@uniorganization/uni-lib 4.0.50 → 4.1.1

package/dist/modules/tenant/tenant-ownership.service.js

@@ -0,0 +1,28 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantOwnershipService = void 0;
+const common_1 = require("@nestjs/common");
+let TenantOwnershipService = class TenantOwnershipService {
+    assertOwned(record, clientId, resourceName = 'Resource') {
+        if (!record || record.clientId !== clientId) {
+            throw new common_1.NotFoundException(`${resourceName} not found`);
+        }
+        return record;
+    }
+    assertReadableGlobalOrOwned(record, clientId, resourceName = 'Resource') {
+        if (!record || (record.clientId !== null && record.clientId !== clientId)) {
+            throw new common_1.NotFoundException(`${resourceName} not found`);
+        }
+        return record;
+    }
+};
+exports.TenantOwnershipService = TenantOwnershipService;
+exports.TenantOwnershipService = TenantOwnershipService = __decorate([
+    (0, common_1.Injectable)()
+], TenantOwnershipService);

package/dist/modules/tenant/tenant-query.helpers.d.ts

@@ -0,0 +1,12 @@
+import { FindOptionsWhere, ObjectLiteral, SelectQueryBuilder } from 'typeorm';
+export interface TenantOwnedRecord {
+    clientId: number;
+}
+export interface GlobalOrTenantRecord {
+    clientId: number | null;
+}
+export declare function tenantWhere<T extends TenantOwnedRecord>(clientId: number): FindOptionsWhere<T>;
+export declare function globalOrTenantWhere<T extends GlobalOrTenantRecord>(clientId: number): FindOptionsWhere<T>[];
+export declare function addTenantScope<T extends ObjectLiteral>(query: SelectQueryBuilder<T>, alias: string, clientId: number): SelectQueryBuilder<T>;
+export declare function addGlobalOrTenantScope<T extends ObjectLiteral>(query: SelectQueryBuilder<T>, alias: string, clientId: number): SelectQueryBuilder<T>;
+export declare function resolveGlobalTenantOverrides<T extends GlobalOrTenantRecord>(rows: readonly T[], naturalKey: (row: T) => string, clientId: number): T[];

package/dist/modules/tenant/tenant-query.helpers.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantWhere = tenantWhere;
+exports.globalOrTenantWhere = globalOrTenantWhere;
+exports.addTenantScope = addTenantScope;
+exports.addGlobalOrTenantScope = addGlobalOrTenantScope;
+exports.resolveGlobalTenantOverrides = resolveGlobalTenantOverrides;
+const typeorm_1 = require("typeorm");
+function tenantWhere(clientId) {
+    return { clientId };
+}
+function globalOrTenantWhere(clientId) {
+    return [
+        { clientId },
+        { clientId: (0, typeorm_1.IsNull)() },
+    ];
+}
+function addTenantScope(query, alias, clientId) {
+    return query.andWhere(`${alias}.client_id = :clientId`, { clientId });
+}
+function addGlobalOrTenantScope(query, alias, clientId) {
+    return query.andWhere(`(${alias}.client_id = :clientId OR ${alias}.client_id IS NULL)`, { clientId });
+}
+function resolveGlobalTenantOverrides(rows, naturalKey, clientId) {
+    const resolved = new Map();
+    for (const row of rows) {
+        if (row.clientId === null) {
+            resolved.set(naturalKey(row), row);
+        }
+    }
+    for (const row of rows) {
+        if (row.clientId === clientId) {
+            resolved.set(naturalKey(row), row);
+        }
+    }
+    return [...resolved.values()];
+}

package/dist/modules/tenant/tenant-runner.service.d.ts

@@ -0,0 +1,7 @@
+import { TenantContextStorage } from './tenant-context.storage';
+import { TenantRunnerMetadata } from './tenant.types';
+export declare class TenantRunner {
+    private readonly tenantContextStorage;
+    constructor(tenantContextStorage: TenantContextStorage);
+    run<T>(clientId: number, metadata: TenantRunnerMetadata, callback: () => T): T;
+}

