@uniorganization/uni-lib 4.0.51 → 4.1.2

package/dist/modules/tenant/redis-tenant-state.store.js

@@ -0,0 +1,165 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var RedisTenantStateStore_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisTenantStateStore = void 0;
+const common_1 = require("@nestjs/common");
+const ioredis_1 = require("ioredis");
+let RedisTenantStateStore = RedisTenantStateStore_1 = class RedisTenantStateStore {
+    constructor() {
+        this.logger = new common_1.Logger(RedisTenantStateStore_1.name);
+        this.client = null;
+    }
+    get(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const serialized = yield this.execute((client) => client.get(key));
+            if (serialized === null) {
+                return null;
+            }
+            const snapshot = JSON.parse(serialized);
+            if (!this.isAuthorizationSnapshot(snapshot)) {
+                throw new Error('Invalid cached authorization snapshot');
+            }
+            return snapshot;
+        });
+    }
+    set(key, value, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.set(key, JSON.stringify(value), 'EX', ttlSeconds));
+        });
+    }
+    delete(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.del(key));
+        });
+    }
+    deleteMany(keys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            for (let offset = 0; offset < keys.length; offset += 500) {
+                const batch = keys.slice(offset, offset + 500);
+                yield this.execute((client) => client.del(...batch));
+            }
+        });
+    }
+    isRevoked(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (yield this.execute((client) => client.exists(key))) === 1;
+        });
+    }
+    revoke(key, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.execute((client) => client.set(key, '1', 'EX', ttlSeconds));
+        });
+    }
+    createPreAuth(key, userId, ttlSeconds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this.execute((client) => client.set(key, String(userId), 'EX', ttlSeconds, 'NX'));
+            if (result !== 'OK') {
+                throw new Error('Pre-auth security state already exists');
+            }
+        });
+    }
+    consumePreAuth(key, userId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield this.execute((client) => client.eval('if redis.call("GET", KEYS[1]) == ARGV[1] then return redis.call("DEL", KEYS[1]) else return 0 end', 1, key, String(userId)));
+            return Number(result) === 1;
+        });
+    }
+    onModuleDestroy() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.client) {
+                return;
+            }
+            const client = this.client;
+            this.client = null;
+            try {
+                if (client.status === 'ready') {
+                    yield client.quit();
+                }
+                else {
+                    client.disconnect();
+                }
+            }
+            catch (_a) {
+                client.disconnect();
+            }
+        });
+    }
+    execute(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const client = this.getClient();
+            return operation(client);
+        });
+    }
+    getClient() {
+        if (this.client && this.client.status !== 'end') {
+            return this.client;
+        }
+        const url = process.env.TENANT_REDIS_URL || process.env.REDIS_URL;
+        const host = process.env.TENANT_REDIS_HOST || process.env.REDIS_HOST;
+        if (!url && !host) {
+            throw new Error('Tenant Redis is not configured');
+        }
+        const options = {
+            connectTimeout: this.positiveInteger(process.env.TENANT_REDIS_CONNECT_TIMEOUT_MS, 2000),
+            maxRetriesPerRequest: 1,
+            username: process.env.TENANT_REDIS_USERNAME || process.env.REDIS_USERNAME,
+            password: process.env.TENANT_REDIS_PASSWORD || process.env.REDIS_PASSWORD,
+            tls: process.env.TENANT_REDIS_TLS === 'true' ? {} : undefined,
+        };
+        this.client = url
+            ? new ioredis_1.default(url, options)
+            : new ioredis_1.default(Object.assign(Object.assign({}, options), { host, port: this.positiveInteger(process.env.TENANT_REDIS_PORT || process.env.REDIS_PORT, 6379) }));
+        this.client.on('error', () => {
+            this.logger.error('Tenant Redis connection is unavailable');
+        });
+        return this.client;
+    }
+    positiveInteger(value, fallback) {
+        const parsed = Number(value);
+        return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+    }
+    isAuthorizationSnapshot(value) {
+        var _a;
+        return Boolean(value &&
+            Number.isInteger(value.userId) &&
+            value.userId > 0 &&
+            Number.isInteger(value.homeClientId) &&
+            value.homeClientId > 0 &&
+            Number.isInteger(value.clientId) &&
+            value.clientId > 0 &&
+            typeof value.clientName === 'string' &&
+            typeof value.clientAlias === 'string' &&
+            Array.isArray(value.roles) &&
+            value.roles.length > 0 &&
+            value.roles.every((role) => Number.isInteger(role.roleId) &&
+                role.roleId > 0 &&
+                typeof role.roleName === 'string' &&
+                Number.isInteger(role.moduleId) &&
+                role.moduleId > 0 &&
+                typeof role.moduleName === 'string') &&
+            Array.isArray(value.privileges) &&
+            value.privileges.every((privilege) => typeof privilege === 'string') &&
+            ((_a = value.identity) === null || _a === void 0 ? void 0 : _a.id) === value.userId &&
+            value.identity.homeClientId === value.homeClientId &&
+            typeof value.cachedAt === 'string');
+    }
+};
+exports.RedisTenantStateStore = RedisTenantStateStore;
+exports.RedisTenantStateStore = RedisTenantStateStore = RedisTenantStateStore_1 = __decorate([
+    (0, common_1.Injectable)()
+], RedisTenantStateStore);

