resolved = yield this.loadFromDatabase(userId, clientId, expectedHomeClientId);
+            yield this.writeCache(key, resolved.snapshot);
+            return resolved;
+        });
+    }
+    resolveImpersonation(userId, homeClientId, targetClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (homeClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+                targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID) {
+                throw new common_1.UnauthorizedException();
+            }
+            const origin = yield this.resolve(userId, homeClientId, homeClientId);
+            const isNewtechMaster = origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                role.roleName.toLowerCase() === 'sysadmin');
+            const targetClient = yield this.clientRepository.findOne({
+                where: { id: targetClientId, deletedAt: (0, typeorm_2.IsNull)() },
+            });
+            if (!isNewtechMaster || !targetClient) {
+                throw new common_1.UnauthorizedException();
+            }
+            const snapshot = {
+                userId,
+                homeClientId,
+                clientId: targetClientId,
+                clientName: targetClient.name,
+                clientAlias: targetClient.alias,
+                roles: [
+                    {
+                        roleId: 0,
+                        roleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                        moduleId: 0,
+                        moduleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                    },
+                ],
+                privileges: [],
+                identity: origin.identity,
+                cachedAt: new Date().toISOString(),
+            };
+            return { identity: origin.identity, snapshot };
+        });
+    }
+    invalidate(userId, clientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.store.delete((0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId));
+        });
+    }
+    invalidateMany(clientId, userIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keys = Array.from(new Set(userIds)).map((userId) => (0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId));
+            if (keys.length > 0) {
+                yield this.store.deleteMany(keys);
+            }
+        });
+    }
+    loadFromDatabase(userId, clientId, expectedHomeClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [user, client, assignments] = yield Promise.all([
+                this.userRepository.findOne({ where: { id: userId } }),
+                this.clientRepository.findOne({
+                    where: { id: clientId, deletedAt: (0, typeorm_2.IsNull)() },
+                }),
+                this.userRoleRepository
+                    .createQueryBuilder('assignment')
+                    .innerJoinAndSelect('assignment.role', 'role', 'role.client_id = assignment.client_id')
+                    .innerJoinAndSelect('role.module', 'module', 'module.is_active = true')
+                    .leftJoinAndSelect('role.privileges', 'definition', 'definition.client_id = assignment.client_id')
+                    .leftJoinAndSelect('definition.privilege', 'privilege', 'privilege.client_id = assignment.client_id AND privilege."IS_ACTIVE" <> 0')
+                    .where('assignment."USER_ID" = :userId', { userId })
+                    .andWhere('assignment.client_id = :clientId', { clientId })
+                    .getMany(),
+            ]);
+            if (!user ||
+                !Number(user.is_active) ||
+                user.clientId !== expectedHomeClientId ||
+                !client ||
+                assignments.length === 0) {
+                throw new common_1.UnauthorizedException();
+            }
+            const roles = assignments.map((assignment) => {
+                var _a, _b, _c, _d, _e, _f;
+                return ({
+                    roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
+                    roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
+                    moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
+                    moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
+                });
+            });
+            if (roles.some((role) => !Number.isInteger(role.roleId) ||
+                role.roleId <= 0 ||
+                !role.roleName ||
+                !Number.isInteger(role.moduleId) ||
+                role.moduleId <= 0 ||
+                !role.moduleName)) {
+                throw new common_1.UnauthorizedException();
+            }
+            const privileges = Array.from(new Set(assignments.flatMap((assignment) => {
+                var _a;
+                return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
+                    .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
+                    .filter((privilege) => Boolean(privilege));
+            }))).sort();
+            const identity = {
+                id: user.id,
+                homeClientId: user.clientId,
+                firstName: user.first_name,
+                username: user.username,
+                lastName: user.last_name,
+                division: user.division,
+                lob: user.lob,
+                fullName: user.fullName,
+                ntgid: user.ntgid,
+                profile: user.profile,
+                passwordExpired: user.password_expired,
+                viewEvaluations: user.viewEvaluations,
+                ern: user.ern,
+            };
+            const snapshot = {
+                userId,
+                homeClientId: user.clientId,
+                clientId,
+                clientName: client.name,
+                clientAlias: client.alias,
+                roles,
+                privileges,
+                identity,
+                cachedAt: new Date().toISOString(),
+            };
+            return { identity, snapshot };
+        });
+    }
+    readCache(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield this.store.get(key);
+            }
+            catch (_a) {
+                this.logger.warn('Authorization cache read failed; falling back to PostgreSQL');
+                return null;
+            }
+        });
+    }
+    writeCache(key, snapshot) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.store.set(key, snapshot, exports.TENANT_AUTHORIZATION_TTL_SECONDS);
+            }
+            catch (_a) {
+                this.logger.warn('Authorization cache write failed; continuing with PostgreSQL result');
+            }
+        });
+    }
+    assertPositiveInteger(value) {
+        if (!Number.isInteger(value) || value <= 0) {
+            throw new common_1.UnauthorizedException();
+        }
+    }
+    isFresh(cachedAt) {
+        const ageMilliseconds = Date.now() - Date.parse(cachedAt);
+        return (Number.isFinite(ageMilliseconds) &&
+            ageMilliseconds >= 0 &&
+            ageMilliseconds <= exports.TENANT_AUTHORIZATION_TTL_SECONDS * 1000);
+    }
+};
+exports.TenantAuthorizationService = TenantAuthorizationService;
+exports.TenantAuthorizationService = TenantAuthorizationService = TenantAuthorizationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(tenant_authorization_store_1.TENANT_AUTHORIZATION_STORE)),
+    __param(1, (0, typeorm_1.InjectRepository)(usr_entity_1.Users)),
+    __param(2, (0, typeorm_1.InjectRepository)(client_entity_1.Client)),
+    __param(3, (0, typeorm_1.InjectRepository)(user_roles_entity_1.UserRoles)),
+    __metadata("design:paramtypes", [Object, typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository])
+], TenantAuthorizationService);

