@uniorganization/uni-lib 4.0.51 → 4.1.1

package/dist/modules/common/jwt.strategy.js

@@ -8,9 +8,6 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -24,33 +21,100 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
-const typeorm_1 = require("@nestjs/typeorm");
 const passport_jwt_1 = require("passport-jwt");
-const usr_entity_1 = require("../../entities/usr.entity");
-const typeorm_2 = require("typeorm");
+const tenant_1 = require("../tenant");
 let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
-    constructor(userRepository) {
+    constructor(authorization, securityState) {
         super({
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
-            ignoreExpiration: JSON.parse(process.env.JWT_IGNORE_EXPIRATION) || false,
+            ignoreExpiration: process.env.JWT_IGNORE_EXPIRATION === 'true',
             secretOrKey: process.env.JWT_SECRET,
         });
-        this.userRepository = userRepository;
+        this.authorization = authorization;
+        this.securityState = securityState;
     }
     validate(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const user = yield this.userRepository.findOne({ where: { id: payload.user.id } });
-            if (!user) {
-                throw new common_1.UnauthorizedException('User not found');
+            var _a, _b, _c;
+            const signedUser = payload === null || payload === void 0 ? void 0 : payload.user;
+            const effectiveClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.clientId);
+            const homeClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.homeClientId);
+            const originalClientId = (_a = signedUser === null || signedUser === void 0 ? void 0 : signedUser.originalClientId) !== null && _a !== void 0 ? _a : null;
+            const now = Math.floor(Date.now() / 1000);
+            if ((payload === null || payload === void 0 ? void 0 : payload.type) !== 'access' ||
+                !signedUser ||
+                !Number.isInteger(signedUser.id) ||
+                String(signedUser.id) !== payload.sub ||
+                !Number.isInteger(effectiveClientId) ||
+                effectiveClientId <= 0 ||
+                !Number.isInteger(homeClientId) ||
+                homeClientId <= 0 ||
+                !Number.isInteger(payload.exp) ||
+                payload.exp <= now ||
+                !this.validTokenIdentifier(payload.jti) ||
+                signedUser.jti !== payload.jti ||
+                signedUser.tokenExpiresAt !== payload.exp) {
+                throw new common_1.UnauthorizedException();
+            }
+            if (yield this.securityState.isAccessTokenRevoked(payload.jti)) {
+                throw new common_1.UnauthorizedException();
             }
-            const { id, first_name, username, last_name, division, lob, fullName, ntgid, profile, password_expired, viewEvaluations, ern } = user;
-            return { id, first_name, username, last_name, division, lob, fullName, ntgid, profile, password_expired, viewEvaluations, ern };
+            const impersonating = originalClientId !== null;
+            if ((impersonating &&
+                (originalClientId !== tenant_1.NEWTECH_CLIENT_ID ||
+                    homeClientId !== tenant_1.NEWTECH_CLIENT_ID ||
+                    effectiveClientId === tenant_1.NEWTECH_CLIENT_ID ||
+                    !((_b = signedUser.roles) === null || _b === void 0 ? void 0 : _b.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)) ||
+                    !signedUser.impersonatedAt ||
+                    !signedUser.impersonationReason)) ||
+                (!impersonating && ((_c = signedUser.roles) === null || _c === void 0 ? void 0 : _c.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)))) {
+                throw new common_1.UnauthorizedException();
+            }
+            const resolved = impersonating
+                ? yield this.authorization.resolveImpersonation(signedUser.id, homeClientId, effectiveClientId)
+                : yield this.authorization.resolve(signedUser.id, effectiveClientId, homeClientId);
+            const { identity, snapshot } = resolved;
+            const isMasterTenantAdmin = !impersonating &&
+                snapshot.clientId === tenant_1.NEWTECH_CLIENT_ID &&
+                snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                    role.roleName.toLowerCase() === 'sysadmin');
+            return {
+                id: identity.id,
+                first_name: identity.firstName,
+                username: identity.username,
+                last_name: identity.lastName,
+                division: identity.division,
+                lob: identity.lob,
+                fullName: identity.fullName,
+                ntgid: identity.ntgid,
+                profile: identity.profile,
+                password_expired: identity.passwordExpired,
+                viewEvaluations: identity.viewEvaluations,
+                ern: identity.ern,
+                homeClientId: identity.homeClientId,
+                clientId: snapshot.clientId,
+                clientAlias: snapshot.clientAlias,
+                clientName: snapshot.clientName,
+                jti: payload.jti,
+                tokenExpiresAt: payload.exp,
+                originalClientId,
+                impersonatedAt: impersonating ? signedUser.impersonatedAt : null,
+                impersonationReason: impersonating
+                    ? signedUser.impersonationReason
+                    : null,
+                roles: Array.from(new Set(snapshot.roles.map((role) => role.roleName))),
+                privileges: snapshot.privileges,
+                isMasterTenantAdmin,
+            };
         });
     }
+    validTokenIdentifier(value) {
+        return /^[A-Za-z0-9._:-]{1,128}$/.test(value || '');
+    }
 };
 exports.JwtStrategy = JwtStrategy;
 exports.JwtStrategy = JwtStrategy = __decorate([
     (0, common_1.Injectable)(),
-    __param(0, (0, typeorm_1.InjectRepository)(usr_entity_1.Users)),
-    __metadata("design:paramtypes", [typeorm_2.Repository])
+    __metadata("design:paramtypes", [tenant_1.TenantAuthorizationService,
+        tenant_1.TenantSecurityStateService])
 ], JwtStrategy);

