@webiny/api-core 6.3.0-beta.4 → 6.4.0-beta.0

package/graphql/wcp/graphql.js.map

@@ -1 +1 @@
-{"version":3,"names":["GraphQLSchemaPlugin","ErrorResponse","Response","WcpContext","emptyResolver","createWcpGraphQL","typeDefs","resolvers","Query","wcp","WcpQuery","getProject","_","__","context","wcpContext","container","resolve","project","getProjectWithFeatureFlags","Error","e","code","message","data","stack"],"sources":["graphql.ts"],"sourcesContent":["import { GraphQLSchemaPlugin } from \"@webiny/handler-graphql/plugins/index.js\";\nimport { ErrorResponse, Response } from \"@webiny/handler-graphql/responses.js\";\nimport { WcpContext } from \"~/features/wcp/WcpContext/index.js\";\n\nconst emptyResolver = () => ({});\n\nexport const createWcpGraphQL = () => {\n    return new GraphQLSchemaPlugin({\n        typeDefs: /* GraphQL */ `\n            type WcpProjectPackageFeaturesFeature {\n                enabled: Boolean\n                options: JSON\n            }\n\n            type WcpProjectPackageFeatures {\n                seats: WcpProjectPackageFeaturesFeature\n                multiTenancy: WcpProjectPackageFeaturesFeature\n                advancedPublishingWorkflow: WcpProjectPackageFeaturesFeature\n                advancedAccessControlLayer: WcpProjectPackageFeaturesFeature\n                auditLogs: WcpProjectPackageFeaturesFeature\n                recordLocking: WcpProjectPackageFeaturesFeature\n                fileManager: WcpProjectPackageFeaturesFeature\n                aiPowerups: WcpProjectPackageFeaturesFeature\n            }\n\n            type WcpProjectPackage {\n                features: WcpProjectPackageFeatures\n            }\n\n            type WcpProject {\n                orgId: ID\n                projectId: ID\n                package: WcpProjectPackage\n            }\n\n            type WcpError {\n                code: String\n                message: String\n                data: JSON\n                stack: String\n            }\n\n            type WcpProjectResponse {\n                data: WcpProject\n                error: WcpError\n            }\n\n            type WcpQuery {\n                getProject: WcpProjectResponse\n            }\n\n            type WcpMutation {\n                updateProject: WcpProjectResponse\n            }\n\n            extend type Query {\n                wcp: WcpQuery\n            }\n\n            extend type Mutation {\n                wcp: WcpMutation\n            }\n        `,\n        resolvers: {\n            Query: {\n                wcp: emptyResolver\n            },\n            WcpQuery: {\n                getProject: async (_, __, context) => {\n                    try {\n                        const wcpContext = context.container.resolve(WcpContext);\n                        const project = wcpContext.getProjectWithFeatureFlags();\n\n                        if (!project) {\n                            throw Error(`Could not get project!`);\n                        }\n\n                        return new Response(project);\n                    } catch (e) {\n                        return new ErrorResponse({\n                            code: \"COULD_NOT_GET_PROJECT\",\n                            message: e.message,\n                            data: null,\n                            stack: e.stack\n                        });\n                    }\n                }\n            }\n        }\n    });\n};\n"],"mappings":"AAAA,SAASA,mBAAmB,QAAQ,0CAA0C;AAC9E,SAASC,aAAa,EAAEC,QAAQ,QAAQ,sCAAsC;AAC9E,SAASC,UAAU;AAEnB,MAAMC,aAAa,GAAGA,CAAA,MAAO,CAAC,CAAC,CAAC;AAEhC,OAAO,MAAMC,gBAAgB,GAAGA,CAAA,KAAM;EAClC,OAAO,IAAIL,mBAAmB,CAAC;IAC3BM,QAAQ,EAAE,aAAc;AAChC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS;IACDC,SAAS,EAAE;MACPC,KAAK,EAAE;QACHC,GAAG,EAAEL;MACT,CAAC;MACDM,QAAQ,EAAE;QACNC,UAAU,EAAE,MAAAA,CAAOC,CAAC,EAAEC,EAAE,EAAEC,OAAO,KAAK;UAClC,IAAI;YACA,MAAMC,UAAU,GAAGD,OAAO,CAACE,SAAS,CAACC,OAAO,CAACd,UAAU,CAAC;YACxD,MAAMe,OAAO,GAAGH,UAAU,CAACI,0BAA0B,CAAC,CAAC;YAEvD,IAAI,CAACD,OAAO,EAAE;cACV,MAAME,KAAK,CAAC,wBAAwB,CAAC;YACzC;YAEA,OAAO,IAAIlB,QAAQ,CAACgB,OAAO,CAAC;UAChC,CAAC,CAAC,OAAOG,CAAC,EAAE;YACR,OAAO,IAAIpB,aAAa,CAAC;cACrBqB,IAAI,EAAE,uBAAuB;cAC7BC,OAAO,EAAEF,CAAC,CAACE,OAAO;cAClBC,IAAI,EAAE,IAAI;cACVC,KAAK,EAAEJ,CAAC,CAACI;YACb,CAAC,CAAC;UACN;QACJ;MACJ;IACJ;EACJ,CAAC,CAAC;AACN,CAAC","ignoreList":[]}
+{"version":3,"file":"graphql/wcp/graphql.js","sources":["../../../src/graphql/wcp/graphql.ts"],"sourcesContent":["import { GraphQLSchemaPlugin } from \"@webiny/handler-graphql/plugins/index.js\";\nimport { ErrorResponse, Response } from \"@webiny/handler-graphql/responses.js\";\nimport { WcpContext } from \"~/features/wcp/WcpContext/index.js\";\n\nconst emptyResolver = () => ({});\n\nexport const createWcpGraphQL = () => {\n    return new GraphQLSchemaPlugin({\n        typeDefs: /* GraphQL */ `\n            type WcpProjectPackageFeaturesFeature {\n                enabled: Boolean\n                options: JSON\n            }\n\n            type WcpProjectPackageFeatures {\n                seats: WcpProjectPackageFeaturesFeature\n                multiTenancy: WcpProjectPackageFeaturesFeature\n                advancedPublishingWorkflow: WcpProjectPackageFeaturesFeature\n                advancedAccessControlLayer: WcpProjectPackageFeaturesFeature\n                auditLogs: WcpProjectPackageFeaturesFeature\n                recordLocking: WcpProjectPackageFeaturesFeature\n                fileManager: WcpProjectPackageFeaturesFeature\n                aiPowerups: WcpProjectPackageFeaturesFeature\n            }\n\n            type WcpProjectPackage {\n                features: WcpProjectPackageFeatures\n            }\n\n            type WcpProject {\n                orgId: ID\n                projectId: ID\n                package: WcpProjectPackage\n            }\n\n            type WcpError {\n                code: String\n                message: String\n                data: JSON\n                stack: String\n            }\n\n            type WcpProjectResponse {\n                data: WcpProject\n                error: WcpError\n            }\n\n            type WcpQuery {\n                getProject: WcpProjectResponse\n            }\n\n            type WcpMutation {\n                updateProject: WcpProjectResponse\n            }\n\n            extend type Query {\n                wcp: WcpQuery\n            }\n\n            extend type Mutation {\n                wcp: WcpMutation\n            }\n        `,\n        resolvers: {\n            Query: {\n                wcp: emptyResolver\n            },\n            WcpQuery: {\n                getProject: async (_, __, context) => {\n                    try {\n                        const wcpContext = context.container.resolve(WcpContext);\n                        const project = wcpContext.getProjectWithFeatureFlags();\n\n                        if (!project) {\n                            throw Error(`Could not get project!`);\n                        }\n\n                        return new Response(project);\n                    } catch (e) {\n                        return new ErrorResponse({\n                            code: \"COULD_NOT_GET_PROJECT\",\n                            message: e.message,\n                            data: null,\n                            stack: e.stack\n                        });\n                    }\n                }\n            }\n        }\n    });\n};\n"],"names":["emptyResolver","createWcpGraphQL","GraphQLSchemaPlugin","_","__","context","wcpContext","WcpContext","project","Error","Response","e","ErrorResponse"],"mappings":";;;AAIA,MAAMA,gBAAgB,IAAO,EAAC;AAEvB,MAAMC,mBAAmB,IACrB,IAAIC,oBAAoB;QAC3B,UAAwB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAsDzB,CAAC;QACD,WAAW;YACP,OAAO;gBACH,KAAKF;YACT;YACA,UAAU;gBACN,YAAY,OAAOG,GAAGC,IAAIC;oBACtB,IAAI;wBACA,MAAMC,aAAaD,QAAQ,SAAS,CAAC,OAAO,CAACE;wBAC7C,MAAMC,UAAUF,WAAW,0BAA0B;wBAErD,IAAI,CAACE,SACD,MAAMC,MAAM;wBAGhB,OAAO,IAAIC,SAASF;oBACxB,EAAE,OAAOG,GAAG;wBACR,OAAO,IAAIC,cAAc;4BACrB,MAAM;4BACN,SAASD,EAAE,OAAO;4BAClB,MAAM;4BACN,OAAOA,EAAE,KAAK;wBAClB;oBACJ;gBACJ;YACJ;QACJ;IACJ"}

