@xemahq/authorization-nest 0.7.1 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authorize.decorator.js +2 -2
- package/dist/authorize.decorator.js.map +1 -1
- package/dist/authzen.transport.d.ts +5 -1
- package/dist/authzen.transport.d.ts.map +1 -1
- package/dist/authzen.transport.js +20 -11
- package/dist/authzen.transport.js.map +1 -1
- package/dist/durable-delegation/carrier-mint.d.ts +1 -1
- package/dist/durable-delegation/carrier-mint.d.ts.map +1 -1
- package/dist/durable-delegation/holder-client.d.ts +2 -2
- package/dist/durable-delegation/holder-client.d.ts.map +1 -1
- package/dist/durable-delegation/holder-client.js +15 -8
- package/dist/durable-delegation/holder-client.js.map +1 -1
- package/dist/durable-delegation/holder-lifecycle.d.ts +4 -2
- package/dist/durable-delegation/holder-lifecycle.d.ts.map +1 -1
- package/dist/durable-delegation/holder-lifecycle.js +10 -2
- package/dist/durable-delegation/holder-lifecycle.js.map +1 -1
- package/dist/durable-delegation/router-replay.d.ts +21 -0
- package/dist/durable-delegation/router-replay.d.ts.map +1 -0
- package/dist/durable-delegation/router-replay.js +27 -0
- package/dist/durable-delegation/router-replay.js.map +1 -0
- package/dist/ephemeral-delegation/ephemeral-delegation.d.ts +10 -5
- package/dist/ephemeral-delegation/ephemeral-delegation.d.ts.map +1 -1
- package/dist/ephemeral-delegation/ephemeral-delegation.js +11 -3
- package/dist/ephemeral-delegation/ephemeral-delegation.js.map +1 -1
- package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts +5 -0
- package/dist/ephemeral-delegation/held-ephemeral-delegation.d.ts.map +1 -0
- package/dist/ephemeral-delegation/held-ephemeral-delegation.js +17 -0
- package/dist/ephemeral-delegation/held-ephemeral-delegation.js.map +1 -0
- package/dist/ephemeral-delegation/issued-ref.d.ts +9 -0
- package/dist/ephemeral-delegation/issued-ref.d.ts.map +1 -0
- package/dist/ephemeral-delegation/issued-ref.js +14 -0
- package/dist/ephemeral-delegation/issued-ref.js.map +1 -0
- package/dist/grant-version.reader.d.ts +2 -1
- package/dist/grant-version.reader.d.ts.map +1 -1
- package/dist/grant-version.reader.js +10 -7
- package/dist/grant-version.reader.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/internal-caller-or-member-context.guard.d.ts.map +1 -1
- package/dist/internal-caller-or-member-context.guard.js +3 -2
- package/dist/internal-caller-or-member-context.guard.js.map +1 -1
- package/dist/organization-delegation-admission.d.ts +2 -1
- package/dist/organization-delegation-admission.d.ts.map +1 -1
- package/dist/organization-delegation-admission.js +10 -2
- package/dist/organization-delegation-admission.js.map +1 -1
- package/dist/relayable-caller.d.ts +1 -1
- package/dist/relayable-caller.d.ts.map +1 -1
- package/dist/relayable-caller.js +3 -3
- package/dist/relayable-caller.js.map +1 -1
- package/dist/route-action-evaluator.d.ts +1 -1
- package/dist/route-action-evaluator.d.ts.map +1 -1
- package/dist/subject-from-context.d.ts +1 -1
- package/dist/subject-from-context.d.ts.map +1 -1
- package/dist/subject-from-context.js +3 -2
- package/dist/subject-from-context.js.map +1 -1
- package/package.json +12 -12
|
@@ -5,7 +5,9 @@ exports.createEphemeralDelegation = createEphemeralDelegation;
|
|
|
5
5
|
exports.createEphemeralSubDelegation = createEphemeralSubDelegation;
|
|
6
6
|
exports.mintEphemeralDelegatedToken = mintEphemeralDelegatedToken;
|
|
7
7
|
exports.revokeEphemeralDelegation = revokeEphemeralDelegation;
|
|
8
|
+
const caller_context_1 = require("@xemahq/contracts/caller-context");
|
|
8
9
|
const identity_client_1 = require("@xemahq/identity-client");
|
|
10
|
+
const issued_ref_1 = require("./issued-ref");
|
|
9
11
|
exports.EPHEMERAL_DELEGATION_MAX_LIFETIME_MS = 10 * 60 * 1000;
|
|
10
12
|
var EphemeralDelegationOperation;
|
|
11
13
|
(function (EphemeralDelegationOperation) {
|
|
@@ -21,6 +23,8 @@ var EphemeralDelegationRefusal;
|
|
|
21
23
|
EphemeralDelegationRefusal["ScopeRequired"] = "scope-required";
|
|
22
24
|
EphemeralDelegationRefusal["Renewable"] = "renewable";
|
|
23
25
|
EphemeralDelegationRefusal["LifetimeExceeded"] = "lifetime-exceeded";
|
|
26
|
+
EphemeralDelegationRefusal["NotIssued"] = "not-issued";
|
|
27
|
+
EphemeralDelegationRefusal["AudienceRequired"] = "audience-required";
|
|
24
28
|
})(EphemeralDelegationRefusal || (exports.EphemeralDelegationRefusal = EphemeralDelegationRefusal = {}));
|
|
25
29
|
class EphemeralDelegationError extends Error {
|
|
26
30
|
operation;
|
|
@@ -89,11 +93,15 @@ async function createEphemeralSubDelegation(client, input, now = new Date()) {
|
|
|
89
93
|
...(parent.realm === undefined ? {} : { realm: parent.realm }),
|
|
90
94
|
});
|
|
91
95
|
}
|
|
92
|
-
async function mintEphemeralDelegatedToken(client, ref, options
|
|
96
|
+
async function mintEphemeralDelegatedToken(client, ref, options) {
|
|
97
|
+
const audience = options?.audience;
|
|
98
|
+
if (!(0, caller_context_1.isReceiverAudience)(audience)) {
|
|
99
|
+
throw new EphemeralDelegationError(EphemeralDelegationOperation.Mint, ref.organizationId, `A context from ephemeral delegation '${ref.delegationId}' must name the one receiver audience it is for.`, EphemeralDelegationRefusal.AudienceRequired);
|
|
100
|
+
}
|
|
93
101
|
try {
|
|
94
102
|
return await client.mintDelegatedContext({
|
|
95
103
|
delegationId: ref.delegationId,
|
|
96
|
-
|
|
104
|
+
audience,
|
|
97
105
|
...(ref.realm === undefined ? {} : { realm: ref.realm }),
|
|
98
106
|
});
|
|
99
107
|
}
|
|
@@ -139,7 +147,7 @@ async function created(client, organizationId, realm, request) {
|
|
|
139
147
|
