@xemahq/platform-common 0.12.8 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +0 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +0 -1
- package/dist/index.js.map +1 -1
- package/dist/lib/errors/pipeline-errors.d.ts +0 -4
- package/dist/lib/errors/pipeline-errors.d.ts.map +1 -1
- package/dist/lib/errors/pipeline-errors.js +1 -8
- package/dist/lib/errors/pipeline-errors.js.map +1 -1
- package/dist/lib/xema-path-builder.d.ts +1 -1
- package/dist/lib/xema-path-builder.d.ts.map +1 -1
- package/dist/lib/xema-path-builder.js +0 -3
- package/dist/lib/xema-path-builder.js.map +1 -1
- package/dist/nestjs/auth/realm-token-verifier.d.ts +30 -0
- package/dist/nestjs/auth/realm-token-verifier.d.ts.map +1 -0
- package/dist/nestjs/auth/realm-token-verifier.js +161 -0
- package/dist/nestjs/auth/realm-token-verifier.js.map +1 -0
- package/dist/nestjs/auth/service-token.guard.d.ts +6 -8
- package/dist/nestjs/auth/service-token.guard.d.ts.map +1 -1
- package/dist/nestjs/auth/service-token.guard.js +21 -101
- package/dist/nestjs/auth/service-token.guard.js.map +1 -1
- package/dist/nestjs/jwt-verification.guard.d.ts +2 -16
- package/dist/nestjs/jwt-verification.guard.d.ts.map +1 -1
- package/dist/nestjs/jwt-verification.guard.js +6 -149
- package/dist/nestjs/jwt-verification.guard.js.map +1 -1
- package/package.json +2 -2
package/dist/index.d.ts
CHANGED
|
@@ -30,7 +30,6 @@ export * from './lib/request-context';
|
|
|
30
30
|
export * from './lib/resolve-acting-user';
|
|
31
31
|
export * from './lib/safe-truncate';
|
|
32
32
|
export * from './lib/vote-feedback';
|
|
33
|
-
export * from './lib/write-policy';
|
|
34
33
|
export * from './lib/interactive-workspace-layout';
|
|
35
34
|
export * from './lib/xema-path-builder';
|
|
36
35
|
export * from './lib/interaction-widgets/index';
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AAMpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAI1C,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AAMpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAI1C,OAAO,KAAK,SAAS,MAAM,uBAAuB,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oCAAoC,CAAC;AACnD,cAAc,yBAAyB,CAAC;AAGxC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAG1C,cAAc,oCAAoC,CAAC;AAGnD,cAAc,wBAAwB,CAAC;AAGvC,cAAc,sBAAsB,CAAC;AAGrC,cAAc,gBAAgB,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -69,7 +69,6 @@ __exportStar(require("./lib/request-context"), exports);
|
|
|
69
69
|
__exportStar(require("./lib/resolve-acting-user"), exports);
|
|
70
70
|
__exportStar(require("./lib/safe-truncate"), exports);
|
|
71
71
|
__exportStar(require("./lib/vote-feedback"), exports);
|
|
72
|
-
__exportStar(require("./lib/write-policy"), exports);
|
|
73
72
|
__exportStar(require("./lib/interactive-workspace-layout"), exports);
|
|
74
73
|
__exportStar(require("./lib/xema-path-builder"), exports);
|
|
75
74
|
__exportStar(require("./lib/interaction-widgets/index"), exports);
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,0DAAwC;AACxC,sDAAoC;AAMpC,2DAAyC;AACzC,4DAA0C;AAI1C,mEAAmD;AACnD,oEAAkD;AAClD,wEAAsD;AACtD,0DAAwC;AACxC,mDAAiC;AACjC,4DAA0C;AAC1C,oDAAkC;AAClC,+DAA6C;AAC7C,0DAAwC;AACxC,6DAA2C;AAC3C,oDAAkC;AAClC,yDAAuC;AACvC,iEAA+C;AAC/C,wDAAsC;AACtC,4DAA0C;AAC1C,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,sDAAoC;AACpC,2DAAyC;AACzC,uDAAqC;AACrC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,4DAA0C;AAC1C,sDAAoC;AACpC,sDAAoC;AACpC,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQA,0DAAwC;AACxC,sDAAoC;AAMpC,2DAAyC;AACzC,4DAA0C;AAI1C,mEAAmD;AACnD,oEAAkD;AAClD,wEAAsD;AACtD,0DAAwC;AACxC,mDAAiC;AACjC,4DAA0C;AAC1C,oDAAkC;AAClC,+DAA6C;AAC7C,0DAAwC;AACxC,6DAA2C;AAC3C,oDAAkC;AAClC,yDAAuC;AACvC,iEAA+C;AAC/C,wDAAsC;AACtC,4DAA0C;AAC1C,yDAAuC;AACvC,yDAAuC;AACvC,gEAA8C;AAC9C,sDAAoC;AACpC,2DAAyC;AACzC,uDAAqC;AACrC,wDAAsC;AACtC,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,4DAA0C;AAC1C,sDAAoC;AACpC,sDAAoC;AACpC,qEAAmD;AACnD,0DAAwC;AAGxC,kEAAgD;AAChD,uDAAqC;AACrC,2DAAyC;AACzC,4DAA0C;AAG1C,qEAAmD;AAGnD,yDAAuC;AAGvC,uDAAqC;AAGrC,iDAA+B"}
|
|
@@ -3,10 +3,6 @@ export declare abstract class PipelineError extends Error {
|
|
|
3
3
|
readonly causeError: unknown;
|
|
4
4
|
protected constructor(message: string, cause?: unknown);
|
|
5
5
|
}
|
|
6
|
-
export declare class MissingWritePolicyError extends PipelineError {
|
|
7
|
-
readonly kind: "missing-write-policy";
|
|
8
|
-
constructor(message?: string);
|
|
9
|
-
}
|
|
10
6
|
export declare class CredentialRefreshError extends PipelineError {
|
|
11
7
|
readonly scope: 'llm' | 'mcp';
|
|
12
8
|
readonly allocationId: string | undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pipeline-errors.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/pipeline-errors.ts"],"names":[],"mappings":"AA0BA,8BAAsB,aAAc,SAAQ,KAAK;IAE/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAG/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAQvD;
|
|
1
|
+
{"version":3,"file":"pipeline-errors.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/pipeline-errors.ts"],"names":[],"mappings":"AA0BA,8BAAsB,aAAc,SAAQ,KAAK;IAE/C,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAG/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAE7B,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAQvD;AAWD,qBAAa,sBAAuB,SAAQ,aAAa;IAIrD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM;IALtC,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;gBAE5C,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,KAAK,GAAG,KAAK,EACpB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,mBAAmB,EAAE,MAAM,EACpC,KAAK,CAAC,EAAE,OAAO;CAIlB;AAGD,qBAAa,iBAAkB,SAAQ,aAAa;IAErB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IADtD,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGxE;AAGD,qBAAa,yBAA0B,SAAQ,aAAa;IAIxD,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAJzB,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBAEhD,OAAO,EAAE,MAAM,EACN,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACvB,KAAK,CAAC,EAAE,OAAO;CAIlB;AAGD,qBAAa,6BAA8B,SAAQ,aAAa;IAC9D,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAG7C;AAGD,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,QAAQ,CAAC,IAAI,EAAG,kBAAkB,CAAU;gBAChC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAG7C;AAGD,qBAAa,0BAA2B,SAAQ,aAAa;IAE9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IADtD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBACvC,OAAO,EAAE,MAAM,EAAW,QAAQ,EAAE,MAAM;CAGvD;AAGD,qBAAa,uBAAwB,SAAQ,aAAa;IAItD,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC;IAHlD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBAE7C,OAAO,EAAE,MAAM,EACN,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,EAChD,KAAK,CAAC,EAAE,OAAO;CAIlB;AAGD,qBAAa,gBAAiB,SAAQ,aAAa;IAEpB,QAAQ,CAAC,YAAY,EAAE,MAAM;IAD1D,QAAQ,CAAC,IAAI,EAAG,cAAc,CAAU;gBAC5B,OAAO,EAAE,MAAM,EAAW,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAG5E;AAKD,qBAAa,qBAAsB,SAAQ,aAAa;IAEzB,QAAQ,CAAC,MAAM,EAAE,MAAM;IADpD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACjC,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAGtE;AAQD,qBAAa,wBAAyB,SAAQ,aAAa;IAE5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IAD9D,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBACpC,OAAO,EAAE,MAAM,EAAW,gBAAgB,EAAE,MAAM;CAG/D;AAGD,qBAAa,kBAAmB,SAAQ,aAAa;IAIjD,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM;IAJ7B,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAExC,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAC3B,KAAK,CAAC,EAAE,OAAO;CAIlB;AAGD,qBAAa,yBAA0B,SAAQ,aAAa;IAIxD,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