package/dist/modules/common/logged-user.decorator.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoggedUser = void 0;
 const common_1 = require("@nestjs/common");
-exports.LoggedUser = (0, common_1.createParamDecorator)((data, ctx) => {
+exports.LoggedUser = (0, common_1.createParamDecorator)((_data, ctx) => {
     const request = ctx.switchToHttp().getRequest();
-    return request === null || request === void 0 ? void 0 : request.user;
+    return request.user;
 });

package/dist/modules/common/skip-jwt-auth.decorator.d.ts

@@ -1,2 +1,4 @@
+import { PublicRouteOptions } from '../tenant';
 export declare const SKIP_JWT_AUTH_KEY = "skipJwtAuth";
-export declare const SkipJwtAuth: () => import("@nestjs/common").CustomDecorator<string>;
+export declare const Public: (options?: PublicRouteOptions) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+export declare const SkipJwtAuth: () => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;

package/dist/modules/common/skip-jwt-auth.decorator.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SkipJwtAuth = exports.SKIP_JWT_AUTH_KEY = void 0;
+exports.SkipJwtAuth = exports.Public = exports.SKIP_JWT_AUTH_KEY = void 0;
 const common_1 = require("@nestjs/common");
+const tenant_1 = require("../tenant");
 exports.SKIP_JWT_AUTH_KEY = 'skipJwtAuth';
-const SkipJwtAuth = () => (0, common_1.SetMetadata)(exports.SKIP_JWT_AUTH_KEY, true);
+const Public = (options = { tenant: 'tenantless' }) => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.SKIP_JWT_AUTH_KEY, true), (0, common_1.SetMetadata)(tenant_1.PUBLIC_ROUTE_METADATA_KEY, options));
+exports.Public = Public;
+const SkipJwtAuth = () => (0, exports.Public)({ tenant: 'tenantless' });
 exports.SkipJwtAuth = SkipJwtAuth;

package/dist/modules/index.d.ts

@@ -5,3 +5,4 @@ export * from './google-maps/google-maps.module';
 export * from './google-maps/google-maps.service';
 export * from './google-maps/google-maps.types';
 export * from './file-storage';
+export * from './tenant';

package/dist/modules/index.js

@@ -21,3 +21,4 @@ __exportStar(require("./google-maps/google-maps.module"), exports);
 __exportStar(require("./google-maps/google-maps.service"), exports);
 __exportStar(require("./google-maps/google-maps.types"), exports);
 __exportStar(require("./file-storage"), exports);
+__exportStar(require("./tenant"), exports);

package/dist/modules/tenant/current-tenant.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentTenant: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/modules/tenant/current-tenant.decorator.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentTenant = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_context_errors_1 = require("./tenant-context.errors");
+exports.CurrentTenant = (0, common_1.createParamDecorator)((_data, context) => {
+    var _a;
+    const request = context.switchToHttp().getRequest();
+    const clientId = (_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId;
+    if (!Number.isInteger(clientId) || !clientId || clientId <= 0) {
+        throw new tenant_context_errors_1.MissingTenantContextError();
+    }
+    return clientId;
+});

