@uniorganization/uni-lib 5.0.3 → 5.0.4

package/dist/modules/common/jwt.strategy.js

@@ -39,6 +39,8 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             const signedUser = payload === null || payload === void 0 ? void 0 : payload.user;
             const effectiveClientId = Number(signedUser === null || signedUser === void 0 ? void 0 : signedUser.clientId);
             const originalClientId = (_a = signedUser === null || signedUser === void 0 ? void 0 : signedUser.originalClientId) !== null && _a !== void 0 ? _a : null;
+            const originalUserId = (_b = signedUser === null || signedUser === void 0 ? void 0 : signedUser.originalUserId) !== null && _b !== void 0 ? _b : null;
+            const impersonationType = (_c = signedUser === null || signedUser === void 0 ? void 0 : signedUser.impersonationType) !== null && _c !== void 0 ? _c : null;
             const now = Math.floor(Date.now() / 1000);
             if ((payload === null || payload === void 0 ? void 0 : payload.type) !== 'access' ||
                 !signedUser ||
@@ -56,18 +58,23 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             if (yield this.securityState.isAccessTokenRevoked(payload.jti)) {
                 throw new common_1.UnauthorizedException();
             }
-            const impersonating = originalClientId !== null;
+            const impersonating = originalUserId !== null;
             if ((impersonating &&
                 (originalClientId !== tenant_1.NEWTECH_CLIENT_ID ||
                     effectiveClientId === tenant_1.NEWTECH_CLIENT_ID ||
-                    !((_b = signedUser.roles) === null || _b === void 0 ? void 0 : _b.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)) ||
+                    !Number.isInteger(originalUserId) ||
+                    originalUserId <= 0 ||
+                    originalUserId === signedUser.id ||
+                    impersonationType !== 'user' ||
                     !signedUser.impersonatedAt ||
                     !signedUser.impersonationReason)) ||
-                (!impersonating && ((_c = signedUser.roles) === null || _c === void 0 ? void 0 : _c.includes(tenant_1.TENANT_IMPERSONATOR_ROLE)))) {
+                (!impersonating &&
+                    (originalClientId !== null || impersonationType !== null)) ||
+                (impersonating && originalClientId === null)) {
                 throw new common_1.UnauthorizedException();
             }
             const resolved = impersonating
-                ? yield this.authorization.resolveImpersonation(signedUser.id, originalClientId, effectiveClientId)
+                ? yield this.authorization.resolveUserImpersonation(originalUserId, originalClientId, signedUser.id, effectiveClientId)
                 : yield this.authorization.resolve(signedUser.id, effectiveClientId);
             const { identity, snapshot } = resolved;
             const isMasterTenantAdmin = !impersonating &&
@@ -93,6 +100,8 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
                 jti: payload.jti,
                 tokenExpiresAt: payload.exp,
                 originalClientId,
+                originalUserId,
+                impersonationType: impersonating ? 'user' : null,
                 impersonatedAt: impersonating ? signedUser.impersonatedAt : null,
                 impersonationReason: impersonating
                     ? signedUser.impersonationReason

package/dist/modules/tenant/impersonation-audit.service.d.ts

@@ -0,0 +1,27 @@
+import { DataSource } from 'typeorm';
+type MutationAuditInput = {
+    actorUserId: number | null;
+    effectiveUserId: number | null;
+    clientId: number;
+    reason: string | null;
+    correlationId: string;
+    method: string;
+    route: string;
+};
+type LifecycleAuditInput = {
+    event: 'USER_IMPERSONATION_START' | 'USER_IMPERSONATION_END';
+    actorUserId: number;
+    targetUserId: number;
+    clientId: number;
+    reason: string | null;
+    correlationId: string;
+    result: 'SUCCESS' | 'DENIED';
+};
+export declare class ImpersonationAuditService {
+    private readonly dataSource;
+    constructor(dataSource: DataSource);
+    beginMutation(input: MutationAuditInput): Promise<number>;
+    completeMutation(auditId: number, result: 'SUCCESS' | 'FAILURE', statusCode?: number | null): Promise<void>;
+    recordLifecycle(input: LifecycleAuditInput): Promise<void>;
+}
+export {};

