@universis/janitor 1.5.0 → 1.6.1

package/README.md

@@ -295,3 +295,51 @@ app.use('/api', passport.authenticate('bearer', {session: false}), validateScope
 ```
 
 A `403 - Access denied due to authorization scopes` error will be thrown if the user does not have access to the resource.
+
+## RemoteAddressValidator
+
+`RemoteAddressValidator` is a configurable application service for validating access to service endpoints based on remote address provided by OAuth2 token.
+
+Register service under application services:
+
+```json
+{
+    "services": [
+        {
+            "serviceType": "@universis/janitor#RemoteAddressValidator"
+        }
+    ]
+}
+```
+
+`RemoteAddressValidator` validates the remote address of the request with the remote address provided by the OAuth2 token. If the addresses do not match, a `403 - Access denied due to remote address` error will be thrown. Token remote address is provided by the `remoteAddress` claim in the token payload. It can be configured in the OAuth2 server configuration and may have a different name. This name may be configured in the `settings/universis/janitor/remoteAddress` configuration e.g.
+
+```json
+{
+    "settings": {
+        "universis": {
+            "janitor": {
+                "remoteAddress": {
+                    "claim": "ipAddress"
+                }
+            }
+        }
+    }
+}
+```
+
+where `claim` is the name of the remote address claim in the token payload.
+
+**Important Note**: If api server is served by a proxy, the remote address may be different from the client address. In this case, the proxy should be configured to forward the client address to the server. This scenario should be configured in application settings under `settings/universis/api/` section e.g.
+
+```json
+{
+    "settings": {
+        "universis": {
+            "api": {
+                "proxyAddressForwarding": true
+            }
+        }
+    }
+}
+``` 

package/dist/OAuth2ClientService.d.ts

@@ -0,0 +1,98 @@
+import { ApplicationService, ApplicationBase } from '@themost/common';
+import { DataContext } from '@themost/data';
+
+export declare interface OAuth2MethodOptions {
+    access_token: string;
+}
+
+export declare interface OAuth2AuthorizeUser {
+    client_id?: string;
+    client_secret?: string;
+    username: string;
+    password: string;
+    grant_type: string;
+    scope?: string;
+}
+
+export declare interface OAuth2ServiceSettings {
+    unattendedExecutionAccount?: string;
+    client_id: string;
+    client_secret?: string;
+    server_uri: string;
+    userinfo_uri?: string;
+    introspect_uri?: string;
+    admin_uri?: string;
+    well_known_configuration_uri?: string;
+    adminAccount: {
+        username: string;
+        password: string;
+        client_id: string;
+        client_secret?: string;
+        scope?: string;
+    }
+}
+
+export declare interface OAuth2UserProfile {
+    sub: string;
+    name: string;
+    preferred_username: string;
+    given_name: string;
+    family_name: string;
+    email: string;
+}
+
+export declare interface GenericUser {
+     id?: any; 
+     additionalType?: string; 
+     alternateName?: string; 
+     description?: string; 
+     givenName?: string; 
+     familyName?: string; 
+     image?: string; 
+     name?: string; 
+     url?: string; 
+     dateCreated?: Date; 
+     dateModified?: Date; 
+     createdBy?: any; 
+     modifiedBy?: any; 
+     lockoutTime?: Date; 
+     logonCount?: number; 
+     enabled?: boolean; 
+     lastLogon?: Date; 
+     userCredentials?: {
+         userPassword?: string;
+         userActivated?: boolean;
+         temporary?: boolean;
+     }
+}
+
+export declare interface OAuth2User {
+    id?: any; 
+    username?: string; 
+    email?: string; 
+    enabled?: boolean;
+    emailVerified?: boolean;
+    firstName?: string; 
+    lastName?: string; 
+    credentials?: {
+        algorithm?: string,
+        temporary?: boolean,
+        type?: string,
+        value?: string
+    }
+}
+
+export declare class OAuth2ClientService extends ApplicationService {
+    get settings(): OAuth2ServiceSettings;
+    constructor(app: ApplicationBase)
+    getUserInfo(context: DataContext, token: string): Promise<OAuth2UserProfile>;
+    getTokenInfo(context: DataContext, token: string): Promise<any>;
+    getContextTokenInfo(context: DataContext): Promise<any>;
+    authorize(authorizeUser: OAuth2AuthorizeUser): Promise<{ access_token?: string, refresh_token?: string}>;
+    getUser(username: string, options: OAuth2MethodOptions): Promise<any>;
+    getUserById(user_id: any, options: OAuth2MethodOptions): Promise<any>;
+    getUserByEmail(email: string, options: OAuth2MethodOptions): Promise<any>;
+    updateUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    createUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    deleteUser(user: { id: any }, options: OAuth2MethodOptions): Promise<any>; 
+}

package/dist/OAuth2ClientService.js

@@ -0,0 +1,251 @@
+"use strict";Object.defineProperty(exports, "__esModule", { value: true });exports.OAuth2ClientService = void 0;var _superagent = require("superagent");
+var _url = require("url");
+var _common = require("@themost/common");
+
+function responseHander(resolve, reject) {
+  return function (err, response) {
+    if (err) {
+      /**
+       * @type {import('superagent').Response}
+       */
+      const response = err.response;
+      if (response && response.headers['content-type'] === 'application/json') {
+        // get body
+        const clientError = response.body;
+        const error = new _common.HttpError(response.status);
+        return reject(Object.assign(error, {
+          clientError
+        }));
+      }
+      return reject(err);
+    }
+    if (response.status === 204 && response.headers['content-type'] === 'application/json') {
+      return resolve(null);
+    }
+    return resolve(response.body);
+  };
+}
+
+/**
+ * @class
+ */
+class OAuth2ClientService extends _common.ApplicationService {
+  /**
+   * @param {import('@themost/express').ExpressDataApplication} app
+   */
+  constructor(app) {
+    super(app);
+    /**
+     * @name OAuth2ClientService#settings
+     * @type {{server_uri:string,token_uri?:string}}
+     */
+    Object.defineProperty(this, 'settings', {
+      writable: false,
+      value: app.getConfiguration().getSourceAt('settings/auth'),
+      enumerable: false,
+      configurable: false
+    });
+  }
+
+  /**
+   * Gets keycloak server root
+   * @returns {string}
+   */
+  getServer() {
+    return this.settings.server_uri;
+  }
+
+  /**
+   * Gets keycloak server root
+   * @returns {string}
+   */
+  getAdminRoot() {
+    return this.settings.admin_uri;
+  }
+
+  // noinspection JSUnusedGlobalSymbols
+  /**
+   * Gets user's profile by calling OAuth2 server profile endpoint
+   * @param {ExpressDataContext} context
+   * @param {string} token
+   */
+  getUserInfo(token) {
+    return new Promise((resolve, reject) => {
+      const userinfo_uri = this.settings.userinfo_uri ? new _url.URL(this.settings.userinfo_uri, this.getServer()) : new _url.URL('me', this.getServer());
+      return new _superagent.Request('GET', userinfo_uri).
+      set({
+        'Authorization': `Bearer ${token}`,
+        'Accept': 'application/json'
+      }).
+      query({
+        'access_token': token
+      }).end(responseHander(resolve, reject));
+    });
+  }
+
+  // noinspection JSUnusedGlobalSymbols
+  /**
+   * Gets the token info of the current context
+   * @param {ExpressDataContext} context
+   */
+  getContextTokenInfo(context) {
+    if (context.user == null) {
+      return Promise.reject(new Error('Context user may not be null'));
+    }
+    if (context.user.authenticationType !== 'Bearer') {
+      return Promise.reject(new Error('Invalid context authentication type'));
+    }
+    if (context.user.authenticationToken == null) {
+      return Promise.reject(new Error('Context authentication data may not be null'));
+    }
+    return this.getTokenInfo(context, context.user.authenticationToken);
+  }
+  /**
+   * Gets token info by calling OAuth2 server endpoint
+   * @param {ExpressDataContext} _context
+   * @param {string} token
+   */
+  getTokenInfo(_context, token) {
+    return new Promise((resolve, reject) => {
+      const introspection_uri = this.settings.introspection_uri ? new _url.URL(this.settings.introspection_uri, this.getServer()) : new _url.URL('tokeninfo', this.getServer());
+      return new _superagent.Request('POST', introspection_uri).
+      auth(this.settings.client_id, this.settings.client_secret).
+      set('Accept', 'application/json').
+      type('form').