package/dist/modules/tenant/tenant-authorization.store.d.ts

@@ -0,0 +1,8 @@
+import { TenantAuthorizationSnapshot } from './tenant-authorization.types';
+export declare const TENANT_AUTHORIZATION_STORE: unique symbol;
+export interface TenantAuthorizationStore {
+    get(key: string): Promise<TenantAuthorizationSnapshot | null>;
+    set(key: string, value: TenantAuthorizationSnapshot, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: readonly string[]): Promise<void>;
+}

package/dist/modules/tenant/tenant-authorization.store.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANT_AUTHORIZATION_STORE = void 0;
+exports.TENANT_AUTHORIZATION_STORE = Symbol('TENANT_AUTHORIZATION_STORE');

package/dist/modules/tenant/tenant-authorization.types.d.ts

@@ -0,0 +1,36 @@
+export interface TenantRoleAuthorization {
+    roleId: number;
+    roleName: string;
+    moduleId: number;
+    moduleName: string;
+}
+export interface TenantAuthorizationSnapshot {
+    userId: number;
+    homeClientId: number;
+    clientId: number;
+    clientName: string;
+    clientAlias: string;
+    roles: TenantRoleAuthorization[];
+    privileges: string[];
+    identity: TenantAuthorizationIdentity;
+    cachedAt: string;
+}
+export interface TenantAuthorizationIdentity {
+    id: number;
+    homeClientId: number;
+    firstName?: string;
+    username?: string;
+    lastName?: string;
+    division?: string;
+    lob?: string;
+    fullName?: string;
+    ntgid?: string;
+    profile?: string;
+    passwordExpired?: number;
+    viewEvaluations?: boolean;
+    ern?: string;
+}
+export interface ResolvedTenantAuthorization {
+    identity: TenantAuthorizationIdentity;
+    snapshot: TenantAuthorizationSnapshot;
+}

package/dist/modules/tenant/tenant-authorization.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/modules/tenant/tenant-context.errors.d.ts