package/idp/JwksCache.js

@@ -1,32 +1,26 @@
-export class JwksCache {
-  cache = new Map();
-  async getKeys(issuer) {
-    // Check cache first
-    const cached = this.cache.get(issuer);
-    if (cached) {
-      return cached.jwks;
+class JwksCache {
+    async getKeys(issuer) {
+        const cached = this.cache.get(issuer);
+        if (cached) return cached.jwks;
+        const openidUrl = new URL(issuer);
+        const pathname = openidUrl.pathname + "/.well-known/openid-configuration";
+        openidUrl.pathname = pathname.replace(/\/+/g, "/");
+        const oidcConfig = await fetch(openidUrl.toString()).then((res)=>res.json());
+        const jwksResponse = await fetch(oidcConfig.jwks_uri).then((res)=>res.json());
+        const jwks = jwksResponse.keys;
+        this.cache.set(issuer, {
+            oidcConfig,
+            jwks
+        });
+        return jwks;
+    }
+    clearCache() {
+        this.cache.clear();
+    }
+    constructor(){
+        this.cache = new Map();
     }
-
-    // Fetch OIDC configuration
-    const openidUrl = new URL(issuer);
-    const pathname = openidUrl.pathname + "/.well-known/openid-configuration";
-    openidUrl.pathname = pathname.replace(/\/+/g, "/");
-    const oidcConfig = await fetch(openidUrl.toString()).then(res => res.json());
-
-    // Fetch JWKs from jwks_uri
-    const jwksResponse = await fetch(oidcConfig.jwks_uri).then(res => res.json());
-    const jwks = jwksResponse.keys;
-
-    // Cache both config and JWKs
-    this.cache.set(issuer, {
-      oidcConfig,
-      jwks
-    });
-    return jwks;
-  }
-  clearCache() {
-    this.cache.clear();
-  }
 }
+export { JwksCache };
 
 //# sourceMappingURL=JwksCache.js.map

package/idp/JwksCache.js.map

@@ -1 +1 @@
-{"version":3,"names":["JwksCache","cache","Map","getKeys","issuer","cached","get","jwks","openidUrl","URL","pathname","replace","oidcConfig","fetch","toString","then","res","json","jwksResponse","jwks_uri","keys","set","clearCache","clear"],"sources":["JwksCache.ts"],"sourcesContent":["import type { Jwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport { JwkCache } from \"./abstractions.js\";\n\ninterface OidcConfiguration {\n    jwks_uri: string;\n    [key: string]: any;\n}\n\ninterface CacheEntry {\n    oidcConfig: OidcConfiguration;\n    jwks: Jwk[];\n}\n\nexport class JwksCache implements JwkCache.Interface {\n    private cache = new Map<string, CacheEntry>();\n\n    async getKeys(issuer: string): Promise<Jwk[]> {\n        // Check cache first\n        const cached = this.cache.get(issuer);\n        if (cached) {\n            return cached.jwks;\n        }\n\n        // Fetch OIDC configuration\n        const openidUrl = new URL(issuer);\n        const pathname = openidUrl.pathname + \"/.well-known/openid-configuration\";\n        openidUrl.pathname = pathname.replace(/\\/+/g, \"/\");\n\n        const oidcConfig = await fetch(openidUrl.toString()).then(\n            res => res.json() as Promise<OidcConfiguration>\n        );\n\n        // Fetch JWKs from jwks_uri\n        const jwksResponse = await fetch(oidcConfig.jwks_uri).then(res => res.json());\n        const jwks = jwksResponse.keys as Jwk[];\n\n        // Cache both config and JWKs\n        this.cache.set(issuer, {\n            oidcConfig,\n            jwks\n        });\n\n        return jwks;\n    }\n\n    clearCache(): void {\n        this.cache.clear();\n    }\n}\n"],"mappings":"AAaA,OAAO,MAAMA,SAAS,CAA+B;EACzCC,KAAK,GAAG,IAAIC,GAAG,CAAqB,CAAC;EAE7C,MAAMC,OAAOA,CAACC,MAAc,EAAkB;IAC1C;IACA,MAAMC,MAAM,GAAG,IAAI,CAACJ,KAAK,CAACK,GAAG,CAACF,MAAM,CAAC;IACrC,IAAIC,MAAM,EAAE;MACR,OAAOA,MAAM,CAACE,IAAI;IACtB;;IAEA;IACA,MAAMC,SAAS,GAAG,IAAIC,GAAG,CAACL,MAAM,CAAC;IACjC,MAAMM,QAAQ,GAAGF,SAAS,CAACE,QAAQ,GAAG,mCAAmC;IACzEF,SAAS,CAACE,QAAQ,GAAGA,QAAQ,CAACC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;IAElD,MAAMC,UAAU,GAAG,MAAMC,KAAK,CAACL,SAAS,CAACM,QAAQ,CAAC,CAAC,CAAC,CAACC,IAAI,CACrDC,GAAG,IAAIA,GAAG,CAACC,IAAI,CAAC,CACpB,CAAC;;IAED;IACA,MAAMC,YAAY,GAAG,MAAML,KAAK,CAACD,UAAU,CAACO,QAAQ,CAAC,CAACJ,IAAI,CAACC,GAAG,IAAIA,GAAG,CAACC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAMV,IAAI,GAAGW,YAAY,CAACE,IAAa;;IAEvC;IACA,IAAI,CAACnB,KAAK,CAACoB,GAAG,CAACjB,MAAM,EAAE;MACnBQ,UAAU;MACVL;IACJ,CAAC,CAAC;IAEF,OAAOA,IAAI;EACf;EAEAe,UAAUA,CAAA,EAAS;IACf,IAAI,CAACrB,KAAK,CAACsB,KAAK,CAAC,CAAC;EACtB;AACJ","ignoreList":[]}
+{"version":3,"file":"idp/JwksCache.js","sources":["../../src/idp/JwksCache.ts"],"sourcesContent":["import type { Jwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport { JwkCache } from \"./abstractions.js\";\n\ninterface OidcConfiguration {\n    jwks_uri: string;\n    [key: string]: any;\n}\n\ninterface CacheEntry {\n    oidcConfig: OidcConfiguration;\n    jwks: Jwk[];\n}\n\nexport class JwksCache implements JwkCache.Interface {\n    private cache = new Map<string, CacheEntry>();\n\n    async getKeys(issuer: string): Promise<Jwk[]> {\n        // Check cache first\n        const cached = this.cache.get(issuer);\n        if (cached) {\n            return cached.jwks;\n        }\n\n        // Fetch OIDC configuration\n        const openidUrl = new URL(issuer);\n        const pathname = openidUrl.pathname + \"/.well-known/openid-configuration\";\n        openidUrl.pathname = pathname.replace(/\\/+/g, \"/\");\n\n        const oidcConfig = await fetch(openidUrl.toString()).then(\n            res => res.json() as Promise<OidcConfiguration>\n        );\n\n        // Fetch JWKs from jwks_uri\n        const jwksResponse = await fetch(oidcConfig.jwks_uri).then(res => res.json());\n        const jwks = jwksResponse.keys as Jwk[];\n\n        // Cache both config and JWKs\n        this.cache.set(issuer, {\n            oidcConfig,\n            jwks\n        });\n\n        return jwks;\n    }\n\n    clearCache(): void {\n        this.cache.clear();\n    }\n}\n"],"names":["JwksCache","issuer","cached","openidUrl","URL","pathname","oidcConfig","fetch","res","jwksResponse","jwks","Map"],"mappings":"AAaO,MAAMA;IAGT,MAAM,QAAQC,MAAc,EAAkB;QAE1C,MAAMC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAACD;QAC9B,IAAIC,QACA,OAAOA,OAAO,IAAI;QAItB,MAAMC,YAAY,IAAIC,IAAIH;QAC1B,MAAMI,WAAWF,UAAU,QAAQ,GAAG;QACtCA,UAAU,QAAQ,GAAGE,SAAS,OAAO,CAAC,QAAQ;QAE9C,MAAMC,aAAa,MAAMC,MAAMJ,UAAU,QAAQ,IAAI,IAAI,CACrDK,CAAAA,MAAOA,IAAI,IAAI;QAInB,MAAMC,eAAe,MAAMF,MAAMD,WAAW,QAAQ,EAAE,IAAI,CAACE,CAAAA,MAAOA,IAAI,IAAI;QAC1E,MAAME,OAAOD,aAAa,IAAI;QAG9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAACR,QAAQ;YACnBK;YACAI;QACJ;QAEA,OAAOA;IACX;IAEA,aAAmB;QACf,IAAI,CAAC,KAAK,CAAC,KAAK;IACpB;;aAjCQ,KAAK,GAAG,IAAIC;;AAkCxB"}