package/dist/modules/tenant/impersonation-audit.service.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImpersonationAuditService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+let ImpersonationAuditService = class ImpersonationAuditService {
+    constructor(dataSource) {
+        this.dataSource = dataSource;
+    }
+    beginMutation(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const rows = yield this.dataSource.query(`INSERT INTO stm."ACCESS_AUDIT_LOG" (
+         client_id, actor_user_id, target_user_id, event,
+         reason, correlation_id, details
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)
+       RETURNING id`, [
+                input.clientId,
+                input.actorUserId,
+                input.effectiveUserId,
+                'USER_IMPERSONATED_MUTATION',
+                input.reason,
+                input.correlationId,
+                JSON.stringify({
+                    service: (_b = (_a = process.env.SERVICE_NAME) !== null && _a !== void 0 ? _a : process.env.npm_package_name) !== null && _b !== void 0 ? _b : 'unknown',
+                    method: input.method,
+                    route: input.route.split('?')[0],
+                    effectiveUserId: input.effectiveUserId,
+                    result: 'STARTED',
+                }),
+            ]);
+            const auditId = Number((_c = rows[0]) === null || _c === void 0 ? void 0 : _c.id);
+            if (!Number.isInteger(auditId) || auditId <= 0) {
+                throw new Error('The impersonation audit record was not created');
+            }
+            return auditId;
+        });
+    }
+    completeMutation(auditId_1, result_1) {
+        return __awaiter(this, arguments, void 0, function* (auditId, result, statusCode = null) {
+            yield this.dataSource.query(`UPDATE stm."ACCESS_AUDIT_LOG"
+       SET details = details || $2::jsonb
+       WHERE id = $1`, [auditId, JSON.stringify({ result, statusCode })]);
+        });
+    }
+    recordLifecycle(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dataSource.query(`INSERT INTO stm."ACCESS_AUDIT_LOG" (
+         client_id, actor_user_id, target_user_id, event,
+         reason, correlation_id, details
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7::jsonb)`, [
+                input.clientId,
+                input.actorUserId,
+                input.targetUserId,
+                input.event,
+                input.reason,
+                input.correlationId,
+                JSON.stringify({ result: input.result }),
+            ]);
+        });
+    }
+};
+exports.ImpersonationAuditService = ImpersonationAuditService;
+exports.ImpersonationAuditService = ImpersonationAuditService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], ImpersonationAuditService);

package/dist/modules/tenant/index.d.ts

@@ -1,6 +1,7 @@
 export * from './current-tenant.decorator';
 export * from './master-tenant.decorator';
 export * from './master-tenant.guard';
+export * from './impersonation-audit.service';
 export * from './redis-tenant-state.store';
 export * from './tenant-audit.types';
 export * from './tenant-authorization.keys';

package/dist/modules/tenant/index.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./current-tenant.decorator"), exports);
 __exportStar(require("./master-tenant.decorator"), exports);
 __exportStar(require("./master-tenant.guard"), exports);
+__exportStar(require("./impersonation-audit.service"), exports);
 __exportStar(require("./redis-tenant-state.store"), exports);
 __exportStar(require("./tenant-audit.types"), exports);
 __exportStar(require("./tenant-authorization.keys"), exports);

package/dist/modules/tenant/master-tenant.guard.js

@@ -18,7 +18,7 @@ let MasterTenantGuard = class MasterTenantGuard {
         this.reflector = reflector;
     }
     canActivate(context) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         const required = this.reflector.getAllAndOverride(tenant_constants_1.MASTER_TENANT_METADATA_KEY, [context.getHandler(), context.getClass()]);
         if (!required) {
             return true;
@@ -29,8 +29,10 @@ let MasterTenantGuard = class MasterTenantGuard {
         }
         const effectiveClientId = ((_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId) || request.user.clientId;
         const originalClientId = (_d = (_c = (_b = request.tenantContext) === null || _b === void 0 ? void 0 : _b.originalClientId) !== null && _c !== void 0 ? _c : request.user.originalClientId) !== null && _d !== void 0 ? _d : null;
+        const originalUserId = (_e = request.user.originalUserId) !== null && _e !== void 0 ? _e : null;
         if (effectiveClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
             originalClientId !== null ||
+            originalUserId !== null ||
             !request.user.isMasterTenantAdmin) {
             throw new common_1.ForbiddenException();
         }