;IAJhD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBAEhD,OAAO,EAAE,MAAM,EACN,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC;CAIjD;AAGD,qBAAa,wBAAyB,SAAQ,aAAa;IAE5B,QAAQ,CAAC,OAAO,EAAE,MAAM;IADrD,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBACrC,OAAO,EAAE,MAAM,EAAW,OAAO,EAAE,MAAM;CAGtD;AAMD,qBAAa,kCAAmC,SAAQ,aAAa;IAIjE,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC;IAL1C,QAAQ,CAAC,IAAI,EAAG,kCAAkC,CAAU;gBAE1D,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC;CAI3C;AAgBD,qBAAa,yBAA0B,SAAQ,aAAa;IAIxD,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO;IAL7B,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;gBAExD,OAAO,EAAE,MAAM,EACN,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO;CAI9B;AAOD,qBAAa,iCAAkC,SAAQ,aAAa;IAIhE,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM;IAJhC,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;gBAExD,OAAO,EAAE,MAAM,EACN,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM;CAIjC;AASD,qBAAa,2BAA4B,SAAQ,aAAa;IAI1D,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO;IAJ7B,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;gBAEnD,OAAO,EAAE,MAAM,EACN,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,OAAO;CAI9B;AAGD,qBAAa,8BAA+B,SAAQ,aAAa;IAI7D,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM;IAJpC,QAAQ,CAAC,IAAI,EAAG,8BAA8B,CAAU;gBAEtD,OAAO,EAAE,MAAM,EACN,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,MAAM;CAIrC;AAWD,qBAAa,uCAAwC,SAAQ,aAAa;IAItE,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM;IAJhC,QAAQ,CAAC,IAAI,EAAG,uCAAuC,CAAU;gBAE/D,OAAO,EAAE,MAAM,EACN,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM;CAIjC;AAKD,qBAAa,iCAAkC,SAAQ,aAAa;IAClE,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;gBAC9C,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAG7C;AAMD,qBAAa,6BAA8B,SAAQ,aAAa;IAI5D,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM;IALhC,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAEpD,OAAO,EAAE,MAAM,EACN,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM;CAIjC;AAGD,qBAAa,qBAAsB,SAAQ,aAAa;IAIpD,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC;IAHpD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBAE3C,OAAO,EAAE,MAAM,EACN,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAAC,EAClD,KAAK,CAAC,EAAE,OAAO;CAIlB;AASD,qBAAa,wBAAyB,SAAQ,aAAa;IAIvD,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,gBAAgB;IAJxE,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBAE/C,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,gBAAgB;CAIzE;AAGD,qBAAa,4BAA6B,SAAQ,aAAa;IAEhC,QAAQ,CAAC,SAAS,EAAE,OAAO;IADxD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,OAAO,EAAE,MAAM,EAAW,SAAS,EAAE,OAAO;CAGzD;AAGD,qBAAa,uBAAwB,SAAQ,aAAa;IAE3B,QAAQ,CAAC,OAAO,EAAE,MAAM;IADrD,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;gBACrC,OAAO,EAAE,MAAM,EAAW,OAAO,EAAE,MAAM;CAGtD;AAGD,qBAAa,wBAAyB,SAAQ,aAAa;IACzD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAG5B;AAUD,qBAAa,uBAAwB,SAAQ,aAAa;IAItD,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC;IAJ/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBAE7C,OAAO,EAAE,MAAM,EACN,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC;CAIhD;AAOD,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;gBACjC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAG7C;AAgBD,qBAAa,wBAAyB,SAAQ,aAAa;IAIvD,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAPlC,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAErD,OAAO,EAAE,MAAM,EACN,SAAS,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,EACjE,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GAAG,IAAI;CAInC;AAGD,qBAAa,8BAA+B,SAAQ,aAAa;IAI7D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAHhE,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAErD,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAIjE"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.MemoryEffectivenessUpdateError = exports.AgentBudgetExceededError = exports.EntityExtractionError = exports.ContractIncompleteError = exports.KbWritePhaseMissingError = exports.KbSpaceSlugMissingError = exports.UserReviewActionInvalidError = exports.RegionRefResolutionError = exports.DeliverableFetchError = exports.CapabilityReviewerConfigError = exports.CapabilityReviewerResolutionError = exports.CoordinatorRejectionContextMissingError = exports.PhaseDagMissingDependencyError = exports.WorkItemPayloadInvalidError = exports.OptionalProjectionIncompleteError = exports.ArtifactPayloadShapeError = exports.ArtifactSchemaVersionMismatchError = exports.ManifestSlugMissingError = exports.ManifestSlugMismatchError = exports.ManifestParseError = exports.FrontmatterEncodingError = exports.FrontmatterParseError = exports.PoolReleaseError = exports.SessionTerminationError = exports.SessionCreatedTimeoutError = exports.CallbackHeadersError = exports.ProjectVariableInjectionError = exports.McpToolAuthorizationError = exports.McpInjectionError = exports.CredentialRefreshError = exports.
|
|
3
|
+
exports.MemoryEffectivenessUpdateError = exports.AgentBudgetExceededError = exports.EntityExtractionError = exports.ContractIncompleteError = exports.KbWritePhaseMissingError = exports.KbSpaceSlugMissingError = exports.UserReviewActionInvalidError = exports.RegionRefResolutionError = exports.DeliverableFetchError = exports.CapabilityReviewerConfigError = exports.CapabilityReviewerResolutionError = exports.CoordinatorRejectionContextMissingError = exports.PhaseDagMissingDependencyError = exports.WorkItemPayloadInvalidError = exports.OptionalProjectionIncompleteError = exports.ArtifactPayloadShapeError = exports.ArtifactSchemaVersionMismatchError = exports.ManifestSlugMissingError = exports.ManifestSlugMismatchError = exports.ManifestParseError = exports.FrontmatterEncodingError = exports.FrontmatterParseError = exports.PoolReleaseError = exports.SessionTerminationError = exports.SessionCreatedTimeoutError = exports.CallbackHeadersError = exports.ProjectVariableInjectionError = exports.McpToolAuthorizationError = exports.McpInjectionError = exports.CredentialRefreshError = exports.PipelineError = void 0;
|
|
4
4
|
class PipelineError extends Error {
|
|
5
5
|
causeError;
|
|
6
6
|
constructor(message, cause) {
|
|
@@ -11,13 +11,6 @@ class PipelineError extends Error {
|
|
|
11
11
|
}
|
|
12
12
|
}
|
|
13
13
|
exports.PipelineError = PipelineError;
|
|
14
|
-
class MissingWritePolicyError extends PipelineError {
|
|
15
|
-
kind = 'missing-write-policy';
|
|
16
|
-
constructor(message = 'X-Write-Policy header is required on all MCP write calls') {
|
|
17
|
-
super(message);
|
|
18
|
-
}
|
|
19
|
-
}
|
|
20
|
-
exports.MissingWritePolicyError = MissingWritePolicyError;
|
|
21
14
|
class CredentialRefreshError extends PipelineError {
|
|
22
15
|
scope;
|
|
23
16
|
allocationId;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pipeline-errors.js","sourceRoot":"","sources":["../../../src/lib/errors/pipeline-errors.ts"],"names":[],"mappings":";;;AA0BA,MAAsB,aAAc,SAAQ,KAAK;IAKtC,UAAU,CAAU;IAE7B,YAAsB,OAAe,EAAE,KAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAGxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAfD,sCAeC;
|
|
1
|
+