+      send({
+        'token_type_hint': 'access_token',
+        'token': token
+      }).end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * @param {AuthorizeUser} authorizeUser
+   */
+  authorize(authorizeUser) {
+    const tokenURL = this.settings.token_uri ? new _url.URL(this.settings.token_uri) : new _url.URL('authorize', this.getServer());
+    return new Promise((resolve, reject) => {
+      return new _superagent.Request('POST', tokenURL).
+      type('form').
+      send(authorizeUser).end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Gets a user by name
+   * @param {*} user_id 
+   * @param {AdminMethodOptions} options 
+   */
+  getUserById(user_id, options) {
+    return new Promise((resolve, reject) => {
+      return new _superagent.Request('GET', new _url.URL(`users/${user_id}`, this.getAdminRoot())).
+      set('Authorization', `Bearer ${options.access_token}`).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Gets a user by name
+   * @param {string} username 
+   * @param {AdminMethodOptions} options 
+   */
+  getUser(username, options) {
+    return new Promise((resolve, reject) => {
+      return new _superagent.Request('GET', new _url.URL('users', this.getAdminRoot())).
+      set('Authorization', `Bearer ${options.access_token}`).
+      query({
+        '$filter': `name eq '${username}'`
+      }).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Gets a user by email address
+   * @param {string} email 
+   * @param {AdminMethodOptions} options 
+   */
+  getUserByEmail(email, options) {
+    return new Promise((resolve, reject) => {
+      return new _superagent.Request('GET', new _url.URL('users', this.getAdminRoot())).
+      set('Authorization', `Bearer ${options.access_token}`).
+      query({
+        '$filter': `alternateName eq '${email}'`
+      }).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Updates an existing user
+   * @param {*} user 
+   * @param {AdminMethodOptions} options 
+   */
+  updateUser(user, options) {
+    return new Promise((resolve, reject) => {
+      if (user.id == null) {
+        return reject(new _common.DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+      }
+      const request = new _superagent.Request('PUT', new _url.URL(`users/${user.id}`, this.getAdminRoot()));
+      return request.set('Authorization', `Bearer ${options.access_token}`).
+      set('Content-Type', 'application/json').
+      send(user).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Creates a new user
+   * @param {*} user 
+   * @param {AdminMethodOptions} options 
+   */
+  createUser(user, options) {
+    return new Promise((resolve, reject) => {
+      const request = new _superagent.Request('POST', new _url.URL('users', this.getAdminRoot()));
+      return request.set('Authorization', `Bearer ${options.access_token}`).
+      set('Content-Type', 'application/json').
+      send(Object.assign({}, user, {
+        $state: 1 // for create
+      })).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * Deletes a user
+   * @param {{id: any}} user 
+   * @param {AdminMethodOptions} options 
+   */
+  deleteUser(user, options) {
+    return new Promise((resolve, reject) => {
+      if (user.id == null) {
+        return reject(new _common.DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+      }
+      const request = new _superagent.Request('DELETE', new _url.URL(`users/${user.id}`, this.getAdminRoot()));
+      return request.set('Authorization', `Bearer ${options.access_token}`).
+      end(responseHander(resolve, reject));
+    });
+  }
+
+  /**
+   * @param {boolean=} force 
+   * @returns {*}
+   */
+  getWellKnownConfiguration(force) {
+    if (force) {
+      this.well_known_configuration = null;
+    }
+    if (this.well_known_configuration) {
+      return Promise.resolve(this.well_known_configuration);
+    }
+    return new Promise((resolve, reject) => {
+      const well_known_configuration_uri = this.settings.well_known_configuration_uri ? new _url.URL(this.settings.well_known_configuration_uri, this.getServer()) : new _url.URL('.well-known/openid-configuration', this.getServer());
+      return new _superagent.Request('GET', well_known_configuration_uri).
+      end(responseHander(resolve, reject));
+    }).then((configuration) => {
+      this.well_known_configuration = configuration;
+      return configuration;
+    });
+  }
+}exports.OAuth2ClientService = OAuth2ClientService;
+//# sourceMappingURL=OAuth2ClientService.js.map

package/dist/OAuth2ClientService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OAuth2ClientService.js","names":["_superagent","require","_url","_common","responseHander","resolve","reject","err","response","headers","clientError","body","error","HttpError","status","Object","assign","OAuth2ClientService","ApplicationService","constructor","app","defineProperty","writable","value","getConfiguration","getSourceAt","enumerable","configurable","getServer","settings","server_uri","getAdminRoot","admin_uri","getUserInfo","token","Promise","userinfo_uri","URL","Request","set","query","end","getContextTokenInfo","context","user","Error","authenticationType","authenticationToken","getTokenInfo","_context","introspection_uri","auth","client_id","client_secret","type","send","authorize","authorizeUser","tokenURL","token_uri","getUserById","user_id","options","access_token","getUser","username","getUserByEmail","email","updateUser","id","DataError","request","createUser","$state","deleteUser","getWellKnownConfiguration","force","well_known_configuration","well_known_configuration_uri","then","configuration","exports"],"sources":["../src/OAuth2ClientService.js"],"sourcesContent":["import {Request} from 'superagent'\nimport {URL} from 'url';\nimport {ApplicationService, DataError, HttpError} from '@themost/common';\n\nfunction responseHander(resolve, reject) {\n    return function (err, response) {\n        if (err) {\n            /**\n             * @type {import('superagent').Response}\n             */\n            const response = err.response\n            if (response && response.headers['content-type'] === 'application/json') {\n                // get body\n                const clientError = response.body;\n                const error = new HttpError(response.status);\n                return reject(Object.assign(error, {\n                    clientError\n                }));\n            }\n            return reject(err);\n        }\n        if (response.status === 204 && response.headers['content-type'] === 'application/json') {\n            return resolve(null);\n        }\n        return resolve(response.body);\n    };\n}\n\n/**\n * @class\n */\nclass OAuth2ClientService extends ApplicationService {\n    /**\n     * @param {import('@themost/express').ExpressDataApplication} app\n     */\n    constructor(app) {\n        super(app);\n        /**\n         * @name OAuth2ClientService#settings\n         * @type {{server_uri:string,token_uri?:string}}\n         */\n         Object.defineProperty(this, 'settings', {\n            writable: false,\n            value: app.getConfiguration().getSourceAt('settings/auth'),\n            enumerable: false,\n            configurable: false\n        });\n    }\n\n    /**\n     * Gets keycloak server root\n     * @returns {string}\n     */\n     getServer() {\n        return this.settings.server_uri;\n    }\n\n    /**\n     * Gets keycloak server root\n     * @returns {string}\n     */\n     getAdminRoot() {\n        return this.settings.admin_uri;\n    }\n\n    // noinspection JSUnusedGlobalSymbols\n    /**\n     * Gets user's profile by calling OAuth2 server profile endpoint\n     * @param {ExpressDataContext} context\n     * @param {string} token\n     */\n    getUserInfo(token) {\n        return new Promise((resolve, reject) => {\n            const userinfo_uri = this.settings.userinfo_uri ? new URL(this.settings.userinfo_uri, this.getServer()) : new URL('me', this.getServer());\n            return new Request('GET', userinfo_uri)\n                .set({\n                    'Authorization': `Bearer ${token}`,\n                    'Accept': 'application/json'\n                })\n                .query({\n                    'access_token':token\n                }).end(responseHander(resolve, reject));\n        });\n    }\n\n    // noinspection JSUnusedGlobalSymbols\n    /**\n     * Gets the token info of the current context\n     * @param {ExpressDataContext} context\n     */\n    getContextTokenInfo(context) {\n        if (context.user == null) {\n            return Promise.reject(new Error('Context user may not be null'));\n        }\n        if (context.user.authenticationType !