package/dist/modules/tenant/tenant-audit.types.d.ts

@@ -0,0 +1,15 @@
+import { TenantAuthenticationType } from './tenant.types';
+export interface TenantAuditMetadata {
+    actorUserId: number | null;
+    originalClientId: number | null;
+    effectiveClientId: number;
+    authenticationType: TenantAuthenticationType;
+    impersonationReason: string | null;
+    correlationId: string;
+    service: string;
+    operation: string;
+    route?: string;
+    entityType?: string;
+    entityId?: string | number;
+    result?: 'success' | 'failure';
+}

package/dist/modules/tenant/tenant-audit.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/modules/tenant/tenant-authorization.keys.d.ts

@@ -0,0 +1,3 @@
+export declare function tenantAuthorizationKey(clientId: number, userId: number): string;
+export declare function revokedAccessTokenKey(jti: string): string;
+export declare function preAuthTokenKey(jti: string): string;

package/dist/modules/tenant/tenant-authorization.keys.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tenantAuthorizationKey = tenantAuthorizationKey;
+exports.revokedAccessTokenKey = revokedAccessTokenKey;
+exports.preAuthTokenKey = preAuthTokenKey;
+const common_1 = require("@nestjs/common");
+const TOKEN_IDENTIFIER = /^[A-Za-z0-9._:-]{1,128}$/;
+function positiveInteger(value, field) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new common_1.UnauthorizedException(`Invalid ${field}`);
+    }
+    return value;
+}
+function tokenIdentifier(value) {
+    if (!TOKEN_IDENTIFIER.test(value || '')) {
+        throw new common_1.UnauthorizedException('Invalid token identifier');
+    }
+    return value;
+}
+function tenantAuthorizationKey(clientId, userId) {
+    return `client:${positiveInteger(clientId, 'clientId')}:authz:user:${positiveInteger(userId, 'userId')}`;
+}
+function revokedAccessTokenKey(jti) {
+    return `security:access-token:revoked:${tokenIdentifier(jti)}`;
+}
+function preAuthTokenKey(jti) {
+    return `security:pre-auth:${tokenIdentifier(jti)}`;
+}

package/dist/modules/tenant/tenant-authorization.service.d.ts

@@ -0,0 +1,24 @@
+import { Repository } from 'typeorm';
+import { Client } from '../../entities/client.entity';
+import { UserRoles } from '../../entities/user-roles.entity';
+import { Users } from '../../entities/usr.entity';
+import { TenantAuthorizationStore } from './tenant-authorization.store';
+import { ResolvedTenantAuthorization } from './tenant-authorization.types';
+export declare const TENANT_AUTHORIZATION_TTL_SECONDS = 60;
+export declare class TenantAuthorizationService {
+    private readonly store;
+    private readonly userRepository;
+    private readonly clientRepository;
+    private readonly userRoleRepository;
+    private readonly logger;
+    constructor(store: TenantAuthorizationStore, userRepository: Repository<Users>, clientRepository: Repository<Client>, userRoleRepository: Repository<UserRoles>);
+    resolve(userId: number, clientId: number, expectedHomeClientId: number): Promise<ResolvedTenantAuthorization>;
+    resolveImpersonation(userId: number, homeClientId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
+    invalidate(userId: number, clientId: number): Promise<void>;
+    invalidateMany(clientId: number, userIds: readonly number[]): Promise<void>;
+    private loadFromDatabase;
+    private readCache;
+    private writeCache;
+    private assertPositiveInteger;
+    private isFresh;
+}