{"version":3,"file":"pipeline-errors.js","sourceRoot":"","sources":["../../../src/lib/errors/pipeline-errors.ts"],"names":[],"mappings":";;;AA0BA,MAAsB,aAAc,SAAQ,KAAK;IAKtC,UAAU,CAAU;IAE7B,YAAsB,OAAe,EAAE,KAAe;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAGxB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAfD,sCAeC;AAWD,MAAa,sBAAuB,SAAQ,aAAa;IAI5C;IACA;IACA;IALF,IAAI,GAAG,oBAA6B,CAAC;IAC9C,YACE,OAAe,EACN,KAAoB,EACpB,YAAgC,EAChC,mBAA2B,EACpC,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QALb,UAAK,GAAL,KAAK,CAAe;QACpB,iBAAY,GAAZ,YAAY,CAAoB;QAChC,wBAAmB,GAAnB,mBAAmB,CAAQ;IAItC,CAAC;CACF;AAXD,wDAWC;AAGD,MAAa,iBAAkB,SAAQ,aAAa;IAEZ;IAD7B,IAAI,GAAG,eAAwB,CAAC;IACzC,YAAY,OAAe,EAAW,QAAgB,EAAE,KAAe;QACrE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QADc,aAAQ,GAAR,QAAQ,CAAQ;IAEtD,CAAC;CACF;AALD,8CAKC;AAGD,MAAa,yBAA0B,SAAQ,aAAa;IAI/C;IACA;IAJF,IAAI,GAAG,wBAAiC,CAAC;IAClD,YACE,OAAe,EACN,YAAoB,EACpB,MAAc,EACvB,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAJb,iBAAY,GAAZ,YAAY,CAAQ;QACpB,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAVD,8DAUC;AAGD,MAAa,6BAA8B,SAAQ,aAAa;IACrD,IAAI,GAAG,4BAAqC,CAAC;IACtD,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AALD,sEAKC;AAGD,MAAa,oBAAqB,SAAQ,aAAa;IAC5C,IAAI,GAAG,kBAA2B,CAAC;IAC5C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AALD,oDAKC;AAGD,MAAa,0BAA2B,SAAQ,aAAa;IAErB;IAD7B,IAAI,GAAG,yBAAkC,CAAC;IACnD,YAAY,OAAe,EAAW,QAAgB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,aAAQ,GAAR,QAAQ,CAAQ;IAEtD,CAAC;CACF;AALD,gEAKC;AAGD,MAAa,uBAAwB,SAAQ,aAAa;IAI7C;IAHF,IAAI,GAAG,qBAA8B,CAAC;IAC/C,YACE,OAAe,EACN,gBAAuC,EAChD,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAHb,qBAAgB,GAAhB,gBAAgB,CAAuB;IAIlD,CAAC;CACF;AATD,0DASC;AAGD,MAAa,gBAAiB,SAAQ,aAAa;IAEX;IAD7B,IAAI,GAAG,cAAuB,CAAC;IACxC,YAAY,OAAe,EAAW,YAAoB,EAAE,KAAe;QACzE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QADc,iBAAY,GAAZ,YAAY,CAAQ;IAE1D,CAAC;CACF;AALD,4CAKC;AAKD,MAAa,qBAAsB,SAAQ,aAAa;IAEhB;IAD7B,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAY,OAAe,EAAW,MAAc,EAAE,KAAe;QACnE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QADc,WAAM,GAAN,MAAM,CAAQ;IAEpD,CAAC;CACF;AALD,sDAKC;AAQD,MAAa,wBAAyB,SAAQ,aAAa;IAEnB;IAD7B,IAAI,GAAG,sBAA+B,CAAC;IAChD,YAAY,OAAe,EAAW,gBAAwB;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,qBAAgB,GAAhB,gBAAgB,CAAQ;IAE9D,CAAC;CACF;AALD,4DAKC;AAGD,MAAa,kBAAmB,SAAQ,aAAa;IAIxC;IACA;IAJF,IAAI,GAAG,gBAAyB,CAAC;IAC1C,YACE,OAAe,EACN,IAAY,EACZ,UAAkB,EAC3B,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAJb,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;IAI7B,CAAC;CACF;AAVD,gDAUC;AAGD,MAAa,yBAA0B,SAAQ,aAAa;IAI/C;IACA;IAJF,IAAI,GAAG,wBAAiC,CAAC;IAClD,YACE,OAAe,EACN,YAAoB,EACpB,cAAqC;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,iBAAY,GAAZ,YAAY,CAAQ;QACpB,mBAAc,GAAd,cAAc,CAAuB;IAGhD,CAAC;CACF;AATD,8DASC;AAGD,MAAa,wBAAyB,SAAQ,aAAa;IAEnB;IAD7B,IAAI,GAAG,uBAAgC,CAAC;IACjD,YAAY,OAAe,EAAW,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,YAAO,GAAP,OAAO,CAAQ;IAErD,CAAC;CACF;AALD,4DAKC;AAMD,MAAa,kCAAmC,SAAQ,aAAa;IAIxD;IACA;IACA;IALF,IAAI,GAAG,kCAA2C,CAAC;IAC5D,YACE,OAAe,EACN,KAAa,EACb,GAAW,EACX,QAA+B;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,UAAK,GAAL,KAAK,CAAQ;QACb,QAAG,GAAH,GAAG,CAAQ;QACX,aAAQ,GAAR,QAAQ,CAAuB;IAG1C,CAAC;CACF;AAVD,gFAUC;AAgBD,MAAa,yBAA0B,SAAQ,aAAa;IAI/C;IACA;IACA;IALF,IAAI,GAAG,gCAAyC,CAAC;IAC1D,YACE,OAAe,EACN,YAAoB,EACpB,UAAkB,EAClB,SAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,iBAAY,GAAZ,YAAY,CAAQ;QACpB,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAAS;IAG7B,CAAC;CACF;AAVD,8DAUC;AAOD,MAAa,iCAAkC,SAAQ,aAAa;IAIvD;IACA;IAJF,IAAI,GAAG,gCAAyC,CAAC;IAC1D,YACE,OAAe,EACN,aAAqB,EACrB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,kBAAa,GAAb,aAAa,CAAQ;QACrB,kBAAa,GAAb,aAAa,CAAQ;IAGhC,CAAC;CACF;AATD,8EASC;AASD,MAAa,2BAA4B,SAAQ,aAAa;IAIjD;IACA;IAJF,IAAI,GAAG,2BAAoC,CAAC;IACrD,YACE,OAAe,EACN,UAAkB,EAClB,SAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAAS;IAG7B,CAAC;CACF;AATD,kEASC;AAGD,MAAa,8BAA+B,SAAQ,aAAa;IAIpD;IACA;IAJF,IAAI,GAAG,8BAAuC,CAAC;IACxD,YACE,OAAe,EACN,QAAgB,EAChB,iBAAyB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,sBAAiB,GAAjB,iBAAiB,CAAQ;IAGpC,CAAC;CACF;AATD,wEASC;AAWD,MAAa,uCAAwC,SAAQ,aAAa;IAI7D;IACA;IAJF,IAAI,GAAG,uCAAgD,CAAC;IACjE,YACE,OAAe,EACN,QAAgB,EAChB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,kBAAa,GAAb,aAAa,CAAQ;IAGhC,CAAC;CACF;AATD,0FASC;AAKD,MAAa,iCAAkC,SAAQ,aAAa;IACzD,IAAI,GAAG,gCAAyC,CAAC;IAC1D,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AALD,8EAKC;AAMD,MAAa,6BAA8B,SAAQ,aAAa;IAInD;IACA;IACA;IALF,IAAI,GAAG,4BAAqC,CAAC;IACtD,YACE,OAAe,EACN,QAAgB,EAChB,aAAqB,EACrB,aAAqB;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,aAAQ,GAAR,QAAQ,CAAQ;QAChB,kBAAa,GAAb,aAAa,CAAQ;QACrB,kBAAa,GAAb,aAAa,CAAQ;IAGhC,CAAC;CACF;AAVD,sEAUC;AAGD,MAAa,qBAAsB,SAAQ,aAAa;IAI3C;IAHF,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YACE,OAAe,EACN,kBAAyC,EAClD,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAHb,uBAAkB,GAAlB,kBAAkB,CAAuB;IAIpD,CAAC;CACF;AATD,sDASC;AASD,MAAa,wBAAyB,SAAQ,aAAa;IAI9C;IACA;IAJF,IAAI,GAAG,uBAAgC,CAAC;IACjD,YACE,OAAe,EACN,MAAc,EACd,MAA6D;QAEtE,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAuD;IAGxE,CAAC;CACF;AATD,4DASC;AAGD,MAAa,4BAA6B,SAAQ,aAAa;IAEvB;IAD7B,IAAI,GAAG,4BAAqC,CAAC;IACtD,YAAY,OAAe,EAAW,SAAkB;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,cAAS,GAAT,SAAS,CAAS;IAExD,CAAC;CACF;AALD,oEAKC;AAGD,MAAa,uBAAwB,SAAQ,aAAa;IAElB;IAD7B,IAAI,GAAG,uBAAgC,CAAC;IACjD,YAAY,OAAe,EAAW,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,YAAO,GAAP,OAAO,CAAQ;IAErD,CAAC;CACF;AALD,0DAKC;AAGD,MAAa,wBAAyB,SAAQ,aAAa;IAChD,IAAI,GAAG,wBAAiC,CAAC;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;IACjB,CAAC;CACF;AALD,4DAKC;AAUD,MAAa,uBAAwB,SAAQ,aAAa;IAI7C;IACA;IAJF,IAAI,GAAG,qBAA8B,CAAC;IAC/C,YACE,OAAe,EACN,YAAoB,EACpB,aAAoC;QAE7C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,iBAAY,GAAZ,YAAY,CAAQ;QACpB,kBAAa,GAAb,aAAa,CAAuB;IAG/C,CAAC;CACF;AATD,0DASC;AAOD,MAAa,qBAAsB,SAAQ,aAAa;IAC7C,IAAI,GAAG,mBAA4B,CAAC;IAC7C,YAAY,OAAe,EAAE,KAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;CACF;AALD,sDAKC;AAgBD,MAAa,wBAAyB,SAAQ,aAAa;IAI9C;IACA;IACA;IACA;IACA;IAPF,IAAI,GAAG,6BAAsC,CAAC;IACvD,YACE,OAAe,EACN,SAAiE,EACjE,QAAgB,EAChB,KAAa,EACb,SAAiB,EACjB,QAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QANN,cAAS,GAAT,SAAS,CAAwD;QACjE,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAQ;QACb,cAAS,GAAT,SAAS,CAAQ;QACjB,aAAQ,GAAR,QAAQ,CAAe;IAGlC,CAAC;CACF;AAZD,4DAYC;AAGD,MAAa,8BAA+B,SAAQ,aAAa;IAIpD;IAHF,IAAI,GAAG,6BAAsC,CAAC;IACvD,YACE,OAAe,EACN,MAAqD;QAE9D,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAA+C;IAGhE,CAAC;CACF;AARD,wEAQC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export type XemaPathType = 'phase-root' | 'phase-pages' | 'phase-analysis' | 'phase-manifest' | '
|
|
1
|
+
export type XemaPathType = 'phase-root' | 'phase-pages' | 'phase-analysis' | 'phase-manifest' | 'coordinator-root' | 'coordinator-pages' | 'coordinator-contract' | 'coordinator-analysis' | 'review-root' | 'references-root' | 'inputs-root' | 'deliverables-root' | 'uploads-root' | 'repos-root' | 'retry-history' | 'unit-pages-reference' | 'unit-pages-index' | 'review-reference' | 'review-template' | 'review-deliverables' | 'review-output' | 'review-upstream' | 'review-coordinator-report' | 'review-scope-validation' | 'context-json' | 'agents-md' | 'coordinator-consistency-report' | 'scope-validation-output' | 'review-brief' | 'scope-validation';
|
|
2
2
|
export interface XemaPathConfig {
|
|
3
3
|
runId: string;
|
|
4
4
|
groupKey: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-path-builder.d.ts","sourceRoot":"","sources":["../../src/lib/xema-path-builder.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"xema-path-builder.d.ts","sourceRoot":"","sources":["../../src/lib/xema-path-builder.ts"],"names":[],"mappings":"AA0CA,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,sBAAsB,GACtB,aAAa,GACb,iBAAiB,GACjB,aAAa,GACb,mBAAmB,GACnB,cAAc,GACd,YAAY,GACZ,eAAe,GACf,sBAAsB,GACtB,kBAAkB,GAClB,kBAAkB,GAClB,iBAAiB,GACjB,qBAAqB,GACrB,eAAe,GACf,iBAAiB,GACjB,2BAA2B,GAC3B,yBAAyB,GACzB,cAAc,GACd,WAAW,GACX,gCAAgC,GAChC,yBAAyB,GACzB,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAaD,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CA2D9E"}