package/dist/modules/tenant/index.d.ts

@@ -0,0 +1,21 @@
+export * from './current-tenant.decorator';
+export * from './master-tenant.decorator';
+export * from './master-tenant.guard';
+export * from './redis-tenant-state.store';
+export * from './tenant-audit.types';
+export * from './tenant-authorization.keys';
+export * from './tenant-authorization.service';
+export * from './tenant-authorization.store';
+export * from './tenant-authorization.types';
+export * from './tenant.constants';
+export * from './tenant-context.interceptor';
+export * from './tenant-context.errors';
+export * from './tenant-context.service';
+export * from './tenant-credential.guard';
+export * from './tenant.module';
+export * from './tenant-ownership.service';
+export * from './tenant-query.helpers';
+export * from './tenant-runner.service';
+export * from './tenant-security-state.service';
+export * from './tenant-security-state.store';
+export * from './tenant.types';

package/dist/modules/tenant/index.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./current-tenant.decorator"), exports);
+__exportStar(require("./master-tenant.decorator"), exports);
+__exportStar(require("./master-tenant.guard"), exports);
+__exportStar(require("./redis-tenant-state.store"), exports);
+__exportStar(require("./tenant-audit.types"), exports);
+__exportStar(require("./tenant-authorization.keys"), exports);
+__exportStar(require("./tenant-authorization.service"), exports);
+__exportStar(require("./tenant-authorization.store"), exports);
+__exportStar(require("./tenant-authorization.types"), exports);
+__exportStar(require("./tenant.constants"), exports);
+__exportStar(require("./tenant-context.interceptor"), exports);
+__exportStar(require("./tenant-context.errors"), exports);
+__exportStar(require("./tenant-context.service"), exports);
+__exportStar(require("./tenant-credential.guard"), exports);
+__exportStar(require("./tenant.module"), exports);
+__exportStar(require("./tenant-ownership.service"), exports);
+__exportStar(require("./tenant-query.helpers"), exports);
+__exportStar(require("./tenant-runner.service"), exports);
+__exportStar(require("./tenant-security-state.service"), exports);
+__exportStar(require("./tenant-security-state.store"), exports);
+__exportStar(require("./tenant.types"), exports);

package/dist/modules/tenant/master-tenant.decorator.d.ts

@@ -0,0 +1 @@
+export declare const MasterTenant: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/modules/tenant/master-tenant.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MasterTenant = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_constants_1 = require("./tenant.constants");
+const MasterTenant = () => (0, common_1.SetMetadata)(tenant_constants_1.MASTER_TENANT_METADATA_KEY, true);
+exports.MasterTenant = MasterTenant;

package/dist/modules/tenant/master-tenant.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class MasterTenantGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/modules/tenant/master-tenant.guard.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MasterTenantGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const tenant_constants_1 = require("./tenant.constants");
+let MasterTenantGuard = class MasterTenantGuard {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        var _a, _b, _c, _d;
+        const required = this.reflector.getAllAndOverride(tenant_constants_1.MASTER_TENANT_METADATA_KEY, [context.getHandler(), context.getClass()]);
+        if (!required) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        if (!request.user || request.user === true) {
+            throw new common_1.UnauthorizedException();
+        }
+        const effectiveClientId = ((_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId) || request.user.clientId;
+        const originalClientId = (_d = (_c = (_b = request.tenantContext) === null || _b === void 0 ? void 0 : _b.originalClientId) !== null && _c !== void 0 ? _c : request.user.originalClientId) !== null && _d !== void 0 ? _d : null;
+        if (effectiveClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+            originalClientId !== null ||
+            !request.user.isMasterTenantAdmin) {
+            throw new common_1.ForbiddenException();
+        }
+        return true;
+    }
+};
+exports.MasterTenantGuard = MasterTenantGuard;
+exports.MasterTenantGuard = MasterTenantGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], MasterTenantGuard);

package/dist/modules/tenant/redis-tenant-state.store.d.ts

@@ -0,0 +1,21 @@
+import { OnModuleDestroy } from '@nestjs/common';
+import { TenantAuthorizationStore } from './tenant-authorization.store';
+import { TenantAuthorizationSnapshot } from './tenant-authorization.types';
+import { TenantSecurityStateStore } from './tenant-security-state.store';
+export declare class RedisTenantStateStore implements TenantAuthorizationStore, TenantSecurityStateStore, OnModuleDestroy {
+    private readonly logger;
+    private client;
+    get(key: string): Promise<TenantAuthorizationSnapshot | null>;
+    set(key: string, value: TenantAuthorizationSnapshot, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: readonly string[]): Promise<void>;
+    isRevoked(key: string): Promise<boolean>;
+    revoke(key: string, ttlSeconds: number): Promise<void>;
+    createPreAuth(key: string, userId: number, ttlSeconds: number): Promise<void>;
+    consumePreAuth(key: string, userId: number): Promise<boolean>;
+    onModuleDestroy(): Promise<void>;
+    private execute;
+    private getClient;
+    private positiveInteger;
+    private isAuthorizationSnapshot;
+}