package/idp/JwtAuthenticator.js

@@ -1,58 +1,46 @@
-import jwt from "jsonwebtoken";
+import jsonwebtoken from "jsonwebtoken";
 import { Authenticator } from "../features/security/authentication/Authenticator/abstractions.js";
 import { JwtIdentityProvider } from "./abstractions.js";
 import { isJwt } from "../features/security/utils/isJwt.js";
 class JwtAuthenticatorImpl {
-  constructor(providers) {
-    this.providers = providers;
-  }
-  async authenticate(token) {
-    if (!isJwt(token)) {
-      return null;
+    constructor(providers){
+        this.providers = providers;
     }
-
-    // Decode JWT to get payload
-    const decoded = jwt.decode(token, {
-      complete: true
-    });
-    if (!decoded || typeof decoded === "string") {
-      return null;
-    }
-    if (typeof decoded.payload === "string") {
-      return null;
-    }
-
-    // TODO: validate expiration claim and exit early if expired
-
-    for (const provider of this.providers) {
-      // Check if provider is applicable
-      if (provider.isApplicable(decoded.payload)) {
-        // Use provider to get identity
-        const identity = await provider.getIdentity(token, decoded);
-        if (identity) {
-          // We treat all IDP identities as external by default.
-          const isExternal = identity.profile?.external ?? true;
-          return {
-            ...identity,
-            type: identity.type ?? "admin",
-            profile: {
-              ...(identity.profile ?? {}),
-              external: isExternal
+    async authenticate(token) {
+        if (!isJwt(token)) return null;
+        const decoded = jsonwebtoken.decode(token, {
+            complete: true
+        });
+        if (!decoded || "string" == typeof decoded) return null;
+        if ("string" == typeof decoded.payload) return null;
+        for (const provider of this.providers)if (provider.isApplicable(decoded.payload)) {
+            const identity = await provider.getIdentity(token, decoded);
+            if (identity) {
+                const isExternal = identity.profile?.external ?? true;
+                return {
+                    ...identity,
+                    type: identity.type ?? "admin",
+                    profile: {
+                        ...identity.profile ?? {},
+                        external: isExternal
+                    }
+                };
             }
-          };
         }
-      }
+        return null;
     }
-
-    // No applicable provider found
-    return null;
-  }
 }
-export const JwtAuthenticator = Authenticator.createImplementation({
-  implementation: JwtAuthenticatorImpl,
-  dependencies: [[JwtIdentityProvider, {
-    multiple: true
-  }]]
+const JwtAuthenticator = Authenticator.createImplementation({
+    implementation: JwtAuthenticatorImpl,
+    dependencies: [
+        [
+            JwtIdentityProvider,
+            {
+                multiple: true
+            }
+        ]
+    ]
 });
+export { JwtAuthenticator };
 
