@xemahq/platform-common 0.16.0 → 0.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/lib/session-event-payloads/error-codes.d.ts +3 -2
- package/dist/lib/session-event-payloads/error-codes.d.ts.map +1 -1
- package/dist/lib/session-event-payloads/error-codes.js +2 -0
- package/dist/lib/session-event-payloads/error-codes.js.map +1 -1
- package/dist/lib/session-event-payloads/validation.d.ts +2 -2
- package/dist/nestjs/auth/actor-classification.d.ts +2 -0
- package/dist/nestjs/auth/actor-classification.d.ts.map +1 -1
- package/dist/nestjs/auth/actor-classification.js +10 -0
- package/dist/nestjs/auth/actor-classification.js.map +1 -1
- package/dist/nestjs/auth/auth-module-options.d.ts +3 -0
- package/dist/nestjs/auth/auth-module-options.d.ts.map +1 -1
- package/dist/nestjs/auth/auth-module-options.js.map +1 -1
- package/dist/nestjs/auth/delegation-chain.d.ts +7 -1
- package/dist/nestjs/auth/delegation-chain.d.ts.map +1 -1
- package/dist/nestjs/auth/delegation-chain.js +32 -6
- package/dist/nestjs/auth/delegation-chain.js.map +1 -1
- package/dist/nestjs/auth/index.d.ts +4 -1
- package/dist/nestjs/auth/index.d.ts.map +1 -1
- package/dist/nestjs/auth/index.js +15 -1
- package/dist/nestjs/auth/index.js.map +1 -1
- package/dist/nestjs/auth/realm-token-verifier.d.ts +15 -1
- package/dist/nestjs/auth/realm-token-verifier.d.ts.map +1 -1
- package/dist/nestjs/auth/realm-token-verifier.js +59 -6
- package/dist/nestjs/auth/realm-token-verifier.js.map +1 -1
- package/dist/nestjs/index.d.ts +3 -2
- package/dist/nestjs/index.d.ts.map +1 -1
- package/dist/nestjs/index.js +21 -11
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/jwt-verification.guard.d.ts +1 -0
- package/dist/nestjs/jwt-verification.guard.d.ts.map +1 -1
- package/dist/nestjs/jwt-verification.guard.js +39 -9
- package/dist/nestjs/jwt-verification.guard.js.map +1 -1
- package/package.json +3 -3
|
@@ -24,6 +24,7 @@ export declare enum SessionErrorCode {
|
|
|
24
24
|
LaunchUnclassifiedFailure = "launch_unclassified",
|
|
25
25
|
LaunchWorkspaceRestoreFailed = "workspace_restore_failed",
|
|
26
26
|
LaunchWorkspaceSnapshotCorrupt = "workspace_snapshot_corrupt",
|
|
27
|
+
LaunchWorkspaceSnapshotRuntimeNewer = "workspace_snapshot_runtime_newer",
|
|
27
28
|
LaunchWorkingFileSourceMissing = "working_file_source_missing",
|
|
28
29
|
LaunchFinalizeFailed = "finalize_failed",
|
|
29
30
|
LaunchFinalizeReadinessFailed = "finalize_readiness_failed",
|
|
@@ -35,8 +36,8 @@ export declare enum SessionErrorCode {
|
|
|
35
36
|
}
|
|
36
37
|
export type SessionTurnErrorCode = SessionErrorCode.ThreadBusy | SessionErrorCode.TurnFailed | SessionErrorCode.ConsentResumeFailed | SessionErrorCode.ToolIterationLimit | SessionErrorCode.NoTerminalFrame | SessionErrorCode.WorkerTurnFailed;