|
|
@@ -31,9 +31,6 @@ function buildXemaPath(_cfg, type) {
|
|
|
31
31
|
return 'deliverables/manifest.json';
|
|
32
32
|
case 'coordinator-contract':
|
|
33
33
|
return 'deliverables/coordinator-contract.json';
|
|
34
|
-
case 'phase-policy':
|
|
35
|
-
case 'coordinator-policy':
|
|
36
|
-
return 'deliverables/.write-policy.json';
|
|
37
34
|
case 'review-output':
|
|
38
35
|
return 'deliverables/review.json';
|
|
39
36
|
case 'review-reference':
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xema-path-builder.js","sourceRoot":"","sources":["../../src/lib/xema-path-builder.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"xema-path-builder.js","sourceRoot":"","sources":["../../src/lib/xema-path-builder.ts"],"names":[],"mappings":";;AA0FA,sCA2DC;AA3DD,SAAgB,aAAa,CAAC,IAAoB,EAAE,IAAkB;IACpE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,kBAAkB,CAAC;QACxB,KAAK,mBAAmB;YACtB,OAAO,cAAc,CAAC;QACxB,KAAK,aAAa;YAChB,OAAO,GAAG,CAAC;QACb,KAAK,iBAAiB;YACpB,OAAO,YAAY,CAAC;QACtB,KAAK,aAAa;YAChB,OAAO,QAAQ,CAAC;QAClB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,YAAY;YACf,OAAO,OAAO,CAAC;QACjB,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa,CAAC;QACnB,KAAK,mBAAmB;YACtB,OAAO,oBAAoB,CAAC;QAC9B,KAAK,gBAAgB,CAAC;QACtB,KAAK,sBAAsB;YACzB,OAAO,4BAA4B,CAAC;QACtC,KAAK,gBAAgB;YACnB,OAAO,4BAA4B,CAAC;QACtC,KAAK,sBAAsB;YACzB,OAAO,wCAAwC,CAAC;QAClD,KAAK,eAAe;YAClB,OAAO,0BAA0B,CAAC;QACpC,KAAK,kBAAkB;YACrB,OAAO,YAAY,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,0BAA0B,CAAC;QACpC,KAAK,qBAAqB;YACxB,OAAO,8BAA8B,CAAC;QACxC,KAAK,iBAAiB;YACpB,OAAO,qBAAqB,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,wCAAwC,CAAC;QAClD,KAAK,sBAAsB;YACzB,OAAO,uBAAuB,CAAC;QACjC,KAAK,kBAAkB;YACrB,OAAO,kCAAkC,CAAC;QAC5C,KAAK,cAAc;YACjB,OAAO,8BAA8B,CAAC;QACxC,KAAK,2BAA2B;YAC9B,OAAO,oCAAoC,CAAC;QAC9C,KAAK,yBAAyB;YAC5B,OAAO,kCAAkC,CAAC;QAC5C,KAAK,gCAAgC;YACnC,OAAO,sCAAsC,CAAC;QAChD,KAAK,yBAAyB;YAC5B,OAAO,oCAAoC,CAAC;QAC9C,KAAK,kBAAkB;YACrB,OAAO,kCAAkC,CAAC;IAC9C,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
import type { DecodedJwtHeader, DecodedJwtPayload, IssuerTenantResolver } from '@xemahq/oidc-guard';
|
|
2
|
+
import type { AuthModuleOptions } from './auth-module-options';
|
|
3
|
+
export interface MultiRealmKeySource {
|
|
4
|
+
readonly discoveryBaseUrls: string[];
|
|
5
|
+
readonly allowedRealms: string[];
|
|
6
|
+
}
|
|
7
|
+
export declare class RealmTokenVerifier {
|
|
8
|
+
private readonly options?;
|
|
9
|
+
private static readonly SINGLE_REALM_CACHE_KEY;
|
|
10
|
+
private readonly logger;
|
|
11
|
+
private readonly jwks;
|
|
12
|
+
private readonly issuerMetadata;
|
|
13
|
+
readonly tenantResolver: IssuerTenantResolver;
|
|
14
|
+
private readonly oidcVerifier;
|
|
15
|
+
private multiRealmConfig;
|
|
16
|
+
private resolvingConfig;
|
|
17
|
+
constructor(options?: AuthModuleOptions | undefined);
|
|
18
|
+
decode(token: string): {
|
|
19
|
+
header: DecodedJwtHeader;
|
|
20
|
+
payload: DecodedJwtPayload;
|
|
21
|
+
};
|
|
22
|
+
verify(token: string): Promise<DecodedJwtPayload>;
|
|
23
|
+
assertKeySourceResolvable(consumer: string): Promise<void>;
|
|
24
|
+
configuredIssuers(): string[];
|
|
25
|
+
private verifySingleRealm;
|
|
26
|
+
private resolveMultiRealmKeySource;
|
|
27
|
+
private resolveKeycloakBaseUrl;
|
|
28
|
+
private resolveAllowedRealms;
|
|
29
|
+
}
|
|
30
|
+
//# sourceMappingURL=realm-token-verifier.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"realm-token-verifier.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC;AA6CD,qBAAa,kBAAkB;IAmCjB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAjCrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAgB;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAQ9D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAMlD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAM/D,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IAGjD,OAAO,CAAC,gBAAgB,CAAoC;IAG5D,OAAO,CAAC,eAAe,CAAoD;gBAE9C,OAAO,CAAC,EAAE,iBAAiB,YAAA;IAaxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QACrB,MAAM,EAAE,gBAAgB,CAAC;QACzB,OAAO,EAAE,iBAAiB,CAAC;KAC5B;IAWK,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmCjD,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,iBAAiB,IAAI,MAAM,EAAE;YAWf,iBAAiB;YAkDjB,0BAA0B;YAsD1B,sBAAsB;YAQtB,oBAAoB;CASnC"}
|
|
@@ -0,0 +1,161 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.RealmTokenVerifier = void 0;
|
|
4
|
+
const common_1 = require("@nestjs/common");
|
|
5
|
+
const oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
6
|
+
const idp_tenant_resolver_1 = require("./idp-tenant-resolver");
|
|
7
|
+
class RealmTokenVerifier {
|
|
8
|
+
options;
|
|
9
|
+
static SINGLE_REALM_CACHE_KEY = '__single__';
|
|
10
|
+
logger = new common_1.Logger(RealmTokenVerifier.name);
|
|
11
|
+
jwks = new oidc_guard_1.JwksVerifier(600_000);
|
|
12
|
+
issuerMetadata = new oidc_guard_1.IssuerMetadataResolver();
|
|
13
|
+
tenantResolver;
|
|
14
|
+
oidcVerifier;
|
|
15
|
+
multiRealmConfig = null;
|
|
16
|
+
resolvingConfig = null;
|
|
17
|
+
constructor(options) {
|
|
18
|
+
this.options = options;
|
|
19
|
+
this.tenantResolver = (0, idp_tenant_resolver_1.selectTenantResolver)(process.env.IDP_KIND);
|
|
20
|
+
this.oidcVerifier = new oidc_guard_1.OidcTokenVerifier({
|
|
21
|
+
jwks: this.jwks,
|
|
22
|
+
issuerMetadata: this.issuerMetadata,
|
|
23
|
+
tenantResolver: this.tenantResolver,
|
|
24
|
+
});
|
|
25
|
+
}
|
|
26
|
+
decode(token) {
|
|
27
|
+
return this.jwks.decode(token);
|
|
28
|
+
}
|
|
29
|
+
async verify(token) {
|
|
30
|
+
const { payload } = this.decode(token);
|
|
31
|
+
const multiRealm = await this.resolveMultiRealmKeySource();
|
|
32
|
+
if (multiRealm) {
|
|
33
|
+
await this.oidcVerifier.verify(token, {
|
|
34
|
+
discoveryBaseUrls: [...multiRealm.discoveryBaseUrls],
|
|
35
|
+
allowedRealms: [...multiRealm.allowedRealms],
|
|
36
|
+
expectedIssuers: this.configuredIssuers(),
|
|
37
|
+
});
|
|
38
|
+
return payload;
|
|
39
|
+
}
|
|
40
|
+
await this.verifySingleRealm(token, payload);
|
|
41
|
+
return payload;
|
|
42
|
+
}
|
|
43
|
+
async assertKeySourceResolvable(consumer) {
|
|
44
|
+
if (!this.options) {
|
|
45
|
+
throw new Error(`${consumer}: AUTH_MODULE_OPTIONS is not provided in this module's injector. ` +
|
|
46
|
+
'Import AuthModule.forRoot()/forRootAsync() (XemaServiceModule.forBiome does ' +
|
|
47
|
+
'this for you), or provide AUTH_MODULE_OPTIONS locally as public-gateway-api ' +
|
|
48
|
+
'does in RouteSourcesModule.');
|
|
49
|
+
}
|
|
50
|
+
let multiRealm;
|
|
51
|
+
try {
|
|
52
|
+
multiRealm = await this.resolveMultiRealmKeySource();
|
|
53
|
+
}
|
|
54
|
+
catch (error) {
|
|
55
|
+
throw new Error(`${consumer}: failed to resolve the realm key source from AUTH_MODULE_OPTIONS — ` +
|
|
56
|
+
`${error instanceof Error ? error.message : String(error)}`);
|
|
57
|
+
}
|
|
58
|
+
if (multiRealm)
|
|
59
|
+
return;
|
|
60
|
+
if (this.options.jwksUrl)
|
|
61
|
+
return;
|
|
62
|
+
throw new Error(`${consumer}: no realm key source is configured. AUTH_MODULE_OPTIONS resolved ` +
|
|
63
|
+
'neither a multi-realm pair (keycloakBaseUrl + allowedRealms, or their ' +
|
|
64
|
+
'lazy providers) nor a single-realm jwksUrl. Every service token would ' +
