@wazobiatech/auth-middleware 1.0.0

package/dist/nestjs/guards/project.guard.js

@@ -0,0 +1,352 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var ProjectAuthGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jwt = __importStar(require("jsonwebtoken"));
+const axios_1 = __importDefault(require("axios"));
+const jose = __importStar(require("node-jose"));
+const crypto = __importStar(require("crypto"));
+const redis_connection_1 = __importDefault(require("../../utils/redis.connection"));
+let ProjectAuthGuard = ProjectAuthGuard_1 = class ProjectAuthGuard {
+    constructor() {
+        this.logger = new common_1.Logger(ProjectAuthGuard_1.name);
+        this.jwksCacheKey = 'project_jwks_cache';
+        this.jwksCacheTTL = 18000; // 5 hours in seconds
+    }
+    async canActivate(context) {
+        try {
+            // Handle both HTTP and GraphQL contexts
+            const request = this.getRequest(context);
+            if (!request || !request.headers) {
+                this.logger.error('Request or headers not available');
+                throw new common_1.UnauthorizedException('Request context not available');
+            }
+            // Extract project token from header
+            const authHeader = request.headers['x-project-token'];
+            if (!authHeader) {
+                this.logger.warn('Missing x-project-token header');
+                this.logger.debug('Available headers:', Object.keys(request.headers));
+                throw new common_1.UnauthorizedException('Missing project token header (x-project-token)');
+            }
+            // Handle Bearer prefix
+            const token = authHeader.startsWith('Bearer ')
+                ? authHeader.slice(7)
+                : authHeader;
+            if (!token) {
+                this.logger.warn('Empty project token after extraction');
+                throw new common_1.UnauthorizedException('Empty project token');
+            }
+            // Validate project token using cached JWKS
+            const validation = await this.validateProjectToken(token);
+            if (!validation.isValid) {
+                this.logger.warn(`Token validation failed: ${validation.error}`);
+                throw new common_1.UnauthorizedException(`Invalid project token: ${validation.error}`);
+            }
+            // Check if current service is enabled
+            const serviceId = process.env.SERVICE_ID;
+            if (!serviceId) {
+                this.logger.error('SERVICE_ID environment variable not configured');
+                throw new common_1.UnauthorizedException('Service ID not configured');
+            }
+            const hasAccess = validation.payload.enabled_services.includes(serviceId);
+            if (!hasAccess) {
+                this.logger.warn(`Service access denied - Service: ${serviceId}, Enabled: [${validation.payload.enabled_services.join(', ')}]`);
+                throw new common_1.UnauthorizedException(`Service '${serviceId}' not enabled for project ${validation.payload.project_uuid}`);
+            }
+            // Inject project context into request (no user context)
+            const projectContext = {
+                project_uuid: validation.payload.project_uuid,
+                enabled_services: validation.payload.enabled_services,
+                secret_version: validation.payload.secret_version,
+                token_id: validation.payload.token_id,
+                expires_at: validation.payload.exp
+            };
+            request.project = projectContext;
+            this.logger.log(`Authentication successful for project: ${projectContext.project_uuid}, service: ${serviceId}`);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException) {
+                throw error;
+            }
+            this.logger.error('Project authentication failed:', error.message);
+            throw new common_1.UnauthorizedException('Authentication service error');
+        }
+    }
+    /**
+     * Extract request object from different NestJS contexts
+     */
+    getRequest(context) {
+        const contextType = context.getType();
+        if (contextType === 'graphql') {
+            // GraphQL context
+            const gqlContext = context.getArgByIndex(2);
+            return gqlContext?.req || gqlContext?.request;
+        }
+        else {
+            // HTTP context
+            return context.switchToHttp().getRequest();
+        }
+    }
+    /**
+     * Validate project token using cached JWKS + RSA verification
+     */
+    async validateProjectToken(token) {
+        try {
+            // Get public key from cached JWKS
+            const publicKey = await this.getPublicKeyFromCache(token);
+            // Verify JWT with RSA public key
+            const verified = jwt.verify(token, publicKey, {
+                algorithms: ['RS512'],
+                ignoreExpiration: false,
+            });
+            if (typeof verified !== 'object' || verified === null) {
+                return {
+                    isValid: false,
+                    error: 'Invalid token payload'
+                };
+            }
+            const payload = verified;
+            // Validate project token structure
+            if (!payload.project_uuid || !payload.token_id || !Array.isArray(payload.enabled_services)) {
+                return {
+                    isValid: false,
+                    error: 'Invalid project token structure'
+                };
+            }
+            const currentSecretVersion = await this.getCurrentProjectSecretVersion(payload.project_uuid);
+            if (currentSecretVersion > 0 && payload.secret_version < currentSecretVersion) {
+                return {
+                    isValid: false,
+                    error: `Token secret version outdated (token: ${payload.secret_version}, current: ${currentSecretVersion}) - re-authentication required`
+                };
+            }
+            // Check if token is in Redis cache (for revocation)
+            const redis = await redis_connection_1.default.getInstance();
+            const tokenExists = await redis.sendCommand([
+                'EXISTS',
+                `project_token:${payload.token_id}`
+            ]);
+            if (tokenExists === 0) {
+                return {
+                    isValid: false,
+                    error: 'Token has been revoked'
+                };
+            }
+            return {
+                isValid: true,