|
|
37
38
|
export declare const SESSION_TURN_ERROR_CODES: readonly [SessionErrorCode.ThreadBusy, SessionErrorCode.TurnFailed, SessionErrorCode.ConsentResumeFailed, SessionErrorCode.ToolIterationLimit, SessionErrorCode.NoTerminalFrame, SessionErrorCode.WorkerTurnFailed];
|
|
38
|
-
export type SessionLaunchErrorCode = SessionErrorCode.LaunchConfigResolutionFailed | SessionErrorCode.LaunchSelectionInvalid | SessionErrorCode.LaunchWorkerAcquireTimeout | SessionErrorCode.LaunchWorkerAcquireRejected | SessionErrorCode.LaunchWorkerAllocationLost | SessionErrorCode.LaunchControlBundleFailed | SessionErrorCode.LaunchControlBundleRejected | SessionErrorCode.LaunchBootstrapFailed | SessionErrorCode.LaunchBootstrapContractBroken | SessionErrorCode.LaunchProvisionFailed | SessionErrorCode.LaunchStepUnreachable | SessionErrorCode.LaunchUnclassifiedFailure | SessionErrorCode.LaunchWorkspaceRestoreFailed | SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | SessionErrorCode.LaunchWorkingFileSourceMissing | SessionErrorCode.LaunchFinalizeFailed | SessionErrorCode.LaunchFinalizeReadinessFailed | SessionErrorCode.LaunchNoUsableProvider | SessionErrorCode.LaunchAgentUnavailable | SessionErrorCode.LaunchDeadlineExceeded | SessionErrorCode.LaunchIllegalTransition | SessionErrorCode.LaunchAbandoned;
|
|
39
|
-
export declare const SESSION_LAUNCH_ERROR_CODES: readonly [SessionErrorCode.LaunchConfigResolutionFailed, SessionErrorCode.LaunchSelectionInvalid, SessionErrorCode.LaunchWorkerAcquireTimeout, SessionErrorCode.LaunchWorkerAcquireRejected, SessionErrorCode.LaunchWorkerAllocationLost, SessionErrorCode.LaunchControlBundleFailed, SessionErrorCode.LaunchControlBundleRejected, SessionErrorCode.LaunchBootstrapFailed, SessionErrorCode.LaunchBootstrapContractBroken, SessionErrorCode.LaunchProvisionFailed, SessionErrorCode.LaunchStepUnreachable, SessionErrorCode.LaunchUnclassifiedFailure, SessionErrorCode.LaunchWorkspaceRestoreFailed, SessionErrorCode.LaunchWorkspaceSnapshotCorrupt, SessionErrorCode.LaunchWorkingFileSourceMissing, SessionErrorCode.LaunchFinalizeFailed, SessionErrorCode.LaunchFinalizeReadinessFailed, SessionErrorCode.LaunchNoUsableProvider, SessionErrorCode.LaunchAgentUnavailable, SessionErrorCode.LaunchDeadlineExceeded, SessionErrorCode.LaunchIllegalTransition, SessionErrorCode.LaunchAbandoned];
|
|
39
|
+