|
|
65
|
+
'be refused at runtime.');
|
|
66
|
+
}
|
|
67
|
+
configuredIssuers() {
|
|
68
|
+
const raw = this.options?.issuer;
|
|
69
|
+
if (!raw)
|
|
70
|
+
return [];
|
|
71
|
+
return raw
|
|
72
|
+
.split(',')
|
|
73
|
+
.map((s) => s.trim())
|
|
74
|
+
.filter((s) => s.length > 0);
|
|
75
|
+
}
|
|
76
|
+
async verifySingleRealm(token, payload) {
|
|
77
|
+
const expectedIssuer = this.options?.issuer;
|
|
78
|
+
if (expectedIssuer) {
|
|
79
|
+
if (!payload.iss) {
|
|
80
|
+
throw new oidc_guard_1.JwksVerificationError('Token missing required issuer claim');
|
|
81
|
+
}
|
|
82
|
+
const allowedIssuers = this.configuredIssuers();
|
|
83
|
+
const tenants = [
|
|
84
|
+
...new Set(allowedIssuers
|
|
85
|
+
.map((iss) => this.tenantResolver.tenantFromIssuer(iss))
|
|
86
|
+
.filter((tenant) => tenant !== null)),
|
|
87
|
+
];
|
|
88
|
+
const iss = payload.iss;
|
|
89
|
+
const issuerMatched = allowedIssuers.includes(iss) ||
|
|
90
|
+
tenants.some((tenant) => this.tenantResolver.issuerBelongsToTenant(iss, tenant));
|
|
91
|
+
if (!issuerMatched) {
|
|
92
|
+
throw new oidc_guard_1.JwksVerificationError('Invalid token issuer');
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
const jwksUrl = this.options?.jwksUrl;
|
|
96
|
+
if (!jwksUrl) {
|
|
97
|
+
throw new oidc_guard_1.JwksVerificationError('AuthModule jwksUrl is not configured (and no multi-realm key source resolved)');
|
|
98
|
+
}
|
|
99
|
+
await this.jwks.verify(token, {
|
|
100
|
+
cacheKey: RealmTokenVerifier.SINGLE_REALM_CACHE_KEY,
|
|
101
|
+
jwksUrl,
|
|
102
|
+
});
|
|
103
|
+
}
|
|
104
|
+
async resolveMultiRealmKeySource() {
|
|
105
|
+
if (this.multiRealmConfig)
|
|
106
|
+
return this.multiRealmConfig;
|
|
107
|
+
if (this.resolvingConfig)
|
|
108
|
+
return this.resolvingConfig;
|
|
109
|
+
this.resolvingConfig = (async () => {
|
|
110
|
+
try {
|
|
111
|
+
const keycloakBaseUrl = await this.resolveKeycloakBaseUrl();
|
|
112
|
+
const allowedRealms = await this.resolveAllowedRealms();
|
|
113
|
+
if (!keycloakBaseUrl || allowedRealms.length === 0) {
|
|
114
|
+
return null;
|
|
115
|
+
}
|
|
116
|
+
const localBaseUrls = keycloakBaseUrl
|
|
117
|
+
.split(',')
|
|
118
|
+
.map((s) => s.trim().replace(/\/$/, ''));
|
|
119
|
+
const federated = this.options?.federatedRealmTrust;
|
|
120
|
+
const discoveryBaseUrls = [
|
|
121
|
+
...new Set([
|
|
122
|
+
...localBaseUrls,
|
|
123
|
+
...(federated?.discoveryBaseUrls ?? []).map((s) => s.trim().replace(/\/$/, '')),
|
|
124
|
+
]),
|
|
125
|
+
];
|
|
126
|
+
const mergedRealms = [
|
|
127
|
+
...new Set([...allowedRealms, ...(federated?.allowedRealms ?? [])]),
|
|
128
|
+
];
|
|
129
|
+
this.multiRealmConfig = { discoveryBaseUrls, allowedRealms: mergedRealms };
|
|
130
|
+
this.logger.log(`Multi-realm mode enabled: realms=[${mergedRealms.join(', ')}], base URLs=[${discoveryBaseUrls.join(', ')}]` +
|
|
131
|
+
(federated
|
|
132
|
+
? ` (incl. ${federated.discoveryBaseUrls.length} federated base URL(s))`
|
|
133
|
+
: ''));
|
|
134
|
+
return this.multiRealmConfig;
|
|
135
|
+
}
|
|
136
|
+
finally {
|
|
137
|
+
this.resolvingConfig = null;
|
|
138
|
+
}
|
|
139
|
+
})();
|
|
140
|
+
return this.resolvingConfig;
|
|
141
|
+
}
|
|
142
|
+
async resolveKeycloakBaseUrl() {
|
|
143
|
+
if (this.options?.keycloakBaseUrl)
|
|
144
|
+
return this.options.keycloakBaseUrl;
|
|
145
|
+
if (this.options?.keycloakBaseUrlProvider) {
|
|
146
|
+
return (await this.options.keycloakBaseUrlProvider()) ?? undefined;
|
|
147
|
+
}
|
|
148
|
+
return undefined;
|
|
149
|
+
}
|
|
150
|
+
async resolveAllowedRealms() {
|
|
151
|
+
if (this.options?.allowedRealms && this.options.allowedRealms.length > 0) {
|
|
152
|
+
return this.options.allowedRealms;
|
|
153
|
+
}
|
|
154
|
+
if (this.options?.allowedRealmsProvider) {
|
|
155
|
+
return await this.options.allowedRealmsProvider();
|
|
156
|
+
}
|
|
157
|
+
return [];
|
|
158
|
+
}
|
|
159
|
+
}
|
|
160
|
+
exports.RealmTokenVerifier = RealmTokenVerifier;
|
|
161
|
+
//# sourceMappingURL=realm-token-verifier.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"realm-token-verifier.js","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AACxC,mDAK4B;AAQ5B,+DAA6D;AAsD7D,MAAa,kBAAkB;IAmCA;IAjCrB,MAAM,CAAU,sBAAsB,GAAG,YAAY,CAAC;IAE7C,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAQ7C,IAAI,GAAG,IAAI,yBAAY,CAAC,OAAO,CAAC,CAAC;IAMjC,cAAc,GAAG,IAAI,mCAAsB,EAAE,CAAC;IAMtD,cAAc,CAAuB;IAG7B,YAAY,CAAoB;IAGzC,gBAAgB,GAA+B,IAAI,CAAC;IAGpD,eAAe,GAA+C,IAAI,CAAC;IAE3E,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAItD,IAAI,CAAC,cAAc,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAiB,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,KAAa;QAIlB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IASD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,iBAAiB,EAAE,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC;gBACpD,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC;gBAK5C,eAAe,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAgBD,KAAK,CAAC,yBAAyB,CAAC,QAAgB;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,mEAAmE;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,6BAA6B,CAChC,CAAC;QACJ,CAAC;QAED,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,sEAAsE;gBAC/E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU;YAAE,OAAO;QAEvB,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO;QAEjC,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,oEAAoE;YAC7E,wEAAwE;YACxE,wEAAwE;YACxE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IAGD,iBAAiB;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG;aACP,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAIO,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,OAA0B;QAE1B,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,kCAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAKhD,MAAM,OAAO,GAAG;gBACd,GAAG,IAAI,GAAG,CACR,cAAc;qBACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBACvD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CACzD;aACF,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,aAAa,GACjB,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CACvD,CAAC;YACJ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,kCAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kCAAqB,CAC7B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,kBAAkB,CAAC,sBAAsB;YACnD,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAOO,KAAK,CAAC,0BAA0B;QACtC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QACxD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QAEtD,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAExD,IAAI,CAAC,eAAe,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAMD,MAAM,aAAa,GAAG,eAAe;qBAClC,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAM3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBACpD,MAAM,iBAAiB,GAAG;oBACxB,GAAG,IAAI,GAAG,CAAC;wBACT,GAAG,aAAa;wBAChB,GAAG,CAAC,SAAS,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC5B;qBACF,CAAC;iBACH,CAAC;gBACF,MAAM,YAAY,GAAG;oBACnB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;iBACpE,CAAC;gBAEF,IAAI,CAAC,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;gBAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qCAAqC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC1G,CAAC,SAAS;wBACR,CAAC,CAAC,WAAW,SAAS,CAAC,iBAAiB,CAAC,MAAM,yBAAyB;wBACxE,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC/B,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,IAAI,IAAI,CAAC,OAAO,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO,EAAE,uBAAuB,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,SAAS,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC;YACxC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;;AApQH,gDAqQC"}