@@ -0,0 +1,3 @@
+export declare class MissingTenantContextError extends Error {
+    constructor();
+}

package/dist/modules/tenant/tenant-context.errors.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingTenantContextError = void 0;
+class MissingTenantContextError extends Error {
+    constructor() {
+        super('Tenant context is required for this operation');
+        this.name = MissingTenantContextError.name;
+    }
+}
+exports.MissingTenantContextError = MissingTenantContextError;

package/dist/modules/tenant/tenant-context.interceptor.d.ts

@@ -0,0 +1,9 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { TenantContextStorage } from './tenant-context.storage';
+export declare class TenantContextInterceptor implements NestInterceptor {
+    private readonly tenantContextStorage;
+    constructor(tenantContextStorage: TenantContextStorage);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    private fromAuthenticatedUser;
+}

package/dist/modules/tenant/tenant-context.interceptor.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantContextInterceptor = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const tenant_context_storage_1 = require("./tenant-context.storage");
+let TenantContextInterceptor = class TenantContextInterceptor {
+    constructor(tenantContextStorage) {
+        this.tenantContextStorage = tenantContextStorage;
+    }
+    intercept(context, next) {
+        if (context.getType() !== 'http') {
+            return next.handle();
+        }
+        const request = context.switchToHttp().getRequest();
+        const state = request.tenantContext || this.fromAuthenticatedUser(request);
+        if (!state) {
+            return next.handle();
+        }
+        request.tenantContext = Object.freeze(state);
+        return new rxjs_1.Observable((subscriber) => {
+            const subscription = this.tenantContextStorage.run(state, () => next.handle().subscribe(subscriber));
+            return () => subscription.unsubscribe();
+        });
+    }
+    fromAuthenticatedUser(request) {
+        var _a, _b, _c, _d;
+        if (!request.user || request.user === true) {
+            return undefined;
+        }
+        const user = request.user;
+        if (!Number.isInteger(user.clientId) || user.clientId <= 0) {
+            throw new common_1.UnauthorizedException();
+        }
+        const correlationHeader = (_a = request.headers) === null || _a === void 0 ? void 0 : _a['x-correlation-id'];
+        const presentedCorrelationId = Array.isArray(correlationHeader)
+            ? correlationHeader[0]
+            : correlationHeader;
+        const correlationId = presentedCorrelationId &&
+            /^[A-Za-z0-9._:-]{1,128}$/.test(presentedCorrelationId)
+            ? presentedCorrelationId
+            : (0, crypto_1.randomUUID)();
+        return {
+            clientId: user.clientId,
+            originalClientId: (_b = user.originalClientId) !== null && _b !== void 0 ? _b : null,
+            actorUserId: user.id,
+            authenticationType: 'jwt',
+            impersonatedAt: (_c = user.impersonatedAt) !== null && _c !== void 0 ? _c : null,
+            impersonationReason: (_d = user.impersonationReason) !== null && _d !== void 0 ? _d : null,
+            correlationId,
+            roles: user.roles || [],
+        };
+    }
+};
+exports.TenantContextInterceptor = TenantContextInterceptor;
+exports.TenantContextInterceptor = TenantContextInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage])
+], TenantContextInterceptor);

package/dist/modules/tenant/tenant-context.service.d.ts

@@ -0,0 +1,15 @@
+import { TenantContextStorage } from './tenant-context.storage';
+import { TenantAuthenticationType, TenantContextState } from './tenant.types';
+export declare class TenantContext {
+    private readonly storage;
+    constructor(storage: TenantContextStorage);
+    getState(): Readonly<TenantContextState>;
+    tryGetState(): Readonly<TenantContextState> | undefined;
+    getClientId(): number;
+    getOriginalClientId(): number | null;
+    getActorUserId(): number | null;
+    getAuthenticationType(): TenantAuthenticationType;
+    getImpersonationReason(): string | null;
+    getCorrelationId(): string;
+    isImpersonating(): boolean;
+}