== 'Bearer') {\n            return Promise.reject(new Error('Invalid context authentication type'));\n        }\n        if (context.user.authenticationToken == null) {\n            return Promise.reject(new Error('Context authentication data may not be null'));\n        }\n        return this.getTokenInfo(context, context.user.authenticationToken);\n    }\n    /**\n     * Gets token info by calling OAuth2 server endpoint\n     * @param {ExpressDataContext} _context\n     * @param {string} token\n     */\n    getTokenInfo(_context, token) {\n        return new Promise((resolve, reject) => {\n            const introspection_uri = this.settings.introspection_uri ? new URL(this.settings.introspection_uri, this.getServer()) : new URL('tokeninfo', this.getServer());\n            return new Request('POST', introspection_uri)\n                .auth(this.settings.client_id, this.settings.client_secret)\n                .set('Accept', 'application/json')\n                .type('form')\n                .send({\n                    'token_type_hint': 'access_token',\n                    'token': token,\n                }).end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * @param {AuthorizeUser} authorizeUser\n     */\n     authorize(authorizeUser) {\n        const tokenURL = this.settings.token_uri ? new URL(this.settings.token_uri) : new URL('authorize', this.getServer());\n        return new Promise((resolve, reject)=> {\n            return new Request('POST', tokenURL)\n                .type('form')\n                .send(authorizeUser).end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Gets a user by name\n     * @param {*} user_id \n     * @param {AdminMethodOptions} options \n     */\n     getUserById(user_id, options) {\n        return new Promise((resolve, reject) => {\n            return new Request('GET', new URL(`users/${user_id}`, this.getAdminRoot()))\n                .set('Authorization', `Bearer ${options.access_token}`)\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Gets a user by name\n     * @param {string} username \n     * @param {AdminMethodOptions} options \n     */\n    getUser(username, options) {\n        return new Promise((resolve, reject)=> {\n            return new Request('GET', new URL('users', this.getAdminRoot()))\n                .set('Authorization', `Bearer ${options.access_token}`)\n                .query({\n                    '$filter': `name eq '${username}'`\n                })\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Gets a user by email address\n     * @param {string} email \n     * @param {AdminMethodOptions} options \n     */\n     getUserByEmail(email, options) {\n        return new Promise((resolve, reject)=> {\n            return new Request('GET', new URL('users', this.getAdminRoot()))\n                .set('Authorization', `Bearer ${options.access_token}`)\n                .query({\n                    '$filter': `alternateName eq '${email}'`\n                })\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Updates an existing user\n     * @param {*} user \n     * @param {AdminMethodOptions} options \n     */\n     updateUser(user, options) {\n        return new Promise((resolve, reject)=> {\n            if (user.id == null) {\n                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));\n            }\n            const request = new Request('PUT', new URL(`users/${user.id}`, this.getAdminRoot()));\n            return request.set('Authorization', `Bearer ${options.access_token}`)\n                .set('Content-Type', 'application/json')\n                .send(user)\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Creates a new user\n     * @param {*} user \n     * @param {AdminMethodOptions} options \n     */\n     createUser(user, options) {\n        return new Promise((resolve, reject)=> {\n            const request = new Request('POST', new URL('users', this.getAdminRoot()));\n            return request.set('Authorization', `Bearer ${options.access_token}`)\n                .set('Content-Type', 'application/json')\n                .send(Object.assign({}, user, {\n                    $state: 1 // for create\n                }))\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * Deletes a user\n     * @param {{id: any}} user \n     * @param {AdminMethodOptions} options \n     */\n     deleteUser(user, options) {\n        return new Promise((resolve, reject)=> {\n            if (user.id == null) {\n                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));\n            }\n            const request = new Request('DELETE', new URL(`users/${user.id}`, this.getAdminRoot()));\n            return request.set('Authorization', `Bearer ${options.access_token}`)\n                .end(responseHander(resolve, reject));\n        });\n    }\n\n    /**\n     * @param {boolean=} force \n     * @returns {*}\n     */\n    getWellKnownConfiguration(force) {\n        if (force) {\n            this.well_known_configuration = null;\n        }\n        if (this.well_known_configuration) {\n            return Promise.resolve(this.well_known_configuration);\n        }\n        return new Promise((resolve, reject) => {\n            const well_known_configuration_uri = this.settings.well_known_configuration_uri ? new URL(this.settings.well_known_configuration_uri, this.getServer()) : new URL('.well-known/openid-configuration', this.getServer());\n            return new Request('GET', well_known_configuration_uri)\n                .end(responseHander(resolve, reject));\n        }).then((configuration) => {\n            this.well_known_configuration = configuration;\n            return configuration;\n        });\n    }\n}\n\nexport {\n    OAuth2ClientService\n}\n\n"],"mappings":"gHAAA,IAAAA,WAAA,GAAAC,OAAA;AACA,IAAAC,IAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;;AAEA,SAASG,cAAcA,CAACC,OAAO,EAAEC,MAAM,EAAE;EACrC,OAAO,UAAUC,GAAG,EAAEC,QAAQ,EAAE;IAC5B,IAAID,GAAG,EAAE;MACL;AACZ;AACA;MACY,MAAMC,QAAQ,GAAGD,GAAG,CAACC,QAAQ;MAC7B,IAAIA,QAAQ,IAAIA,QAAQ,CAACC,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,EAAE;QACrE;QACA,MAAMC,WAAW,GAAGF,QAAQ,CAACG,IAAI;QACjC,MAAMC,KAAK,GAAG,IAAIC,iBAAS,CAACL,QAAQ,CAACM,MAAM,CAAC;QAC5C,OAAOR,MAAM,CAACS,MAAM,CAACC,MAAM,CAACJ,KAAK,EAAE;UAC/BF;QACJ,CAAC,CAAC,CAAC;MACP;MACA,OAAOJ,MAAM,CAACC,GAAG,CAAC;IACtB;IACA,IAAIC,QAAQ,CAACM,MAAM,KAAK,GAAG,IAAIN,QAAQ,CAACC,OAAO,CAAC,cAAc,CAAC,KAAK,kBAAkB,EAAE;MACpF,OAAOJ,OAAO,CAAC,IAAI,CAAC;IACxB;IACA,OAAOA,OAAO,CAACG,QAAQ,CAACG,IAAI,CAAC;EACjC,CAAC;AACL;;AAEA;AACA;AACA;AACA,MAAMM,mBAAmB,SAASC,0BAAkB,CAAC;EACjD;AACJ;AACA;EACIC,WAAWA,CAACC,GAAG,EAAE;IACb,KAAK,CAACA,GAAG,CAAC;IACV;AACR;AACA;AACA;IACSL,MAAM,CAACM,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE;MACrCC,QAAQ,EAAE,KAAK;MACfC,KAAK,EAAEH,GAAG,CAACI,gBAAgB,EAAE,CAACC,WAAW,CAAC,eAAe,CAAC;MAC1DC,UAAU,EAAE,KAAK;MACjBC,YAAY,EAAE;IAClB,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;EACKC,SAASA,CAAA,EAAG;IACT,OAAO,IAAI,CAACC,QAAQ,CAACC,UAAU;EACnC;;EAEA;AACJ;AACA;AACA;EACKC,YAAYA,CAAA,EAAG;IACZ,OAAO,IAAI,CAACF,QAAQ,CAACG,SAAS;EAClC;;EAEA;EACA;AACJ;AACA;AACA;AACA;EACIC,WAAWA,CAACC,KAAK,EAAE;IACf,OAAO,IAAIC,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAK;MACpC,MAAM8B,YAAY,GAAG,IAAI,CAACP,QAAQ,CAACO,YAAY,GAAG,IAAIC,QAAG,CAAC,IAAI,CAACR,QAAQ,CAACO,YAAY,EAAE,IAAI,CAACR,SAAS,EAAE,CAAC,GAAG,IAAIS,QAAG,CAAC,IAAI,EAAE,IAAI,CAACT,SAAS,EAAE,CAAC;MACzI,OAAO,IAAIU,mBAAO,CAAC,KAAK,EAAEF,YAAY,CAAC;MAClCG,GAAG,CAAC;QACD,eAAe,EAAG,UAASL,KAAM,EAAC;QAClC,QAAQ,EAAE;MACd,CAAC,CAAC;MACDM,KAAK,CAAC;QACH,cAAc,EAACN;MACnB,CAAC,CAAC,CAACO,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC/C,CAAC,CAAC;EACN;;EAEA;EACA;AACJ;AACA;AACA;EACIoC,mBAAmBA,CAACC,OAAO,EAAE;IACzB,IAAIA,OAAO,CAACC,IAAI,IAAI,IAAI,EAAE;MACtB,OAAOT,OAAO,CAAC7B,MAAM,CAAC,IAAIuC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpE;IACA,IAAIF,OAAO,CAACC,IAAI,CAACE,kBAAkB,KAAK,QAAQ,EAAE;MAC9C,OAAOX,OAAO,CAAC7B,MAAM,CAAC,IAAIuC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3E;IACA,IAAIF,OAAO,CAACC,IAAI,CAACG,mBAAmB,IAAI,IAAI,EAAE;MAC1C,OAAOZ,OAAO,CAAC7B,MAAM,CAAC,IAAIuC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnF;IACA,OAAO,IAAI,CAACG,YAAY,CAACL,OAAO,EAAEA,OAAO,CAACC,IAAI,CAACG,mBAAmB,CAAC;EACvE;EACA;AACJ;AACA;AACA;AACA;EACIC,YAAYA,CAACC,QAAQ,EAAEf,KAAK,EAAE;IAC1B,OAAO,IAAIC,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAK;MACpC,MAAM4C,iBAAiB,GAAG,IAAI,CAACrB,QAAQ,CAACqB,iBAAiB,GAAG,IAAIb,QAAG,CAAC,IAAI,CAACR,QAAQ,CAACqB,iBAAiB,EAAE,IAAI,CAACtB,SAAS,EAAE,CAAC,GAAG,IAAIS,QAAG,CAAC,WAAW,EAAE,IAAI,CAACT,SAAS,EAAE,CAAC;MAC/J,OAAO,IAAIU,mBAAO,CAAC,MAAM,EAAEY,iBAAiB,CAAC;MACxCC,IAAI,CAAC,IAAI,CAACtB,QAAQ,CAACuB,SAAS,EAAE,IAAI,CAACvB,QAAQ,CAACwB,aAAa,CAAC;MAC1Dd,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;MACjCe,IAAI,CAAC,MAAM,CAAC;MACZC,IAAI,CAAC;QACF,iBAAiB,EAAE,cAAc;QACjC,OAAO,EAAErB;MACb,CAAC,CAAC,CAACO,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC/C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;EACKkD,SAASA,CAACC,aAAa,EAAE;IACtB,MAAMC,QAAQ,GAAG,IAAI,CAAC7B,QAAQ,CAAC8B,SAAS,GAAG,IAAItB,QAAG,CAAC,IAAI,CAACR,QAAQ,CAAC8B,SAAS,CAAC,GAAG,IAAItB,QAAG,CAAC,WAAW,EAAE,IAAI,CAACT,SAAS,EAAE,CAAC;IACpH,OAAO,IAAIO,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,OAAO,IAAIgC,mBAAO,CAAC,MAAM,EAAEoB,QAAQ,CAAC;MAC/BJ,IAAI,CAAC,MAAM,CAAC;MACZC,IAAI,CAACE,aAAa,CAAC,CAAChB,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACKsD,WAAWA,CAACC,OAAO,EAAEC,OAAO,EAAE;IAC3B,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAK;MACpC,OAAO,IAAIgC,mBAAO,CAAC,KAAK,EAAE,IAAID,QAAG,CAAE,SAAQwB,OAAQ,EAAC,EAAE,IAAI,CAAC9B,YAAY,EAAE,CAAC,CAAC;MACtEQ,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MACtDtB,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACI0D,OAAOA,CAACC,QAAQ,EAAEH,OAAO,EAAE;IACvB,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,OAAO,IAAIgC,mBAAO,CAAC,KAAK,EAAE,IAAID,QAAG,CAAC,OAAO,EAAE,IAAI,CAACN,YAAY,EAAE,CAAC,CAAC;MAC3DQ,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MACtDvB,KAAK,CAAC;QACH,SAAS,EAAG,YAAWyB,QAAS;MACpC,CAAC,CAAC;MACDxB,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACK4D,cAAcA,CAACC,KAAK,EAAEL,OAAO,EAAE;IAC5B,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,OAAO,IAAIgC,mBAAO,CAAC,KAAK,EAAE,IAAID,QAAG,CAAC,OAAO,EAAE,IAAI,CAACN,YAAY,EAAE,CAAC,CAAC;MAC3DQ,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MACtDvB,KAAK,CAAC;QACH,SAAS,EAAG,qBAAoB2B,KAAM;MAC1C,CAAC,CAAC;MACD1B,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACK8D,UAAUA,CAACxB,IAAI,EAAEkB,OAAO,EAAE;IACvB,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,IAAIsC,IAAI,CAACyB,EAAE,IAAI,IAAI,EAAE;QACjB,OAAO/D,MAAM,CAAC,IAAIgE,iBAAS,CAAC,cAAc,EAAE,wCAAwC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;MAC9G;MACA,MAAMC,OAAO,GAAG,IAAIjC,mBAAO,CAAC,KAAK,EAAE,IAAID,QAAG,CAAE,SAAQO,IAAI,CAACyB,EAAG,EAAC,EAAE,IAAI,CAACtC,YAAY,EAAE,CAAC,CAAC;MACpF,OAAOwC,OAAO,CAAChC,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MAChExB,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;MACvCgB,IAAI,CAACX,IAAI,CAAC;MACVH,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACKkE,UAAUA,CAAC5B,IAAI,EAAEkB,OAAO,EAAE;IACvB,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,MAAMiE,OAAO,GAAG,IAAIjC,mBAAO,CAAC,MAAM,EAAE,IAAID,QAAG,CAAC,OAAO,EAAE,IAAI,CAACN,YAAY,EAAE,CAAC,CAAC;MAC1E,OAAOwC,OAAO,CAAChC,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MAChExB,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC;MACvCgB,IAAI,CAACxC,MAAM,CAACC,MAAM,CAAC,CAAC,CAAC,EAAE4B,IAAI,EAAE;QAC1B6B,MAAM,EAAE,CAAC,CAAC;MACd,CAAC,CAAC,CAAC;MACFhC,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;AACA;EACKoE,UAAUA,CAAC9B,IAAI,EAAEkB,OAAO,EAAE;IACvB,OAAO,IAAI3B,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAI;MACnC,IAAIsC,IAAI,CAACyB,EAAE,IAAI,IAAI,EAAE;QACjB,OAAO/D,MAAM,CAAC,IAAIgE,iBAAS,CAAC,cAAc,EAAE,wCAAwC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;MAC9G;MACA,MAAMC,OAAO,GAAG,IAAIjC,mBAAO,CAAC,QAAQ,EAAE,IAAID,QAAG,CAAE,SAAQO,IAAI,CAACyB,EAAG,EAAC,EAAE,IAAI,CAACtC,YAAY,EAAE,CAAC,CAAC;MACvF,OAAOwC,OAAO,CAAChC,GAAG,CAAC,eAAe,EAAG,UAASuB,OAAO,CAACC,YAAa,EAAC,CAAC;MAChEtB,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC;EACN;;EAEA;AACJ;AACA;AACA;EACIqE,yBAAyBA,CAACC,KAAK,EAAE;IAC7B,IAAIA,KAAK,EAAE;MACP,IAAI,CAACC,wBAAwB,GAAG,IAAI;IACxC;IACA,IAAI,IAAI,CAACA,wBAAwB,EAAE;MAC/B,OAAO1C,OAAO,CAAC9B,OAAO,CAAC,IAAI,CAACwE,wBAAwB,CAAC;IACzD;IACA,OAAO,IAAI1C,OAAO,CAAC,CAAC9B,OAAO,EAAEC,MAAM,KAAK;MACpC,MAAMwE,4BAA4B,GAAG,IAAI,CAACjD,QAAQ,CAACiD,4BAA4B,GAAG,IAAIzC,QAAG,CAAC,IAAI,CAACR,QAAQ,CAACiD,4BAA4B,EAAE,IAAI,CAAClD,SAAS,EAAE,CAAC,GAAG,IAAIS,QAAG,CAAC,kCAAkC,EAAE,IAAI,CAACT,SAAS,EAAE,CAAC;MACvN,OAAO,IAAIU,mBAAO,CAAC,KAAK,EAAEwC,4BAA4B,CAAC;MAClDrC,GAAG,CAACrC,cAAc,CAACC,OAAO,EAAEC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAACyE,IAAI,CAAC,CAACC,aAAa,KAAK;MACvB,IAAI,CAACH,wBAAwB,GAAGG,aAAa;MAC7C,OAAOA,aAAa;IACxB,CAAC,CAAC;EACN;AACJ,CAACC,OAAA,CAAAhE,mBAAA,GAAAA,mBAAA"}

package/dist/RemoteAddressValidator.d.ts

@@ -0,0 +1,10 @@
+import { ApplicationService } from '@themost/common';
+import { Request } from 'express';
+
+export declare class RemoteAddressValidator extends ApplicationService {
+    
+    constructor(app: ApplicationService);
+    validateRemoteAddress(request: Request): Promise<boolean>;
+    getRemoteAddress(request: Request): string;
+
+}

package/dist/RemoteAddressValidator.js

@@ -0,0 +1,89 @@
+"use strict";Object.defineProperty(exports, "__esModule", { value: true });exports.RemoteAddressValidator = exports.HttpRemoteAddrForbiddenError = void 0;var _common = require("@themost/common");
+var _express = _interopRequireDefault(require("express"));
+var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));function _interopRequireDefault(obj) {return obj && obj.__esModule ? obj : { default: obj };}
+
+class HttpRemoteAddrForbiddenError extends _common.HttpForbiddenError {
+  constructor() {
+    super('Access is denied due to remote address conflict. The client network has been changed or cannot be determined.');
+    this.statusCode = 403.6;
+  }
+
+}exports.HttpRemoteAddrForbiddenError = HttpRemoteAddrForbiddenError;
+
+class RemoteAddressValidator extends _common.ApplicationService {
+  constructor(app) {
+    super(app);
+
+    // get proxy address forwarding option
+    let proxyAddressForwarding = app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding');
+    if (typeof proxyAddressForwarding !== 'boolean') {
+      proxyAddressForwarding = false;
+    }
+    this.proxyAddressForwarding = proxyAddressForwarding;
+    // get token claim name
+    this.claim = app.getConfiguration().getSourceAt('settings/universis/janitor/remoteAddress/claim') || 'remoteAddress';
+
+    app.serviceRouter.subscribe((serviceRouter) => {
+      if (serviceRouter == null) {
+        return;
+      }
+      const addRouter = _express.default.Router();
+      addRouter.use((req, res, next) => {
+        void this.validateRemoteAddress(req).then((value) => {