package/dist/modules/tenant/tenant-audit.types.d.ts

@@ -1,6 +1,7 @@
 import { TenantAuthenticationType } from './tenant.types';
 export interface TenantAuditMetadata {
     actorUserId: number | null;
+    effectiveUserId: number | null;
     originalClientId: number | null;
     effectiveClientId: number;
     authenticationType: TenantAuthenticationType;

package/dist/modules/tenant/tenant-authorization.service.d.ts

@@ -13,7 +13,7 @@ export declare class TenantAuthorizationService {
     private readonly logger;
     constructor(store: TenantAuthorizationStore, userRepository: Repository<Users>, clientRepository: Repository<Client>, userRoleRepository: Repository<UserRoles>);
     resolve(userId: number, clientId: number, _legacyOriginClientId?: number): Promise<ResolvedTenantAuthorization>;
-    resolveImpersonation(userId: number, originClientId: number, targetClientIdOrLegacyOriginClientId: number, legacyTargetClientId?: number): Promise<ResolvedTenantAuthorization>;
+    resolveUserImpersonation(actorUserId: number, originClientId: number, targetUserId: number, targetClientId: number): Promise<ResolvedTenantAuthorization>;
     invalidate(userId: number, clientId: number): Promise<void>;
     invalidateMany(clientId: number, userIds: readonly number[]): Promise<void>;
     private loadFromDatabase;

package/dist/modules/tenant/tenant-authorization.service.js

@@ -63,50 +63,19 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
             return resolved;
         });
     }
-    resolveImpersonation(userId, originClientId, targetClientIdOrLegacyOriginClientId, legacyTargetClientId) {
+    resolveUserImpersonation(actorUserId, originClientId, targetUserId, targetClientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            const targetClientId = legacyTargetClientId !== null && legacyTargetClientId !== void 0 ? legacyTargetClientId : targetClientIdOrLegacyOriginClientId;
             if (originClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
-                targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID) {
+                targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID ||
+                actorUserId === targetUserId) {
                 throw new common_1.UnauthorizedException();
             }
-            const origin = yield this.resolve(userId, originClientId);
-            const isNewtechMaster = origin.snapshot.permissions.includes('master.users.read') ||
-                origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
-                    role.roleName.toLowerCase() === 'sysadmin');
-            const targetClient = yield this.clientRepository.findOne({
-                where: { id: targetClientId, deletedAt: (0, typeorm_2.IsNull)() },
-            });
-            if (!isNewtechMaster || !targetClient) {
+            const origin = yield this.resolve(actorUserId, originClientId);
+            if (!origin.snapshot.permissions.includes('master.users.read') ||
+                !origin.snapshot.permissions.includes('master.users.impersonate')) {
                 throw new common_1.UnauthorizedException();
             }
-            const snapshot = {
-                userId,
-                clientId: targetClientId,
-                clientName: targetClient.name,
-                clientAlias: targetClient.alias,
-                roles: [
-                    {
-                        roleId: 0,
-                        roleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
-                        moduleId: 0,
-                        moduleName: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
-                    },
-                ],
-                privileges: [],
-                accessRole: {
-                    id: 0,
-                    code: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
-                    name: 'Tenant impersonator',
-                    scope: 'GLOBAL',
-                    clientId: null,
-                },
-                permissions: [],
-                authzVersion: 1,
-                identity: origin.identity,
-                cachedAt: new Date().toISOString(),
-            };
-            return { identity: origin.identity, snapshot };
+            return this.resolve(targetUserId, targetClientId);
         });
     }
     invalidate(userId, clientId) {

package/dist/modules/tenant/tenant-context.interceptor.d.ts

@@ -1,9 +1,14 @@
 import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
 import { Observable } from 'rxjs';
 import { TenantContextStorage } from './tenant-context.storage';
+import { ImpersonationAuditService } from './impersonation-audit.service';
 export declare class TenantContextInterceptor implements NestInterceptor {
     private readonly tenantContextStorage;
-    constructor(tenantContextStorage: TenantContextStorage);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    private readonly impersonationAudit;
+    private readonly logger;
+    constructor(tenantContextStorage: TenantContextStorage, impersonationAudit: ImpersonationAuditService);
+    intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<unknown>>;
+    private beginImpersonatedMutation;
+    private errorStatus;
     private fromAuthenticatedUser;
 }