package/dist/modules/tenant/redis-tenant-state.store.js

@@ -0,0 +1,165 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var RedisTenantStateStore_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisTenantStateStore = void 0;
+const common_1 = require("@nestjs/common");
+const ioredis_1 = require("ioredis");
+let RedisTenantStateStore = RedisTenantStateStore_1 = class RedisTenantStateStore {
+    constructor() {
+        this.logger = new common_1.Logger(RedisTenantStateStore_1.name);
+        this.client = null;
+    }
+    get(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serialized = yield this.execute((client) => client.get(key));
+            if (serialized === null) {
+                return null;
+            }
+            const snapshot = JSON.parse(serialized);
+            if (!this.isAuthorizationSnapshot(snapshot)) {
+                throw new Error('Invalid cached authorization snapshot');
+            }
+            return snapshot;
+        });
+    }
+    set(key, value, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.set(key, JSON.stringify(value), 'EX', ttlSeconds));
+        });
+    }
+    delete(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.del(key));
+        });
+    }
+    deleteMany(keys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (let offset = 0; offset < keys.length; offset += 500) {
+                const batch = keys.slice(offset, offset + 500);
+                yield this.execute((client) => client.del(...batch));
+            }
+        });
+    }
+    isRevoked(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (yield this.execute((client) => client.exists(key))) === 1;
+        });
+    }
+    revoke(key, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.set(key, '1', 'EX', ttlSeconds));
+        });
+    }
+    createPreAuth(key, userId, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this.execute((client) => client.set(key, String(userId), 'EX', ttlSeconds, 'NX'));
+            if (result !== 'OK') {
+                throw new Error('Pre-auth security state already exists');
+            }
+        });
+    }
+    consumePreAuth(key, userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this.execute((client) => client.eval('if redis.call("GET", KEYS[1]) == ARGV[1] then return redis.call("DEL", KEYS[1]) else return 0 end', 1, key, String(userId)));
+            return Number(result) === 1;
+        });
+    }
+    onModuleDestroy() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.client) {
+                return;
+            }
+            const client = this.client;
+            this.client = null;
+            try {
+                if (client.status === 'ready') {
+                    yield client.quit();
+                }
+                else {
+                    client.disconnect();
+                }
+            }
+            catch (_a) {
+                client.disconnect();
+            }
+        });
+    }
+    execute(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const client = this.getClient();
+            return operation(client);
+        });
+    }
+    getClient() {
+        if (this.client && this.client.status !== 'end') {
+            return this.client;
+        }
+        const url = process.env.TENANT_REDIS_URL || process.env.REDIS_URL;
+        const host = process.env.TENANT_REDIS_HOST || process.env.REDIS_HOST;
+        if (!url && !host) {
+            throw new Error('Tenant Redis is not configured');
+        }
+        const options = {
+            connectTimeout: this.positiveInteger(process.env.TENANT_REDIS_CONNECT_TIMEOUT_MS, 2000),
+            maxRetriesPerRequest: 1,
+            username: process.env.TENANT_REDIS_USERNAME || process.env.REDIS_USERNAME,
+            password: process.env.TENANT_REDIS_PASSWORD || process.env.REDIS_PASSWORD,
+            tls: process.env.TENANT_REDIS_TLS === 'true' ? {} : undefined,
+        };
+        this.client = url
+            ? new ioredis_1.default(url, options)
+            : new ioredis_1.default(Object.assign(Object.assign({}, options), { host, port: this.positiveInteger(process.env.TENANT_REDIS_PORT || process.env.REDIS_PORT, 6379) }));
+        this.client.on('error', () => {
+            this.logger.error('Tenant Redis connection is unavailable');
+        });
+        return this.client;
+    }
+    positiveInteger(value, fallback) {
+        const parsed = Number(value);
+        return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+    }
+    isAuthorizationSnapshot(value) {
+        var _a;
+        return Boolean(value &&
+            Number.isInteger(value.userId) &&
+            value.userId > 0 &&
+            Number.isInteger(value.homeClientId) &&
+            value.homeClientId > 0 &&
+            Number.isInteger(value.clientId) &&
+            value.clientId > 0 &&
+            typeof value.clientName === 'string' &&
+            typeof value.clientAlias === 'string' &&
+            Array.isArray(value.roles) &&
+            value.roles.length > 0 &&
+            value.roles.every((role) => Number.isInteger(role.roleId) &&
+                role.roleId > 0 &&
+                typeof role.roleName === 'string' &&
+                Number.isInteger(role.moduleId) &&
+                role.moduleId > 0 &&
+                typeof role.moduleName === 'string') &&
+            Array.isArray(value.privileges) &&
+            value.privileges.every((privilege) => typeof privilege === 'string') &&
+            ((_a = value.identity) === null || _a === void 0 ? void 0 : _a.id) === value.userId &&
+            value.identity.homeClientId === value.homeClientId &&
+            typeof value.cachedAt === 'string');
+    }
+};
+exports.RedisTenantStateStore = RedisTenantStateStore;
+exports.RedisTenantStateStore = RedisTenantStateStore = RedisTenantStateStore_1 = __decorate([
+    (0, common_1.Injectable)()
+], RedisTenantStateStore);