 //# sourceMappingURL=JwtAuthenticator.js.map

package/idp/JwtAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"names":["jwt","Authenticator","JwtIdentityProvider","isJwt","JwtAuthenticatorImpl","constructor","providers","authenticate","token","decoded","decode","complete","payload","provider","isApplicable","identity","getIdentity","isExternal","profile","external","type","JwtAuthenticator","createImplementation","implementation","dependencies","multiple"],"sources":["JwtAuthenticator.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { IdentityProvider, JwtIdentityProvider } from \"./abstractions.js\";\nimport { isJwt } from \"~/features/security/utils/isJwt.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass JwtAuthenticatorImpl implements Authenticator.Interface {\n    constructor(private providers: JwtIdentityProvider.Interface[]) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (!isJwt(token)) {\n            return null;\n        }\n\n        // Decode JWT to get payload\n        const decoded = jwt.decode(token, { complete: true });\n        if (!decoded || typeof decoded === \"string\") {\n            return null;\n        }\n\n        if (typeof decoded.payload === \"string\") {\n            return null;\n        }\n\n        // TODO: validate expiration claim and exit early if expired\n\n        for (const provider of this.providers) {\n            // Check if provider is applicable\n            if (provider.isApplicable(decoded.payload as IdentityProvider.JwtPayload)) {\n                // Use provider to get identity\n                const identity = await provider.getIdentity(\n                    token,\n                    decoded as JwtIdentityProvider.Jwt\n                );\n\n                if (identity) {\n                    // We treat all IDP identities as external by default.\n                    const isExternal = identity.profile?.external ?? true;\n                    return {\n                        ...identity,\n                        type: identity.type ?? \"admin\",\n                        profile: {\n                            ...(identity.profile ?? {}),\n                            external: isExternal\n                        }\n                    };\n                }\n            }\n        }\n\n        // No applicable provider found\n        return null;\n    }\n}\n\nexport const JwtAuthenticator = Authenticator.createImplementation({\n    implementation: JwtAuthenticatorImpl,\n    dependencies: [[JwtIdentityProvider, { multiple: true }]]\n});\n"],"mappings":"AAAA,OAAOA,GAAG,MAAM,cAAc;AAC9B,SAASC,aAAa;AACtB,SAA2BC,mBAAmB;AAC9C,SAASC,KAAK;AAGd,MAAMC,oBAAoB,CAAoC;EAC1DC,WAAWA,CAASC,SAA0C,EAAE;IAAA,KAA5CA,SAA0C,GAA1CA,SAA0C;EAAG;EAEjE,MAAMC,YAAYA,CAACC,KAAa,EAAgC;IAC5D,IAAI,CAACL,KAAK,CAACK,KAAK,CAAC,EAAE;MACf,OAAO,IAAI;IACf;;IAEA;IACA,MAAMC,OAAO,GAAGT,GAAG,CAACU,MAAM,CAACF,KAAK,EAAE;MAAEG,QAAQ,EAAE;IAAK,CAAC,CAAC;IACrD,IAAI,CAACF,OAAO,IAAI,OAAOA,OAAO,KAAK,QAAQ,EAAE;MACzC,OAAO,IAAI;IACf;IAEA,IAAI,OAAOA,OAAO,CAACG,OAAO,KAAK,QAAQ,EAAE;MACrC,OAAO,IAAI;IACf;;IAEA;;IAEA,KAAK,MAAMC,QAAQ,IAAI,IAAI,CAACP,SAAS,EAAE;MACnC;MACA,IAAIO,QAAQ,CAACC,YAAY,CAACL,OAAO,CAACG,OAAsC,CAAC,EAAE;QACvE;QACA,MAAMG,QAAQ,GAAG,MAAMF,QAAQ,CAACG,WAAW,CACvCR,KAAK,EACLC,OACJ,CAAC;QAED,IAAIM,QAAQ,EAAE;UACV;UACA,MAAME,UAAU,GAAGF,QAAQ,CAACG,OAAO,EAAEC,QAAQ,IAAI,IAAI;UACrD,OAAO;YACH,GAAGJ,QAAQ;YACXK,IAAI,EAAEL,QAAQ,CAACK,IAAI,IAAI,OAAO;YAC9BF,OAAO,EAAE;cACL,IAAIH,QAAQ,CAACG,OAAO,IAAI,CAAC,CAAC,CAAC;cAC3BC,QAAQ,EAAEF;YACd;UACJ,CAAC;QACL;MACJ;IACJ;;IAEA;IACA,OAAO,IAAI;EACf;AACJ;AAEA,OAAO,MAAMI,gBAAgB,GAAGpB,aAAa,CAACqB,oBAAoB,CAAC;EAC/DC,cAAc,EAAEnB,oBAAoB;EACpCoB,YAAY,EAAE,CAAC,CAACtB,mBAAmB,EAAE;IAAEuB,QAAQ,EAAE;EAAK,CAAC,CAAC;AAC5D,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/JwtAuthenticator.js","sources":["../../src/idp/JwtAuthenticator.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { IdentityProvider, JwtIdentityProvider } from \"./abstractions.js\";\nimport { isJwt } from \"~/features/security/utils/isJwt.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass JwtAuthenticatorImpl implements Authenticator.Interface {\n    constructor(private providers: JwtIdentityProvider.Interface[]) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (!isJwt(token)) {\n            return null;\n        }\n\n        // Decode JWT to get payload\n        const decoded = jwt.decode(token, { complete: true });\n        if (!decoded || typeof decoded === \"string\") {\n            return null;\n        }\n\n        if (typeof decoded.payload === \"string\") {\n            return null;\n        }\n\n        // TODO: validate expiration claim and exit early if expired\n\n        for (const provider of this.providers) {\n            // Check if provider is applicable\n            if (provider.isApplicable(decoded.payload as IdentityProvider.JwtPayload)) {\n                // Use provider to get identity\n                const identity = await provider.getIdentity(\n                    token,\n                    decoded as JwtIdentityProvider.Jwt\n                );\n\n                if (identity) {\n                    // We treat all IDP identities as external by default.\n                    const isExternal = identity.profile?.external ?? true;\n                    return {\n                        ...identity,\n                        type: identity.type ?? \"admin\",\n                        profile: {\n                            ...(identity.profile ?? {}),\n                            external: isExternal\n                        }\n                    };\n                }\n            }\n        }\n\n        // No applicable provider found\n        return null;\n    }\n}\n\nexport const JwtAuthenticator = Authenticator.createImplementation({\n    implementation: JwtAuthenticatorImpl,\n    dependencies: [[JwtIdentityProvider, { multiple: true }]]\n});\n"],"names":["JwtAuthenticatorImpl","providers","token","isJwt","decoded","jwt","provider","identity","isExternal","JwtAuthenticator","Authenticator","JwtIdentityProvider"],"mappings":";;;;AAMA,MAAMA;IACF,YAAoBC,SAA0C,CAAE;aAA5CA,SAAS,GAATA;IAA6C;IAEjE,MAAM,aAAaC,KAAa,EAAgC;QAC5D,IAAI,CAACC,MAAMD,QACP,OAAO;QAIX,MAAME,UAAUC,aAAAA,MAAU,CAACH,OAAO;YAAE,UAAU;QAAK;QACnD,IAAI,CAACE,WAAW,AAAmB,YAAnB,OAAOA,SACnB,OAAO;QAGX,IAAI,AAA2B,YAA3B,OAAOA,QAAQ,OAAO,EACtB,OAAO;QAKX,KAAK,MAAME,YAAY,IAAI,CAAC,SAAS,CAEjC,IAAIA,SAAS,YAAY,CAACF,QAAQ,OAAO,GAAkC;YAEvE,MAAMG,WAAW,MAAMD,SAAS,WAAW,CACvCJ,OACAE;YAGJ,IAAIG,UAAU;gBAEV,MAAMC,aAAaD,SAAS,OAAO,EAAE,YAAY;gBACjD,OAAO;oBACH,GAAGA,QAAQ;oBACX,MAAMA,SAAS,IAAI,IAAI;oBACvB,SAAS;wBACL,GAAIA,SAAS,OAAO,IAAI,CAAC,CAAC;wBAC1B,UAAUC;oBACd;gBACJ;YACJ;QACJ;QAIJ,OAAO;IACX;AACJ;AAEO,MAAMC,mBAAmBC,cAAc,oBAAoB,CAAC;IAC/D,gBAAgBV;IAChB,cAAc;QAAC;YAACW;YAAqB;gBAAE,UAAU;YAAK;SAAE;KAAC;AAC7D"}

