@uniorganization/uni-lib 4.0.51 → 4.1.2

package/dist/modules/common/jwt.strategy.js

@@ -8,9 +8,6 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -24,33 +21,100 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
-const typeorm_1 = require("@nestjs/typeorm");
 const passport_jwt_1 = require("passport-jwt");
-const usr_entity_1 = require("../../entities/usr.entity");
-const typeorm_2 = require("typeorm");
+const tenant_1 = require("../tenant");
 let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
-    constructor(userRepository) {
+    constructor(authorization, securityState) {
         super({
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
-            ignoreExpiration: JSON.parse(process.env.JWT_IGNORE_EXPIRATION) || false,
+            ignoreExpiration: process.env.JWT_IGNORE_EXPIRATION === 'true',
             secretOrKey: process.env.JWT_SECRET,
         });
-        this.userRepository = userRepository;
+        this.authorization = authorization;
+        this.securityState = securityState;
     }
     validate(payload) {
         return __awaiter(this, void 0, void 0, function* () {
-            const user = yield this.userRepository.findOne({ where: { id: payload.user.id } });
-            if (!user) {
-                throw new common_1.UnauthorizedException('User not found');
+            var _a, _b, _c;
+            const signedUser = payload === null || payload === void 0 ? void 0 : payload.user;
+            const effectiveClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.clientId);
+            const homeClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.homeClientId);
+            const originalClientId = (_a = signedUser === null || signedUser === void 0 ? void 0 : signedUser.originalClientId) !== null && _a !== void 0 ? _a : null;
+            const now = Math.floor(Date.now() / 1000);
+            if ((payload === null || payload === void 0 ? void 0 : payload.type) !== 'access' ||
+                !signedUser ||
+                !Number.isInteger(signedUser.id) ||
+                String(signedUser.id) !== payload.sub ||
+                !Number.isInteger(effectiveClientId) ||
+                effectiveClientId <= 0 ||
+                !Number.isInteger(homeClientId) ||
+                homeClientId <= 0 ||
+                !Number.isInteger(payload.exp) ||
+                payload.exp <= now ||
+                !this.validTokenIdentifier(payload.jti) ||
+                signedUser.jti !== payload.jti ||
+                signedUser.tokenExpiresAt !== payload.exp) {
+                throw new common_1.UnauthorizedException();
+            }
+            if (yield this.securityState.isAccessTokenRevoked(payload.jti)) {
+                throw new common_1.UnauthorizedException();
             }
-            const { id, first_name, username, last_name, division, lob, fullName, ntgid, profile, password_expired, viewEvaluations, ern } = user;
-            return { id, first_name, username, last_name, division, lob, fullName, ntgid, profile, password_expired, viewEvaluations, ern };
+            const impersonating = originalClientId !== null;
+            if ((impersonating &&
+                (originalClientId !== tenant_1.NEWTECH_CLIENT_ID ||
+                    homeClientId !== tenant_1.NEWTECH_CLIENT_ID ||
+                    effectiveClientId === tenant_1.NEWTECH_CLIENT_ID ||
+                    !((_b = signedUser.roles) === null || _b === void 0 ? void 0 : _b.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)) ||
+                    !signedUser.impersonatedAt ||
+                    !signedUser.impersonationReason)) ||
+                (!impersonating && ((_c = signedUser.roles) === null || _c === void 0 ? void 0 : _c.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)))) {
+                throw new common_1.UnauthorizedException();
+            }
+            const resolved = impersonating
+                ? yield this.authorization.resolveImpersonation(signedUser.id, homeClientId, effectiveClientId)
+                : yield this.authorization.resolve(signedUser.id, effectiveClientId, homeClientId);
+            const { identity, snapshot } = resolved;
+            const isMasterTenantAdmin = !impersonating &&
+                snapshot.clientId === tenant_1.NEWTECH_CLIENT_ID &&
+                snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                    role.roleName.toLowerCase() === 'sysadmin');
+            return {
+                id: identity.id,
+                first_name: identity.firstName,
+                username: identity.username,
+                last_name: identity.lastName,
+                division: identity.division,
+                lob: identity.lob,
+                fullName: identity.fullName,
+                ntgid: identity.ntgid,
+                profile: identity.profile,
+                password_expired: identity.passwordExpired,
+                viewEvaluations: identity.viewEvaluations,
+                ern: identity.ern,
+                homeClientId: identity.homeClientId,
+                clientId: snapshot.clientId,
+                clientAlias: snapshot.clientAlias,
+                clientName: snapshot.clientName,
+                jti: payload.jti,
+                tokenExpiresAt: payload.exp,
+                originalClientId,
+                impersonatedAt: impersonating ? signedUser.impersonatedAt : null,
+                impersonationReason: impersonating
+                    ? signedUser.impersonationReason
+                    : null,
+                roles: Array.from(new Set(snapshot.roles.map((role) => role.roleName))),
+                privileges: snapshot.privileges,
+                isMasterTenantAdmin,
+            };
         });
     }
+    validTokenIdentifier(value) {
+        return /^[A-Za-z0-9._:-]{1,128}$/.test(value || '');
+    }
 };
 exports.JwtStrategy = JwtStrategy;
 exports.JwtStrategy = JwtStrategy = __decorate([
     (0, common_1.Injectable)(),
-    __param(0, (0, typeorm_1.InjectRepository)(usr_entity_1.Users)),
-    __metadata("design:paramtypes", [typeorm_2.Repository])
+    __metadata("design:paramtypes", [tenant_1.TenantAuthorizationService,
+        tenant_1.TenantSecurityStateService])
 ], JwtStrategy);