package/dist/modules/tenant/tenant-context.interceptor.js

@@ -8,33 +8,97 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var TenantContextInterceptor_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantContextInterceptor = void 0;
 const crypto_1 = require("crypto");
 const common_1 = require("@nestjs/common");
 const rxjs_1 = require("rxjs");
 const tenant_context_storage_1 = require("./tenant-context.storage");
-let TenantContextInterceptor = class TenantContextInterceptor {
-    constructor(tenantContextStorage) {
+const impersonation_audit_service_1 = require("./impersonation-audit.service");
+let TenantContextInterceptor = TenantContextInterceptor_1 = class TenantContextInterceptor {
+    constructor(tenantContextStorage, impersonationAudit) {
         this.tenantContextStorage = tenantContextStorage;
+        this.impersonationAudit = impersonationAudit;
+        this.logger = new common_1.Logger(TenantContextInterceptor_1.name);
     }
     intercept(context, next) {
-        if (context.getType() !== 'http') {
-            return next.handle();
-        }
-        const request = context.switchToHttp().getRequest();
-        const state = request.tenantContext || this.fromAuthenticatedUser(request);
-        if (!state) {
-            return next.handle();
-        }
-        request.tenantContext = Object.freeze(state);
-        return new rxjs_1.Observable((subscriber) => {
-            const subscription = this.tenantContextStorage.run(state, () => next.handle().subscribe(subscriber));
-            return () => subscription.unsubscribe();
+        return __awaiter(this, void 0, void 0, function* () {
+            if (context.getType() !== 'http') {
+                return next.handle();
+            }
+            const request = context.switchToHttp().getRequest();
+            const state = request.tenantContext || this.fromAuthenticatedUser(request);
+            if (!state) {
+                return next.handle();
+            }
+            request.tenantContext = Object.freeze(state);
+            const auditId = yield this.beginImpersonatedMutation(request, state);
+            return new rxjs_1.Observable((subscriber) => {
+                const subscription = this.tenantContextStorage.run(state, () => next
+                    .handle()
+                    .pipe((0, rxjs_1.concatMap)((value) => auditId === null
+                    ? (0, rxjs_1.of)(value)
+                    : (0, rxjs_1.from)(this.impersonationAudit.completeMutation(auditId, 'SUCCESS')).pipe((0, rxjs_1.map)(() => value), (0, rxjs_1.catchError)((error) => {
+                        this.logger.error(`Could not complete impersonation audit ${auditId}`, error instanceof Error ? error.stack : String(error));
+                        return (0, rxjs_1.of)(value);
+                    }))), (0, rxjs_1.catchError)((error) => {
+                    if (auditId === null)
+                        return (0, rxjs_1.throwError)(() => error);
+                    return (0, rxjs_1.from)(this.impersonationAudit.completeMutation(auditId, 'FAILURE', this.errorStatus(error))).pipe((0, rxjs_1.catchError)((auditError) => {
+                        this.logger.error(`Could not complete failed impersonation audit ${auditId}`, auditError instanceof Error
+                            ? auditError.stack
+                            : String(auditError));
+                        return (0, rxjs_1.of)(undefined);
+                    }), (0, rxjs_1.concatMap)(() => (0, rxjs_1.throwError)(() => error)));
+                }))
+                    .subscribe(subscriber));
+                return () => subscription.unsubscribe();
+            });
         });
     }
+    beginImpersonatedMutation(request, state) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const method = String(request.method || '').toUpperCase();
+            if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(method))
+                return null;
+            if (!state.impersonatedAt || state.actorUserId === state.effectiveUserId) {
+                return null;
+            }
+            const route = request.originalUrl || ((_a = request.route) === null || _a === void 0 ? void 0 : _a.path) || 'unknown';
+            if (route.split('?')[0].endsWith('/auth/end-impersonation'))
+                return null;
+            return this.impersonationAudit.beginMutation({
+                actorUserId: state.actorUserId,
+                effectiveUserId: state.effectiveUserId,
+                clientId: state.clientId,
+                reason: state.impersonationReason,
+                correlationId: state.correlationId,
+                method,
+                route,
+            });
+        });
+    }
+    errorStatus(error) {
+        var _a;
+        if (!error || typeof error !== 'object')
+            return null;
+        const candidate = error;
+        const status = Number((_a = candidate.status) !== null && _a !== void 0 ? _a : candidate.statusCode);
+        return Number.isInteger(status) ? status : null;
+    }
     fromAuthenticatedUser(request) {
-        var _a, _b, _c, _d;
+        var _a, _b, _c, _d, _e;
         if (!request.user || request.user === true) {
             return undefined;
         }
@@ -53,17 +117,19 @@ let TenantContextInterceptor = class TenantContextInterceptor {
         return {
             clientId: user.clientId,
             originalClientId: (_b = user.originalClientId) !== null && _b !== void 0 ? _b : null,
-            actorUserId: user.id,
+            actorUserId: (_c = user.originalUserId) !== null && _c !== void 0 ? _c : user.id,
+            effectiveUserId: user.id,
             authenticationType: 'jwt',
-            impersonatedAt: (_c = user.impersonatedAt) !== null && _c !== void 0 ? _c : null,
-            impersonationReason: (_d = user.impersonationReason) !== null && _d !== void 0 ? _d : null,
+            impersonatedAt: (_d = user.impersonatedAt) !== null && _d !== void 0 ? _d : null,
+            impersonationReason: (_e = user.impersonationReason) !== null && _e !== void 0 ? _e : null,
             correlationId,
             roles: user.roles || [],
         };
     }
 };
 exports.TenantContextInterceptor = TenantContextInterceptor;
-exports.TenantContextInterceptor = TenantContextInterceptor = __decorate([
+exports.TenantContextInterceptor = TenantContextInterceptor = TenantContextInterceptor_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage])
+    __metadata("design:paramtypes", [tenant_context_storage_1.TenantContextStorage,
+        impersonation_audit_service_1.ImpersonationAuditService])
 ], TenantContextInterceptor);