if (record.organizationId !== organizationId) {
|
|
140
148
|
throw new EphemeralDelegationError(EphemeralDelegationOperation.Create, organizationId, `The boundary returned a delegation for '${String(record.organizationId)}', not '${organizationId}'.`);
|
|
141
149
|
}
|
|
142
|
-
return { delegationId: record.id, organizationId, ...(realm === undefined ? {} : { realm }) };
|
|
150
|
+
return (0, issued_ref_1.markIssued)({ delegationId: record.id, organizationId, ...(realm === undefined ? {} : { realm }) });
|
|
143
151
|
}
|
|
144
152
|
function refused(organizationId, refusal, message) {
|
|
145
153
|
return new EphemeralDelegationError(EphemeralDelegationOperation.Create, organizationId, message, refusal);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/ephemeral-delegation.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/ephemeral-delegation.ts"],"names":[],"mappings":";;;AAoKA,8DA6BC;AAOD,oEAmCC;AAOD,kEA+BC;AAGD,8DAeC;AA9QD,qEAA6F;AAC7F,6DAA0E;AAE1E,6CAA6E;AAYhE,QAAA,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA8BnE,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAJW,4BAA4B,4CAA5B,4BAA4B,QAIvC;AAGD,IAAY,0BAiBX;AAjBD,WAAY,0BAA0B;IAEpC,uDAAyB,CAAA;IAEzB,4DAA8B,CAAA;IAE9B,6EAA+C,CAAA;IAE/C,8DAAgC,CAAA;IAEhC,qDAAuB,CAAA;IAEvB,oEAAsC,CAAA;IAEtC,sDAAwB,CAAA;IAExB,oEAAsC,CAAA;AACxC,CAAC,EAjBW,0BAA0B,0CAA1B,0BAA0B,QAiBrC;AAWD,MAAa,wBAAyB,SAAQ,KAAK;IAI/B;IACA;IAEA;IANF,SAAS,CAAU;IAEnC,YACkB,SAAuC,EACvC,cAAsB,EACtC,OAAe,EACC,OAAoC,EACpD,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QANR,cAAS,GAAT,SAAS,CAA8B;QACvC,mBAAc,GAAd,cAAc,CAAQ;QAEtB,YAAO,GAAP,OAAO,CAA6B;QAIpD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;QAC7B,IAAI,CAAC,SAAS;YACZ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,kCAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/F,CAAC;IAGD,IAAW,YAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,OAAO,KAAK,YAAY,kCAAgB,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,CAAC;CACF;AAtBD,4DAsBC;AAyCM,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,KAAqC,EACrC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,cAAc,KAAK,EAAE,IAAI,KAAK,CAAC,aAAa,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE;QAClD,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,SAAS,EAAE,+BAAa,CAAC,YAAY;QACrC,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC7F,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAChG,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,4BAA4B,CAChD,MAAiC,EACjC,KAAwC,EACxC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,cAAc,KAAK,EAAE,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,UAAU,EACrC,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,aAAa,EACxC,uGAAuG,CACxG,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE;QACnD,QAAQ,EAAE,MAAM,CAAC,YAAY;QAC7B,cAAc;QACd,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,GAAG,CAAC,KAAK,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,GAAG,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACpE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;QACvC,SAAS,EAAE,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK;QAChB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC;AAOM,KAAK,UAAU,2BAA2B,CAC/C,MAA+D,EAC/D,GAA2B,EAC3B,OAAgD;IAIhD,MAAM,QAAQ,GAAa,OAAuD,EAAE,QAAQ,CAAC;IAC7F,IAAI,CAAC,IAAA,mCAAkB,EAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,wCAAwC,GAAG,CAAC,YAAY,kDAAkD,EAC1G,0BAA0B,CAAC,gBAAgB,CAC5C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC;YACvC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ;YACR,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,mEAAmE,GAAG,CAAC,YAAY,IAAI,EACvF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,yBAAyB,CAC7C,MAA2D,EAC3D,GAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,GAAG,CAAC,cAAc,EAClB,yBAAyB,GAAG,CAAC,YAAY,yBAAyB,EAClE,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,cAAsB,EACtB,KAIC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,SAAS,EACpC,qGAAqG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,CAAC,cAAc,EAAE,0BAA0B,CAAC,YAAY,EAAE,4DAA4D,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,oBAAoB,EAC/C,oDAAoD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,SAAS,aAAa,CAAC,cAAsB,EAAE,SAAe,EAAE,GAAS;IACvE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,4CAAoC,EAAE,CAAC;QACzG,MAAM,OAAO,CACX,cAAc,EACd,0BAA0B,CAAC,gBAAgB,EAC3C,4DAA4D,4CAAoC,GAAG,MAAM,8CAA8C,CACxJ,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAAiC,EACjC,cAAsB,EACtB,KAAyB,EACzB,OAAgC;IAEhC,IAAI,MAA+D,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,8DAA8D,cAAc,IAAI,EAChF,SAAS,EACT,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;QAE7C,MAAM,IAAI,wBAAwB,CAChC,4BAA4B,CAAC,MAAM,EACnC,cAAc,EACd,2CAA2C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,cAAc,IAAI,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,uBAAU,EAAC,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,OAAO,CACd,cAAsB,EACtB,OAAmC,EACnC,OAAe;IAEf,OAAO,IAAI,wBAAwB,CAAC,4BAA4B,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7G,CAAC"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import { type HeldEphemeralDelegation } from '@xemahq/xema-service-nest';
|
|
2
|
+
import { type IssuedEphemeralDelegationRef } from './issued-ref';
|
|
3
|
+
import type { EphemeralDelegationClient } from './ephemeral-delegation';
|
|
4
|
+
export declare function heldEphemeralDelegation(minter: Pick<EphemeralDelegationClient, 'mintDelegatedContext'>, ref: IssuedEphemeralDelegationRef): HeldEphemeralDelegation;
|
|
5
|
+