package/dist/modules/common/logged-user.decorator.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LoggedUser = void 0;
 const common_1 = require("@nestjs/common");
-exports.LoggedUser = (0, common_1.createParamDecorator)((data, ctx) => {
+exports.LoggedUser = (0, common_1.createParamDecorator)((_data, ctx) => {
     const request = ctx.switchToHttp().getRequest();
-    return request === null || request === void 0 ? void 0 : request.user;
+    return request.user;
 });

package/dist/modules/common/skip-jwt-auth.decorator.d.ts

@@ -1,2 +1,4 @@
+import { PublicRouteOptions } from '../tenant';
 export declare const SKIP_JWT_AUTH_KEY = "skipJwtAuth";
-export declare const SkipJwtAuth: () => import("@nestjs/common").CustomDecorator<string>;
+export declare const Public: (options?: PublicRouteOptions) => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;
+export declare const SkipJwtAuth: () => <TFunction extends Function, Y>(target: TFunction | object, propertyKey?: string | symbol, descriptor?: TypedPropertyDescriptor<Y>) => void;

package/dist/modules/common/skip-jwt-auth.decorator.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SkipJwtAuth = exports.SKIP_JWT_AUTH_KEY = void 0;
+exports.SkipJwtAuth = exports.Public = exports.SKIP_JWT_AUTH_KEY = void 0;
 const common_1 = require("@nestjs/common");
+const tenant_1 = require("../tenant");
 exports.SKIP_JWT_AUTH_KEY = 'skipJwtAuth';
-const SkipJwtAuth = () => (0, common_1.SetMetadata)(exports.SKIP_JWT_AUTH_KEY, true);
+const Public = (options = { tenant: 'tenantless' }) => (0, common_1.applyDecorators)((0, common_1.SetMetadata)(exports.SKIP_JWT_AUTH_KEY, true), (0, common_1.SetMetadata)(tenant_1.PUBLIC_ROUTE_METADATA_KEY, options));
+exports.Public = Public;
+const SkipJwtAuth = () => (0, exports.Public)({ tenant: 'tenantless' });
 exports.SkipJwtAuth = SkipJwtAuth;

package/dist/modules/file-storage/file-storage.service.d.ts

@@ -1,6 +1,7 @@
 import { Repository } from 'typeorm';
 import { FileEntity } from '../../entities/file.entity';
 import { FileTypeEntity } from '../../entities/file-type.entity';
+import { TenantContext } from '../tenant/tenant-context.service';
 export interface FileStorageUploadOptions {
     fileTypeCode?: string;
     fileTypeId?: number;
@@ -16,13 +17,16 @@ export interface FileStorageUploadFile {
 export declare class FileStorageService {
     private readonly fileRepository;
     private readonly fileTypeRepository;
+    private readonly tenantContext?;
     private readonly logger;
     private readonly s3Client;
-    constructor(fileRepository: Repository<FileEntity>, fileTypeRepository: Repository<FileTypeEntity>);
+    constructor(fileRepository: Repository<FileEntity>, fileTypeRepository: Repository<FileTypeEntity>, tenantContext?: TenantContext);
     uploadDocument(file: FileStorageUploadFile, options: FileStorageUploadOptions): Promise<FileEntity>;
     deleteDocument(file: Pick<FileEntity, 'id' | 'path'>): Promise<void>;
     downloadDocument(bucketPath: string): Promise<Buffer>;
     resolveFileType(fileTypeCode?: string, fileTypeId?: number): Promise<FileTypeEntity>;
+    private findFileType;
+    private getClientId;
     private createS3Client;
     private putObject;
     private deleteObject;