package/dist/modules/tenant/tenant-context.service.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantContext = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_context_errors_1 = require("./tenant-context.errors");
+const tenant_context_storage_1 = require("./tenant-context.storage");
+let TenantContext = class TenantContext {
+    constructor(storage) {
+        this.storage = storage;
+    }
+    getState() {
+        const state = this.storage.getStore();
+        if (!state) {
+            throw new tenant_context_errors_1.MissingTenantContextError();
+        }
+        return state;
+    }
+    tryGetState() {
+        return this.storage.getStore();
+    }
+    getClientId() {
+        return this.getState().clientId;
+    }
+    getOriginalClientId() {
+        return this.getState().originalClientId;
+    }
+    getActorUserId() {
+        return this.getState().actorUserId;
+    }
+    getAuthenticationType() {
+        return this.getState().authenticationType;
+    }
+    getImpersonationReason() {
+        return this.getState().impersonationReason;
+    }
+    getCorrelationId() {
+        return this.getState().correlationId;
+    }
+    isImpersonating() {
+        return this.getState().originalClientId !== null;
+    }
+};
+exports.TenantContext = TenantContext;
+exports.TenantContext = TenantContext = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage])
+], TenantContext);

package/dist/modules/tenant/tenant-context.storage.d.ts

@@ -0,0 +1,6 @@
+import { TenantContextState } from './tenant.types';
+export declare class TenantContextStorage {
+    private readonly storage;
+    run<T>(state: TenantContextState, callback: () => T): T;
+    getStore(): Readonly<TenantContextState> | undefined;
+}

package/dist/modules/tenant/tenant-context.storage.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantContextStorage = void 0;
+const common_1 = require("@nestjs/common");
+const async_hooks_1 = require("async_hooks");
+let TenantContextStorage = class TenantContextStorage {
+    constructor() {
+        this.storage = new async_hooks_1.AsyncLocalStorage();
+    }
+    run(state, callback) {
+        if (!Number.isInteger(state.clientId) || state.clientId <= 0) {
+            throw new Error('A valid tenant is required to establish context');
+        }
+        const current = this.storage.getStore();
+        if (current && current.clientId !== state.clientId) {
+            throw new Error('An established tenant context cannot be replaced');
+        }
+        const immutableState = Object.freeze(Object.assign(Object.assign({}, state), { roles: state.roles ? Object.freeze([...state.roles]) : undefined }));
+        return this.storage.run(immutableState, callback);
+    }
+    getStore() {
+        return this.storage.getStore();
+    }
+};
+exports.TenantContextStorage = TenantContextStorage;
+exports.TenantContextStorage = TenantContextStorage = __decorate([
+    (0, common_1.Injectable)()
+], TenantContextStorage);

package/dist/modules/tenant/tenant-credential.guard.d.ts

@@ -0,0 +1,13 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Repository } from 'typeorm';
+import { ClientCredential } from '../../entities/client-credential.entity';
+export declare function hashTenantCredentialSecret(secret: string): string;
+export declare class TenantCredentialGuard implements CanActivate {
+    private readonly credentialRepository;
+    constructor(credentialRepository: Repository<ClientCredential>);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private getHeader;
+    private getCorrelationId;
+    private parseCredential;
+    private matches;
+}