//# sourceMappingURL=held-ephemeral-delegation.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"held-ephemeral-delegation.d.ts","sourceRoot":"","sources":["../../src/ephemeral-delegation/held-ephemeral-delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAQ1G,OAAO,EAAY,KAAK,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAYxE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,IAAI,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,EAC/D,GAAG,EAAE,4BAA4B,GAChC,uBAAuB,CAczB"}
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.heldEphemeralDelegation = heldEphemeralDelegation;
|
|
4
|
+
const xema_service_nest_1 = require("@xemahq/xema-service-nest");
|
|
5
|
+
const ephemeral_delegation_1 = require("./ephemeral-delegation");
|
|
6
|
+
const issued_ref_1 = require("./issued-ref");
|
|
7
|
+
function heldEphemeralDelegation(minter, ref) {
|
|
8
|
+
if (!(0, issued_ref_1.isIssued)(ref)) {
|
|
9
|
+
throw new ephemeral_delegation_1.EphemeralDelegationError(ephemeral_delegation_1.EphemeralDelegationOperation.Mint, ref.organizationId, 'A held ephemeral delegation is produced only from the ref the create call returned in this process.', ephemeral_delegation_1.EphemeralDelegationRefusal.NotIssued);
|
|
10
|
+
}
|
|
11
|
+
return {
|
|
12
|
+
brand: xema_service_nest_1.HELD_EPHEMERAL_DELEGATION_BRAND,
|
|
13
|
+
organizationId: ref.organizationId,
|
|
14
|
+
mintDelegatedContext: ({ audience }) => (0, ephemeral_delegation_1.mintEphemeralDelegatedToken)(minter, ref, { audience }),
|
|
15
|
+
};
|
|
16
|
+
}
|
|
17
|
+
//# sourceMappingURL=held-ephemeral-delegation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"held-ephemeral-delegation.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/held-ephemeral-delegation.ts"],"names":[],"mappings":";;AAsBA,0DAiBC;AAvCD,iEAA0G;AAE1G,iEAKgC;AAChC,6CAA2E;AAc3E,SAAgB,uBAAuB,CACrC,MAA+D,EAC/D,GAAiC;IAEjC,IAAI,CAAC,IAAA,qBAAQ,EAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,+CAAwB,CAChC,mDAA4B,CAAC,IAAI,EACjC,GAAG,CAAC,cAAc,EAClB,qGAAqG,EACrG,iDAA0B,CAAC,SAAS,CACrC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,mDAA+B;QACtC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,oBAAoB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,IAAA,kDAA2B,EAAC,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,9 @@
|
|
|
1
|
+
import type { EphemeralDelegationRef } from './ephemeral-delegation';
|
|
2
|
+
declare const ISSUED_BY_AUTHORIZATION_API: unique symbol;
|
|
3
|
+
export interface IssuedEphemeralDelegationRef extends EphemeralDelegationRef {
|
|
4
|
+
readonly [ISSUED_BY_AUTHORIZATION_API]: true;
|
|
5
|
+
}
|
|
6
|
+
export declare function markIssued(ref: EphemeralDelegationRef): IssuedEphemeralDelegationRef;
|
|
7
|
+
export declare function isIssued(ref: EphemeralDelegationRef): boolean;
|
|
8
|
+
export {};
|
|
9
|
+
//# sourceMappingURL=issued-ref.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"issued-ref.d.ts","sourceRoot":"","sources":["../../src/ephemeral-delegation/issued-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,CAAC,MAAM,2BAA2B,EAAE,OAAO,MAAM,CAAC;AASzD,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,QAAQ,CAAC,CAAC,2BAA2B,CAAC,EAAE,IAAI,CAAC;CAC9C;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,sBAAsB,GAAG,4BAA4B,CAIpF;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAE7D"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.markIssued = markIssued;
|
|
4
|
+
exports.isIssued = isIssued;
|
|
5
|
+
const issued = new WeakSet();
|
|
6
|
+
function markIssued(ref) {
|
|
7
|
+
const frozen = Object.freeze({ ...ref });
|
|
8
|
+
issued.add(frozen);
|
|
9
|
+
return frozen;
|
|
10
|
+
}
|
|
11
|
+
function isIssued(ref) {
|
|
12
|
+
return issued.has(ref);
|
|
13
|
+
}
|
|
14
|
+
//# sourceMappingURL=issued-ref.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"issued-ref.js","sourceRoot":"","sources":["../../src/ephemeral-delegation/issued-ref.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAED,4BAEC;AAXD,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AAGrC,SAAgB,UAAU,CAAC,GAA2B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,OAAO,MAAsC,CAAC;AAChD,CAAC;AAED,SAAgB,QAAQ,CAAC,GAA2B;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
+
import { type ForwardedCallerContext } from '@xemahq/contracts/caller-context';
|
|
1
2
|
import { type ServiceRegistry } from '@xemahq/contracts/service-registry';
|
|
2
3
|
import { IdentityBootstrapService } from '@xemahq/identity-client';
|
|
3
|
-
import { type ForwardedCallerContext } from '@xemahq/platform-common';
|
|
4
4
|
import { type XemaAuthorizationOptions } from './authorization.options';
|
|
5
5
|
export interface AuthorizationGrantVersionReader {
|
|
6
6
|
read(orgId: string, forwardedCaller?: ForwardedCallerContext): Promise<number>;
|
|
@@ -11,6 +11,7 @@ export declare class HttpAuthorizationGrantVersionReader implements Authorizatio
|
|
|
11
11
|
private readonly identityBootstrap;
|
|
12
12
|
private readonly options;
|
|
13
13
|
constructor(registry: ServiceRegistry, identityBootstrap: IdentityBootstrapService, options: XemaAuthorizationOptions);
|
|
14
|
+
private readonly own;
|
|
14
15
|
read(orgId: string, forwardedCaller?: ForwardedCallerContext): Promise<number>;
|
|
15
16
|
}
|
|
16
17
|
export declare function assertGrantVersion(orgId: string, body: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,
|
|
1
|
+
{"version":3,"file":"grant-version.reader.d.ts","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAWnE,OAAO,EAEL,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAC;AAcjC,MAAM,WAAW,+BAA+B;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChF;AAED,eAAO,MAAM,kCAAkC,eAE9C,CAAC;AAKF,qBACa,mCACX,YAAW,+BAA+B;IAIxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,QAAQ,EAAE,eAAe,EACzB,iBAAiB,EAAE,wBAAwB,EAE3C,OAAO,EAAE,wBAAwB;IAKpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAuC;IAE9C,IAAI,CACf,KAAK,EAAE,MAAM,EACb,eAAe,CAAC,EAAE,sBAAsB,GACvC,OAAO,CAAC,MAAM,CAAC;CAmCnB;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAClE,MAAM,CAaR"}