|
|
@@ -1,12 +1,10 @@
|
|
|
1
|
-
import { CanActivate, ExecutionContext } from '@nestjs/common';
|
|
2
|
-
import {
|
|
3
|
-
export declare class ServiceTokenGuard implements CanActivate {
|
|
4
|
-
private readonly eventHubClient;
|
|
1
|
+
import { CanActivate, ExecutionContext, OnApplicationBootstrap } from '@nestjs/common';
|
|
2
|
+
import type { AuthModuleOptions } from './auth-module-options';
|
|
3
|
+
export declare class ServiceTokenGuard implements CanActivate, OnApplicationBootstrap {
|
|
5
4
|
private readonly logger;
|
|
6
|
-
private
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
private initJwksClient;
|
|
5
|
+
private readonly verifier;
|
|
6
|
+
constructor(authOptions?: AuthModuleOptions);
|
|
7
|
+
onApplicationBootstrap(): Promise<void>;
|
|
10
8
|
canActivate(context: ExecutionContext): Promise<boolean>;
|
|
11
9
|
private assertServiceTokenClass;
|
|
12
10
|
private verifyToken;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAoE9D,OAAO,CAAC,uBAAuB;YAuBjB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA6CpC"}
|
|
@@ -1,79 +1,35 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
-
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
-
if (k2 === undefined) k2 = k;
|
|
4
|
-
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
-
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
-
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
-
}
|
|
8
|
-
Object.defineProperty(o, k2, desc);
|
|
9
|
-
}) : (function(o, m, k, k2) {
|
|
10
|
-
if (k2 === undefined) k2 = k;
|
|
11
|
-
o[k2] = m[k];
|
|
12
|
-
}));
|
|
13
|
-
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
-
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
-
}) : function(o, v) {
|
|
16
|
-
o["default"] = v;
|
|
17
|
-
});
|
|
18
2
|
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
|
19
3
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
20
4
|
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
|
21
5
|
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
|
22
6
|
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
|
23
7
|
};
|
|
24
|
-
var __importStar = (this && this.__importStar) || (function () {
|
|
25
|
-
var ownKeys = function(o) {
|
|
26
|
-
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
27
|
-
var ar = [];
|
|
28
|
-
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
29
|
-
return ar;
|
|
30
|
-
};
|
|
31
|
-
return ownKeys(o);
|
|
32
|
-
};
|
|
33
|
-
return function (mod) {
|
|
34
|
-
if (mod && mod.__esModule) return mod;
|
|
35
|
-
var result = {};
|
|
36
|
-
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
37
|
-
__setModuleDefault(result, mod);
|
|
38
|
-
return result;
|
|
39
|
-
};
|
|
40
|
-
})();
|
|
41
8
|
var __metadata = (this && this.__metadata) || function (k, v) {
|
|
42
9
|
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
|
43
10
|
};
|
|
11
|
+
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
|
12
|
+
return function (target, key) { decorator(target, key, paramIndex); }
|
|
13
|
+
};
|
|
44
14
|
var ServiceTokenGuard_1;
|
|
45
15
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
46
16
|
exports.ServiceTokenGuard = void 0;
|
|
47
17
|
const common_1 = require("@nestjs/common");
|
|
48
|
-
const event_hub_client_1 = require("@xemahq/event-hub-client");
|
|
49
18
|
const subject_1 = require("@xemahq/kernel-contracts/subject");
|
|
50
|
-
const
|
|
19
|
+
const oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
51
20
|
const org_claim_1 = require("../../lib/auth/org-claim");
|
|
21
|
+
const auth_module_options_1 = require("./auth-module-options");
|
|
52
22
|
const org_claim_required_1 = require("./org-claim-required");
|
|
23
|
+
const realm_token_verifier_1 = require("./realm-token-verifier");
|
|
53
24
|
const decorator_metadata_1 = require("../decorator-metadata");
|
|
54
25
|
let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
|
|
55
|
-
eventHubClient;
|
|
56
26
|
logger = new common_1.Logger(ServiceTokenGuard_1.name);
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
this.eventHubClient = eventHubClient;
|
|
27
|
+
verifier;
|
|
28
|
+
constructor(authOptions) {
|
|
29
|
+
this.verifier = new realm_token_verifier_1.RealmTokenVerifier(authOptions);
|
|
61
30
|
}
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
if (!authInfo) {
|
|
65
|
-
throw new common_1.UnauthorizedException('Event Hub not registered yet — cannot validate service tokens. ' +
|
|
66
|
-
'Ensure EventHubBootstrapService has completed registration.');
|
|
67
|
-
}
|
|
68
|
-
this.jwksClient = jwksRsa.default({
|
|
69
|
-
jwksUri: authInfo.jwksUrl,
|
|
70
|
-
cache: true,
|
|
71
|
-
cacheMaxAge: 600_000,
|
|
72
|
-
rateLimit: true,
|
|
73
|
-
jwksRequestsPerMinute: 10,
|
|
74
|
-
});
|
|
75
|
-
this.expectedIssuer = authInfo.issuer;
|
|
76
|
-
this.logger.log(`Service token JWKS client initialized: ${authInfo.jwksUrl}`);
|
|
31
|
+
async onApplicationBootstrap() {
|
|
32
|
+
await this.verifier.assertKeySourceResolvable(ServiceTokenGuard_1.name);
|
|
77
33
|
}
|
|
78
34
|
async canActivate(context) {
|
|
79
35
|
const request = context.switchToHttp().getRequest();
|
|
@@ -83,9 +39,6 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
|
|
|
83
39
|
}
|
|
84
40
|
const token = authHeader.substring(7);
|
|
85
41
|
try {
|
|
86
|
-
if (!this.jwksClient) {
|
|
87
|
-
this.initJwksClient();
|
|
88
|
-
}
|
|
89
42
|
const payload = await this.verifyToken(token);
|
|
90
43
|
const requireOrgClaim = (0, decorator_metadata_1.readDecoratorOverride)(org_claim_required_1.REQUIRE_ORG_CLAIM, [
|
|
91
44
|
context.getHandler(),
|
|
@@ -124,50 +77,15 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
|
|
|
124
77
|
}
|
|
125
78
|
}
|
|
126
79
|
async verifyToken(token) {
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
}
|
|
130
|
-
const parts = token.split('.');
|
|
131
|
-
if (parts.length !== 3) {
|
|
132
|
-
throw new Error('Invalid token format');
|
|
133
|
-
}
|
|
134
|
-
const [headerB64, payloadB64, signature] = parts;
|
|
135
|
-
if (!headerB64 || !payloadB64 || !signature) {
|
|
136
|
-
throw new Error('Invalid token format');
|
|
137
|
-
}
|
|
138
|
-
const header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
|
|
139
|
-
const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
|
|
140
|
-
if (payload.exp && Date.now() >= payload.exp * 1000) {
|
|
141
|
-
throw new Error('Token expired');
|
|
142
|
-
}
|
|
143
|
-
if (this.expectedIssuer && payload.iss !== this.expectedIssuer) {
|
|
144
|
-
throw new Error(`Invalid issuer: ${payload.iss}`);
|
|
145
|
-
}
|
|
146
|
-
if (!header.kid) {
|
|
147
|
-
throw new Error('Token missing kid in header');
|
|
148
|
-
}
|
|
149
|
-
const key = await this.jwksClient.getSigningKey(header.kid);
|
|
150
|
-
const publicKey = key.getPublicKey();
|
|
151
|
-
const crypto = await import('node:crypto');
|
|
152
|
-
const data = `${headerB64}.${payloadB64}`;
|
|
153
|
-
const signatureBuffer = Buffer.from(signature, 'base64url');
|
|
154
|
-
const algMap = {
|
|
155
|
-
RS256: 'RSA-SHA256',
|
|
156
|
-
RS384: 'RSA-SHA384',
|
|
157
|
-
RS512: 'RSA-SHA512',
|
|
158
|
-
};
|
|
159
|
-
const algorithm = algMap[header.alg];
|
|
160
|
-
if (!algorithm) {
|
|
161
|
-
throw new Error(`Unsupported algorithm: ${header.alg}`);
|
|
80
|
+
try {
|
|
81
|
+
return await this.verifier.verify(token);
|
|
162
82
|
}
|
|
163
|
-
|
|
164
|
-
.