export type SessionLaunchErrorCode = SessionErrorCode.LaunchConfigResolutionFailed | SessionErrorCode.LaunchSelectionInvalid | SessionErrorCode.LaunchWorkerAcquireTimeout | SessionErrorCode.LaunchWorkerAcquireRejected | SessionErrorCode.LaunchWorkerAllocationLost | SessionErrorCode.LaunchControlBundleFailed | SessionErrorCode.LaunchControlBundleRejected | SessionErrorCode.LaunchBootstrapFailed | SessionErrorCode.LaunchBootstrapContractBroken | SessionErrorCode.LaunchProvisionFailed | SessionErrorCode.LaunchStepUnreachable | SessionErrorCode.LaunchUnclassifiedFailure | SessionErrorCode.LaunchWorkspaceRestoreFailed | SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | SessionErrorCode.LaunchWorkspaceSnapshotRuntimeNewer | SessionErrorCode.LaunchWorkingFileSourceMissing | SessionErrorCode.LaunchFinalizeFailed | SessionErrorCode.LaunchFinalizeReadinessFailed | SessionErrorCode.LaunchNoUsableProvider | SessionErrorCode.LaunchAgentUnavailable | SessionErrorCode.LaunchDeadlineExceeded | SessionErrorCode.LaunchIllegalTransition | SessionErrorCode.LaunchAbandoned;
|
|
40
|
+
export declare const SESSION_LAUNCH_ERROR_CODES: readonly [SessionErrorCode.LaunchConfigResolutionFailed, SessionErrorCode.LaunchSelectionInvalid, SessionErrorCode.LaunchWorkerAcquireTimeout, SessionErrorCode.LaunchWorkerAcquireRejected, SessionErrorCode.LaunchWorkerAllocationLost, SessionErrorCode.LaunchControlBundleFailed, SessionErrorCode.LaunchControlBundleRejected, SessionErrorCode.LaunchBootstrapFailed, SessionErrorCode.LaunchBootstrapContractBroken, SessionErrorCode.LaunchProvisionFailed, SessionErrorCode.LaunchStepUnreachable, SessionErrorCode.LaunchUnclassifiedFailure, SessionErrorCode.LaunchWorkspaceRestoreFailed, SessionErrorCode.LaunchWorkspaceSnapshotCorrupt, SessionErrorCode.LaunchWorkspaceSnapshotRuntimeNewer, SessionErrorCode.LaunchWorkingFileSourceMissing, SessionErrorCode.LaunchFinalizeFailed, SessionErrorCode.LaunchFinalizeReadinessFailed, SessionErrorCode.LaunchNoUsableProvider, SessionErrorCode.LaunchAgentUnavailable, SessionErrorCode.LaunchDeadlineExceeded, SessionErrorCode.LaunchIllegalTransition, SessionErrorCode.LaunchAbandoned];
|
|
40
41
|
export declare const SESSION_LAUNCH_FAILURE_CODES: Readonly<Record<string, SessionLaunchErrorCode>>;
|
|
41
42
|
export declare function mapLaunchFailureToSessionErrorCode(launchFailureKind: string): SessionLaunchErrorCode;
|
|
42
43
|
//# sourceMappingURL=error-codes.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":"AA4BA,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,YAAY,iBAAiB;CAC9B;AA6BD,oBAAY,gBAAgB;IAM1B,UAAU,uBAAuB;IAMjC,UAAU,uBAAuB;IAUjC,mBAAmB,yBAAyB;IAO5C,kBAAkB,gCAAgC;IAKlD,eAAe,6BAA6B;IAU5C,gBAAgB,+BAA+B;IAkB/C,4BAA4B,6BAA6B;IAOzD,sBAAsB,6BAA6B;IAEnD,0BAA0B,2BAA2B;IAErD,2BAA2B,4BAA4B;IAWvD,0BAA0B,2BAA2B;IAQrD,yBAAyB,0BAA0B;IAenD,2BAA2B,4BAA4B;IAEvD,qBAAqB,qBAAqB;IAa1C,6BAA6B,8BAA8B;IAkB3D,qBAAqB,qBAAqB;IAqC1C,qBAAqB,qBAAqB;IAuB1C,yBAAyB,wBAAwB;IAYjD,4BAA4B,6BAA6B;IAazD,8BAA8B,+BAA+B;