|
|
@@ -15,10 +15,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
15
15
|
exports.HttpAuthorizationGrantVersionReader = exports.AUTHORIZATION_GRANT_VERSION_READER = void 0;
|
|
16
16
|
exports.assertGrantVersion = assertGrantVersion;
|
|
17
17
|
const common_1 = require("@nestjs/common");
|
|
18
|
+
const http_1 = require("@xemahq/contracts/http");
|
|
18
19
|
const service_registry_1 = require("@xemahq/contracts/service-registry");
|
|
19
20
|
const identity_client_1 = require("@xemahq/identity-client");
|
|
20
|
-
const platform_common_1 = require("@xemahq/platform-common");
|
|
21
21
|
const service_registry_nest_1 = require("@xemahq/service-registry-nest");
|
|
22
|
+
const xema_service_nest_1 = require("@xemahq/xema-service-nest");
|
|
22
23
|
const authorization_options_1 = require("./authorization.options");
|
|
23
24
|
const authzen_transport_1 = require("./authzen.transport");
|
|
24
25
|
exports.AUTHORIZATION_GRANT_VERSION_READER = Symbol('AUTHORIZATION_GRANT_VERSION_READER');
|
|
@@ -31,26 +32,28 @@ let HttpAuthorizationGrantVersionReader = class HttpAuthorizationGrantVersionRea
|
|
|
31
32
|
this.registry = registry;
|
|
32
33
|
this.identityBootstrap = identityBootstrap;
|
|
33
34
|
this.options = options;
|
|
35
|
+
this.own = (0, xema_service_nest_1.ownTokenSourceFor)(this.identityBootstrap);
|
|
34
36
|
}
|
|
37
|
+
own;
|
|
35
38
|
async read(orgId, forwardedCaller) {
|
|
36
39
|
const path = `${GRANT_VERSION_PATH}${encodeURIComponent(orgId)}`;
|
|
37
40
|
if (forwardedCaller === undefined) {
|
|
38
41
|
throw new authzen_transport_1.AuthzenCallerContextRequiredError(path);
|
|
39
42
|
}
|
|
43
|
+
if (forwardedCaller.orgId !== orgId) {
|
|
44
|
+
throw new authzen_transport_1.AuthzenCallerOrgMismatchError(path);
|
|
45
|
+
}
|
|
40
46
|
const baseUrl = await (0, service_registry_nest_1.resolveHttpUrl)(this.registry, service_registry_1.ServiceName.AUTHORIZATION_API);
|
|
41
|
-
const
|
|
47
|
+
const init = await (0, xema_service_nest_1.peerCallInit)((0, xema_service_nest_1.peerAuthorityForCaller)(forwardedCaller, this.own), service_registry_1.ServiceName.AUTHORIZATION_API, {
|
|
42
48
|
method: 'GET',
|
|
43
|
-
headers: {
|
|
44
|
-
...(await (0, platform_common_1.forwardedCallerHeaders)(forwardedCaller, this.identityBootstrap)),
|
|
45
|
-
'X-Xema-Org-Id': orgId,
|
|
46
|
-
},
|
|
47
49
|
signal: AbortSignal.timeout(this.options.requestTimeoutMs),
|
|
48
50
|
});
|
|
51
|
+
const response = await fetch(`${baseUrl.replace(/\/+$/, '')}${path}`, init);
|
|
49
52
|
if (!response.ok) {
|
|
50
53
|
const text = await response.text();
|
|
51
54
|
throw new authzen_transport_1.AuthzenPdpError(`authorization-api GET ${path} failed with HTTP ${response.status}: ${text.slice(0, 2000)}`, response.status, undefined);
|
|
52
55
|
}
|
|
53
|
-
const body = (0,
|
|
56
|
+
const body = (0, http_1.unwrapPlatformResponseEnvelope)(await response.json(), `authorization-api GET ${path}`);
|
|
54
57
|
return assertGrantVersion(orgId, body);
|
|
55
58
|
}
|
|
56
59
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"grant-version.reader.js","sourceRoot":"","sources":["../src/grant-version.reader.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAuGA,gDAgBC;AAvHD,2CAAoD;AAEpD,iDAAwE;AACxE,yEAG4C;AAC5C,6DAAmE;AACnE,yEAGuC;AACvC,iEAImC;AAEnC,mEAGiC;AACjC,2DAI6B;AAahB,QAAA,kCAAkC,GAAG,MAAM,CACtD,oCAAoC,CACrC,CAAC;AAGF,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAGpD,IAAM,mCAAmC,GAAzC,MAAM,mCAAmC;IAK3B;IACA;IAEA;IALnB,YAEmB,QAAyB,EACzB,iBAA2C,EAE3C,OAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,sBAAiB,GAAjB,iBAAiB,CAA0B;QAE3C,YAAO,GAAP,OAAO,CAA0B;QAElD,IAAI,CAAC,GAAG,GAAG,IAAA,qCAAiB,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACvD,CAAC;IAEgB,GAAG,CAAuC;IAEpD,KAAK,CAAC,IAAI,CACf,KAAa,EACb,eAAwC;QAExC,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,qDAAiC,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,eAAe,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,iDAA6B,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAA,sCAAc,EAClC,IAAI,CAAC,QAAQ,EACb,8BAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAA,gCAAY,EAC7B,IAAA,0CAAsB,EAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,EACjD,8BAAW,CAAC,iBAAiB,EAC7B;YACE,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC3D,CACF,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAe,CACvB,yBAAyB,IAAI,qBAAqB,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAC3F,QAAQ,CAAC,MAAM,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,qCAA8B,EAGxC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,yBAAyB,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AArDY,kFAAmC;8CAAnC,mCAAmC;IAD/C,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8CAAsB,CAAC,CAAA;IAG9B,WAAA,IAAA,eAAM,EAAC,kDAA0B,CAAC,CAAA;6CADC,0CAAwB;GANnD,mCAAmC,CAqD/C;AAGD,SAAgB,kBAAkB,CAChC,KAAa,EACb,IAAmE;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IACE,IAAI,CAAC,KAAK,KAAK,KAAK;QACpB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,CAAC,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -18,5 +18,7 @@ export * from './durable-delegation/decision-codes';
|
|
|
18
18
|
export * from './durable-delegation/holder-client';
|
|
19
19
|
export * from './durable-delegation/holder-errors';
|
|
20
20
|
export * from './durable-delegation/holder-lifecycle';
|
|
21
|
+