package/dist/modules/file-storage/file-storage.service.js

@@ -37,11 +37,13 @@ const typeorm_2 = require("typeorm");
 const node_crypto_1 = require("node:crypto");
 const file_entity_1 = require("../../entities/file.entity");
 const file_type_entity_1 = require("../../entities/file-type.entity");
+const tenant_context_service_1 = require("../tenant/tenant-context.service");
 const constants_1 = require("./constants");
 let FileStorageService = FileStorageService_1 = class FileStorageService {
-    constructor(fileRepository, fileTypeRepository) {
+    constructor(fileRepository, fileTypeRepository, tenantContext) {
         this.fileRepository = fileRepository;
         this.fileTypeRepository = fileTypeRepository;
+        this.tenantContext = tenantContext;
         this.logger = new common_1.Logger(FileStorageService_1.name);
         this.s3Client = this.createS3Client();
     }
@@ -58,11 +60,16 @@ let FileStorageService = FileStorageService_1 = class FileStorageService {
             const extension = (0, constants_1.extractFileExtension)(file.originalname);
             const uniqueId = (0, node_crypto_1.randomUUID)();
             const bucketPrefix = process.env[constants_1.FILE_STORAGE_BUCKET_PREFIX_ENV];
+            const clientId = this.getClientId();
+            const tenantBucketPrefix = [bucketPrefix, `client-${clientId}`]
+                .filter(Boolean)
+                .join('/');
             const bucketName = this.getRequiredEnv(constants_1.FILE_STORAGE_BUCKET_NAME_ENV);
-            const bucketPath = (0, constants_1.buildBucketPath)(bucketPrefix, fileType.code, uniqueId, file.originalname);
+            const bucketPath = (0, constants_1.buildBucketPath)(tenantBucketPrefix, fileType.code, uniqueId, file.originalname);
             yield this.putObject(bucketName, bucketPath, file);
             try {
                 const fileRecord = this.fileRepository.create({
+                    clientId,
                     name: file.originalname,
                     typeId: fileType.id,
                     path: bucketPath,
@@ -82,17 +89,38 @@ let FileStorageService = FileStorageService_1 = class FileStorageService {
     deleteDocument(file) {
         return __awaiter(this, void 0, void 0, function* () {
             const bucketName = this.getRequiredEnv(constants_1.FILE_STORAGE_BUCKET_NAME_ENV);
-            yield this.deleteObject(bucketName, file.path);
-            yield this.fileRepository.softDelete(file.id);
+            const ownedFile = yield this.fileRepository.findOne({
+                where: {
+                    id: file.id,
+                    clientId: this.getClientId(),
+                },
+            });
+            if (!ownedFile) {
+                throw new Error('File not found');
+            }
+            yield this.deleteObject(bucketName, ownedFile.path);
+            yield this.fileRepository.softDelete({
+                id: ownedFile.id,
+                clientId: this.getClientId(),
+            });
         });
     }
     downloadDocument(bucketPath) {
         return __awaiter(this, void 0, void 0, function* () {
             const bucketName = this.getRequiredEnv(constants_1.FILE_STORAGE_BUCKET_NAME_ENV);
+            const ownedFile = yield this.fileRepository.findOne({
+                where: {
+                    path: bucketPath,
+                    clientId: this.getClientId(),
+                },
+            });
+            if (!ownedFile) {
+                throw new Error('File not found');
+            }
             try {
                 const response = yield this.s3Client.send(new client_s3_1.GetObjectCommand({
                     Bucket: bucketName,
-                    Key: bucketPath,
+                    Key: ownedFile.path,
                 }));
                 if (!response.Body) {
                     throw new Error(`Empty body returned for bucket path "${bucketPath}"`);
@@ -111,8 +139,8 @@ let FileStorageService = FileStorageService_1 = class FileStorageService {
         return __awaiter(this, void 0, void 0, function* () {
             if (fileTypeCode && typeof fileTypeId === 'number') {
                 const [byCode, byId] = yield Promise.all([
-                    this.fileTypeRepository.findOne({ where: { code: fileTypeCode } }),
-                    this.fileTypeRepository.findOne({ where: { id: fileTypeId } }),
+                    this.findFileType({ code: fileTypeCode }),
+                    this.findFileType({ id: fileTypeId }),
                 ]);
                 if (!byCode) {
                     throw new Error(`File type not found for code "${fileTypeCode}"`);
@@ -126,14 +154,14 @@ let FileStorageService = FileStorageService_1 = class FileStorageService {
                 return byCode;
             }
             if (fileTypeCode) {
-                const fileType = yield this.fileTypeRepository.findOne({ where: { code: fileTypeCode } });
+                const fileType = yield this.findFileType({ code: fileTypeCode });
                 if (!fileType) {
                     throw new Error(`File type not found for code "${fileTypeCode}"`);
                 }
                 return fileType;
             }
             if (typeof fileTypeId === 'number') {
-                const fileType = yield this.fileTypeRepository.findOne({ where: { id: fileTypeId } });
+                const fileType = yield this.findFileType({ id: fileTypeId });
                 if (!fileType) {
                     throw new Error(`File type not found for id "${fileTypeId}"`);
                 }
@@ -142,6 +170,30 @@ let FileStorageService = FileStorageService_1 = class FileStorageService {
             throw new Error('Either fileTypeCode or fileTypeId must be provided');
         });
     }
+    findFileType(options) {
+        const clientId = this.getClientId();
+        const query = this.fileTypeRepository
+            .createQueryBuilder('fileType')
+            .where('(fileType.client_id = :clientId OR fileType.client_id IS NULL)', {
+            clientId,
+        })
+            .andWhere('fileType.deletedDate IS NULL')
+            .orderBy('CASE WHEN fileType.client_id = :clientId THEN 0 ELSE 1 END', 'ASC')
+            .setParameter('clientId', clientId);
+        if (options.code) {
+            query.andWhere('fileType.code = :code', { code: options.code });
+        }
+        if (typeof options.id === 'number') {
+            query.andWhere('fileType.id = :id', { id: options.id });
+        }
+        return query.getOne();
+    }
+    getClientId() {
+        if (!this.tenantContext) {
+            throw new Error('File storage requires an active tenant context');
+        }
+        return this.tenantContext.getClientId();
+    }
     createS3Client() {
         const region = this.getRequiredEnv(constants_1.FILE_STORAGE_BUCKET_REGION_ENV);
         const accessKeyId = this.getRequiredEnv(constants_1.FILE_STORAGE_BUCKET_ACCESS_KEY_ID_ENV);
@@ -229,6 +281,8 @@ exports.FileStorageService = FileStorageService = FileStorageService_1 = __decor
     (0, common_1.Injectable)(),
     __param(0, (0, typeorm_1.InjectRepository)(file_entity_1.FileEntity)),
     __param(1, (0, typeorm_1.InjectRepository)(file_type_entity_1.FileTypeEntity)),
+    __param(2, (0, common_1.Optional)()),
     __metadata("design:paramtypes", [typeorm_2.Repository,
-        typeorm_2.Repository])
+        typeorm_2.Repository,
+        tenant_context_service_1.TenantContext])
 ], FileStorageService);