package/dist/modules/tenant/tenant-context.service.d.ts

@@ -8,6 +8,7 @@ export declare class TenantContext {
     getClientId(): number;
     getOriginalClientId(): number | null;
     getActorUserId(): number | null;
+    getEffectiveUserId(): number | null;
     getAuthenticationType(): TenantAuthenticationType;
     getImpersonationReason(): string | null;
     getCorrelationId(): string;

package/dist/modules/tenant/tenant-context.service.js

@@ -36,6 +36,9 @@ let TenantContext = class TenantContext {
     getActorUserId() {
         return this.getState().actorUserId;
     }
+    getEffectiveUserId() {
+        return this.getState().effectiveUserId;
+    }
     getAuthenticationType() {
         return this.getState().authenticationType;
     }

package/dist/modules/tenant/tenant-credential.guard.js

@@ -65,6 +65,7 @@ let TenantCredentialGuard = class TenantCredentialGuard {
                 clientId: credential.clientId,
                 originalClientId: null,
                 actorUserId: null,
+                effectiveUserId: null,
                 authenticationType: 'client-credential',
                 impersonatedAt: null,
                 impersonationReason: null,

package/dist/modules/tenant/tenant-runner.service.js

@@ -18,7 +18,7 @@ let TenantRunner = class TenantRunner {
         this.tenantContextStorage = tenantContextStorage;
     }
     run(clientId, metadata, callback) {
-        var _a, _b;
+        var _a, _b, _c;
         if (!Number.isInteger(clientId) || clientId <= 0) {
             throw new Error('TenantRunner requires a valid client ID');
         }
@@ -26,11 +26,12 @@ let TenantRunner = class TenantRunner {
             clientId,
             originalClientId: null,
             actorUserId: (_a = metadata.actorUserId) !== null && _a !== void 0 ? _a : null,
+            effectiveUserId: (_b = metadata.actorUserId) !== null && _b !== void 0 ? _b : null,
             authenticationType: metadata.authenticationType,
             impersonatedAt: null,
             impersonationReason: null,
             correlationId: metadata.correlationId || (0, crypto_1.randomUUID)(),
-            credentialId: (_b = metadata.credentialId) !== null && _b !== void 0 ? _b : null,
+            credentialId: (_c = metadata.credentialId) !== null && _c !== void 0 ? _c : null,
         }, callback);
     }
 };

package/dist/modules/tenant/tenant.constants.d.ts

@@ -1,6 +1,5 @@
 export declare const NEWTECH_CLIENT_ID = 1;
 export declare const ALTERA_CLIENT_ID = 2;
-export declare const TENANT_IMPERSONATOR_ROLE = "TENANT_IMPERSONATOR";
 export declare const MASTER_TENANT_METADATA_KEY = "masterTenant";
 export declare const PUBLIC_ROUTE_METADATA_KEY = "publicRoute";
 export declare const TENANT_CONTEXT_REQUEST_KEY = "tenantContext";