export * from './durable-delegation/router-replay';
|
|
21
22
|
export * from './ephemeral-delegation/ephemeral-delegation';
|
|
23
|
+
export * from './ephemeral-delegation/held-ephemeral-delegation';
|
|
22
24
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,6CAA6C,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,wBAAwB,CAAC;AACvC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2CAA2C,CAAC;AAC1D,cAAc,qCAAqC,CAAC;AACpD,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,kDAAkD,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -34,5 +34,7 @@ __exportStar(require("./durable-delegation/decision-codes"), exports);
|
|
|
34
34
|
__exportStar(require("./durable-delegation/holder-client"), exports);
|
|
35
35
|
__exportStar(require("./durable-delegation/holder-errors"), exports);
|
|
36
36
|
__exportStar(require("./durable-delegation/holder-lifecycle"), exports);
|
|
37
|
+
__exportStar(require("./durable-delegation/router-replay"), exports);
|
|
37
38
|
__exportStar(require("./ephemeral-delegation/ephemeral-delegation"), exports);
|
|
39
|
+
__exportStar(require("./ephemeral-delegation/held-ephemeral-delegation"), exports);
|
|
38
40
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,8EAA4D"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yDAAuC;AACvC,0DAAwC;AACxC,wDAAsC;AACtC,sDAAoC;AACpC,yDAAuC;AACvC,uDAAqC;AACrC,qDAAmC;AACnC,yDAAuC;AACvC,2DAAyC;AACzC,4EAA0D;AAC1D,sEAAoD;AACpD,qDAAmC;AACnC,oEAAkD;AAClD,qEAAmD;AACnD,sEAAoD;AACpD,sEAAoD;AACpD,qEAAmD;AACnD,qEAAmD;AACnD,wEAAsD;AACtD,qEAAmD;AACnD,8EAA4D;AAC5D,mFAAiE"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"internal-caller-or-member-context.guard.d.ts","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"internal-caller-or-member-context.guard.d.ts","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AASxB,OAAO,EAEL,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AASjC,oBAAY,wBAAwB;IAElC,iBAAiB,4BAA4B;IAE7C,iBAAiB,uCAAuC;IAExD,YAAY,kCAAkC;IAE9C,UAAU,gCAAgC;CAC3C;AA2CD,qBACa,kCAAmC,YAAW,WAAW;IAQlE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAP/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;gBAK1B,WAAW,CAAC,EAAE,iBAAiB,YAAA;IAG5C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAmDhD,eAAe;IAY7B,OAAO,CAAC,MAAM;CAQf"}
|
|
@@ -16,6 +16,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
16
16
|
exports.InternalCallerOrMemberContextGuard = exports.MemberContextRefusalCode = void 0;
|
|
17
17
|
const common_1 = require("@nestjs/common");
|
|
18
18
|
const core_1 = require("@nestjs/core");
|
|
19
|
+
const caller_context_1 = require("@xemahq/contracts/caller-context");
|
|
19
20
|
const subject_1 = require("@xemahq/contracts/subject");
|
|
20
21
|
const principal_context_claims_1 = require("@xemahq/identity-client/principal-context-claims");
|
|
21
22
|
const platform_common_1 = require("@xemahq/platform-common");
|
|
@@ -52,7 +53,7 @@ let InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard_1 =
|
|
|
52
53
|
}
|
|
53
54
|
async canActivate(context) {
|
|
54
55
|
const request = context.switchToHttp().getRequest();
|
|
55
|
-
const ctx = request[
|
|
56
|
+
const ctx = request[caller_context_1.REQUEST_CONTEXT];
|
|
56
57
|
if (ctx !== undefined && ctx.subject.kind === subject_1.SubjectKind.Organization) {
|
|
57
58
|
(0, organization_delegation_admission_1.assertOrganizationDelegationAdmitted)(ctx, this.reflector.getAllAndOverride(organization_delegation_admission_1.ACCEPT_ORGANIZATION_DELEGATION_FOR, [
|
|
58
59
|
context.getHandler(),
|
|
@@ -76,7 +77,7 @@ let InternalCallerOrMemberContextGuard = InternalCallerOrMemberContextGuard_1 =
|
|
|
76
77
|
!(await this.boundaryIssuers()).has(claims['iss'])) {
|
|
77
78
|
throw this.refuse(MemberContextRefusalCode.NotBoundaryIssued, ctx, 'A member\'s own context must be a principal context issued by the identity boundary.');
|
|
78
79
|
}
|
|
79
|
-
if (ctx.orgAuthority?.source !==
|
|
80
|
+
if (ctx.orgAuthority?.source !== caller_context_1.OrgAuthoritySource.OrgClaim) {
|
|
80
81
|
throw this.refuse(MemberContextRefusalCode.OrgNotProven, ctx, 'The organization must be the context\'s own tenant claim, not a header alone.');
|
|
81
82
|
}
|
|
82
83
|
if (ctx.orgRole === undefined) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"internal-caller-or-member-context.guard.js","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,uDAAoE;AACpE,+FAAuG;AACvG,
|
|
1
|
+
{"version":3,"file":"internal-caller-or-member-context.guard.js","sourceRoot":"","sources":["../src/internal-caller-or-member-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AACzC,qEAI0C;AAC1C,uDAAoE;AACpE,+FAAuG;AACvG,6DAKiC;AAEjC,2FAG6C;AAI7C,IAAY,wBASX;AATD,WAAY,wBAAwB;IAElC,yEAA6C,CAAA;IAE7C,oFAAwD,CAAA;IAExD,0EAA8C,CAAA;IAE9C,sEAA0C,CAAA;AAC5C,CAAC,EATW,wBAAwB,wCAAxB,wBAAwB,QASnC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAAA,OAAO,SAAS,CAAC;IAAA,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAClD,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AA+BM,IAAM,kCAAkC,0CAAxC,MAAM,kCAAkC;IAQ1B;IAPF,MAAM,GAAG,IAAI,eAAM,CAAC,oCAAkC,CAAC,IAAI,CAAC,CAAC;IAC7D,cAAc,GAAG,IAAI,qCAAmB,EAAE,CAAC;IAC3C,SAAS,GAAG,IAAI,gBAAS,EAAE,CAAC;IAE7C,YAGmB,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA2B,CAAC;QAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,gCAAe,CAA+B,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,YAAY,EAAE,CAAC;YAIvE,IAAA,wEAAoC,EAClC,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAqB,sEAAkC,EAAE;gBACvF,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,CACH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,UAAU;YACxC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;YAED,