package/dist/modules/tenant/tenant-audit.types.d.ts

@@ -0,0 +1,15 @@
+import { TenantAuthenticationType } from './tenant.types';
+export interface TenantAuditMetadata {
+    actorUserId: number | null;
+    originalClientId: number | null;
+    effectiveClientId: number;
+    authenticationType: TenantAuthenticationType;
+    impersonationReason: string | null;
+    correlationId: string;
+    service: string;
+    operation: string;
+    route?: string;
+    entityType?: string;
+    entityId?: string | number;
+    result?: 'success' | 'failure';
+}

package/dist/modules/tenant/tenant-audit.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/modules/tenant/tenant-authorization.keys.d.ts

@@ -0,0 +1,3 @@
+export declare function tenantAuthorizationKey(clientId: number, userId: number): string;
+export declare function revokedAccessTokenKey(jti: string): string;
+export declare function preAuthTokenKey(jti: string): string;

package/dist/modules/tenant/tenant-authorization.keys.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantAuthorizationKey = tenantAuthorizationKey;
+exports.revokedAccessTokenKey = revokedAccessTokenKey;
+exports.preAuthTokenKey = preAuthTokenKey;
+const common_1 = require("@nestjs/common");
+const TOKEN_IDENTIFIER = /^[A-Za-z0-9._:-]{1,128}$/;
+function positiveInteger(value, field) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new common_1.UnauthorizedException(`Invalid ${field}`);
+    }
+    return value;
+}
+function tokenIdentifier(value) {
+    if (!TOKEN_IDENTIFIER.test(value || '')) {
+        throw new common_1.UnauthorizedException('Invalid token identifier');
+    }
+    return value;
+}
+function tenantAuthorizationKey(clientId, userId) {
+    return `client:${positiveInteger(clientId, 'clientId')}:authz:user:${positiveInteger(userId, 'userId')}`;
+}
+function revokedAccessTokenKey(jti) {
+    return `security:access-token:revoked:${tokenIdentifier(jti)}`;
+}
+function preAuthTokenKey(jti) {
+    return `security:pre-auth:${tokenIdentifier(jti)}`;
+}

package/dist/modules/tenant/tenant-authorization.service.d.ts

@@ -0,0 +1,24 @@
+import { Repository } from 'typeorm';
+import { Client } from '../../entities/client.entity';
+import { UserRoles } from '../../entities/user-roles.entity';
+import { Users } from '../../entities/usr.entity';
+import { TenantAuthorizationStore } from './tenant-authorization.store';
+import { ResolvedTenantAuthorization } from './tenant-authorization.types';
+export declare const TENANT_AUTHORIZATION_TTL_SECONDS = 60;
+export declare class TenantAuthorizationService {
+    private readonly store;
+    private readonly userRepository;
+    private readonly clientRepository;
+    private readonly userRoleRepository;
+    private readonly logger;
+    constructor(store: TenantAuthorizationStore, userRepository: Repository<Users>, clientRepository: Repository<Client>, userRoleRepository: Repository<UserRoles>);
+    resolve(userId: number, clientId: number, expectedHomeClientId: number): Promise<ResolvedTenantAuthorization>;
+    resolveImpersonation(userId: number, homeClientId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
+    invalidate(userId: number, clientId: number): Promise<void>;
+    invalidateMany(clientId: number, userIds: readonly number[]): Promise<void>;
+    private loadFromDatabase;
+    private readCache;
+    private writeCache;
+    private assertPositiveInteger;
+    private isFresh;
+}