package/dist/modules/tenant/tenant-authorization.service.js

@@ -0,0 +1,235 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var TenantAuthorizationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantAuthorizationService = exports.TENANT_AUTHORIZATION_TTL_SECONDS = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const client_entity_1 = require("../../entities/client.entity");
+const user_roles_entity_1 = require("../../entities/user-roles.entity");
+const usr_entity_1 = require("../../entities/usr.entity");
+const tenant_constants_1 = require("./tenant.constants");
+const tenant_authorization_keys_1 = require("./tenant-authorization.keys");
+const tenant_authorization_store_1 = require("./tenant-authorization.store");
+exports.TENANT_AUTHORIZATION_TTL_SECONDS = 60;
+let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuthorizationService {
+    constructor(store, userRepository, clientRepository, userRoleRepository) {
+        this.store = store;
+        this.userRepository = userRepository;
+        this.clientRepository = clientRepository;
+        this.userRoleRepository = userRoleRepository;
+        this.logger = new common_1.Logger(TenantAuthorizationService_1.name);
+    }
+    resolve(userId, clientId, expectedHomeClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertPositiveInteger(userId);
+            this.assertPositiveInteger(clientId);
+            this.assertPositiveInteger(expectedHomeClientId);
+            const key = (0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId);
+            const cached = yield this.readCache(key);
+            if (cached &&
+                cached.userId === userId &&
+                cached.clientId === clientId &&
+                cached.homeClientId === expectedHomeClientId &&
+                ((_a = cached.identity) === null || _a === void 0 ? void 0 : _a.id) === userId &&
+                cached.identity.homeClientId === expectedHomeClientId &&
+                this.isFresh(cached.cachedAt) &&
+                cached.roles.length > 0) {
+                return { identity: cached.identity, snapshot: cached };
+            }
+            const resolved = yield this.loadFromDatabase(userId, clientId, expectedHomeClientId);
+            yield this.writeCache(key, resolved.snapshot);
+            return resolved;
+        });
+    }
+    resolveImpersonation(userId, homeClientId, targetClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (homeClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+                targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID) {
+                throw new common_1.UnauthorizedException();
+            }
+            const origin = yield this.resolve(userId, homeClientId, homeClientId);
+            const isNewtechMaster = origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                role.roleName.toLowerCase() === 'sysadmin');
+            const targetClient = yield this.clientRepository.findOne({
+                where: { id: targetClientId, deletedAt: (0, typeorm_2.IsNull)() },
+            });
+            if (!isNewtechMaster || !targetClient) {
+                throw new common_1.UnauthorizedException();
+            }
+            const snapshot = {
+                userId,
+                homeClientId,
+                clientId: targetClientId,
+                clientName: targetClient.name,
+                clientAlias: targetClient.alias,
+                roles: [
+                    {
+                        roleId: 0,
+                        roleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                        moduleId: 0,
+                        moduleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                    },
+                ],
+                privileges: [],
+                identity: origin.identity,
+                cachedAt: new Date().toISOString(),
+            };
+            return { identity: origin.identity, snapshot };
+        });
+    }
+    invalidate(userId, clientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.store.delete((0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId));
+        });
+    }
+    invalidateMany(clientId, userIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keys = Array.from(new Set(userIds)).map((userId) => (0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId));
+            if (keys.length > 0) {
+                yield this.store.deleteMany(keys);
+            }
+        });
+    }
+    loadFromDatabase(userId, clientId, expectedHomeClientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [user, client, assignments] = yield Promise.all([
+                this.userRepository.findOne({ where: { id: userId } }),
+                this.clientRepository.findOne({
+                    where: { id: clientId, deletedAt: (0, typeorm_2.IsNull)() },
+                }),
+                this.userRoleRepository
+                    .createQueryBuilder('assignment')
+                    .innerJoinAndSelect('assignment.role', 'role', 'role.client_id = assignment.client_id')
+                    .innerJoinAndSelect('role.module', 'module', 'module.is_active = true')
+                    .leftJoinAndSelect('role.privileges', 'definition', 'definition.client_id = assignment.client_id')
+                    .leftJoinAndSelect('definition.privilege', 'privilege', 'privilege.client_id = assignment.client_id AND privilege."IS_ACTIVE" <> 0')
+                    .where('assignment."USER_ID" = :userId', { userId })
+                    .andWhere('assignment.client_id = :clientId', { clientId })
+                    .getMany(),
+            ]);
+            if (!user ||
+                !Number(user.is_active) ||
+                user.clientId !== expectedHomeClientId ||
+                !client ||
+                assignments.length === 0) {
+                throw new common_1.UnauthorizedException();
+            }
+            const roles = assignments.map((assignment) => {
+                var _a, _b, _c, _d, _e, _f;
+                return ({
+                    roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
+                    roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
+                    moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
+                    moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
+                });
+            });
+            if (roles.some((role) => !Number.isInteger(role.roleId) ||
+                role.roleId <= 0 ||
+                !role.roleName ||
+                !Number.isInteger(role.moduleId) ||
+                role.moduleId <= 0 ||
+                !role.moduleName)) {
+                throw new common_1.UnauthorizedException();
+            }
+            const privileges = Array.from(new Set(assignments.flatMap((assignment) => {
+                var _a;
+                return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
+                    .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
+                    .filter((privilege) => Boolean(privilege));
+            }))).sort();
+            const identity = {
+                id: user.id,
+                homeClientId: user.clientId,
+                firstName: user.first_name,
+                username: user.username,
+                lastName: user.last_name,
+                division: user.division,
+                lob: user.lob,
+                fullName: user.fullName,
+                ntgid: user.ntgid,
+                profile: user.profile,
+                passwordExpired: user.password_expired,
+                viewEvaluations: user.viewEvaluations,
+                ern: user.ern,
+            };
+            const snapshot = {
+                userId,
+                homeClientId: user.clientId,
+                clientId,
+                clientName: client.name,
+                clientAlias: client.alias,
+                roles,
+                privileges,
+                identity,
+                cachedAt: new Date().toISOString(),
+            };
+            return { identity, snapshot };
+        });
+    }
+    readCache(key) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield this.store.get(key);
+            }
+            catch (_a) {
+                this.logger.warn('Authorization cache read failed; falling back to PostgreSQL');
+                return null;
+            }
+        });
+    }
+    writeCache(key, snapshot) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.store.set(key, snapshot, exports.TENANT_AUTHORIZATION_TTL_SECONDS);
+            }
+            catch (_a) {
+                this.logger.warn('Authorization cache write failed; continuing with PostgreSQL result');
+            }
+        });
+    }
+    assertPositiveInteger(value) {
+        if (!Number.isInteger(value) || value <= 0) {
+            throw new common_1.UnauthorizedException();
+        }
+    }
+    isFresh(cachedAt) {
+        const ageMilliseconds = Date.now() - Date.parse(cachedAt);
+        return (Number.isFinite(ageMilliseconds) &&
+            ageMilliseconds >= 0 &&
+            ageMilliseconds <= exports.TENANT_AUTHORIZATION_TTL_SECONDS * 1000);
+    }
+};
+exports.TenantAuthorizationService = TenantAuthorizationService;
+exports.TenantAuthorizationService = TenantAuthorizationService = TenantAuthorizationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(tenant_authorization_store_1.TENANT_AUTHORIZATION_STORE)),
+    __param(1, (0, typeorm_1.InjectRepository)(usr_entity_1.Users)),
+    __param(2, (0, typeorm_1.InjectRepository)(client_entity_1.Client)),
+    __param(3, (0, typeorm_1.InjectRepository)(user_roles_entity_1.UserRoles)),
+    __metadata("design:paramtypes", [Object, typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository])
+], TenantAuthorizationService);