package/dist/modules/index.d.ts

@@ -5,3 +5,4 @@ export * from './google-maps/google-maps.module';
 export * from './google-maps/google-maps.service';
 export * from './google-maps/google-maps.types';
 export * from './file-storage';
+export * from './tenant';

package/dist/modules/index.js

@@ -21,3 +21,4 @@ __exportStar(require("./google-maps/google-maps.module"), exports);
 __exportStar(require("./google-maps/google-maps.service"), exports);
 __exportStar(require("./google-maps/google-maps.types"), exports);
 __exportStar(require("./file-storage"), exports);
+__exportStar(require("./tenant"), exports);

package/dist/modules/tenant/current-tenant.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentTenant: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/modules/tenant/current-tenant.decorator.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentTenant = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_context_errors_1 = require("./tenant-context.errors");
+exports.CurrentTenant = (0, common_1.createParamDecorator)((_data, context) => {
+    var _a;
+    const request = context.switchToHttp().getRequest();
+    const clientId = (_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId;
+    if (!Number.isInteger(clientId) || !clientId || clientId <= 0) {
+        throw new tenant_context_errors_1.MissingTenantContextError();
+    }
+    return clientId;
+});

package/dist/modules/tenant/index.d.ts

@@ -0,0 +1,21 @@
+export * from './current-tenant.decorator';
+export * from './master-tenant.decorator';
+export * from './master-tenant.guard';
+export * from './redis-tenant-state.store';
+export * from './tenant-audit.types';
+export * from './tenant-authorization.keys';
+export * from './tenant-authorization.service';
+export * from './tenant-authorization.store';
+export * from './tenant-authorization.types';
+export * from './tenant.constants';
+export * from './tenant-context.interceptor';
+export * from './tenant-context.errors';
+export * from './tenant-context.service';
+export * from './tenant-credential.guard';
+export * from './tenant.module';
+export * from './tenant-ownership.service';
+export * from './tenant-query.helpers';
+export * from './tenant-runner.service';
+export * from './tenant-security-state.service';
+export * from './tenant-security-state.store';
+export * from './tenant.types';