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
throw new Error('Invalid signature');
|
|
83
|
+
catch (error) {
|
|
84
|
+
if (error instanceof oidc_guard_1.JwksVerificationError) {
|
|
85
|
+
throw new common_1.UnauthorizedException(error.message);
|
|
86
|
+
}
|
|
87
|
+
throw error;
|
|
169
88
|
}
|
|
170
|
-
return payload;
|
|
171
89
|
}
|
|
172
90
|
headerValue(request, name) {
|
|
173
91
|
const headers = request.headers ?? {};
|
|
@@ -222,6 +140,8 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
|
|
|
222
140
|
exports.ServiceTokenGuard = ServiceTokenGuard;
|
|
223
141
|
exports.ServiceTokenGuard = ServiceTokenGuard = ServiceTokenGuard_1 = __decorate([
|
|
224
142
|
(0, common_1.Injectable)(),
|
|
225
|
-
|
|
143
|
+
__param(0, (0, common_1.Optional)()),
|
|
144
|
+
__param(0, (0, common_1.Inject)(auth_module_options_1.AUTH_MODULE_OPTIONS)),
|
|
145
|
+
__metadata("design:paramtypes", [Object])
|
|
226
146
|
], ServiceTokenGuard);
|
|
227
147
|
//# sourceMappingURL=service-token.guard.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,8DAA8D;AAC9D,mDAA2D;AAG3D,wDAA0E;AAC1E,+DAA4D;AAE5D,6DAAyD;AACzD,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAe9C,MAAM,eAAe,GACnB,IAAA,0CAAqB,EAAU,sCAAiB,EAAE;gBAChD,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YACd,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;YACpE,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YAGrC,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAUO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,UAAU,KAAK,oBAAU,CAAC,UAAU,EACpC,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C,EAC9C,QAAQ,GAAG,KAAK;QAEhB,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;gBAC7E,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;gBAC9E,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAjNY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAiN7B"}
|
|
@@ -1,25 +1,11 @@
|
|
|
1
1
|
import { CanActivate, ExecutionContext } from '@nestjs/common';
|
|
2
2
|
import type { AuthModuleOptions } from './auth/auth-module-options';
|
|
3
3
|
export declare class JwtVerificationGuard implements CanActivate {
|
|
4
|
-
private readonly authOptions?;
|
|
5
4
|
private readonly logger;
|
|
6
|
-
private readonly
|
|
7
|
-
|
|
8
|
-
private readonly tenantResolver;
|
|
9
|
-
private readonly oidcVerifier;
|
|
10
|
-
private static readonly SINGLE_REALM_CACHE_KEY;
|
|
11
|
-
private multiRealmConfig;
|
|
12
|
-
private resolvingConfig;
|
|
13
|
-
constructor(authOptions?: AuthModuleOptions | undefined);
|
|
5
|
+
private readonly verifier;
|
|
6
|
+
constructor(authOptions?: AuthModuleOptions);
|
|
14
7
|
canActivate(context: ExecutionContext): Promise<boolean>;
|
|
15
8
|
private verifyToken;
|
|
16
|
-
private decodeOrThrow;
|
|
17
|
-
private verifyMultiRealm;
|
|
18
|
-
private verifySingleRealm;
|
|
19
|
-
private configuredIssuers;
|
|
20
|
-
private resolveMultiRealmConfig;
|
|
21
|
-
private resolveKeycloakBaseUrl;
|
|
22
|
-
private resolveAllowedRealms;
|
|
23
9
|
private attachRealmToContext;
|
|
24
10
|
private isPublicPath;
|
|
25
11
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AA8CpE,qBACa,oBAAqB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAUhE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAK3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAgDhD,WAAW;IAazB,OAAO,CAAC,oBAAoB;IAa5B,OAAO,CAAC,YAAY;CAYrB"}
|
|
@@ -18,30 +18,16 @@ const common_1 = require("@nestjs/common");
|
|
|
18
18
|
const decorator_metadata_1 = require("./decorator-metadata");
|
|
19
19
|
const public_decorator_1 = require("./public.decorator");
|
|
20
20
|
const auth_module_options_1 = require("./auth/auth-module-options");
|
|
21
|
-
const idp_tenant_resolver_1 = require("./auth/idp-tenant-resolver");
|
|
22
21
|
const request_context_1 = require("../lib/request-context");
|
|
23
22
|
const oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
23
|
+
const realm_token_verifier_1 = require("./auth/realm-token-verifier");
|
|
24
24
|
const PUBLIC_PATH_PREFIXES = ['/health', '/api/docs', '/api/openapi.json'];
|
|
25
25
|
const PUBLIC_WEBHOOK_PREFIX = '/webhooks';
|
|
26
|
-
let JwtVerificationGuard = class JwtVerificationGuard {
|
|
27
|
-
static { JwtVerificationGuard_1 = this; }
|
|
28
|
-
authOptions;
|
|
26
|
+
let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
29
27
|
logger = new common_1.Logger(JwtVerificationGuard_1.name);
|
|
30
|
-
|
|
31
|
-
issuerMetadata = new oidc_guard_1.IssuerMetadataResolver();
|
|
32
|
-
tenantResolver;
|
|
33
|
-
oidcVerifier;
|
|
34
|
-
static SINGLE_REALM_CACHE_KEY = '__single__';
|
|
35
|
-
multiRealmConfig = null;
|
|
36
|
-
resolvingConfig = null;
|
|
28
|
+
verifier;
|
|
37
29
|
constructor(authOptions) {
|
|
38
|
-
this.