+          if (value === false) {
+            return next(new HttpRemoteAddrForbiddenError());
+          }
+          return next();
+        }).catch((err) => {
+          return next(err);
+        });
+      });
+      // insert router at the beginning of serviceRouter.stack
+      serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);
+    });
+  }
+
+  /**
+   * Gets remote address from request
+   * @param {import('express').Request} req 
+   * @returns 
+   */
+  getRemoteAddress(req) {
+    let remoteAddress;
+    if (this.proxyAddressForwarding) {
+      // get proxy headers or remote address
+      remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);
+    } else {
+      remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;
+    }
+    return remoteAddress;
+  }
+
+  /**
+   * Validates token remote address with request remote address
+   * @param {import('express').Request} req 
+   * @returns {Promise<boolean>}
+   */
+  async validateRemoteAddress(req) {var _req$context, _req$context$user;
+    const authenticationToken = (_req$context = req.context) === null || _req$context === void 0 ? void 0 : (_req$context$user = _req$context.user) === null || _req$context$user === void 0 ? void 0 : _req$context$user.authenticationToken;
+    if (authenticationToken != null) {
+      const access_token = _jsonwebtoken.default.decode(authenticationToken);
+      const remoteAddress = access_token[this.claim];
+      if (remoteAddress == null) {
+        _common.TraceUtils.warn(`Remote address validation failed. Expected a valid remote address claimed by using "${this.claim}" attribute but got none.`);
+        return false;
+      }
+      // get context remote address
+      const requestRemoteAddress = this.getRemoteAddress(req);
+      if (remoteAddress !== requestRemoteAddress) {
+        _common.TraceUtils.warn(`Remote address validation failed. Expected remote address is ${remoteAddress || 'Uknown'} but request remote address is ${requestRemoteAddress}`);
+        return false;
+      }
+      return true;
+    }
+    _common.TraceUtils.warn('Remote address validation cannot be completed because authentication token is not available.');
+    return false;
+  }
+
+}exports.RemoteAddressValidator = RemoteAddressValidator;
+//# sourceMappingURL=RemoteAddressValidator.js.map

package/dist/RemoteAddressValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoteAddressValidator.js","names":["_common","require","_express","_interopRequireDefault","_jsonwebtoken","obj","__esModule","default","HttpRemoteAddrForbiddenError","HttpForbiddenError","constructor","statusCode","exports","RemoteAddressValidator","ApplicationService","app","proxyAddressForwarding","getConfiguration","getSourceAt","claim","serviceRouter","subscribe","addRouter","express","Router","use","req","res","next","validateRemoteAddress","then","value","catch","err","stack","unshift","apply","getRemoteAddress","remoteAddress","headers","connection","socket","_req$context","_req$context$user","authenticationToken","context","user","access_token","jwt","decode","TraceUtils","warn","requestRemoteAddress"],"sources":["../src/RemoteAddressValidator.js"],"sourcesContent":["import { ApplicationService, HttpForbiddenError, TraceUtils } from '@themost/common';\nimport express from 'express';\nimport jwt from 'jsonwebtoken';\n\nclass HttpRemoteAddrForbiddenError extends HttpForbiddenError {\n    constructor() {\n        super('Access is denied due to remote address conflict. The client network has been changed or cannot be determined.');\n        this.statusCode = 403.6;\n    }\n    \n}\n\nclass RemoteAddressValidator extends ApplicationService {\n  constructor(app) {\n    super(app);\n\n    // get proxy address forwarding option\n    let proxyAddressForwarding = app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding');\n    if (typeof proxyAddressForwarding !== 'boolean') {\n        proxyAddressForwarding = false;\n    }\n    this.proxyAddressForwarding = proxyAddressForwarding;\n    // get token claim name\n    this.claim = app.getConfiguration().getSourceAt('settings/universis/janitor/remoteAddress/claim') || 'remoteAddress';\n\n    app.serviceRouter.subscribe((serviceRouter) => {\n        if (serviceRouter == null) {\n            return;\n        }\n        const addRouter = express.Router();\n        addRouter.use((req, res, next) => {\n            void this.validateRemoteAddress(req).then((value) => {\n                if (value === false) {\n                    return next(new HttpRemoteAddrForbiddenError());\n                }\n                return next();\n            }).catch((err) => {\n                return next(err);\n            });\n        });\n        // insert router at the beginning of serviceRouter.stack\n        serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);\n    });\n  }\n\n  /**\n   * Gets remote address from request\n   * @param {import('express').Request} req \n   * @returns \n   */\n  getRemoteAddress(req) {\n    let remoteAddress;\n    if (this.proxyAddressForwarding) {\n        // get proxy headers or remote address\n        remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);\n    } else {\n        remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;\n    }\n    return remoteAddress;\n  }\n\n  /**\n   * Validates token remote address with request remote address\n   * @param {import('express').Request} req \n   * @returns {Promise<boolean>}\n   */\n  async validateRemoteAddress(req) {\n    const authenticationToken = req.context?.user?.authenticationToken;\n    if (authenticationToken != null) {\n        const access_token = jwt.decode(authenticationToken);\n        const remoteAddress = access_token[this.claim];\n        if (remoteAddress == null) {\n            TraceUtils.warn(`Remote address validation failed. Expected a valid remote address claimed by using \"${this.claim}\" attribute but got none.`);\n            return false;\n        }\n        // get context remote address\n        const requestRemoteAddress = this.getRemoteAddress(req);\n        if (remoteAddress !== requestRemoteAddress) {\n            TraceUtils.warn(`Remote address validation failed. Expected remote address is ${remoteAddress || 'Uknown'} but request remote address is ${requestRemoteAddress}`);\n            return false;\n        }\n        return true;\n    }\n    TraceUtils.warn('Remote address validation cannot be completed because authentication token is not available.');\n    return false;\n  }\n\n}\n\nexport {\n    HttpRemoteAddrForbiddenError,\n    RemoteAddressValidator\n}\n"],"mappings":"0JAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,QAAA,GAAAC,sBAAA,CAAAF,OAAA;AACA,IAAAG,aAAA,GAAAD,sBAAA,CAAAF,OAAA,kBAA+B,SAAAE,uBAAAE,GAAA,UAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;;AAE/B,MAAMG,4BAA4B,SAASC,0BAAkB,CAAC;EAC1DC,WAAWA,CAAA,EAAG;IACV,KAAK,CAAC,+GAA+G,CAAC;IACtH,IAAI,CAACC,UAAU,GAAG,KAAK;EAC3B;;AAEJ,CAACC,OAAA,CAAAJ,4BAAA,GAAAA,4BAAA;;AAED,MAAMK,sBAAsB,SAASC,0BAAkB,CAAC;EACtDJ,WAAWA,CAACK,GAAG,EAAE;IACf,KAAK,CAACA,GAAG,CAAC;;IAEV;IACA,IAAIC,sBAAsB,GAAGD,GAAG,CAACE,gBAAgB,EAAE,CAACC,WAAW,CAAC,+CAA+C,CAAC;IAChH,IAAI,OAAOF,sBAAsB,KAAK,SAAS,EAAE;MAC7CA,sBAAsB,GAAG,KAAK;IAClC;IACA,IAAI,CAACA,sBAAsB,GAAGA,sBAAsB;IACpD;IACA,IAAI,CAACG,KAAK,GAAGJ,GAAG,CAACE,gBAAgB,EAAE,CAACC,WAAW,CAAC,gDAAgD,CAAC,IAAI,eAAe;;IAEpHH,GAAG,CAACK,aAAa,CAACC,SAAS,CAAC,CAACD,aAAa,KAAK;MAC3C,IAAIA,aAAa,IAAI,IAAI,EAAE;QACvB;MACJ;MACA,MAAME,SAAS,GAAGC,gBAAO,CAACC,MAAM,EAAE;MAClCF,SAAS,CAACG,GAAG,CAAC,CAACC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;QAC9B,KAAK,IAAI,CAACC,qBAAqB,CAACH,GAAG,CAAC,CAACI,IAAI,CAAC,CAACC,KAAK,KAAK;UACjD,IAAIA,KAAK,KAAK,KAAK,EAAE;YACjB,OAAOH,IAAI,CAAC,IAAIpB,4BAA4B,EAAE,CAAC;UACnD;UACA,OAAOoB,IAAI,EAAE;QACjB,CAAC,CAAC,CAACI,KAAK,CAAC,CAACC,GAAG,KAAK;UACd,OAAOL,IAAI,CAACK,GAAG,CAAC;QACpB,CAAC,