+                payload
+            };
+        }
+        catch (error) {
+            this.logger.error('Token validation error:', error.message);
+            return {
+                isValid: false,
+                error: error instanceof Error ? error.message : 'Token validation failed'
+            };
+        }
+    }
+    /**
+     * Get RSA public key from cached JWKS (with 5+ hour caching)
+     */
+    async getPublicKeyFromCache(token) {
+        try {
+            // Extract kid from JWT header
+            const header = this.decodeJwtHeader(token);
+            if (!header.kid) {
+                throw new Error('Missing key ID in token header');
+            }
+            // Check Redis for cached JWKS
+            const redis = await redis_connection_1.default.getInstance();
+            const cachedJwks = await redis.sendCommand([
+                'GET',
+                this.jwksCacheKey
+            ]);
+            let keyStore;
+            if (cachedJwks) {
+                this.logger.debug('Using cached JWKS');
+                const jwksData = JSON.parse(cachedJwks);
+                keyStore = await jose.JWK.asKeyStore(jwksData);
+            }
+            else {
+                this.logger.log('JWKS cache miss - fetching from Mercury');
+                keyStore = await this.fetchAndCacheJWKS();
+            }
+            // Get the specific key
+            const key = keyStore.get(header.kid);
+            if (!key) {
+                throw new Error(`Key ${header.kid} not found in JWKS`);
+            }
+            // Return PEM format public key
+            return key.toPEM(false);
+        }
+        catch (error) {
+            this.logger.error('Failed to get public key:', error.message);
+            throw new Error(`Failed to get public key: ${error.message}`);
+        }
+    }
+    /**
+   * Get current project secret version from Redis (cached by Mercury)
+   */
+    async getCurrentProjectSecretVersion(projectUuid) {
+        try {
+            const redis = await redis_connection_1.default.getInstance();
+            const cacheKey = `project_secret_version:${projectUuid}`;
+            const cachedVersion = await redis.sendCommand([
+                'GET', cacheKey
+            ]);
+            if (cachedVersion) {
+                return parseInt(cachedVersion, 10);
+            }
+            // If not in Redis, this means Mercury hasn't cached it yet
+            // This shouldn't happen in normal flow, but fallback to allowing the token
+            // Mercury's Kafka handler will eventually populate this
+            return 0; // Default to allow if version not found
+        }
+        catch (error) {
+            throw new Error(`Failed to get project secret version: ${error.message}`);
+        }
+    }
+    /**
+     * Fetch JWKS from Mercury and cache in Redis
+     */
+    async fetchAndCacheJWKS() {
+        try {
+            const path = 'auth/project/.well-known/jwks.json';
+            const jwksUri = `${process.env.MERCURY_BASE_URL}/${path}`;
+            const timestamp = Date.now().toString();
+            const signatureInput = 'GET' + `/${path}` + timestamp;
+            const sharedSecret = process.env.SIGNATURE_SHARED_SECRET || '';
+            const signature = crypto
+                .createHmac('sha256', sharedSecret)
+                .update(signatureInput)
+                .digest('hex');
+            const headers = {
+                Accept: 'application/json',
+                'User-Agent': 'Node-JWT-Strategy/1.0',
+                'X-Timestamp': timestamp,
+                'X-Signature': signature,
+            };
+            this.logger.log(`Fetching JWKS from: ${jwksUri}`);
+            const response = await axios_1.default.get(jwksUri, {
+                timeout: 10000,
+                headers,
+            });
+            if (!response.data || !response.data.keys) {
+                throw new Error('Invalid JWKS response');
+            }
+            // Cache JWKS in Redis for 5+ hours
+            const redis = await redis_connection_1.default.getInstance();
+            await redis.sendCommand([
+                'SETEX',
+                this.jwksCacheKey,
+                this.jwksCacheTTL.toString(),
+                JSON.stringify(response.data)
+            ]);
+            this.logger.log(`JWKS cached successfully for ${this.jwksCacheTTL} seconds`);
+            // Create and return key store
+            return await jose.JWK.asKeyStore(response.data);
+        }
+        catch (error) {
+            this.logger.error('Failed to fetch JWKS:', error.message);
+            if (axios_1.default.isAxiosError(error)) {
+                if (error.code === 'ECONNREFUSED') {
+                    throw new Error('Mercury service unavailable');
+                }
+                else if (error.code === 'ETIMEDOUT') {
+                    throw new Error('Mercury service timeout');
+                }
+                else if (error.response) {
+                    throw new Error(`Mercury returned ${error.response.status}: ${error.response.statusText}`);
+                }
+            }
+            throw new Error(`Failed to fetch JWKS: ${error.message}`);
+        }
+    }
+    /**
+     * Decode JWT header to extract kid
+     */
+    decodeJwtHeader(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            throw new Error('Invalid JWT format');
+        }
+        const headerJson = Buffer.from(parts[0], 'base64').toString();
+        return JSON.parse(headerJson);
+    }
+    /**
+     * Update JWKS cache TTL (can be increased beyond 5 hours)
+     */
+    setCacheTTL(seconds) {
+        this.jwksCacheTTL = seconds;
+        this.logger.log(`JWKS cache TTL updated to ${seconds} seconds`);
+    }
+    /**
+     * Manually refresh JWKS cache
+     */
+    async refreshJWKSCache() {
+        this.logger.log('Manually refreshing JWKS cache');
+        await this.fetchAndCacheJWKS();
+    }
+    /**
+     * Cleanup Redis connection (called on app shutdown)
+     */
+    async onApplicationShutdown() {
+        const redis = await redis_connection_1.default.getInstance();
+        if (redis) {
+            await redis.quit();
+        }
+    }
+};
+exports.ProjectAuthGuard = ProjectAuthGuard;
+exports.ProjectAuthGuard = ProjectAuthGuard = ProjectAuthGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], ProjectAuthGuard);
+//# sourceMappingURL=project.guard.js.map