package/dist/modules/tenant/tenant-runner.service.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantRunner = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const tenant_context_storage_1 = require("./tenant-context.storage");
+let TenantRunner = class TenantRunner {
+    constructor(tenantContextStorage) {
+        this.tenantContextStorage = tenantContextStorage;
+    }
+    run(clientId, metadata, callback) {
+        var _a, _b;
+        if (!Number.isInteger(clientId) || clientId <= 0) {
+            throw new Error('TenantRunner requires a valid client ID');
+        }
+        return this.tenantContextStorage.run({
+            clientId,
+            originalClientId: null,
+            actorUserId: (_a = metadata.actorUserId) !== null && _a !== void 0 ? _a : null,
+            authenticationType: metadata.authenticationType,
+            impersonatedAt: null,
+            impersonationReason: null,
+            correlationId: metadata.correlationId || (0, crypto_1.randomUUID)(),
+            credentialId: (_b = metadata.credentialId) !== null && _b !== void 0 ? _b : null,
+        }, callback);
+    }
+};
+exports.TenantRunner = TenantRunner;
+exports.TenantRunner = TenantRunner = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage])
+], TenantRunner);

package/dist/modules/tenant/tenant-security-state.service.d.ts

@@ -0,0 +1,11 @@
+import { TenantSecurityStateStore } from './tenant-security-state.store';
+export declare class TenantSecurityStateService {
+    private readonly store;
+    constructor(store: TenantSecurityStateStore);
+    isAccessTokenRevoked(jti: string): Promise<boolean>;
+    revokeAccessToken(jti: string, ttlSeconds: number): Promise<void>;
+    createPreAuth(jti: string, userId: number, ttlSeconds: number): Promise<void>;
+    consumePreAuth(jti: string, userId: number): Promise<boolean>;
+    private securityOperation;
+    private assertTtl;
+}

package/dist/modules/tenant/tenant-security-state.service.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantSecurityStateService = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_authorization_keys_1 = require("./tenant-authorization.keys");
+const tenant_security_state_store_1 = require("./tenant-security-state.store");
+let TenantSecurityStateService = class TenantSecurityStateService {
+    constructor(store) {
+        this.store = store;
+    }
+    isAccessTokenRevoked(jti) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.securityOperation(() => this.store.isRevoked((0, tenant_authorization_keys_1.revokedAccessTokenKey)(jti)));
+        });
+    }
+    revokeAccessToken(jti, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertTtl(ttlSeconds);
+            yield this.securityOperation(() => this.store.revoke((0, tenant_authorization_keys_1.revokedAccessTokenKey)(jti), ttlSeconds));
+        });
+    }
+    createPreAuth(jti, userId, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertTtl(ttlSeconds);
+            yield this.securityOperation(() => this.store.createPreAuth((0, tenant_authorization_keys_1.preAuthTokenKey)(jti), userId, ttlSeconds));
+        });
+    }
+    consumePreAuth(jti, userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.securityOperation(() => this.store.consumePreAuth((0, tenant_authorization_keys_1.preAuthTokenKey)(jti), userId));
+        });
+    }
+    securityOperation(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield operation();
+            }
+            catch (_a) {
+                throw new common_1.ServiceUnavailableException('Authentication security state is unavailable');
+            }
+        });
+    }
+    assertTtl(ttlSeconds) {
+        if (!Number.isInteger(ttlSeconds) || ttlSeconds <= 0) {
+            throw new common_1.ServiceUnavailableException('Authentication security state is unavailable');
+        }
+    }
+};
+exports.TenantSecurityStateService = TenantSecurityStateService;
+exports.TenantSecurityStateService = TenantSecurityStateService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(tenant_security_state_store_1.TENANT_SECURITY_STATE_STORE)),
+    __metadata("design:paramtypes", [Object])
+], TenantSecurityStateService);

package/dist/modules/tenant/tenant-security-state.store.d.ts

@@ -0,0 +1,7 @@
+export declare const TENANT_SECURITY_STATE_STORE: unique symbol;
+export interface TenantSecurityStateStore {
+    isRevoked(key: string): Promise<boolean>;
+    revoke(key: string, ttlSeconds: number): Promise<void>;
+    createPreAuth(key: string, userId: number, ttlSeconds: number): Promise<void>;
+    consumePreAuth(key: string, userId: number): Promise<boolean>;
+}