package/dist/modules/tenant/tenant-authorization.store.d.ts

@@ -0,0 +1,8 @@
+import { TenantAuthorizationSnapshot } from './tenant-authorization.types';
+export declare const TENANT_AUTHORIZATION_STORE: unique symbol;
+export interface TenantAuthorizationStore {
+    get(key: string): Promise<TenantAuthorizationSnapshot | null>;
+    set(key: string, value: TenantAuthorizationSnapshot, ttlSeconds: number): Promise<void>;
+    delete(key: string): Promise<void>;
+    deleteMany(keys: readonly string[]): Promise<void>;
+}

package/dist/modules/tenant/tenant-authorization.store.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANT_AUTHORIZATION_STORE = void 0;
+exports.TENANT_AUTHORIZATION_STORE = Symbol('TENANT_AUTHORIZATION_STORE');

package/dist/modules/tenant/tenant-authorization.types.d.ts

@@ -0,0 +1,36 @@
+export interface TenantRoleAuthorization {
+    roleId: number;
+    roleName: string;
+    moduleId: number;
+    moduleName: string;
+}
+export interface TenantAuthorizationSnapshot {
+    userId: number;
+    homeClientId: number;
+    clientId: number;
+    clientName: string;
+    clientAlias: string;
+    roles: TenantRoleAuthorization[];
+    privileges: string[];
+    identity: TenantAuthorizationIdentity;
+    cachedAt: string;
+}
+export interface TenantAuthorizationIdentity {
+    id: number;
+    homeClientId: number;
+    firstName?: string;
+    username?: string;
+    lastName?: string;
+    division?: string;
+    lob?: string;
+    fullName?: string;
+    ntgid?: string;
+    profile?: string;
+    passwordExpired?: number;
+    viewEvaluations?: boolean;
+    ern?: string;
+}
+export interface ResolvedTenantAuthorization {
+    identity: TenantAuthorizationIdentity;
+    snapshot: TenantAuthorizationSnapshot;
+}

package/dist/modules/tenant/tenant-authorization.types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/modules/tenant/tenant-context.errors.d.ts