package/dist/nestjs/guards/project.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.guard.js","sourceRoot":"","sources":["../../../src/nestjs/guards/project.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAMwB;AAExB,kDAAoC;AACpC,kDAA0B;AAC1B,gDAAkC;AAClC,+CAAiC;AACjC,oFAAkE;AAG3D,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAK3B;QAJiB,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;QACpD,iBAAY,GAAG,oBAAoB,CAAC;QACpC,iBAAY,GAAG,KAAK,CAAC,CAAC,qBAAqB;IAEnC,CAAC;IAEjB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,wCAAwC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAEzC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACtD,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;YAED,oCAAoC;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAW,CAAC;YAEhE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;gBACnD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtE,MAAM,IAAI,8BAAqB,CAAC,gDAAgD,CAAC,CAAC;YACpF,CAAC;YAED,uBAAuB;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC,UAAU,CAAC;YAEf,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACzD,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;YACzD,CAAC;YAED,2CAA2C;YAC3C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE1D,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;gBACjE,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,sCAAsC;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YACzC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACpE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAQ,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,SAAS,eAAe,UAAU,CAAC,OAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/G,CAAC;gBACF,MAAM,IAAI,8BAAqB,CAC7B,YAAY,SAAS,6BAA6B,UAAU,CAAC,OAAQ,CAAC,YAAY,EAAE,CACrF,CAAC;YACJ,CAAC;YAED,wDAAwD;YACxD,MAAM,cAAc,GAAmB;gBACrC,YAAY,EAAE,UAAU,CAAC,OAAQ,CAAC,YAAY;gBAC9C,gBAAgB,EAAE,UAAU,CAAC,OAAQ,CAAC,gBAAgB;gBACtD,cAAc,EAAE,UAAU,CAAC,OAAQ,CAAC,cAAc;gBAClD,QAAQ,EAAE,UAAU,CAAC,OAAQ,CAAC,QAAQ;gBACtC,UAAU,EAAE,UAAU,CAAC,OAAQ,CAAC,GAAG;aACpC,CAAC;YAEF,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC;YAEjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,cAAc,CAAC,YAAY,cAAc,SAAS,EAAE,CAC/F,CAAC;YAEF,OAAO,IAAI,CAAC;QAEd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,OAAyB;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAY,CAAC;QAEhD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,kBAAkB;YAClB,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO,UAAU,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,eAAe;YACf,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,oBAAoB,CAAC,KAAa;QAK9C,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAE1D,iCAAiC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;gBAC5C,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,gBAAgB,EAAE,KAAK;aACxB,CAAC,CAAC;YAEH,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,uBAAuB;iBAC/B,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,QAA+B,CAAC;YAEhD,mCAAmC;YACnC,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC3F,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,iCAAiC;iBACzC,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,oBAAoB,GAAG,CAAC,IAAI,OAAO,CAAC,cAAc,GAAG,oBAAoB,EAAE,CAAC;gBAC9E,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,yCAAyC,OAAO,CAAC,cAAc,cAAc,oBAAoB,gCAAgC;iBACzI,CAAC;YACJ,CAAC;YAED,oDAAoD;YACpD,MAAM,KAAK,GAAG,MAAM,0BAAsB,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;gBAC1C,QAAQ;gBACR,iBAAiB,OAAO,CAAC,QAAQ,EAAE;aACpC,CAAW,CAAC;YAEb,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,wBAAwB;iBAChC,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO;aACR,CAAC;QAEJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB;aAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB,CAAC,KAAa;QAC/C,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,8BAA8B;YAC9B,MAAM,KAAK,GAAG,MAAM,0BAAsB,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;gBACzC,KAAK;gBACL,IAAI,CAAC,YAAY;aAClB,CAAkB,CAAC;YAEpB,IAAI,QAA2B,CAAC;YAEhC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxC,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;gBAC3D,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5C,CAAC;YAED,uBAAuB;YACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAA6B,CAAC;YACjE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAC;YACzD,CAAC;YAED,+BAA+B;YAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED;;KAEC;IACO,KAAK,CAAC,8BAA8B,CAAC,WAAmB;QAC9D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,0BAAsB,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,QAAQ,GAAG,0BAA0B,WAAW,EAAE,CAAC;YAEzD,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC;gBAC5C,KAAK,EAAE,QAAQ;aAChB,CAAkB,CAAC;YAEpB,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,2DAA2D;YAC3D,2EAA2E;YAC3E,wDAAwD;YACxD,OAAO,CAAC,CAAC,CAAC,wCAAwC;QAEpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,oCAAoC,CAAA;YACjD,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,IAAI,EAAE,GAAG,SAAS,CAAC;YACtD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC;YAE/D,MAAM,SAAS,GAAG,MAAM;iBACrB,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;iBAClC,MAAM,CAAC,cAAc,CAAC;iBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,OAAO,GAAG;gBACd,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,uBAAuB;gBACrC,aAAa,EAAE,SAAS;gBACxB,aAAa,EAAE,SAAS;aACzB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;YAElD,MAAM,QAAQ,GAAG,MAAM,eAAK,CAAC,GAAG,CAA0C,OAAO,EAAE;gBACjF,OAAO,EAAE,KAAK;gBACd,OAAO;aACR,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,mCAAmC;YACnC,MAAM,KAAK,GAAG,MAAM,0BAAsB,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC,WAAW,CAAC;gBACtB,OAAO;gBACP,IAAI,CAAC,YAAY;gBACjB,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE;gBAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,IAAI,CAAC,YAAY,UAAU,CAAC,CAAC;YAE7E,8BAA8B;YAC9B,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAElD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAE1D,IAAI,eAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;gBACjD,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;gBAC7C,CAAC;qBAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,KAAa;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAe;QACzB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,OAAO,UAAU,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB;QACzB,MAAM,KAAK,GAAG,MAAM,0BAAsB,CAAC,WAAW,EAAE,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;CACF,CAAA;AA5VY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;;GACA,gBAAgB,CA4V5B"}