CAAC;MACN,CAAC,CAAC;MACF;MACAb,aAAa,CAACc,KAAK,CAACC,OAAO,CAACC,KAAK,CAAChB,aAAa,CAACc,KAAK,EAAEZ,SAAS,CAACY,KAAK,CAAC;IAC3E,CAAC,CAAC;EACJ;;EAEA;AACF;AACA;AACA;AACA;EACEG,gBAAgBA,CAACX,GAAG,EAAE;IACpB,IAAIY,aAAa;IACjB,IAAI,IAAI,CAACtB,sBAAsB,EAAE;MAC7B;MACAsB,aAAa,GAAGZ,GAAG,CAACa,OAAO,CAAC,WAAW,CAAC,IAAIb,GAAG,CAACa,OAAO,CAAC,iBAAiB,CAAC,KAAKb,GAAG,CAACc,UAAU,GAAGd,GAAG,CAACc,UAAU,CAACF,aAAa,GAAGZ,GAAG,CAACe,MAAM,CAACH,aAAa,CAAC;IAC5J,CAAC,MAAM;MACHA,aAAa,GAAGZ,GAAG,CAACc,UAAU,GAAGd,GAAG,CAACc,UAAU,CAACF,aAAa,GAAGZ,GAAG,CAACe,MAAM,CAACH,aAAa;IAC5F;IACA,OAAOA,aAAa;EACtB;;EAEA;AACF;AACA;AACA;AACA;EACE,MAAMT,qBAAqBA,CAACH,GAAG,EAAE,KAAAgB,YAAA,EAAAC,iBAAA;IAC/B,MAAMC,mBAAmB,IAAAF,YAAA,GAAGhB,GAAG,CAACmB,OAAO,cAAAH,YAAA,wBAAAC,iBAAA,GAAXD,YAAA,CAAaI,IAAI,cAAAH,iBAAA,uBAAjBA,iBAAA,CAAmBC,mBAAmB;IAClE,IAAIA,mBAAmB,IAAI,IAAI,EAAE;MAC7B,MAAMG,YAAY,GAAGC,qBAAG,CAACC,MAAM,CAACL,mBAAmB,CAAC;MACpD,MAAMN,aAAa,GAAGS,YAAY,CAAC,IAAI,CAAC5B,KAAK,CAAC;MAC9C,IAAImB,aAAa,IAAI,IAAI,EAAE;QACvBY,kBAAU,CAACC,IAAI,CAAE,uFAAsF,IAAI,CAAChC,KAAM,2BAA0B,CAAC;QAC7I,OAAO,KAAK;MAChB;MACA;MACA,MAAMiC,oBAAoB,GAAG,IAAI,CAACf,gBAAgB,CAACX,GAAG,CAAC;MACvD,IAAIY,aAAa,KAAKc,oBAAoB,EAAE;QACxCF,kBAAU,CAACC,IAAI,CAAE,gEAA+Db,aAAa,IAAI,QAAS,kCAAiCc,oBAAqB,EAAC,CAAC;QAClK,OAAO,KAAK;MAChB;MACA,OAAO,IAAI;IACf;IACAF,kBAAU,CAACC,IAAI,CAAC,8FAA8F,CAAC;IAC/G,OAAO,KAAK;EACd;;AAEF,CAACvC,OAAA,CAAAC,sBAAA,GAAAA,sBAAA"}

package/dist/index.d.ts

@@ -3,3 +3,5 @@ export * from './SpeedLimitService';
 export * from './RedisClientStore';
 export * from './ScopeAccessConfiguration';
 export * from './validateScope';
+export * from './OAuth2ClientService';
+export * from './RemoteAddressValidator';

package/dist/index.js

@@ -4,4 +4,6 @@ var _SpeedLimitService = require("./SpeedLimitService");Object.keys(_SpeedLimitS
 var _RedisClientStore = require("./RedisClientStore");Object.keys(_RedisClientStore).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _RedisClientStore[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _RedisClientStore[key];} });});
 var _ScopeAccessConfiguration = require("./ScopeAccessConfiguration");Object.keys(_ScopeAccessConfiguration).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _ScopeAccessConfiguration[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _ScopeAccessConfiguration[key];} });});
 var _validateScope = require("./validateScope");Object.keys(_validateScope).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _validateScope[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _validateScope[key];} });});
+var _OAuth2ClientService = require("./OAuth2ClientService");Object.keys(_OAuth2ClientService).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _OAuth2ClientService[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _OAuth2ClientService[key];} });});
+var _RemoteAddressValidator = require("./RemoteAddressValidator");Object.keys(_RemoteAddressValidator).forEach(function (key) {if (key === "default" || key === "__esModule") return;if (key in exports && exports[key] === _RemoteAddressValidator[key]) return;Object.defineProperty(exports, key, { enumerable: true, get: function () {return _RemoteAddressValidator[key];} });});
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["require","_RateLimitService","Object","keys","forEach","key","exports","defineProperty","enumerable","get","_SpeedLimitService","_RedisClientStore","_ScopeAccessConfiguration","_validateScope"],"sources":["../src/index.js"],"sourcesContent":["import './polyfills';\nexport * from './RateLimitService';\nexport * from './SpeedLimitService';\nexport * from './RedisClientStore';\nexport * from './ScopeAccessConfiguration';\nexport * from './validateScope';\n"],"mappings":"2EAAAA,OAAA;AACA,IAAAC,iBAAA,GAAAD,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAF,iBAAA,EAAAG,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAJ,iBAAA,CAAAI,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAR,iBAAA,CAAAI,GAAA;AACA,IAAAK,kBAAA,GAAAV,OAAA,wBAAAE,MAAA,CAAAC,IAAA,CAAAO,kBAAA,EAAAN,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAK,kBAAA,CAAAL,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAC,kBAAA,CAAAL,GAAA;AACA,IAAAM,iBAAA,GAAAX,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAQ,iBAAA,EAAAP,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAM,iBAAA,CAAAN,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAE,iBAAA,CAAAN,GAAA;AACA,IAAAO,yBAAA,GAAAZ,OAAA,+BAAAE,MAAA,CAAAC,IAAA,CAAAS,yBAAA,EAAAR,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAO,yBAAA,CAAAP,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAG,yBAAA,CAAAP,GAAA;AACA,IAAAQ,cAAA,GAAAb,OAAA,oBAAAE,MAAA,CAAAC,IAAA,CAAAU,cAAA,EAAAT,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAQ,cAAA,CAAAR,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAI,cAAA,CAAAR,GAAA"}
+{"version":3,"file":"index.js","names":["require","_RateLimitService","Object","keys","forEach","key","exports","defineProperty","enumerable","get","_SpeedLimitService","_RedisClientStore","_ScopeAccessConfiguration","_validateScope","_OAuth2ClientService","_RemoteAddressValidator"],"sources":["../src/index.js"],"sourcesContent":["import './polyfills';\nexport * from './RateLimitService';\nexport * from './SpeedLimitService';\nexport * from './RedisClientStore';\nexport * from './ScopeAccessConfiguration';\nexport * from './validateScope';\nexport * from './OAuth2ClientService';\nexport * from './RemoteAddressValidator';\n"],"mappings":"2EAAAA,OAAA;AACA,IAAAC,iBAAA,GAAAD,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAF,iBAAA,EAAAG,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAJ,iBAAA,CAAAI,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAR,iBAAA,CAAAI,GAAA;AACA,IAAAK,kBAAA,GAAAV,OAAA,wBAAAE,MAAA,CAAAC,IAAA,CAAAO,kBAAA,EAAAN,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAK,kBAAA,CAAAL,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAC,kBAAA,CAAAL,GAAA;AACA,IAAAM,iBAAA,GAAAX,OAAA,uBAAAE,MAAA,CAAAC,IAAA,CAAAQ,iBAAA,EAAAP,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAM,iBAAA,CAAAN,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAE,iBAAA,CAAAN,GAAA;AACA,IAAAO,yBAAA,GAAAZ,OAAA,+BAAAE,MAAA,CAAAC,IAAA,CAAAS,yBAAA,EAAAR,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAO,yBAAA,CAAAP,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAG,yBAAA,CAAAP,GAAA;AACA,IAAAQ,cAAA,GAAAb,OAAA,oBAAAE,MAAA,CAAAC,IAAA,CAAAU,cAAA,EAAAT,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAQ,cAAA,CAAAR,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAI,cAAA,CAAAR,GAAA;AACA,IAAAS,oBAAA,GAAAd,OAAA,0BAAAE,MAAA,CAAAC,IAAA,CAAAW,oBAAA,EAAAV,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAS,oBAAA,CAAAT,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAK,oBAAA,CAAAT,GAAA;AACA,IAAAU,uBAAA,GAAAf,OAAA,6BAAAE,MAAA,CAAAC,IAAA,CAAAY,uBAAA,EAAAX,OAAA,WAAAC,GAAA,OAAAA,GAAA,kBAAAA,GAAA,8BAAAA,GAAA,IAAAC,OAAA,IAAAA,OAAA,CAAAD,GAAA,MAAAU,uBAAA,CAAAV,GAAA,UAAAH,MAAA,CAAAK,cAAA,CAAAD,OAAA,EAAAD,GAAA,IAAAG,UAAA,QAAAC,GAAA,WAAAA,CAAA,UAAAM,uBAAA,CAAAV,GAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universis/janitor",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Universis api plugin for rate limiting requests",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,7 +32,9 @@
     "express-rate-limit": "^7.1.1",
     "express-slow-down": "^1.6.0",
     "ioredis": "^5.3.2",
-    "rate-limit-redis": "^4.2.0"
+    "jsonwebtoken": "^9.0.2",
+    "rate-limit-redis": "^4.2.0",
+    "superagent": "^8.1.2"
   },
   "peerDependencies": {
     "@themost/common": "^2",

package/src/OAuth2ClientService.d.ts

@@ -0,0 +1,98 @@
+import { ApplicationService, ApplicationBase } from '@themost/common';
+import { DataContext } from '@themost/data';
+
+export declare interface OAuth2MethodOptions {
+    access_token: string;
+}
+
+export declare interface OAuth2AuthorizeUser {
+    client_id?: string;