package/idp/OidcJwtIdentityProvider.js

@@ -1,90 +1,63 @@
 import { verifyJwtUsingJwk } from "../features/security/utils/verifyJwtUsingJwk.js";
 import { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";
 class OidcJwtIdentityProviderImpl {
-  constructor(oidcIdentityProviders, jwksCache) {
-    this.oidcIdentityProviders = oidcIdentityProviders;
-    this.jwksCache = jwksCache;
-  }
-  isApplicable(token) {
-    return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));
-  }
-  async getIdentity(token, jwt) {
-    const {
-      header,
-      payload
-    } = jwt;
-    const provider = this.getApplicableProvider(payload);
-    if (!provider) {
-      return null;
+    constructor(oidcIdentityProviders, jwksCache){
+        this.oidcIdentityProviders = oidcIdentityProviders;
+        this.jwksCache = jwksCache;
+    }
+    isApplicable(token) {
+        return this.oidcIdentityProviders.some((provider)=>provider.isApplicable(token));
+    }
+    async getIdentity(token, jwt) {
+        const { header, payload } = jwt;
+        const provider = this.getApplicableProvider(payload);
+        if (!provider) return null;
+        const verifiedPayload = await this.verifyToken(provider, token, header);
+        if (!verifiedPayload) return null;
+        const providerIdentity = await provider.getIdentity(verifiedPayload);
+        const identity = {
+            ...providerIdentity,
+            type: providerIdentity.type ?? "admin"
+        };
+        const context = identity.context ?? {
+            canAccessTenant: true,
+            defaultTenantId: "root"
+        };
+        if (void 0 === context.canAccessTenant) context.canAccessTenant = true;
+        if (void 0 === context.defaultTenantId) context.defaultTenantId = "root";
+        identity.context = context;
+        return identity;
+    }
+    getApplicableProvider(payload) {
+        return this.oidcIdentityProviders.find((provider)=>provider.isApplicable(payload));
+    }
+    async verifyToken(provider, token, header) {
+        let verifiedPayload;
+        if ("function" == typeof provider.verifyToken) {
+            const result = await provider.verifyToken(token);
+            if (result) return result;
+            return null;
+        }
+        const jwks = await this.jwksCache.getKeys(provider.issuer);
+        const jwk = jwks.find((key)=>key.kid === header.kid);
+        if (!jwk) return null;
+        if (!verifiedPayload) verifiedPayload = await verifyJwtUsingJwk(token, jwk);
+        if (provider.verifyTokenClaims) await provider.verifyTokenClaims(verifiedPayload);
+        return verifiedPayload;
     }
-    const verifiedPayload = await this.verifyToken(provider, token, header);
-    if (!verifiedPayload) {
-      return null;
-    }
-
-    // Call config.getIdentity to get IdentityData
-    const providerIdentity = await provider.getIdentity(verifiedPayload);
-    const identity = {
-      ...providerIdentity,
-      type: providerIdentity.type ?? "admin"
-    };
-
-    // Handle default values
-    const context = identity.context ?? {
-      canAccessTenant: true,
-      defaultTenantId: "root"
-    };
-    if (context.canAccessTenant === undefined) {
-      context.canAccessTenant = true;
-    }
-    if (context.defaultTenantId === undefined) {
-      context.defaultTenantId = "root";
-    }
-    identity.context = context;
-    return identity;
-  }
-  getApplicableProvider(payload) {
-    return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));
-  }
-  async verifyToken(provider, token, header) {
-    // If the implementation specifies a custom verification function, use it.
-    let verifiedPayload;
-    if (typeof provider.verifyToken === "function") {
-      // Use custom verification
-      const result = await provider.verifyToken(token);
-      if (result) {
-        return result;
-      }
-      return null;
-    }
-
-    // Otherwise, continue with OIDC best practices, using JWKs.
-
-    // Fetch JWKs from cache
-    const jwks = await this.jwksCache.getKeys(provider.issuer);
-
-    // Find matching JWK using header.kid
-    const jwk = jwks.find(key => key.kid === header.kid);
-    if (!jwk) {
-      return null;
-    }
-    if (!verifiedPayload) {
-      // Default JWK verification
-      verifiedPayload = await verifyJwtUsingJwk(token, jwk);
-    }
-
-    // Call verifyTokenClaims if provided
-    if (provider.verifyTokenClaims) {
-      await provider.verifyTokenClaims(verifiedPayload);
-    }
-    return verifiedPayload;
-  }
 }
-export const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({
-  implementation: OidcJwtIdentityProviderImpl,
-  dependencies: [[OidcIdentityProvider, {
-    multiple: true
-  }], JwkCache]
+const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({
+    implementation: OidcJwtIdentityProviderImpl,
+    dependencies: [
+        [
+            OidcIdentityProvider,
+            {
+                multiple: true
+            }
+        ],
+        JwkCache
+    ]
 });
+export { OidcJwtIdentityProvider };
 