package/dist/nestjs/index.d.ts

@@ -0,0 +1,6 @@
+export { JwtAuthModule } from './jwt-auth.module';
+export { JwtStrategy } from './strategies/jwt-strategy';
+export { JwtAuthGuard } from './guards/jwt-guard';
+export { ProjectAuthGuard } from './guards/project.guard';
+export { ProjectAndUserAuth } from './decorators/auth.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/nestjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/nestjs/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectAndUserAuth = exports.ProjectAuthGuard = exports.JwtAuthGuard = exports.JwtStrategy = exports.JwtAuthModule = void 0;
+var jwt_auth_module_1 = require("./jwt-auth.module");
+Object.defineProperty(exports, "JwtAuthModule", { enumerable: true, get: function () { return jwt_auth_module_1.JwtAuthModule; } });
+var jwt_strategy_1 = require("./strategies/jwt-strategy");
+Object.defineProperty(exports, "JwtStrategy", { enumerable: true, get: function () { return jwt_strategy_1.JwtStrategy; } });
+var jwt_guard_1 = require("./guards/jwt-guard");
+Object.defineProperty(exports, "JwtAuthGuard", { enumerable: true, get: function () { return jwt_guard_1.JwtAuthGuard; } });
+var project_guard_1 = require("./guards/project.guard");
+Object.defineProperty(exports, "ProjectAuthGuard", { enumerable: true, get: function () { return project_guard_1.ProjectAuthGuard; } });
+var auth_decorator_1 = require("./decorators/auth.decorator");
+Object.defineProperty(exports, "ProjectAndUserAuth", { enumerable: true, get: function () { return auth_decorator_1.ProjectAndUserAuth; } });
+//# sourceMappingURL=index.js.map