+    client_secret?: string;
+    username: string;
+    password: string;
+    grant_type: string;
+    scope?: string;
+}
+
+export declare interface OAuth2ServiceSettings {
+    unattendedExecutionAccount?: string;
+    client_id: string;
+    client_secret?: string;
+    server_uri: string;
+    userinfo_uri?: string;
+    introspect_uri?: string;
+    admin_uri?: string;
+    well_known_configuration_uri?: string;
+    adminAccount: {
+        username: string;
+        password: string;
+        client_id: string;
+        client_secret?: string;
+        scope?: string;
+    }
+}
+
+export declare interface OAuth2UserProfile {
+    sub: string;
+    name: string;
+    preferred_username: string;
+    given_name: string;
+    family_name: string;
+    email: string;
+}
+
+export declare interface GenericUser {
+     id?: any; 
+     additionalType?: string; 
+     alternateName?: string; 
+     description?: string; 
+     givenName?: string; 
+     familyName?: string; 
+     image?: string; 
+     name?: string; 
+     url?: string; 
+     dateCreated?: Date; 
+     dateModified?: Date; 
+     createdBy?: any; 
+     modifiedBy?: any; 
+     lockoutTime?: Date; 
+     logonCount?: number; 
+     enabled?: boolean; 
+     lastLogon?: Date; 
+     userCredentials?: {
+         userPassword?: string;
+         userActivated?: boolean;
+         temporary?: boolean;
+     }
+}
+
+export declare interface OAuth2User {
+    id?: any; 
+    username?: string; 
+    email?: string; 
+    enabled?: boolean;
+    emailVerified?: boolean;
+    firstName?: string; 
+    lastName?: string; 
+    credentials?: {
+        algorithm?: string,
+        temporary?: boolean,
+        type?: string,
+        value?: string
+    }
+}
+
+export declare class OAuth2ClientService extends ApplicationService {
+    get settings(): OAuth2ServiceSettings;
+    constructor(app: ApplicationBase)
+    getUserInfo(context: DataContext, token: string): Promise<OAuth2UserProfile>;
+    getTokenInfo(context: DataContext, token: string): Promise<any>;
+    getContextTokenInfo(context: DataContext): Promise<any>;
+    authorize(authorizeUser: OAuth2AuthorizeUser): Promise<{ access_token?: string, refresh_token?: string}>;
+    getUser(username: string, options: OAuth2MethodOptions): Promise<any>;
+    getUserById(user_id: any, options: OAuth2MethodOptions): Promise<any>;
+    getUserByEmail(email: string, options: OAuth2MethodOptions): Promise<any>;
+    updateUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    createUser(user: GenericUser | any, options: OAuth2MethodOptions): Promise<any>;
+    deleteUser(user: { id: any }, options: OAuth2MethodOptions): Promise<any>; 
+}

package/src/OAuth2ClientService.js

@@ -0,0 +1,255 @@
+import {Request} from 'superagent'
+import {URL} from 'url';
+import {ApplicationService, DataError, HttpError} from '@themost/common';
+
+function responseHander(resolve, reject) {
+    return function (err, response) {
+        if (err) {
+            /**
+             * @type {import('superagent').Response}
+             */
+            const response = err.response
+            if (response && response.headers['content-type'] === 'application/json') {
+                // get body
+                const clientError = response.body;
+                const error = new HttpError(response.status);
+                return reject(Object.assign(error, {
+                    clientError
+                }));
+            }
+            return reject(err);
+        }
+        if (response.status === 204 && response.headers['content-type'] === 'application/json') {
+            return resolve(null);
+        }
+        return resolve(response.body);
+    };
+}
+
+/**
+ * @class
+ */
+class OAuth2ClientService extends ApplicationService {
+    /**
+     * @param {import('@themost/express').ExpressDataApplication} app
+     */
+    constructor(app) {
+        super(app);
+        /**
+         * @name OAuth2ClientService#settings
+         * @type {{server_uri:string,token_uri?:string}}
+         */
+         Object.defineProperty(this, 'settings', {
+            writable: false,
+            value: app.getConfiguration().getSourceAt('settings/auth'),
+            enumerable: false,
+            configurable: false
+        });
+    }
+
+    /**
+     * Gets keycloak server root
+     * @returns {string}
+     */
+     getServer() {
+        return this.settings.server_uri;
+    }
+
+    /**
+     * Gets keycloak server root
+     * @returns {string}
+     */
+     getAdminRoot() {
+        return this.settings.admin_uri;
+    }
+
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Gets user's profile by calling OAuth2 server profile endpoint
+     * @param {ExpressDataContext} context
+     * @param {string} token
+     */
+    getUserInfo(token) {
+        return new Promise((resolve, reject) => {
+            const userinfo_uri = this.settings.userinfo_uri ? new URL(this.settings.userinfo_uri, this.getServer()) : new URL('me', this.getServer());
+            return new Request('GET', userinfo_uri)
+                .set({
+                    'Authorization': `Bearer ${token}`,
+                    'Accept': 'application/json'
+                })
+                .query({
+                    'access_token':token
+                }).end(responseHander(resolve, reject));
+        });
+    }
+
+    // noinspection JSUnusedGlobalSymbols
+    /**
+     * Gets the token info of the current context
+     * @param {ExpressDataContext} context
+     */
+    getContextTokenInfo(context) {
+        if (context.user == null) {
+            return Promise.reject(new Error('Context user may not be null'));
+        }
+        if (context.user.authenticationType !== 'Bearer') {
+            return Promise.reject(new Error('Invalid context authentication type'));
+        }
+        if (context.user.authenticationToken == null) {
+            return Promise.reject(new Error('Context authentication data may not be null'));
+        }
+        return this.getTokenInfo(context, context.user.authenticationToken);
+    }
+    /**
+     * Gets token info by calling OAuth2 server endpoint
+     * @param {ExpressDataContext} _context
+     * @param {string} token
+     */
+    getTokenInfo(_context, token) {
+        return new Promise((resolve, reject) => {
+            const introspection_uri = this.settings.introspection_uri ? new URL(this.settings.introspection_uri, this.getServer()) : new URL('tokeninfo', this.getServer());
+            return new Request('POST', introspection_uri)
+                .auth(this.settings.client_id, this.settings.client_secret)
+                .set('Accept', 'application/json')
+                .type('form')
+                .send({
+                    'token_type_hint': 'access_token',
+                    'token': token,
+                }).end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * @param {AuthorizeUser} authorizeUser
+     */
+     authorize(authorizeUser) {
+        const tokenURL = this.settings.token_uri ? new URL(this.settings.token_uri) : new URL('authorize', this.getServer());
+        return new Promise((resolve, reject)=> {
+            return new Request('POST', tokenURL)
+                .type('form')
+                .send(authorizeUser).end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by name
+     * @param {*} user_id 
+     * @param {AdminMethodOptions} options 
+     */
+     getUserById(user_id, options) {
+        return new Promise((resolve, reject) => {
+            return new Request('GET', new URL(`users/${user_id}`, this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by name
+     * @param {string} username 
+     * @param {AdminMethodOptions} options 
+     */
+    getUser(username, options) {
+        return new Promise((resolve, reject)=> {