 //# sourceMappingURL=OidcJwtIdentityProvider.js.map

package/idp/OidcJwtIdentityProvider.js.map

@@ -1 +1 @@
-{"version":3,"names":["verifyJwtUsingJwk","JwkCache","JwtIdentityProvider","OidcIdentityProvider","OidcJwtIdentityProviderImpl","constructor","oidcIdentityProviders","jwksCache","isApplicable","token","some","provider","getIdentity","jwt","header","payload","getApplicableProvider","verifiedPayload","verifyToken","providerIdentity","identity","type","context","canAccessTenant","defaultTenantId","undefined","find","result","jwks","getKeys","issuer","jwk","key","kid","verifyTokenClaims","OidcJwtIdentityProvider","createImplementation","implementation","dependencies","multiple"],"sources":["OidcJwtIdentityProvider.ts"],"sourcesContent":["import { verifyJwtUsingJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from \"./abstractions.js\";\n\nclass OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {\n    constructor(\n        private oidcIdentityProviders: OidcIdentityProvider.Interface[],\n        private jwksCache: JwkCache.Interface\n    ) {}\n\n    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean {\n        return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));\n    }\n\n    async getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null> {\n        const { header, payload } = jwt;\n\n        const provider = this.getApplicableProvider(payload);\n\n        if (!provider) {\n            return null;\n        }\n\n        const verifiedPayload = await this.verifyToken(provider, token, header);\n\n        if (!verifiedPayload) {\n            return null;\n        }\n\n        // Call config.getIdentity to get IdentityData\n        const providerIdentity = await provider.getIdentity(verifiedPayload);\n\n        const identity: IdentityData = {\n            ...providerIdentity,\n            type: providerIdentity.type ?? \"admin\"\n        };\n\n        // Handle default values\n        const context = identity.context ?? { canAccessTenant: true, defaultTenantId: \"root\" };\n        if (context.canAccessTenant === undefined) {\n            context.canAccessTenant = true;\n        }\n        if (context.defaultTenantId === undefined) {\n            context.defaultTenantId = \"root\";\n        }\n\n        identity.context = context;\n\n        return identity;\n    }\n\n    private getApplicableProvider(\n        payload: JwtIdentityProvider.JwtPayload\n    ): OidcIdentityProvider.Interface | undefined {\n        return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));\n    }\n\n    private async verifyToken(\n        provider: OidcIdentityProvider.Interface,\n        token: string,\n        header: JwtIdentityProvider.JwtHeader\n    ) {\n        // If the implementation specifies a custom verification function, use it.\n        let verifiedPayload: JwtIdentityProvider.JwtPayload | undefined;\n        if (typeof provider.verifyToken === \"function\") {\n            // Use custom verification\n            const result = await provider.verifyToken(token);\n            if (result) {\n                return result;\n            }\n            return null;\n        }\n\n        // Otherwise, continue with OIDC best practices, using JWKs.\n\n        // Fetch JWKs from cache\n        const jwks = await this.jwksCache.getKeys(provider.issuer);\n\n        // Find matching JWK using header.kid\n        const jwk = jwks.find(key => key.kid === header.kid);\n        if (!jwk) {\n            return null;\n        }\n\n        if (!verifiedPayload) {\n            // Default JWK verification\n            verifiedPayload = await verifyJwtUsingJwk(token, jwk);\n        }\n\n        // Call verifyTokenClaims if provided\n        if (provider.verifyTokenClaims) {\n            await provider.verifyTokenClaims(verifiedPayload);\n        }\n\n        return verifiedPayload;\n    }\n}\n\nexport const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({\n    implementation: OidcJwtIdentityProviderImpl,\n    dependencies: [[OidcIdentityProvider, { multiple: true }], JwkCache]\n});\n"],"mappings":"AAAA,SAASA,iBAAiB;AAE1B,SAASC,QAAQ,EAAEC,mBAAmB,EAAEC,oBAAoB;AAE5D,MAAMC,2BAA2B,CAA0C;EACvEC,WAAWA,CACCC,qBAAuD,EACvDC,SAA6B,EACvC;IAAA,KAFUD,qBAAuD,GAAvDA,qBAAuD;IAAA,KACvDC,SAA6B,GAA7BA,SAA6B;EACtC;EAEHC,YAAYA,CAACC,KAAqC,EAAW;IACzD,OAAO,IAAI,CAACH,qBAAqB,CAACI,IAAI,CAACC,QAAQ,IAAIA,QAAQ,CAACH,YAAY,CAACC,KAAK,CAAC,CAAC;EACpF;EAEA,MAAMG,WAAWA,CAACH,KAAa,EAAEI,GAA4B,EAAgC;IACzF,MAAM;MAAEC,MAAM;MAAEC;IAAQ,CAAC,GAAGF,GAAG;IAE/B,MAAMF,QAAQ,GAAG,IAAI,CAACK,qBAAqB,CAACD,OAAO,CAAC;IAEpD,IAAI,CAACJ,QAAQ,EAAE;MACX,OAAO,IAAI;IACf;IAEA,MAAMM,eAAe,GAAG,MAAM,IAAI,CAACC,WAAW,CAACP,QAAQ,EAAEF,KAAK,EAAEK,MAAM,CAAC;IAEvE,IAAI,CAACG,eAAe,EAAE;MAClB,OAAO,IAAI;IACf;;IAEA;IACA,MAAME,gBAAgB,GAAG,MAAMR,QAAQ,CAACC,WAAW,CAACK,eAAe,CAAC;IAEpE,MAAMG,QAAsB,GAAG;MAC3B,GAAGD,gBAAgB;MACnBE,IAAI,EAAEF,gBAAgB,CAACE,IAAI,IAAI;IACnC,CAAC;;IAED;IACA,MAAMC,OAAO,GAAGF,QAAQ,CAACE,OAAO,IAAI;MAAEC,eAAe,EAAE,IAAI;MAAEC,eAAe,EAAE;IAAO,CAAC;IACtF,IAAIF,OAAO,CAACC,eAAe,KAAKE,SAAS,EAAE;MACvCH,OAAO,CAACC,eAAe,GAAG,IAAI;IAClC;IACA,IAAID,OAAO,CAACE,eAAe,KAAKC,SAAS,EAAE;MACvCH,OAAO,CAACE,eAAe,GAAG,MAAM;IACpC;IAEAJ,QAAQ,CAACE,OAAO,GAAGA,OAAO;IAE1B,OAAOF,QAAQ;EACnB;EAEQJ,qBAAqBA,CACzBD,OAAuC,EACG;IAC1C,OAAO,IAAI,CAACT,qBAAqB,CAACoB,IAAI,CAACf,QAAQ,IAAIA,QAAQ,CAACH,YAAY,CAACO,OAAO,CAAC,CAAC;EACtF;EAEA,MAAcG,WAAWA,CACrBP,QAAwC,EACxCF,KAAa,EACbK,MAAqC,EACvC;IACE;IACA,IAAIG,eAA2D;IAC/D,IAAI,OAAON,QAAQ,CAACO,WAAW,KAAK,UAAU,EAAE;MAC5C;MACA,MAAMS,MAAM,GAAG,MAAMhB,QAAQ,CAACO,WAAW,CAACT,KAAK,CAAC;MAChD,IAAIkB,MAAM,EAAE;QACR,OAAOA,MAAM;MACjB;MACA,OAAO,IAAI;IACf;;IAEA;;IAEA;IACA,MAAMC,IAAI,GAAG,MAAM,IAAI,CAACrB,SAAS,CAACsB,OAAO,CAAClB,QAAQ,CAACmB,MAAM,CAAC;;IAE1D;IACA,MAAMC,GAAG,GAAGH,IAAI,CAACF,IAAI,CAACM,GAAG,IAAIA,GAAG,CAACC,GAAG,KAAKnB,MAAM,CAACmB,GAAG,CAAC;IACpD,IAAI,CAACF,GAAG,EAAE;MACN,OAAO,IAAI;IACf;IAEA,IAAI,CAACd,eAAe,EAAE;MAClB;MACAA,eAAe,GAAG,MAAMjB,iBAAiB,CAACS,KAAK,EAAEsB,GAAG,CAAC;IACzD;;IAEA;IACA,IAAIpB,QAAQ,CAACuB,iBAAiB,EAAE;MAC5B,MAAMvB,QAAQ,CAACuB,iBAAiB,CAACjB,eAAe,CAAC;IACrD;IAEA,OAAOA,eAAe;EAC1B;AACJ;AAEA,OAAO,MAAMkB,uBAAuB,GAAGjC,mBAAmB,CAACkC,oBAAoB,CAAC;EAC5EC,cAAc,EAAEjC,2BAA2B;EAC3CkC,YAAY,EAAE,CAAC,CAACnC,oBAAoB,EAAE;IAAEoC,QAAQ,EAAE;EAAK,CAAC,CAAC,EAAEtC,QAAQ;AACvE,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/OidcJwtIdentityProvider.js","sources":["../../src/idp/OidcJwtIdentityProvider.ts"],"sourcesContent":["import { verifyJwtUsingJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from \"./abstractions.js\";\n\nclass OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {\n    constructor(\n        private oidcIdentityProviders: OidcIdentityProvider.Interface[],\n        private jwksCache: JwkCache.Interface\n    ) {}\n\n    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean {\n        return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));\n    }\n\n    async getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null> {\n        const { header, payload } = jwt;\n\n        const provider = this.getApplicableProvider(payload);\n\n        if (!provider) {\n            return null;\n        }\n\n        const verifiedPayload = await this.verifyToken(provider, token, header);\n\n        if (!verifiedPayload) {\n            return null;\n        }\n\n        // Call config.getIdentity to get IdentityData\n        const providerIdentity = await provider.getIdentity(verifiedPayload);\n\n        const identity: IdentityData = {\n            ...providerIdentity,\n            type: providerIdentity.type ?? \"admin\"\n        };\n\n        // Handle default values\n        const context = identity.context ?? { canAccessTenant: true, defaultTenantId: \"root\" };\n        if (context.canAccessTenant === undefined) {\n            context.canAccessTenant = true;\n        }\n        if (context.defaultTenantId === undefined) {\n            context.defaultTenantId = \"root\";\n        }\n\n        identity.context = context;\n\n        return identity;\n    }\n\n    private getApplicableProvider(\n        payload: JwtIdentityProvider.JwtPayload\n    ): OidcIdentityProvider.Interface | undefined {\n        return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));\n    }\n\n    private async verifyToken(\n        provider: OidcIdentityProvider.Interface,\n        token: string,\n        header: JwtIdentityProvider.JwtHeader\n    ) {\n        // If the implementation specifies a custom verification function, use it.\n        let verifiedPayload: JwtIdentityProvider.JwtPayload | undefined;\n        if (typeof provider.verifyToken === \"function\") {\n            // Use custom verification\n            const result = await provider.verifyToken(token);\n            if (result) {\n                return result;\n            }\n            return null;\n        }\n\n        // Otherwise, continue with OIDC best practices, using JWKs.\n\n        // Fetch JWKs from cache\n        const jwks = await this.jwksCache.getKeys(provider.issuer);\n\n        // Find matching JWK using header.kid\n        const jwk = jwks.find(key => key.kid === header.kid);\n        if (!jwk) {\n            return null;\n        }\n\n        if (!verifiedPayload) {\n            // Default JWK verification\n            verifiedPayload = await verifyJwtUsingJwk(token, jwk);\n        }\n\n        // Call verifyTokenClaims if provided\n        if (provider.verifyTokenClaims) {\n            await provider.verifyTokenClaims(verifiedPayload);\n        }\n\n        return verifiedPayload;\n    }\n}\n\nexport const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({\n    implementation: OidcJwtIdentityProviderImpl,\n    dependencies: [[OidcIdentityProvider, { multiple: true }], JwkCache]\n});\n"],"names":["OidcJwtIdentityProviderImpl","oidcIdentityProviders","jwksCache","token","provider","jwt","header","payload","verifiedPayload","providerIdentity","identity","context","undefined","result","jwks","jwk","key","verifyJwtUsingJwk","OidcJwtIdentityProvider","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"mappings":";;AAIA,MAAMA;IACF,YACYC,qBAAuD,EACvDC,SAA6B,CACvC;aAFUD,qBAAqB,GAArBA;aACAC,SAAS,GAATA;IACT;IAEH,aAAaC,KAAqC,EAAW;QACzD,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACC,CAAAA,WAAYA,SAAS,YAAY,CAACD;IAC7E;IAEA,MAAM,YAAYA,KAAa,EAAEE,GAA4B,EAAgC;QACzF,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGF;QAE5B,MAAMD,WAAW,IAAI,CAAC,qBAAqB,CAACG;QAE5C,IAAI,CAACH,UACD,OAAO;QAGX,MAAMI,kBAAkB,MAAM,IAAI,CAAC,WAAW,CAACJ,UAAUD,OAAOG;QAEhE,IAAI,CAACE,iBACD,OAAO;QAIX,MAAMC,mBAAmB,MAAML,SAAS,WAAW,CAACI;QAEpD,MAAME,WAAyB;YAC3B,GAAGD,gBAAgB;YACnB,MAAMA,iBAAiB,IAAI,IAAI;QACnC;QAGA,MAAME,UAAUD,SAAS,OAAO,IAAI;YAAE,iBAAiB;YAAM,iBAAiB;QAAO;QACrF,IAAIC,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAE9B,IAAIA,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAG9BD,SAAS,OAAO,GAAGC;QAEnB,OAAOD;IACX;IAEQ,sBACJH,OAAuC,EACG;QAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACH,CAAAA,WAAYA,SAAS,YAAY,CAACG;IAC7E;IAEA,MAAc,YACVH,QAAwC,EACxCD,KAAa,EACbG,MAAqC,EACvC;QAEE,IAAIE;QACJ,IAAI,AAAgC,cAAhC,OAAOJ,SAAS,WAAW,EAAiB;YAE5C,MAAMS,SAAS,MAAMT,SAAS,WAAW,CAACD;YAC1C,IAAIU,QACA,OAAOA;YAEX,OAAO;QACX;QAKA,MAAMC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACV,SAAS,MAAM;QAGzD,MAAMW,MAAMD,KAAK,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,KAAKV,OAAO,GAAG;QACnD,IAAI,CAACS,KACD,OAAO;QAGX,IAAI,CAACP,iBAEDA,kBAAkB,MAAMS,kBAAkBd,OAAOY;QAIrD,IAAIX,SAAS,iBAAiB,EAC1B,MAAMA,SAAS,iBAAiB,CAACI;QAGrC,OAAOA;IACX;AACJ;AAEO,MAAMU,0BAA0BC,oBAAoB,oBAAoB,CAAC;IAC5E,gBAAgBnB;IAChB,cAAc;QAAC;YAACoB;YAAsB;gBAAE,UAAU;YAAK;SAAE;QAAEC;KAAS;AACxE"}