package/dist/modules/tenant/tenant.constants.js

@@ -1,9 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TENANT_CREDENTIAL_HEADER = exports.TENANT_CONTEXT_REQUEST_KEY = exports.PUBLIC_ROUTE_METADATA_KEY = exports.MASTER_TENANT_METADATA_KEY = exports.TENANT_IMPERSONATOR_ROLE = exports.ALTERA_CLIENT_ID = exports.NEWTECH_CLIENT_ID = void 0;
+exports.TENANT_CREDENTIAL_HEADER = exports.TENANT_CONTEXT_REQUEST_KEY = exports.PUBLIC_ROUTE_METADATA_KEY = exports.MASTER_TENANT_METADATA_KEY = exports.ALTERA_CLIENT_ID = exports.NEWTECH_CLIENT_ID = void 0;
 exports.NEWTECH_CLIENT_ID = 1;
 exports.ALTERA_CLIENT_ID = 2;
-exports.TENANT_IMPERSONATOR_ROLE = 'TENANT_IMPERSONATOR';
 exports.MASTER_TENANT_METADATA_KEY = 'masterTenant';
 exports.PUBLIC_ROUTE_METADATA_KEY = 'publicRoute';
 exports.TENANT_CONTEXT_REQUEST_KEY = 'tenantContext';

package/dist/modules/tenant/tenant.module.js

@@ -25,6 +25,7 @@ const tenant_credential_guard_1 = require("./tenant-credential.guard");
 const master_tenant_guard_1 = require("./master-tenant.guard");
 const tenant_ownership_service_1 = require("./tenant-ownership.service");
 const tenant_runner_service_1 = require("./tenant-runner.service");
+const impersonation_audit_service_1 = require("./impersonation-audit.service");
 let TenantModule = class TenantModule {
 };
 exports.TenantModule = TenantModule;
@@ -49,6 +50,7 @@ exports.TenantModule = TenantModule = __decorate([
             tenant_context_storage_1.TenantContextStorage,
             tenant_context_service_1.TenantContext,
             tenant_runner_service_1.TenantRunner,
+            impersonation_audit_service_1.ImpersonationAuditService,
             tenant_context_interceptor_1.TenantContextInterceptor,
             tenant_credential_guard_1.TenantCredentialGuard,
             master_tenant_guard_1.MasterTenantGuard,
@@ -61,6 +63,7 @@ exports.TenantModule = TenantModule = __decorate([
             tenant_security_state_service_1.TenantSecurityStateService,
             tenant_context_service_1.TenantContext,
             tenant_runner_service_1.TenantRunner,
+            impersonation_audit_service_1.ImpersonationAuditService,
             tenant_context_interceptor_1.TenantContextInterceptor,
             tenant_credential_guard_1.TenantCredentialGuard,
             master_tenant_guard_1.MasterTenantGuard,

package/dist/modules/tenant/tenant.types.d.ts

@@ -3,6 +3,7 @@ export interface TenantContextState {
     readonly clientId: number;
     readonly originalClientId: number | null;
     readonly actorUserId: number | null;
+    readonly effectiveUserId: number | null;
     readonly authenticationType: TenantAuthenticationType;
     readonly impersonatedAt: string | null;
     readonly impersonationReason: string | null;
@@ -18,6 +19,8 @@ export interface AuthenticatedTenantUser {
     jti: string;
     tokenExpiresAt: number;
     originalClientId: number | null;
+    originalUserId: number | null;
+    impersonationType: 'user' | null;
     impersonatedAt: string | null;
     impersonationReason: string | null;
     roles: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniorganization/uni-lib",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "description": "UNI Library",
   "author": "Jhomiguel",
   "main": "dist/index.js",
@@ -74,7 +74,7 @@
   },
   "scripts": {
     "start:dev": "tsc -w",
-    "build": "tsc",
+    "build": "tsc -p tsconfig.build.json",
     "format": "prettier --write \"src/**/*.ts\"",
     "lint": "tslint -p tsconfig.json -c tslint.json",
     "test": "jest",