package/dist/modules/tenant/tenant-credential.guard.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantCredentialGuard = void 0;
+exports.hashTenantCredentialSecret = hashTenantCredentialSecret;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const client_credential_entity_1 = require("../../entities/client-credential.entity");
+const tenant_constants_1 = require("./tenant.constants");
+function hashTenantCredentialSecret(secret) {
+    return (0, crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+}
+let TenantCredentialGuard = class TenantCredentialGuard {
+    constructor(credentialRepository) {
+        this.credentialRepository = credentialRepository;
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const request = context.switchToHttp().getRequest();
+            const presentedCredential = this.getHeader(request);
+            const parsed = this.parseCredential(presentedCredential);
+            if (!parsed) {
+                throw new common_1.UnauthorizedException();
+            }
+            const credential = yield this.credentialRepository
+                .createQueryBuilder('credential')
+                .addSelect('credential.secretHash')
+                .innerJoinAndSelect('credential.client', 'client')
+                .where('credential.keyPrefix = :keyPrefix', {
+                keyPrefix: parsed.keyPrefix,
+            })
+                .andWhere('credential.isActive = true')
+                .andWhere('credential.revokedAt IS NULL')
+                .andWhere('client.deletedAt IS NULL')
+                .getOne();
+            if (!credential ||
+                (credential.expiresAt && credential.expiresAt.getTime() <= Date.now()) ||
+                !this.matches(parsed.secret, credential.secretHash)) {
+                throw new common_1.UnauthorizedException();
+            }
+            const state = {
+                clientId: credential.clientId,
+                originalClientId: null,
+                actorUserId: null,
+                authenticationType: 'client-credential',
+                impersonatedAt: null,
+                impersonationReason: null,
+                correlationId: this.getCorrelationId(request),
+                credentialId: credential.id,
+            };
+            request[tenant_constants_1.TENANT_CONTEXT_REQUEST_KEY] = Object.freeze(state);
+            return true;
+        });
+    }
+    getHeader(request) {
+        var _a;
+        const value = (_a = request.headers) === null || _a === void 0 ? void 0 : _a[tenant_constants_1.TENANT_CREDENTIAL_HEADER];
+        return Array.isArray(value) ? value[0] : value;
+    }
+    getCorrelationId(request) {
+        var _a;
+        const value = (_a = request.headers) === null || _a === void 0 ? void 0 : _a['x-correlation-id'];
+        const presentedCorrelationId = Array.isArray(value) ? value[0] : value;
+        return presentedCorrelationId &&
+            /^[A-Za-z0-9._:-]{1,128}$/.test(presentedCorrelationId)
+            ? presentedCorrelationId
+            : (0, crypto_1.randomUUID)();
+    }
+    parseCredential(value) {
+        if (!value) {
+            return undefined;
+        }
+        const separatorIndex = value.indexOf('.');
+        if (separatorIndex <= 0 || separatorIndex === value.length - 1) {
+            return undefined;
+        }
+        const keyPrefix = value.slice(0, separatorIndex);
+        const secret = value.slice(separatorIndex + 1);
+        if (!/^[A-Za-z0-9_-]{6,32}$/.test(keyPrefix) ||
+            secret.length < 32 ||
+            secret.length > 512) {
+            return undefined;
+        }
+        return { keyPrefix, secret };
+    }
+    matches(secret, expectedHash) {
+        const actual = Buffer.from(hashTenantCredentialSecret(secret), 'hex');
+        const expected = Buffer.from(expectedHash || '', 'hex');
+        return (actual.length === expected.length && (0, crypto_1.timingSafeEqual)(actual, expected));
+    }
+};
+exports.TenantCredentialGuard = TenantCredentialGuard;
+exports.TenantCredentialGuard = TenantCredentialGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(client_credential_entity_1.ClientCredential)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], TenantCredentialGuard);

package/dist/modules/tenant/tenant-ownership.service.d.ts

@@ -0,0 +1,7 @@
+export interface RecordWithTenant {
+    clientId: number | null;
+}
+export declare class TenantOwnershipService {
+    assertOwned<T extends RecordWithTenant>(record: T | null | undefined, clientId: number, resourceName?: string): T;
+    assertReadableGlobalOrOwned<T extends RecordWithTenant>(record: T | null | undefined, clientId: number, resourceName?: string): T;
+}