package/idp/abstractions.js

@@ -1,17 +1,8 @@
 import { createAbstraction } from "@webiny/feature/api";
-
-// Generic Idp Provider
-
-/** Generic identity provider for token-based authentication. */
-export const IdentityProvider = createAbstraction("IdentityProvider");
-/** JWT-specific identity provider for token validation. */
-export const JwtIdentityProvider = createAbstraction("JwtIdentityProvider");
-
-// OIDC Provider
-
-/** OIDC-compliant identity provider with issuer validation. */
-export const OidcIdentityProvider = createAbstraction("OidcIdentityProvider");
-/** Cache for JSON Web Keys used in JWT verification. */
-export const JwkCache = createAbstraction("JwkCache");
+const IdentityProvider = createAbstraction("IdentityProvider");
+const JwtIdentityProvider = createAbstraction("JwtIdentityProvider");
+const OidcIdentityProvider = createAbstraction("OidcIdentityProvider");
+const JwkCache = createAbstraction("JwkCache");
+export { IdentityProvider, JwkCache, JwtIdentityProvider, OidcIdentityProvider };
 
 //# sourceMappingURL=abstractions.js.map

package/idp/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"names":["createAbstraction","IdentityProvider","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"sources":["abstractions.ts"],"sourcesContent":["import type { JwtPayload as IJwtPayload, JwtHeader as IJwtHeader } from \"jsonwebtoken\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IdentityData as IIdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport type { Jwk as IJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\n\nexport type IJwt = {\n    header: IJwtHeader;\n    payload: IJwtPayload;\n};\n\nexport type OptionalExternal<T> = Omit<T, \"external\"> & { external?: boolean };\n\nexport type IProviderIdentityData = Omit<IIdentityData, \"type\" | \"profile\"> & {\n    /**\n     * Defaults to `admin` it omitted.\n     */\n    type?: string;\n    profile?: OptionalExternal<NonNullable<IIdentityData[\"profile\"]>>;\n};\n\n// Generic Idp Provider\nexport interface IIdentityProvider {\n    isApplicable(token: string): boolean;\n    getIdentity(token: string): Promise<IProviderIdentityData | null>;\n}\n\n/** Generic identity provider for token-based authentication. */\nexport const IdentityProvider = createAbstraction<IIdentityProvider>(\"IdentityProvider\");\n\nexport namespace IdentityProvider {\n    export type Interface = IIdentityProvider;\n    export type IdentityData = IProviderIdentityData;\n    export type JwtPayload = IJwtPayload;\n}\n\nexport interface IJwtIdentityProvider {\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;\n}\n\n/** JWT-specific identity provider for token validation. */\nexport const JwtIdentityProvider = createAbstraction<IJwtIdentityProvider>(\"JwtIdentityProvider\");\n\nexport namespace JwtIdentityProvider {\n    export type Interface = IJwtIdentityProvider;\n    export type Jwt = IJwt;\n    export type JwtPayload = IJwtPayload;\n    export type JwtHeader = IJwtHeader;\n    export type IdentityData = IProviderIdentityData;\n}\n\n// OIDC Provider\nexport interface IOidcIdentityProvider {\n    issuer: string;\n    clientId: string;\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(jwt: IJwtPayload): Promise<IProviderIdentityData>;\n    verifyToken?(token: string): Promise<IJwtPayload | undefined>;\n    verifyTokenClaims?(token: IJwtPayload): Promise<void>;\n}\n\n/** OIDC-compliant identity provider with issuer validation. */\nexport const OidcIdentityProvider =\n    createAbstraction<IOidcIdentityProvider>(\"OidcIdentityProvider\");\n\nexport namespace OidcIdentityProvider {\n    export type Interface = IOidcIdentityProvider;\n    export type JwtPayload = IJwtPayload;\n    export type IdentityData = IProviderIdentityData;\n}\n\ninterface IJwkCache {\n    getKeys(issuer: string): Promise<IJwk[]>;\n}\n\n/** Cache for JSON Web Keys used in JWT verification. */\nexport const JwkCache = createAbstraction<IJwkCache>(\"JwkCache\");\nexport namespace JwkCache {\n    export type Interface = IJwkCache;\n    export type Jwk = IJwk;\n}\n"],"mappings":"AACA,SAASA,iBAAiB,QAAQ,qBAAqB;;AAmBvD;;AAMA;AACA,OAAO,MAAMC,gBAAgB,GAAGD,iBAAiB,CAAoB,kBAAkB,CAAC;AAaxF;AACA,OAAO,MAAME,mBAAmB,GAAGF,iBAAiB,CAAuB,qBAAqB,CAAC;;AAUjG;;AAUA;AACA,OAAO,MAAMG,oBAAoB,GAC7BH,iBAAiB,CAAwB,sBAAsB,CAAC;AAYpE;AACA,OAAO,MAAMI,QAAQ,GAAGJ,iBAAiB,CAAY,UAAU,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/abstractions.js","sources":["../../src/idp/abstractions.ts"],"sourcesContent":["import type { JwtPayload as IJwtPayload, JwtHeader as IJwtHeader } from \"jsonwebtoken\";\nimport { createAbstraction } from \"@webiny/feature/api\";\nimport type { IdentityData as IIdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport type { Jwk as IJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\n\nexport type IJwt = {\n    header: IJwtHeader;\n    payload: IJwtPayload;\n};\n\nexport type OptionalExternal<T> = Omit<T, \"external\"> & { external?: boolean };\n\nexport type IProviderIdentityData = Omit<IIdentityData, \"type\" | \"profile\"> & {\n    /**\n     * Defaults to `admin` it omitted.\n     */\n    type?: string;\n    profile?: OptionalExternal<NonNullable<IIdentityData[\"profile\"]>>;\n};\n\n// Generic Idp Provider\nexport interface IIdentityProvider {\n    isApplicable(token: string): boolean;\n    getIdentity(token: string): Promise<IProviderIdentityData | null>;\n}\n\n/** Generic identity provider for token-based authentication. */\nexport const IdentityProvider = createAbstraction<IIdentityProvider>(\"IdentityProvider\");\n\nexport namespace IdentityProvider {\n    export type Interface = IIdentityProvider;\n    export type IdentityData = IProviderIdentityData;\n    export type JwtPayload = IJwtPayload;\n}\n\nexport interface IJwtIdentityProvider {\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;\n}\n\n/** JWT-specific identity provider for token validation. */\nexport const JwtIdentityProvider = createAbstraction<IJwtIdentityProvider>(\"JwtIdentityProvider\");\n\nexport namespace JwtIdentityProvider {\n    export type Interface = IJwtIdentityProvider;\n    export type Jwt = IJwt;\n    export type JwtPayload = IJwtPayload;\n    export type JwtHeader = IJwtHeader;\n    export type IdentityData = IProviderIdentityData;\n}\n\n// OIDC Provider\nexport interface IOidcIdentityProvider {\n    issuer: string;\n    clientId: string;\n    isApplicable(token: IJwtPayload): boolean;\n    getIdentity(jwt: IJwtPayload): Promise<IProviderIdentityData>;\n    verifyToken?(token: string): Promise<IJwtPayload | undefined>;\n    verifyTokenClaims?(token: IJwtPayload): Promise<void>;\n}\n\n/** OIDC-compliant identity provider with issuer validation. */\nexport const OidcIdentityProvider =\n    createAbstraction<IOidcIdentityProvider>(\"OidcIdentityProvider\");\n\nexport namespace OidcIdentityProvider {\n    export type Interface = IOidcIdentityProvider;\n    export type JwtPayload = IJwtPayload;\n    export type IdentityData = IProviderIdentityData;\n}\n\ninterface IJwkCache {\n    getKeys(issuer: string): Promise<IJwk[]>;\n}\n\n/** Cache for JSON Web Keys used in JWT verification. */\nexport const JwkCache = createAbstraction<IJwkCache>(\"JwkCache\");\nexport namespace JwkCache {\n    export type Interface = IJwkCache;\n    export type Jwk = IJwk;\n}\n"],"names":["IdentityProvider","createAbstraction","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"mappings":";AA2BO,MAAMA,mBAAmBC,kBAAqC;AAc9D,MAAMC,sBAAsBD,kBAAwC;AAqBpE,MAAME,uBACTF,kBAAyC;AAatC,MAAMG,WAAWH,kBAA6B"}

package/idp/feature.js

@@ -3,13 +3,14 @@ import { JwtAuthenticator } from "./JwtAuthenticator.js";
 import { JwkCache } from "./abstractions.js";
 import { JwksCache } from "./JwksCache.js";
 import { OidcJwtIdentityProvider } from "./OidcJwtIdentityProvider.js";
-export const IdpAuthenticatorFeature = createFeature({
-  name: "IdpAuthenticator",
-  register(container) {
-    container.register(JwtAuthenticator);
-    container.register(OidcJwtIdentityProvider);
-    container.registerInstance(JwkCache, new JwksCache());
-  }
+const IdpAuthenticatorFeature = createFeature({
+    name: "IdpAuthenticator",
+    register (container) {
+        container.register(JwtAuthenticator);
+        container.register(OidcJwtIdentityProvider);
+        container.registerInstance(JwkCache, new JwksCache());
+    }
 });
+export { IdpAuthenticatorFeature };
 
 //# sourceMappingURL=feature.js.map

package/idp/feature.js.map

@@ -1 +1 @@
-{"version":3,"names":["createFeature","JwtAuthenticator","JwkCache","JwksCache","OidcJwtIdentityProvider","IdpAuthenticatorFeature","name","register","container","registerInstance"],"sources":["feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwkCache } from \"./abstractions.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        container.registerInstance(JwkCache, new JwksCache());\n    }\n});\n"],"mappings":"AAAA,SAASA,aAAa,QAAQ,qBAAqB;AACnD,SAASC,gBAAgB;AACzB,SAASC,QAAQ;AACjB,SAASC,SAAS;AAClB,SAASC,uBAAuB;AAEhC,OAAO,MAAMC,uBAAuB,GAAGL,aAAa,CAAC;EACjDM,IAAI,EAAE,kBAAkB;EACxBC,QAAQA,CAACC,SAAS,EAAE;IAChBA,SAAS,CAACD,QAAQ,CAACN,gBAAgB,CAAC;IACpCO,SAAS,CAACD,QAAQ,CAACH,uBAAuB,CAAC;IAC3CI,SAAS,CAACC,gBAAgB,CAACP,QAAQ,EAAE,IAAIC,SAAS,CAAC,CAAC,CAAC;EACzD;AACJ,CAAC,CAAC","ignoreList":[]}
+{"version":3,"file":"idp/feature.js","sources":["../../src/idp/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { JwtAuthenticator } from \"./JwtAuthenticator.js\";\nimport { JwkCache } from \"./abstractions.js\";\nimport { JwksCache } from \"./JwksCache.js\";\nimport { OidcJwtIdentityProvider } from \"~/idp/OidcJwtIdentityProvider.js\";\n\nexport const IdpAuthenticatorFeature = createFeature({\n    name: \"IdpAuthenticator\",\n    register(container) {\n        container.register(JwtAuthenticator);\n        container.register(OidcJwtIdentityProvider);\n        container.registerInstance(JwkCache, new JwksCache());\n    }\n});\n"],"names":["IdpAuthenticatorFeature","createFeature","container","JwtAuthenticator","OidcJwtIdentityProvider","JwkCache","JwksCache"],"mappings":";;;;;AAMO,MAAMA,0BAA0BC,cAAc;IACjD,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE;QACnBF,UAAU,gBAAgB,CAACG,UAAU,IAAIC;IAC7C;AACJ"}

package/idp/index.js

@@ -1,3 +1 @@
-export { IdentityProvider, OidcIdentityProvider, JwtIdentityProvider } from "./abstractions.js";
-
-//# sourceMappingURL=index.js.map
+export { IdentityProvider, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";

package/idp/types.js

@@ -1,3 +0,0 @@
-export {};
-
-//# sourceMappingURL=types.js.map

package/index.js

@@ -1,3 +1 @@
 export { createApiCore } from "./createApiCore.js";
-
-//# sourceMappingURL=index.js.map