|
|
39
|
-
this.tenantResolver = (0, idp_tenant_resolver_1.selectTenantResolver)(process.env.IDP_KIND);
|
|
40
|
-
this.oidcVerifier = new oidc_guard_1.OidcTokenVerifier({
|
|
41
|
-
jwks: this.jwks,
|
|
42
|
-
issuerMetadata: this.issuerMetadata,
|
|
43
|
-
tenantResolver: this.tenantResolver,
|
|
44
|
-
});
|
|
30
|
+
this.verifier = new realm_token_verifier_1.RealmTokenVerifier(authOptions);
|
|
45
31
|
}
|
|
46
32
|
async canActivate(context) {
|
|
47
33
|
const isPublic = (0, decorator_metadata_1.readDecoratorOverride)(public_decorator_1.IS_PUBLIC_KEY, [
|
|
@@ -73,69 +59,8 @@ let JwtVerificationGuard = class JwtVerificationGuard {
|
|
|
73
59
|
}
|
|
74
60
|
}
|
|
75
61
|
async verifyToken(token) {
|
|
76
|
-
const { payload } = this.decodeOrThrow(token);
|
|
77
|
-
const multiRealm = await this.resolveMultiRealmConfig();
|
|
78
|
-
if (multiRealm) {
|
|
79
|
-
await this.verifyMultiRealm(token, multiRealm);
|
|
80
|
-
}
|
|
81
|
-
else {
|
|
82
|
-
await this.verifySingleRealm(token, payload);
|
|
83
|
-
}
|
|
84
|
-
return payload;
|
|
85
|
-
}
|
|
86
|
-
decodeOrThrow(token) {
|
|
87
|
-
try {
|
|
88
|
-
return this.jwks.decode(token);
|
|
89
|
-
}
|
|
90
|
-
catch (error) {
|
|
91
|
-
if (error instanceof oidc_guard_1.JwksVerificationError) {
|
|
92
|
-
throw new common_1.UnauthorizedException(error.message);
|
|
93
|
-
}
|
|
94
|
-
throw error;
|
|
95
|
-
}
|
|
96
|
-
}
|
|
97
|
-
async verifyMultiRealm(token, config) {
|
|
98
|
-
try {
|
|
99
|
-
await this.oidcVerifier.verify(token, {
|
|
100
|
-
discoveryBaseUrls: config.discoveryBaseUrls,
|
|
101
|
-
allowedRealms: config.allowedRealms,
|
|
102
|
-
expectedIssuers: this.configuredIssuers(),
|
|
103
|
-
});
|
|
104
|
-
}
|
|
105
|
-
catch (error) {
|
|
106
|
-
if (error instanceof oidc_guard_1.JwksVerificationError) {
|
|
107
|
-
throw new common_1.UnauthorizedException(error.message);
|
|
108
|
-
}
|
|
109
|
-
throw error;
|
|
110
|
-
}
|
|
111
|
-
}
|
|
112
|
-
async verifySingleRealm(token, payload) {
|
|
113
|
-
const expectedIssuer = this.authOptions?.issuer;
|
|
114
|
-
if (expectedIssuer) {
|
|
115
|
-
if (!payload.iss) {
|
|
116
|
-
throw new common_1.UnauthorizedException('Token missing required issuer claim');
|
|
117
|
-
}
|
|
118
|
-
const allowedIssuers = this.configuredIssuers();
|
|
119
|
-
const tenants = [
|
|
120
|
-
...new Set(allowedIssuers
|
|
121
|
-
.map((iss) => this.tenantResolver.tenantFromIssuer(iss))
|
|
122
|
-
.filter((tenant) => tenant !== null)),
|
|
123
|
-
];
|
|
124
|
-
const issuerMatched = allowedIssuers.includes(payload.iss) ||
|
|
125
|
-
tenants.some((tenant) => this.tenantResolver.issuerBelongsToTenant(payload.iss, tenant));
|
|
126
|
-
if (!issuerMatched) {
|
|
127
|
-
throw new common_1.UnauthorizedException('Invalid token issuer');
|
|
128
|
-
}
|
|
129
|
-
}
|
|
130
|
-
const jwksUrl = this.authOptions?.jwksUrl;
|
|
131
|
-
if (!jwksUrl) {
|
|
132
|
-
throw new Error('AuthModule jwksUrl is not configured');
|
|
133
|
-
}
|
|
134
62
|
try {
|
|
135
|
-
await this.
|
|
136
|
-
cacheKey: JwtVerificationGuard_1.SINGLE_REALM_CACHE_KEY,
|
|
137
|
-
jwksUrl,
|
|
138
|
-
});
|
|
63
|
+
return await this.verifier.verify(token);
|
|
139
64
|
}
|
|
140
65
|
catch (error) {
|
|
141
66
|
if (error instanceof oidc_guard_1.JwksVerificationError) {
|
|
@@ -144,78 +69,10 @@ let JwtVerificationGuard = class JwtVerificationGuard {
|
|
|
144
69
|
throw error;
|
|
145
70
|
}
|
|
146
71
|
}
|
|
147
|
-
configuredIssuers() {
|
|
148
|
-
const raw = this.authOptions?.issuer;
|
|
149
|
-
if (!raw)
|
|
150
|
-
return [];
|
|
151
|
-
return raw
|
|
152
|
-
.split(',')
|
|
153
|
-
.map((s) => s.trim())
|
|
154
|
-
.filter((s) => s.length > 0);
|
|
155
|
-
}
|
|
156
|
-
async resolveMultiRealmConfig() {
|
|
157
|
-
if (this.multiRealmConfig)
|
|
158
|
-
return this.multiRealmConfig;
|
|
159
|
-
if (this.resolvingConfig)
|
|
160
|
-
return this.resolvingConfig;
|
|
161
|
-
this.resolvingConfig = (async () => {
|
|
162
|
-
try {
|
|
163
|
-
const keycloakBaseUrl = await this.resolveKeycloakBaseUrl();
|
|
164
|
-
const allowedRealms = await this.resolveAllowedRealms();
|
|
165
|
-
if (keycloakBaseUrl && allowedRealms.length > 0) {
|
|
166
|
-
const localBaseUrls = keycloakBaseUrl
|
|
167
|
-
.split(',')
|
|
168
|
-
.map((s) => s.trim().replace(/\/$/, ''));
|
|
169
|
-
const federated = this.authOptions?.federatedRealmTrust;
|
|
170
|
-
const discoveryBaseUrls = [
|
|
171
|
-
...new Set([
|
|
172
|
-
...localBaseUrls,
|
|
173
|
-
...(federated?.discoveryBaseUrls ?? []).map((s) => s.trim().replace(/\/$/, '')),
|
|
174
|
-
]),
|
|
175
|
-
];
|
|
176
|
-
const mergedRealms = [
|
|
177
|
-
...new Set([...allowedRealms, ...(federated?.allowedRealms ?? [])]),
|
|
178
|
-
];
|
|
179
|
-
this.multiRealmConfig = {
|
|
180
|
-
discoveryBaseUrls,
|
|
181
|
-
allowedRealms: mergedRealms,
|
|
182
|
-
};
|
|
183
|
-
this.logger.log(`Multi-realm mode enabled: realms=[${mergedRealms.join(', ')}], base URLs=[${discoveryBaseUrls.join(', ')}]` +
|
|
184
|
-
(federated
|
|
185
|
-
? ` (incl. ${federated.discoveryBaseUrls.length} federated base URL(s))`
|
|
186
|
-
: ''));
|
|
187
|
-
return this.multiRealmConfig;
|
|
188
|
-
}
|
|
189
|
-
return null;
|
|
190
|
-
}
|
|
191
|
-
finally {
|
|
192
|
-
this.resolvingConfig = null;
|
|
193
|
-
}
|
|
194
|
-
})();
|
|
195
|
-
return this.resolvingConfig;
|
|
196
|
-
}
|
|
197
|
-
async resolveKeycloakBaseUrl() {
|
|
198
|
-
if (this.authOptions?.keycloakBaseUrl)
|
|
199
|
-
return this.authOptions.keycloakBaseUrl;
|
|
200
|
-
if (this.authOptions?.keycloakBaseUrlProvider) {
|
|
201
|
-
return (await this.authOptions.keycloakBaseUrlProvider()) ?? undefined;
|
|
202
|
-
}
|
|
203
|
-
return undefined;
|
|
204
|
-
}
|
|
205
|
-
async resolveAllowedRealms() {
|
|
206
|
-
if (this.authOptions?.allowedRealms &&
|
|
207
|
-
this.authOptions.allowedRealms.length > 0) {
|
|
208
|
-
return this.authOptions.allowedRealms;
|
|
209
|
-
}
|
|
210
|
-
if (this.authOptions?.allowedRealmsProvider) {
|
|
211
|
-
return await this.authOptions.allowedRealmsProvider();
|
|
212
|
-
}
|
|
213
|
-
return [];
|
|
214
|
-
}
|
|
215
72
|
attachRealmToContext(request, payload) {
|
|
216
73
|
if (!payload.iss)
|
|
217
74
|
return;
|
|
218
|
-
const realmName = this.tenantResolver.tenantFromIssuer(payload.iss);
|
|
75
|
+
const realmName = this.verifier.tenantResolver.tenantFromIssuer(payload.iss);
|
|
219
76
|
if (!realmName)
|
|
220
77
|
return;
|
|
221
78
|
const ctx = request[request_context_1.REQUEST_CONTEXT];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,4DAAyD;AAEzD,mDAA2D;AAE3D,sEAAiE;AAQjE,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAiCnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACd,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAU/C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,gCAAa,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAG7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAG9C,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB;gBAAE,MAAM,KAAK,CAAC;YAExD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAUO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAIO,oBAAoB,CAAC,OAAgB,EAAE,OAAmB;QAChE,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,CAAC,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AA3GY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GAfnB,oBAAoB,CA2GhC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/platform-common",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.14.0",
|
|
4
4
|
"description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -62,7 +62,7 @@
|
|
|
62
62
|
"rxjs": "7.8.2",
|
|
63
63
|
"ts-jest": "^29.4.9",
|
|
64
64
|
"typescript": "5.9.3",
|
|
65
|
-
"@xemahq/kernel-contracts": "^
|
|
65
|
+
"@xemahq/kernel-contracts": "^17.1.0"
|
|
66
66
|
},
|
|
67
67
|
"exports": {
|
|
68
68
|
".": {
|