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,KAAK,oBAAU,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,GAAG,EAC/D,wFAAwF,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,uCAAqB,CAAC,KAAK,0CAAe;YACjD,MAAM,CAAC,cAAc,CAAC,KAAK,6CAAkB,CAAC,IAAI;YAClD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YACjC,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAClD,CAAC;YACD,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,GAAG,EAC/D,sFAAsF,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,mCAAkB,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,YAAY,EAAE,GAAG,EAC1D,+EAA+E,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,UAAU,EAAE,GAAG,EACxD,0DAA0D,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAGO,KAAK,CAAC,eAAe;QAC3B,MAAM,UAAU,GACd,IAAI,CAAC,WAAW,EAAE,sBAAsB,KAAK,SAAS;YACpD,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE;YACjD,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,IAAI,GAAG,CACZ,UAAU;aACP,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC;aAChD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAChC,CAAC;IACJ,CAAC;IAEO,MAAM,CACZ,IAA8B,EAC9B,GAAmB,EACnB,OAAe;QAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAlFY,gFAAkC;6CAAlC,kCAAkC;IAD9C,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qCAAmB,CAAC,CAAA;;GAPnB,kCAAkC,CAkF9C"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { type RequestContext } from '@xemahq/
|
|
1
|
+
import { type RequestContext } from '@xemahq/contracts/caller-context';
|
|
2
2
|
export declare const ACCEPT_ORGANIZATION_DELEGATION_FOR = "xema:accept-organization-delegation-for";
|
|
3
3
|
export declare enum OrganizationDelegationRefusalCode {
|
|
4
4
|
NotAccepted = "ORGANIZATION_DELEGATION_NOT_ACCEPTED",
|
|
@@ -7,4 +7,5 @@ export declare enum OrganizationDelegationRefusalCode {
|
|
|
7
7
|
}
|
|
8
8
|
export declare function AcceptOrganizationDelegationFor(capability: string): MethodDecorator & ClassDecorator;
|
|
9
9
|
export declare function assertOrganizationDelegationAdmitted(ctx: RequestContext, operation: string | undefined): void;
|
|
10
|
+
export declare function admitsAsOrganizationDelegate(ctx: RequestContext, operation: string): boolean;
|
|
10
11
|
//# sourceMappingURL=organization-delegation-admission.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organization-delegation-admission.d.ts","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"organization-delegation-admission.d.ts","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAQ1C,eAAO,MAAM,kCAAkC,4CAA4C,CAAC;AAG5F,oBAAY,iCAAiC;IAE3C,WAAW,yCAAyC;IAEpD,kBAAkB,iDAAiD;IAEnE,gBAAgB,+CAA+C;CAChE;AAOD,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,GAAG,cAAc,CAKpG;AAiBD,wBAAgB,oCAAoC,CAClD,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAgCN;AAUD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAM5F"}
|
|
@@ -3,9 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
3
3
|
exports.OrganizationDelegationRefusalCode = exports.ACCEPT_ORGANIZATION_DELEGATION_FOR = void 0;
|
|
4
4
|
exports.AcceptOrganizationDelegationFor = AcceptOrganizationDelegationFor;
|
|
5
5
|
exports.assertOrganizationDelegationAdmitted = assertOrganizationDelegationAdmitted;
|
|
6
|
+
exports.admitsAsOrganizationDelegate = admitsAsOrganizationDelegate;
|
|
6
7
|
const common_1 = require("@nestjs/common");
|
|
8
|
+
const caller_context_1 = require("@xemahq/contracts/caller-context");
|
|
7
9
|
const subject_1 = require("@xemahq/contracts/subject");
|
|
8
|
-
const platform_common_1 = require("@xemahq/platform-common");
|
|
9
10
|
exports.ACCEPT_ORGANIZATION_DELEGATION_FOR = 'xema:accept-organization-delegation-for';
|
|
10
11
|
var OrganizationDelegationRefusalCode;
|
|
11
12
|
(function (OrganizationDelegationRefusalCode) {
|
|
@@ -29,7 +30,7 @@ function assertOrganizationDelegationAdmitted(ctx, operation) {
|
|
|
29
30
|
orgId.length === 0 ||
|
|
30
31
|
ctx.subject.id !== orgId ||
|
|
31
32
|
ctx.orgAuthority === undefined ||
|
|
32
|
-
!(0,
|
|
33
|
+
!(0, caller_context_1.isOrgAuthorityProven)(ctx.orgAuthority)) {
|
|
33
34
|
throw refusal(OrganizationDelegationRefusalCode.NotOwnOrganization, 'An organization is admitted only under its own verified delegation, for the organization the request names.');
|
|
34
35
|
}
|
|
35
36
|
const verdict = (0, subject_1.evaluateDelegatedAuthority)({
|
|
@@ -41,6 +42,13 @@ function assertOrganizationDelegationAdmitted(ctx, operation) {
|
|
|
41
42
|
throw refusal(OrganizationDelegationRefusalCode.OperationNotLent, `The organization's delegation does not lend ${operation}.`);
|
|
42
43
|
}
|
|
43
44
|
}
|
|
45
|
+
function admitsAsOrganizationDelegate(ctx, operation) {
|
|
46
|
+
if (ctx.subject.kind !== subject_1.SubjectKind.Organization) {
|
|
47
|
+
return false;
|
|
48
|
+
}
|
|
49
|
+
assertOrganizationDelegationAdmitted(ctx, operation);
|
|
50
|
+
return true;
|
|
51
|
+
}
|
|
44
52
|
function refusal(code, message) {
|
|
45
53
|
return new common_1.ForbiddenException({ code, message });
|
|
46
54