package/dist/modules/tenant/index.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./current-tenant.decorator"), exports);
+__exportStar(require("./master-tenant.decorator"), exports);
+__exportStar(require("./master-tenant.guard"), exports);
+__exportStar(require("./redis-tenant-state.store"), exports);
+__exportStar(require("./tenant-audit.types"), exports);
+__exportStar(require("./tenant-authorization.keys"), exports);
+__exportStar(require("./tenant-authorization.service"), exports);
+__exportStar(require("./tenant-authorization.store"), exports);
+__exportStar(require("./tenant-authorization.types"), exports);
+__exportStar(require("./tenant.constants"), exports);
+__exportStar(require("./tenant-context.interceptor"), exports);
+__exportStar(require("./tenant-context.errors"), exports);
+__exportStar(require("./tenant-context.service"), exports);
+__exportStar(require("./tenant-credential.guard"), exports);
+__exportStar(require("./tenant.module"), exports);
+__exportStar(require("./tenant-ownership.service"), exports);
+__exportStar(require("./tenant-query.helpers"), exports);
+__exportStar(require("./tenant-runner.service"), exports);
+__exportStar(require("./tenant-security-state.service"), exports);
+__exportStar(require("./tenant-security-state.store"), exports);
+__exportStar(require("./tenant.types"), exports);

package/dist/modules/tenant/master-tenant.decorator.d.ts

@@ -0,0 +1 @@
+export declare const MasterTenant: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/modules/tenant/master-tenant.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MasterTenant = void 0;
+const common_1 = require("@nestjs/common");
+const tenant_constants_1 = require("./tenant.constants");
+const MasterTenant = () => (0, common_1.SetMetadata)(tenant_constants_1.MASTER_TENANT_METADATA_KEY, true);
+exports.MasterTenant = MasterTenant;

package/dist/modules/tenant/master-tenant.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class MasterTenantGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/modules/tenant/master-tenant.guard.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MasterTenantGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const tenant_constants_1 = require("./tenant.constants");
+let MasterTenantGuard = class MasterTenantGuard {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        var _a, _b, _c, _d;
+        const required = this.reflector.getAllAndOverride(tenant_constants_1.MASTER_TENANT_METADATA_KEY, [context.getHandler(), context.getClass()]);
+        if (!required) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        if (!request.user || request.user === true) {
+            throw new common_1.UnauthorizedException();
+        }
+        const effectiveClientId = ((_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId) || request.user.clientId;
+        const originalClientId = (_d = (_c = (_b = request.tenantContext) === null || _b === void 0 ? void 0 : _b.originalClientId) !== null && _c !== void 0 ? _c : request.user.originalClientId) !== null && _d !== void 0 ? _d : null;
+        if (effectiveClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+            originalClientId !== null ||
+            !request.user.isMasterTenantAdmin) {
+            throw new common_1.ForbiddenException();
+        }
+        return true;
+    }
+};
+exports.MasterTenantGuard = MasterTenantGuard;
+exports.MasterTenantGuard = MasterTenantGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], MasterTenantGuard);

package/dist/modules/tenant/redis-tenant-state.store.d.ts

@@ -0,0 +1,21 @@
+import { OnModuleDestroy } from '@nestjs/common';
+import { TenantAuthorizationStore } from './tenant-authorization.store';
+import { TenantAuthorizationSnapshot } from './tenant-authorization.types';
+import { TenantSecurityStateStore } from './tenant-security-state.store';
+export declare class RedisTenantStateStore implements TenantAuthorizationStore, TenantSecurityStateStore, OnModuleDestroy {
+    private readonly logger;
+    private client;
+    get(key: string): Promise<TenantAuthorizationSnapshot | null>;
+    set(key: string, value: TenantAuthorizationSnapshot, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: readonly string[]): Promise<void>;
+    isRevoked(key: string): Promise<boolean>;
+    revoke(key: string, ttlSeconds: number): Promise<void>;
+    createPreAuth(key: string, userId: number, ttlSeconds: number): Promise<void>;
+    consumePreAuth(key: string, userId: number): Promise<boolean>;
+    onModuleDestroy(): Promise<void>;
+    private execute;
+    private getClient;
+    private positiveInteger;
+    private isAuthorizationSnapshot;
+}