package/dist/modules/tenant/tenant-security-state.store.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANT_SECURITY_STATE_STORE = void 0;
+exports.TENANT_SECURITY_STATE_STORE = Symbol('TENANT_SECURITY_STATE_STORE');

package/dist/modules/tenant/tenant.constants.d.ts

@@ -0,0 +1,7 @@
+export declare const NEWTECH_CLIENT_ID = 1;
+export declare const ALTERA_CLIENT_ID = 2;
+export declare const TENANT_IMPERSONATOR_ROLE = "TENANT_IMPERSONATOR";
+export declare const MASTER_TENANT_METADATA_KEY = "masterTenant";
+export declare const PUBLIC_ROUTE_METADATA_KEY = "publicRoute";
+export declare const TENANT_CONTEXT_REQUEST_KEY = "tenantContext";
+export declare const TENANT_CREDENTIAL_HEADER = "x-client-credential";

package/dist/modules/tenant/tenant.constants.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANT_CREDENTIAL_HEADER = exports.TENANT_CONTEXT_REQUEST_KEY = exports.PUBLIC_ROUTE_METADATA_KEY = exports.MASTER_TENANT_METADATA_KEY = exports.TENANT_IMPERSONATOR_ROLE = exports.ALTERA_CLIENT_ID = exports.NEWTECH_CLIENT_ID = void 0;
+exports.NEWTECH_CLIENT_ID = 1;
+exports.ALTERA_CLIENT_ID = 2;
+exports.TENANT_IMPERSONATOR_ROLE = 'TENANT_IMPERSONATOR';
+exports.MASTER_TENANT_METADATA_KEY = 'masterTenant';
+exports.PUBLIC_ROUTE_METADATA_KEY = 'publicRoute';
+exports.TENANT_CONTEXT_REQUEST_KEY = 'tenantContext';
+exports.TENANT_CREDENTIAL_HEADER = 'x-client-credential';

package/dist/modules/tenant/tenant.module.d.ts

@@ -0,0 +1,2 @@
+export declare class TenantModule {
+}

package/dist/modules/tenant/tenant.module.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantModule = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const client_credential_entity_1 = require("../../entities/client-credential.entity");
+const client_entity_1 = require("../../entities/client.entity");
+const user_roles_entity_1 = require("../../entities/user-roles.entity");
+const usr_entity_1 = require("../../entities/usr.entity");
+const redis_tenant_state_store_1 = require("./redis-tenant-state.store");
+const tenant_authorization_store_1 = require("./tenant-authorization.store");
+const tenant_authorization_service_1 = require("./tenant-authorization.service");
+const tenant_security_state_store_1 = require("./tenant-security-state.store");
+const tenant_security_state_service_1 = require("./tenant-security-state.service");
+const tenant_context_storage_1 = require("./tenant-context.storage");
+const tenant_context_service_1 = require("./tenant-context.service");
+const tenant_context_interceptor_1 = require("./tenant-context.interceptor");
+const tenant_credential_guard_1 = require("./tenant-credential.guard");
+const master_tenant_guard_1 = require("./master-tenant.guard");
+const tenant_ownership_service_1 = require("./tenant-ownership.service");
+const tenant_runner_service_1 = require("./tenant-runner.service");
+let TenantModule = class TenantModule {
+};
+exports.TenantModule = TenantModule;
+exports.TenantModule = TenantModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([client_credential_entity_1.ClientCredential, client_entity_1.Client, user_roles_entity_1.UserRoles, usr_entity_1.Users]),
+        ],
+        providers: [
+            redis_tenant_state_store_1.RedisTenantStateStore,
+            {
+                provide: tenant_authorization_store_1.TENANT_AUTHORIZATION_STORE,
+                useExisting: redis_tenant_state_store_1.RedisTenantStateStore,
+            },
+            {
+                provide: tenant_security_state_store_1.TENANT_SECURITY_STATE_STORE,
+                useExisting: redis_tenant_state_store_1.RedisTenantStateStore,
+            },
+            tenant_authorization_service_1.TenantAuthorizationService,
+            tenant_security_state_service_1.TenantSecurityStateService,
+            tenant_context_storage_1.TenantContextStorage,
+            tenant_context_service_1.TenantContext,
+            tenant_runner_service_1.TenantRunner,
+            tenant_context_interceptor_1.TenantContextInterceptor,
+            tenant_credential_guard_1.TenantCredentialGuard,
+            master_tenant_guard_1.MasterTenantGuard,
+            tenant_ownership_service_1.TenantOwnershipService,
+        ],
+        exports: [
+            tenant_authorization_store_1.TENANT_AUTHORIZATION_STORE,
+            tenant_security_state_store_1.TENANT_SECURITY_STATE_STORE,
+            tenant_authorization_service_1.TenantAuthorizationService,
+            tenant_security_state_service_1.TenantSecurityStateService,
+            tenant_context_service_1.TenantContext,
+            tenant_runner_service_1.TenantRunner,
+            tenant_context_interceptor_1.TenantContextInterceptor,
+            tenant_credential_guard_1.TenantCredentialGuard,
+            master_tenant_guard_1.MasterTenantGuard,
+            tenant_ownership_service_1.TenantOwnershipService,
+        ],
+    })
+], TenantModule);

package/dist/modules/tenant/tenant.types.d.ts

@@ -0,0 +1,69 @@
+export type TenantAuthenticationType = 'jwt' | 'client-credential' | 'internal-message' | 'scheduled-job';
+export interface TenantContextState {
+    readonly clientId: number;
+    readonly originalClientId: number | null;
+    readonly actorUserId: number | null;
+    readonly authenticationType: TenantAuthenticationType;
+    readonly impersonatedAt: string | null;
+    readonly impersonationReason: string | null;
+    readonly correlationId: string;
+    readonly credentialId?: string | null;
+    readonly roles?: readonly string[];
+}
+export interface AuthenticatedTenantUser {
+    id: number;
+    homeClientId: number;
+    clientId: number;
+    clientAlias?: string;
+    clientName?: string;
+    jti: string;
+    tokenExpiresAt: number;
+    originalClientId: number | null;
+    impersonatedAt: string | null;
+    impersonationReason: string | null;
+    roles: string[];
+    privileges: string[];
+    isMasterTenantAdmin: boolean;
+    first_name?: string;
+    username?: string;
+    last_name?: string;
+    division?: string;
+    lob?: string;
+    fullName?: string;
+    ntgid?: string;
+    profile?: string;
+    password_expired?: number;
+    viewEvaluations?: boolean;
+    ern?: string;
+    [key: string]: unknown;
+}
+export interface TenantJwtPayload {
+    type: 'access';
+    user: AuthenticatedTenantUser;
+    sub: string;
+    iat: number;
+    exp: number;
+    jti: string;
+}
+export interface PreAuthJwtPayload {
+    type: 'pre-auth';
+    userId: number;
+    iat: number;
+    exp: number;
+    jti: string;
+}
+export interface TenantAwareRequest {
+    headers?: Record<string, string | string[] | undefined>;
+    user?: AuthenticatedTenantUser | true;
+    tenantContext?: Readonly<TenantContextState>;
+}
+export type PublicRouteTenantMode = 'tenantless' | 'credential';
+export interface PublicRouteOptions {
+    tenant: PublicRouteTenantMode;
+}
+export interface TenantRunnerMetadata {
+    authenticationType: 'internal-message' | 'scheduled-job';
+    actorUserId?: number | null;
+    correlationId?: string;
+    credentialId?: string | null;
+}

package/dist/modules/tenant/tenant.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniorganization/uni-lib",
-  "version": "4.0.50",
+  "version": "4.1.1",
   "description": "UNI Library",
   "author": "Jhomiguel",
   "main": "dist/index.js",
@@ -18,6 +18,7 @@
     "@nestjs/swagger": "^7.4.0",
     "axios": "^1.13.2",
     "csvtojson": "^2.0.10",
+    "ioredis": "5.4.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "swagger-ui-express": "^5.0.1",