+            return new Request('GET', new URL('users', this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .query({
+                    '$filter': `name eq '${username}'`
+                })
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Gets a user by email address
+     * @param {string} email 
+     * @param {AdminMethodOptions} options 
+     */
+     getUserByEmail(email, options) {
+        return new Promise((resolve, reject)=> {
+            return new Request('GET', new URL('users', this.getAdminRoot()))
+                .set('Authorization', `Bearer ${options.access_token}`)
+                .query({
+                    '$filter': `alternateName eq '${email}'`
+                })
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Updates an existing user
+     * @param {*} user 
+     * @param {AdminMethodOptions} options 
+     */
+     updateUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            if (user.id == null) {
+                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+            }
+            const request = new Request('PUT', new URL(`users/${user.id}`, this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .set('Content-Type', 'application/json')
+                .send(user)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Creates a new user
+     * @param {*} user 
+     * @param {AdminMethodOptions} options 
+     */
+     createUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            const request = new Request('POST', new URL('users', this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .set('Content-Type', 'application/json')
+                .send(Object.assign({}, user, {
+                    $state: 1 // for create
+                }))
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * Deletes a user
+     * @param {{id: any}} user 
+     * @param {AdminMethodOptions} options 
+     */
+     deleteUser(user, options) {
+        return new Promise((resolve, reject)=> {
+            if (user.id == null) {
+                return reject(new DataError('E_IDENTIFIER', 'User may not be empty at this context.', null, 'User', 'id'));
+            }
+            const request = new Request('DELETE', new URL(`users/${user.id}`, this.getAdminRoot()));
+            return request.set('Authorization', `Bearer ${options.access_token}`)
+                .end(responseHander(resolve, reject));
+        });
+    }
+
+    /**
+     * @param {boolean=} force 
+     * @returns {*}
+     */
+    getWellKnownConfiguration(force) {
+        if (force) {
+            this.well_known_configuration = null;
+        }
+        if (this.well_known_configuration) {
+            return Promise.resolve(this.well_known_configuration);
+        }
+        return new Promise((resolve, reject) => {
+            const well_known_configuration_uri = this.settings.well_known_configuration_uri ? new URL(this.settings.well_known_configuration_uri, this.getServer()) : new URL('.well-known/openid-configuration', this.getServer());
+            return new Request('GET', well_known_configuration_uri)
+                .end(responseHander(resolve, reject));
+        }).then((configuration) => {
+            this.well_known_configuration = configuration;
+            return configuration;
+        });
+    }
+}
+
+export {
+    OAuth2ClientService
+}
+

package/src/RemoteAddressValidator.d.ts

@@ -0,0 +1,10 @@
+import { ApplicationService } from '@themost/common';
+import { Request } from 'express';
+
+export declare class RemoteAddressValidator extends ApplicationService {
+    
+    constructor(app: ApplicationService);
+    validateRemoteAddress(request: Request): Promise<boolean>;
+    getRemoteAddress(request: Request): string;
+
+}

package/src/RemoteAddressValidator.js

@@ -0,0 +1,93 @@
+import { ApplicationService, HttpForbiddenError, TraceUtils } from '@themost/common';
+import express from 'express';
+import jwt from 'jsonwebtoken';
+
+class HttpRemoteAddrForbiddenError extends HttpForbiddenError {
+    constructor() {
+        super('Access is denied due to remote address conflict. The client network has been changed or cannot be determined.');
+        this.statusCode = 403.6;
+    }
+    
+}
+
+class RemoteAddressValidator extends ApplicationService {
+  constructor(app) {
+    super(app);
+
+    // get proxy address forwarding option
+    let proxyAddressForwarding = app.getConfiguration().getSourceAt('settings/universis/api/proxyAddressForwarding');
+    if (typeof proxyAddressForwarding !== 'boolean') {
+        proxyAddressForwarding = false;
+    }
+    this.proxyAddressForwarding = proxyAddressForwarding;
+    // get token claim name
+    this.claim = app.getConfiguration().getSourceAt('settings/universis/janitor/remoteAddress/claim') || 'remoteAddress';
+
+    app.serviceRouter.subscribe((serviceRouter) => {
+        if (serviceRouter == null) {
+            return;
+        }
+        const addRouter = express.Router();
+        addRouter.use((req, res, next) => {
+            void this.validateRemoteAddress(req).then((value) => {
+                if (value === false) {
+                    return next(new HttpRemoteAddrForbiddenError());
+                }
+                return next();
+            }).catch((err) => {
+                return next(err);
+            });
+        });
+        // insert router at the beginning of serviceRouter.stack
+        serviceRouter.stack.unshift.apply(serviceRouter.stack, addRouter.stack);
+    });
+  }
+
+  /**
+   * Gets remote address from request
+   * @param {import('express').Request} req 
+   * @returns 
+   */
+  getRemoteAddress(req) {
+    let remoteAddress;
+    if (this.proxyAddressForwarding) {
+        // get proxy headers or remote address
+        remoteAddress = req.headers['x-real-ip'] || req.headers['x-forwarded-for'] || (req.connection ? req.connection.remoteAddress : req.socket.remoteAddress);
+    } else {
+        remoteAddress = req.connection ? req.connection.remoteAddress : req.socket.remoteAddress;
+    }
+    return remoteAddress;
+  }
+
+  /**
+   * Validates token remote address with request remote address
+   * @param {import('express').Request} req 
+   * @returns {Promise<boolean>}
+   */
+  async validateRemoteAddress(req) {
+    const authenticationToken = req.context?.user?.authenticationToken;
+    if (authenticationToken != null) {
+        const access_token = jwt.decode(authenticationToken);
+        const remoteAddress = access_token[this.claim];
+        if (remoteAddress == null) {
+            TraceUtils.warn(`Remote address validation failed. Expected a valid remote address claimed by using "${this.claim}" attribute but got none.`);
+            return false;
+        }
+        // get context remote address
+        const requestRemoteAddress = this.getRemoteAddress(req);
+        if (remoteAddress !== requestRemoteAddress) {
+            TraceUtils.warn(`Remote address validation failed. Expected remote address is ${remoteAddress || 'Uknown'} but request remote address is ${requestRemoteAddress}`);
+            return false;
+        }
+        return true;
+    }
+    TraceUtils.warn('Remote address validation cannot be completed because authentication token is not available.');
+    return false;
+  }
+
+}
+
+export {
+    HttpRemoteAddrForbiddenError,
+    RemoteAddressValidator
+}

package/src/index.d.ts

@@ -3,3 +3,5 @@ export * from './SpeedLimitService';
 export * from './RedisClientStore';
 export * from './ScopeAccessConfiguration';
 export * from './validateScope';
+export * from './OAuth2ClientService';
+export * from './RemoteAddressValidator';

package/src/index.js

@@ -4,3 +4,5 @@ export * from './SpeedLimitService';
 export * from './RedisClientStore';
 export * from './ScopeAccessConfiguration';
 export * from './validateScope';
+export * from './OAuth2ClientService';
+export * from './RemoteAddressValidator';