@uniorganization/uni-lib 4.2.0 → 4.3.0

package/dist/modules/common/jwt.strategy.js

@@ -62,7 +62,6 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             const impersonating = originalClientId !== null;
             if ((impersonating &&
                 (originalClientId !== tenant_1.NEWTECH_CLIENT_ID ||
-                    homeClientId !== tenant_1.NEWTECH_CLIENT_ID ||
                     effectiveClientId === tenant_1.NEWTECH_CLIENT_ID ||
                     !((_b = signedUser.roles) === null || _b === void 0 ? void 0 : _b.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)) ||
                     !signedUser.impersonatedAt ||
@@ -71,7 +70,7 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                 throw new common_1.UnauthorizedException();
             }
             const resolved = impersonating
-                ? yield this.authorization.resolveImpersonation(signedUser.id, homeClientId, effectiveClientId)
+                ? yield this.authorization.resolveImpersonation(signedUser.id, originalClientId, homeClientId, effectiveClientId)
                 : yield this.authorization.resolve(signedUser.id, effectiveClientId, homeClientId);
             const { identity, snapshot } = resolved;
             const isMasterTenantAdmin = !impersonating &&

package/dist/modules/common/jwt.strategy.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/common/jwt.strategy.spec.js

@@ -0,0 +1,89 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const tenant_1 = require("../tenant");
+const jwt_strategy_1 = require("./jwt.strategy");
+describe('JwtStrategy impersonated sessions', () => {
+    process.env.JWT_SECRET = 'test-secret';
+    const authorization = { resolveImpersonation: jest.fn() };
+    const securityState = { isAccessTokenRevoked: jest.fn() };
+    const strategy = new jwt_strategy_1.JwtStrategy(authorization, securityState);
+    const payload = (overrides = {}) => {
+        const now = Math.floor(Date.now() / 1000);
+        const expiresAt = now + 900;
+        const user = Object.assign({ id: 1, homeClientId: 2, clientId: 2, clientName: 'Altera', clientAlias: 'altera', jti: 'impersonated-jti', tokenExpiresAt: expiresAt, originalClientId: tenant_1.NEWTECH_CLIENT_ID, impersonatedAt: new Date().toISOString(), impersonationReason: 'Investigate issue', roles: [tenant_1.TENANT_IMPERSONATOR_ROLE], privileges: [], role: {
+                id: 0,
+                code: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                name: 'Tenant impersonator',
+                scope: 'GLOBAL',
+                clientId: null,
+            }, permissions: [], authzVersion: 1, isMasterTenantAdmin: false }, overrides);
+        return {
+            type: 'access',
+            user,
+            sub: '1',
+            iat: now - 10,
+            exp: expiresAt,
+            jti: 'impersonated-jti',
+        };
+    };
+    beforeEach(() => {
+        jest.clearAllMocks();
+        securityState.isAccessTokenRevoked.mockResolvedValue(false);
+        authorization.resolveImpersonation.mockResolvedValue({
+            identity: { id: 1, homeClientId: 2 },
+            snapshot: {
+                userId: 1,
+                homeClientId: 2,
+                clientId: 2,
+                clientName: 'Altera',
+                clientAlias: 'altera',
+                roles: [
+                    {
+                        roleId: 0,
+                        roleName: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                        moduleId: 0,
+                        moduleName: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                    },
+                ],
+                privileges: [],
+                accessRole: {
+                    id: 0,
+                    code: tenant_1.TENANT_IMPERSONATOR_ROLE,
+                    name: 'Tenant impersonator',
+                    scope: 'GLOBAL',
+                    clientId: null,
+                },
+                permissions: [],
+                authzVersion: 1,
+                identity: { id: 1, homeClientId: 2 },
+                cachedAt: new Date().toISOString(),
+            },
+        });
+    });
+    it('revalidates an impersonated token with an Altera home client through Newtech', () => __awaiter(void 0, void 0, void 0, function* () {
+        const validated = yield strategy.validate(payload());
+        expect(authorization.resolveImpersonation).toHaveBeenCalledWith(1, 1, 2, 2);
+        expect(validated.homeClientId).toBe(2);
+        expect(validated.clientId).toBe(2);
+        expect(validated.originalClientId).toBe(tenant_1.NEWTECH_CLIENT_ID);
+    }));
+    const invalidTokenCases = [
+        [{ originalClientId: 2 }, 'a non-Newtech origin'],
+        [{ roles: [] }, 'a token without the impersonator role'],
+        [{ impersonationReason: null }, 'a token without a support reason'],
+    ];
+    it.each(invalidTokenCases)('rejects %s', (overrides) => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(strategy.validate(payload(overrides))).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+        expect(authorization.resolveImpersonation).not.toHaveBeenCalled();
+    }));
+});