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organization-delegation-admission.js","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"organization-delegation-admission.js","sourceRoot":"","sources":["../src/organization-delegation-admission.ts"],"names":[],"mappings":";;;AA6BA,0EAKC;AAiBD,oFAmCC;AAUD,oEAMC;AAtGD,2CAAiE;AACjE,qEAG0C;AAC1C,uDAImC;AAGtB,QAAA,kCAAkC,GAAG,yCAAyC,CAAC;AAG5F,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAE3C,yFAAoD,CAAA;IAEpD,wGAAmE,CAAA;IAEnE,oGAA+D,CAAA;AACjE,CAAC,EAPW,iCAAiC,iDAAjC,iCAAiC,QAO5C;AAOD,SAAgB,+BAA+B,CAAC,UAAkB;IAChE,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,IAAA,oBAAW,EAAC,0CAAkC,EAAE,UAAU,CAAC,CAAC;AACrE,CAAC;AAiBD,SAAgB,oCAAoC,CAClD,GAAmB,EACnB,SAA6B;IAE7B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,CACX,iCAAiC,CAAC,WAAW,EAC7C,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/B,IACE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,YAAY;QAC7C,GAAG,CAAC,UAAU,KAAK,SAAS;QAC5B,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK;QACxB,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,CAAC,IAAA,qCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC,EACvC,CAAC;QACD,MAAM,OAAO,CACX,iCAAiC,CAAC,kBAAkB,EACpD,6GAA6G,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,oCAA0B,EAAC;QACzC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;QAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,SAAS;KACtB,CAAC,CAAC;IACH,IAAI,OAAO,KAAK,mCAAyB,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,OAAO,CACX,iCAAiC,CAAC,gBAAgB,EAClD,+CAA+C,SAAS,GAAG,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAUD,SAAgB,4BAA4B,CAAC,GAAmB,EAAE,SAAiB;IACjF,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAW,CAAC,YAAY,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,oCAAoC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,IAAuC,EAAE,OAAe;IACvE,OAAO,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACnD,CAAC"}
|
|
@@ -1,3 +1,3 @@
|
|
|
1
|
-
import { type ForwardedCallerContext, type RequestContext } from '@xemahq/
|
|
1
|
+
import { type ForwardedCallerContext, type RequestContext } from '@xemahq/contracts/caller-context';
|
|
2
2
|
export declare function relayableCallerContext(ctx: RequestContext, orgId: string | undefined): ForwardedCallerContext | undefined;
|
|
3
3
|
//# sourceMappingURL=relayable-caller.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"relayable-caller.d.ts","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,
|
|
1
|
+
{"version":3,"file":"relayable-caller.d.ts","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAa1C,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,sBAAsB,GAAG,SAAS,CAOpC"}
|
package/dist/relayable-caller.js
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.relayableCallerContext = relayableCallerContext;
|
|
4
|
-
const
|
|
4
|
+
const caller_context_1 = require("@xemahq/contracts/caller-context");
|
|
5
5
|
function relayableCallerContext(ctx, orgId) {
|
|
6
6
|
return ctx.orgAuthority !== undefined &&
|
|
7
7
|
orgId !== undefined &&
|
|
8
|
-
(0,
|
|
8
|
+
(0, caller_context_1.isOrgAuthorityProven)(ctx.orgAuthority) &&
|
|
9
9
|
ctx.orgAuthority.assertedOrgId === orgId
|
|
10
|
-
? (0,
|
|
10
|
+
? (0, caller_context_1.forwardCallerContext)(ctx)
|
|
11
11
|
: undefined;
|
|
12
12
|
}
|
|
13
13
|
//# sourceMappingURL=relayable-caller.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"relayable-caller.js","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":";;AAkBA,wDAUC;AA5BD,
|
|
1
|
+
{"version":3,"file":"relayable-caller.js","sourceRoot":"","sources":["../src/relayable-caller.ts"],"names":[],"mappings":";;AAkBA,wDAUC;AA5BD,qEAK0C;AAa1C,SAAgB,sBAAsB,CACpC,GAAmB,EACnB,KAAyB;IAEzB,OAAO,GAAG,CAAC,YAAY,KAAK,SAAS;QACnC,KAAK,KAAK,SAAS;QACnB,IAAA,qCAAoB,EAAC,GAAG,CAAC,YAAY,CAAC;QACtC,GAAG,CAAC,YAAY,CAAC,aAAa,KAAK,KAAK;QACxC,CAAC,CAAC,IAAA,qCAAoB,EAAC,GAAG,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { type CapabilityRef } from '@xemahq/contracts/capability';
|
|
2
2
|
import { type AuthorizationGrantVersionReader } from './grant-version.reader';
|
|
3
3
|
import { XemaPolicyDecisions } from './policy-decisions';
|
|
4
|
-
import type { RequestContext } from '@xemahq/
|
|
4
|
+
import type { RequestContext } from '@xemahq/contracts/caller-context';
|
|
5
5
|
export interface RouteActionCandidate<Action extends string> {
|
|
6
6
|
readonly key: string;
|
|
7
7
|
readonly action: Action;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"route-action-evaluator.d.ts","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA8B,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"route-action-evaluator.d.ts","sourceRoot":"","sources":["../src/route-action-evaluator.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAUlE,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA8B,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGrF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,MAAM,WAAW,oBAAoB,CAAC,MAAM,SAAS,MAAM;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;CACvC;AAGD,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAEhF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,qBAAqB,CAAC,MAAM,SAAS,MAAM;IAE1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAGD,oBAAY,0BAA0B;IACpC,QAAQ,kCAAkC;IAC1C,YAAY,sCAAsC;IAClD,KAAK,8BAA8B;IACnC,eAAe,yCAAyC;IACxD,WAAW,oCAAoC;CAChD;AA6BD,qBACa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,SAAS,EAAE,mBAAmB,EAE9B,aAAa,EAAE,+BAA+B;IAGpD,QAAQ,CAAC,MAAM,SAAS,MAAM,EACzC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,gBAAgB,EACvB,UAAU,EAAE,SAAS,oBAAoB,CAAC,MAAM,CAAC,EAAE,GAClD,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;CAsD1C"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { type XemaAuthzenContext, type XemaAuthzenSubject } from '@xemahq/contracts/authzen';
|
|
2
|
-
import { type RequestContext } from '@xemahq/
|
|
2
|
+
import { type RequestContext } from '@xemahq/contracts/caller-context';
|
|
3
3
|
export declare class UnevaluableSubjectError extends Error {
|
|
4
4
|
constructor(kind: string);
|
|
5
5