package/dist/nestjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,0DAAwD;AAA/C,2GAAA,WAAW,OAAA;AACpB,gDAAkD;AAAzC,yGAAA,YAAY,OAAA;AACrB,wDAAyD;AAAhD,iHAAA,gBAAgB,OAAA;AACzB,8DAAiE;AAAxD,oHAAA,kBAAkB,OAAA"}

package/dist/nestjs/jwt-auth.module.d.ts

@@ -0,0 +1,3 @@
+export declare class JwtAuthModule {
+}
+//# sourceMappingURL=jwt-auth.module.d.ts.map

package/dist/nestjs/jwt-auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.module.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-auth.module.ts"],"names":[],"mappings":"AAMA,qBAMa,aAAa;CAAG"}

package/dist/nestjs/jwt-auth.module.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const jwt_guard_1 = require("./guards/jwt-guard");
+const jwt_strategy_1 = require("./strategies/jwt-strategy");
+let JwtAuthModule = class JwtAuthModule {
+};
+exports.JwtAuthModule = JwtAuthModule;
+exports.JwtAuthModule = JwtAuthModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [passport_1.PassportModule.register({ defaultStrategy: 'jwt' })],
+        providers: [jwt_strategy_1.JwtStrategy, jwt_guard_1.JwtAuthGuard],
+        exports: [jwt_guard_1.JwtAuthGuard, passport_1.PassportModule],
+    })
+], JwtAuthModule);
+//# sourceMappingURL=jwt-auth.module.js.map

package/dist/nestjs/jwt-auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.module.js","sourceRoot":"","sources":["../../src/nestjs/jwt-auth.module.ts"],"names":[],"mappings":";;;;;;;;;AACA,2CAAgD;AAChD,+CAAkD;AAClD,kDAAkD;AAClD,4DAAwD;AAQjD,IAAM,aAAa,GAAnB,MAAM,aAAa;CAAG,CAAA;AAAhB,sCAAa;wBAAb,aAAa;IANzB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,SAAS,EAAE,CAAC,0BAAW,EAAE,wBAAY,CAAC;QACtC,OAAO,EAAE,CAAC,wBAAY,EAAE,yBAAc,CAAC;KACxC,CAAC;GACW,aAAa,CAAG"}

package/dist/nestjs/strategies/jwt-strategy.d.ts

@@ -0,0 +1,23 @@
+import { Strategy } from 'passport-jwt';
+import { Request } from 'express';
+import { AuthUser, JwtPayload } from '../../types/jwt-payload';
+import 'dotenv/config';
+declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class JwtStrategy extends JwtStrategy_base {
+    private expectedIssuer;
+    private jwksCache;
+    constructor();
+    private decodeJWTTokenForProjectUuid;
+    private getJwksUriAndPath;
+    private fetchJWKS;
+    private getSigningKey;
+    private createTokenCacheKey;
+    private cacheValidatedToken;
+    private getCachedToken;
+    private extractRawTokenFromRequest;
+    validate(request: Request, payload: JwtPayload): Promise<AuthUser>;
+}
+export {};
+//# sourceMappingURL=jwt-strategy.d.ts.map

package/dist/nestjs/strategies/jwt-strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-strategy.d.ts","sourceRoot":"","sources":["../../../src/nestjs/strategies/jwt-strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,eAAe,CAAC;;;;AAEvB,qBACa,WAAY,SAAQ,gBAA0B;IACzD,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,SAAS,CAGH;;IA6Bd,OAAO,CAAC,4BAA4B;IA4BpC,OAAO,CAAC,iBAAiB;YAsBX,SAAS;YA+ET,aAAa;IAwE3B,OAAO,CAAC,mBAAmB;YAYb,mBAAmB;YAwBnB,cAAc;IAwC5B,OAAO,CAAC,0BAA0B;IAiB5B,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;CAwEzE"}