@@ -0,0 +1,3 @@
+export declare class MissingTenantContextError extends Error {
+    constructor();
+}

package/dist/modules/tenant/tenant-context.errors.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingTenantContextError = void 0;
+class MissingTenantContextError extends Error {
+    constructor() {
+        super('Tenant context is required for this operation');
+        this.name = MissingTenantContextError.name;
+    }
+}
+exports.MissingTenantContextError = MissingTenantContextError;

package/dist/modules/tenant/tenant-context.interceptor.d.ts

@@ -0,0 +1,9 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Observable } from 'rxjs';
+import { TenantContextStorage } from './tenant-context.storage';
+export declare class TenantContextInterceptor implements NestInterceptor {
+    private readonly tenantContextStorage;
+    constructor(tenantContextStorage: TenantContextStorage);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    private fromAuthenticatedUser;
+}

package/dist/modules/tenant/tenant-context.interceptor.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantContextInterceptor = void 0;
+const crypto_1 = require("crypto");
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const tenant_context_storage_1 = require("./tenant-context.storage");
+let TenantContextInterceptor = class TenantContextInterceptor {
+    constructor(tenantContextStorage) {
+        this.tenantContextStorage = tenantContextStorage;
+    }
+    intercept(context, next) {
+        if (context.getType() !== 'http') {
+            return next.handle();
+        }
+        const request = context.switchToHttp().getRequest();
+        const state = request.tenantContext || this.fromAuthenticatedUser(request);
+        if (!state) {
+            return next.handle();
+        }
+        request.tenantContext = Object.freeze(state);
+        return new rxjs_1.Observable((subscriber) => {
+            const subscription = this.tenantContextStorage.run(state, () => next.handle().subscribe(subscriber));
+            return () => subscription.unsubscribe();
+        });
+    }
+    fromAuthenticatedUser(request) {
+        var _a, _b, _c, _d;
+        if (!request.user || request.user === true) {
+            return undefined;
+        }
+        const user = request.user;
+        if (!Number.isInteger(user.clientId) || user.clientId <= 0) {
+            throw new common_1.UnauthorizedException();
+        }
+        const correlationHeader = (_a = request.headers) === null || _a === void 0 ? void 0 : _a['x-correlation-id'];
+        const presentedCorrelationId = Array.isArray(correlationHeader)
+            ? correlationHeader[0]
+            : correlationHeader;
+        const correlationId = presentedCorrelationId &&
+            /^[A-Za-z0-9._:-]{1,128}$/.test(presentedCorrelationId)
+            ? presentedCorrelationId
+            : (0, crypto_1.randomUUID)();
+        return {
+            clientId: user.clientId,
+            originalClientId: (_b = user.originalClientId) !== null && _b !== void 0 ? _b : null,
+            actorUserId: user.id,
+            authenticationType: 'jwt',
+            impersonatedAt: (_c = user.impersonatedAt) !== null && _c !== void 0 ? _c : null,
+            impersonationReason: (_d = user.impersonationReason) !== null && _d !== void 0 ? _d : null,
+            correlationId,
+            roles: user.roles || [],
+        };
+    }
+};
+exports.TenantContextInterceptor = TenantContextInterceptor;
+exports.TenantContextInterceptor = TenantContextInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage])
+], TenantContextInterceptor);

package/dist/modules/tenant/tenant-context.service.d.ts

@@ -0,0 +1,15 @@
+import { TenantContextStorage } from './tenant-context.storage';
+import { TenantAuthenticationType, TenantContextState } from './tenant.types';
+export declare class TenantContext {
+    private readonly storage;
+    constructor(storage: TenantContextStorage);
+    getState(): Readonly<TenantContextState>;
+    tryGetState(): Readonly<TenantContextState> | undefined;
+    getClientId(): number;
+    getOriginalClientId(): number | null;
+    getActorUserId(): number | null;
+    getAuthenticationType(): TenantAuthenticationType;
+    getImpersonationReason(): string | null;
+    getCorrelationId(): string;
+    isImpersonating(): boolean;
+}