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"subject-from-context.d.ts","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"subject-from-context.d.ts","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,kCAAkC,CAAC;AAW1C,qBAAa,uBAAwB,SAAQ,KAAK;gBAC7B,IAAI,EAAE,MAAM;CAOhC;AAMD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAE/D;AAmBD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,GAClB,kBAAkB,CAgBpB;AAGD,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,cAAc,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAYpB;AAWD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACxD;AAGD,MAAM,MAAM,WAAW,GAAG,cAAc,GAAG,cAAc,CAAC;AAE1D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,IAAI,cAAc,CAE9E;AAGD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,kBAAkB,CAQxE;AAGD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EACnB,KAAK,GAAE;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,kBAAkB,CAapB;AAGD,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAMtD"}
|
|
@@ -9,8 +9,9 @@ exports.authzenSubjectOf = authzenSubjectOf;
|
|
|
9
9
|
exports.authzenContextOf = authzenContextOf;
|
|
10
10
|
exports.authzOrgOf = authzOrgOf;
|
|
11
11
|
const authzen_1 = require("@xemahq/contracts/authzen");
|
|
12
|
+
const caller_context_1 = require("@xemahq/contracts/caller-context");
|
|
12
13
|
const subject_1 = require("@xemahq/contracts/subject");
|
|
13
|
-
const
|
|
14
|
+
const tenant_1 = require("@xemahq/contracts/tenant");
|
|
14
15
|
class UnevaluableSubjectError extends Error {
|
|
15
16
|
constructor(kind) {
|
|
16
17
|
super(`The request's subject kind "${kind}" is not an AuthZEN subject the Xema PDP evaluates ` +
|
|
@@ -29,7 +30,7 @@ function authzenSubjectFromContext(ctx) {
|
|
|
29
30
|
throw new UnevaluableSubjectError(kind);
|
|
30
31
|
}
|
|
31
32
|
const instrument = kind === subject_1.SubjectKind.User
|
|
32
|
-
? (0,
|
|
33
|
+
? (0, caller_context_1.resolveOrgAuthorityInstrument)(ctx, tenant_1.OrgRole.Admin)
|
|
33
34
|
: undefined;
|
|
34
35
|
return authzen_1.XemaAuthzenSubjectSchema.parse({
|
|
35
36
|
type: kind,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"subject-from-context.js","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":";;;AAkCA,gDAEC;AAmBD,8DAkBC;AAGD,8DAeC;AAqBD,4CAEC;AAGD,4CAQC;AAGD,4CAgBC;AAGD,gCAMC;AAzJD,uDAKmC;AACnC,uDAAwD;AACxD,
|
|
1
|
+
{"version":3,"file":"subject-from-context.js","sourceRoot":"","sources":["../src/subject-from-context.ts"],"names":[],"mappings":";;;AAkCA,gDAEC;AAmBD,8DAkBC;AAGD,8DAeC;AAqBD,4CAEC;AAGD,4CAQC;AAGD,4CAgBC;AAGD,gCAMC;AAzJD,uDAKmC;AACnC,qEAG0C;AAC1C,uDAAwD;AACxD,qDAAmD;AASnD,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAmB,IAAY;QAC7B,KAAK,CACH,+BAA+B,IAAI,qDAAqD;YACtF,2CAA2C,CAC9C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC;IAC3C,CAAC;CACF;AARD,0DAQC;AAGD,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,oCAA0B,CAAC,CAAC;AAGjF,SAAgB,kBAAkB,CAAC,MAAmB;IACpD,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAmBD,SAAgB,yBAAyB,CACvC,GAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,UAAU,GACd,IAAI,KAAK,qBAAW,CAAC,IAAI;QACvB,CAAC,CAAC,IAAA,8CAA6B,EAAC,GAAG,EAAE,gBAAO,CAAC,KAAK,CAAC;QACnD,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO,kCAAwB,CAAC,KAAK,CAAC;QACpC,IAAI,EAAE,IAAI;QACV,EAAE;QACF,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC;KAClD,CAAC,CAAC;AACL,CAAC;AAGD,SAAgB,yBAAyB,CACvC,GAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC;AACJ,CAAC;AAqBD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,OAAQ,MAAkC,CAAC,IAAI,KAAK,WAAW,CAAC;AAClE,CAAC;AAGD,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,kCAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9F,CAAC;AAGD,SAAgB,gBAAgB,CAC9B,MAAmB,EACnB,QAAyE,EAAE;IAE3E,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAGD,SAAgB,UAAU,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/authorization-nest",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"description": "AuthZEN 1.0 PEP for Xema services: one Nest module, an AuthZEN client against authorization-api, and the @Authorize route guard.",
|
|
5
5
|
"publishConfig": {
|
|
6
6
|
"registry": "https://registry.npmjs.org/",
|
|
@@ -14,23 +14,23 @@
|
|
|
14
14
|
"peerDependencies": {
|
|
15
15
|
"@nestjs/common": "^11.1.18",
|
|
16
16
|
"@nestjs/core": "^11.1.18",
|
|
17
|
-
"@xemahq/contracts": "
|
|
18
|
-
"@xemahq/identity-client": "
|
|
19
|
-
"@xemahq/platform-common": "
|
|
20
|
-
"@xemahq/service-registry-nest": "^1.
|
|
21
|
-
"@xemahq/xema-service-nest": "^
|
|
17
|
+
"@xemahq/contracts": ">=0.86.0",
|
|
18
|
+
"@xemahq/identity-client": ">=0.28.0",
|
|
19
|
+
"@xemahq/platform-common": ">=0.83.1",
|
|
20
|
+
"@xemahq/service-registry-nest": "^1.1.0",
|
|
21
|
+
"@xemahq/xema-service-nest": "^13.0.0",
|
|
22
22
|
"zod": "^4.6.1"
|
|
23
23
|
},
|
|
24
24
|
"devDependencies": {
|
|
25
25
|
"@nestjs/common": "11.1.18",
|
|
26
26
|
"@nestjs/core": "11.1.18",
|
|
27
27
|
"@nestjs/testing": "11.1.18",
|
|
28
|
-
"@xemahq/contracts": "^0.
|
|
29
|
-
"@xemahq/eslint-config": "^0.14.
|
|
28
|
+
"@xemahq/contracts": "^0.91.0",
|
|
29
|
+
"@xemahq/eslint-config": "^0.14.1",
|
|
30
30
|
"@xemahq/identity-client": "^0.28.0",
|
|
31
|
-
"@xemahq/platform-common": "^0.
|
|
32
|
-
"@xemahq/service-registry-nest": "^1.
|
|
33
|
-
"@xemahq/xema-service-nest": "^
|
|
31
|
+
"@xemahq/platform-common": "^0.83.1",
|
|
32
|
+
"@xemahq/service-registry-nest": "^1.1.0",
|
|
33
|
+
"@xemahq/xema-service-nest": "^14.1.1",
|
|
34
34
|
"@types/jest": "^30.0.0",
|
|
35
35
|
"@types/node": "25.2.3",
|
|
36
36
|
"eslint": "^9.39.4",
|
|
@@ -64,6 +64,6 @@
|
|
|
64
64
|
"test": "jest --config jest.config.ts"
|
|
65
65
|
},
|
|
66
66
|
"xemaRelease": {
|
|
67
|
-
"sourceDigest": "sha256:
|
|
67
|
+
"sourceDigest": "sha256:bc1b1600484372049b3ee88307ea83e6bc0ca710e7e971a23d02531ae6fa0baa"
|
|
68
68
|
}
|
|
69
69
|
}
|