package/dist/modules/tenant/tenant-authorization.service.d.ts

@@ -13,7 +13,7 @@ export declare class TenantAuthorizationService {
     private readonly logger;
     constructor(store: TenantAuthorizationStore, userRepository: Repository<Users>, clientRepository: Repository<Client>, userRoleRepository: Repository<UserRoles>);
     resolve(userId: number, clientId: number, expectedHomeClientId: number): Promise<ResolvedTenantAuthorization>;
-    resolveImpersonation(userId: number, homeClientId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
+    resolveImpersonation(userId: number, originClientId: number, homeClientId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
     invalidate(userId: number, clientId: number): Promise<void>;
     invalidateMany(clientId: number, userIds: readonly number[]): Promise<void>;
     private loadFromDatabase;

package/dist/modules/tenant/tenant-authorization.service.js

@@ -64,13 +64,13 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
             return resolved;
         });
     }
-    resolveImpersonation(userId, homeClientId, targetClientId) {
+    resolveImpersonation(userId, originClientId, homeClientId, targetClientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (homeClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+            if (originClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
                 targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID) {
                 throw new common_1.UnauthorizedException();
             }
-            const origin = yield this.resolve(userId, homeClientId, homeClientId);
+            const origin = yield this.resolve(userId, originClientId, homeClientId);
             const isNewtechMaster = origin.snapshot.permissions.includes('master.users.read') ||
                 origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
                     role.roleName.toLowerCase() === 'sysadmin');

package/dist/modules/tenant/tenant-authorization.service.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/tenant/tenant-authorization.service.spec.js

@@ -0,0 +1,101 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const tenant_constants_1 = require("./tenant.constants");
+const tenant_authorization_service_1 = require("./tenant-authorization.service");
+describe('TenantAuthorizationService impersonation', () => {
+    const store = {
+        get: jest.fn(),
+        set: jest.fn(),
+        delete: jest.fn(),
+        deleteMany: jest.fn(),
+    };
+    const userRepository = {};
+    const clientRepository = { findOne: jest.fn() };
+    const userRoleRepository = {};
+    const service = new tenant_authorization_service_1.TenantAuthorizationService(store, userRepository, clientRepository, userRoleRepository);
+    const origin = (permissions) => ({
+        identity: {
+            id: 1,
+            homeClientId: 2,
+            firstName: 'Root',
+            lastName: 'User',
+        },
+        snapshot: {
+            userId: 1,
+            homeClientId: 2,
+            clientId: tenant_constants_1.NEWTECH_CLIENT_ID,
+            clientName: 'Newtech',
+            clientAlias: 'newtech',
+            roles: [
+                {
+                    roleId: 8,
+                    roleName: 'Master Root',
+                    moduleId: 8,
+                    moduleName: 'access-control',
+                },
+            ],
+            privileges: [],
+            accessRole: {
+                id: 8,
+                code: 'master-root',
+                name: 'Master Root',
+                scope: 'CLIENT',
+                clientId: tenant_constants_1.NEWTECH_CLIENT_ID,
+            },
+            permissions,
+            authzVersion: 3,
+            identity: {
+                id: 1,
+                homeClientId: 2,
+                firstName: 'Root',
+                lastName: 'User',
+            },
+            cachedAt: new Date().toISOString(),
+        },
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        clientRepository.findOne.mockResolvedValue({
+            id: 2,
+            name: 'Altera',
+            alias: 'altera',
+        });
+    });
+    it('resolves support from active Newtech when the permanent home is Altera', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest
+            .spyOn(service, 'resolve')
+            .mockResolvedValue(origin(['master.users.read']));
+        const resolved = yield service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2);
+        expect(service.resolve).toHaveBeenCalledWith(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2);
+        expect(resolved.snapshot.clientId).toBe(2);
+        expect(resolved.snapshot.homeClientId).toBe(2);
+        expect(resolved.snapshot.clientName).toBe('Altera');
+    }));
+    it('rejects an origin outside Newtech', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(service.resolveImpersonation(1, 2, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects Newtech as the target', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, tenant_constants_1.NEWTECH_CLIENT_ID)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects an origin without master access', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest.spyOn(service, 'resolve').mockResolvedValue(origin([]));
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects an inactive or missing target client', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest
+            .spyOn(service, 'resolve')
+            .mockResolvedValue(origin(['master.users.read']));
+        clientRepository.findOne.mockResolvedValue(null);
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniorganization/uni-lib",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "UNI Library",
   "author": "Jhomiguel",
   "main": "dist/index.js",