|
|
1
|
+
{"version":3,"file":"error-codes.d.ts","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":"AA4BA,oBAAY,iBAAiB;IAC3B,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,YAAY,iBAAiB;CAC9B;AA6BD,oBAAY,gBAAgB;IAM1B,UAAU,uBAAuB;IAMjC,UAAU,uBAAuB;IAUjC,mBAAmB,yBAAyB;IAO5C,kBAAkB,gCAAgC;IAKlD,eAAe,6BAA6B;IAU5C,gBAAgB,+BAA+B;IAkB/C,4BAA4B,6BAA6B;IAOzD,sBAAsB,6BAA6B;IAEnD,0BAA0B,2BAA2B;IAErD,2BAA2B,4BAA4B;IAWvD,0BAA0B,2BAA2B;IAQrD,yBAAyB,0BAA0B;IAenD,2BAA2B,4BAA4B;IAEvD,qBAAqB,qBAAqB;IAa1C,6BAA6B,8BAA8B;IAkB3D,qBAAqB,qBAAqB;IAqC1C,qBAAqB,qBAAqB;IAuB1C,yBAAyB,wBAAwB;IAYjD,4BAA4B,6BAA6B;IAazD,8BAA8B,+BAA+B;IAsB7D,mCAAmC,qCAAqC;IAYxE,8BAA8B,gCAAgC;IAiB9D,oBAAoB,oBAAoB;IAWxC,6BAA6B,8BAA8B;IAK3D,sBAAsB,uBAAuB;IAM7C,sBAAsB,sBAAsB;IAa5C,sBAAsB,sBAAsB;IAE5C,uBAAuB,uBAAuB;IAK9C,eAAe,qBAAqB;CACrC;AAUD,MAAM,MAAM,oBAAoB,GAC5B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,UAAU,GAC3B,gBAAgB,CAAC,mBAAmB,GACpC,gBAAgB,CAAC,kBAAkB,GACnC,gBAAgB,CAAC,eAAe,GAChC,gBAAgB,CAAC,gBAAgB,CAAC;AAGtC,eAAO,MAAM,wBAAwB,qNAOe,CAAC;AAUrD,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,0BAA0B,GAC3C,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,2BAA2B,GAC5C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,qBAAqB,GACtC,gBAAgB,CAAC,yBAAyB,GAC1C,gBAAgB,CAAC,4BAA4B,GAC7C,gBAAgB,CAAC,8BAA8B,GAC/C,gBAAgB,CAAC,mCAAmC,GACpD,gBAAgB,CAAC,8BAA8B,GAC/C,gBAAgB,CAAC,oBAAoB,GACrC,gBAAgB,CAAC,6BAA6B,GAC9C,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,sBAAsB,GACvC,gBAAgB,CAAC,uBAAuB,GACxC,gBAAgB,CAAC,eAAe,CAAC;AAGrC,eAAO,MAAM,0BAA0B,8/BAwBe,CAAC;AAiBvD,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAKvC,CAAC;AAuBF,wBAAgB,kCAAkC,CAChD,iBAAiB,EAAE,MAAM,GACxB,sBAAsB,CAWxB"}
|
|
@@ -30,6 +30,7 @@ var SessionErrorCode;
|
|
|
30
30
|
SessionErrorCode["LaunchUnclassifiedFailure"] = "launch_unclassified";
|
|
31
31
|
SessionErrorCode["LaunchWorkspaceRestoreFailed"] = "workspace_restore_failed";
|
|
32
32
|
SessionErrorCode["LaunchWorkspaceSnapshotCorrupt"] = "workspace_snapshot_corrupt";
|
|
33
|
+
SessionErrorCode["LaunchWorkspaceSnapshotRuntimeNewer"] = "workspace_snapshot_runtime_newer";
|
|
33
34
|
SessionErrorCode["LaunchWorkingFileSourceMissing"] = "working_file_source_missing";
|
|
34
35
|
SessionErrorCode["LaunchFinalizeFailed"] = "finalize_failed";
|
|
35
36
|
SessionErrorCode["LaunchFinalizeReadinessFailed"] = "finalize_readiness_failed";
|
|
@@ -62,6 +63,7 @@ exports.SESSION_LAUNCH_ERROR_CODES = [
|
|
|
62
63
|
SessionErrorCode.LaunchUnclassifiedFailure,
|
|
63
64
|
SessionErrorCode.LaunchWorkspaceRestoreFailed,
|
|
64
65
|
SessionErrorCode.LaunchWorkspaceSnapshotCorrupt,
|
|
66
|
+
SessionErrorCode.LaunchWorkspaceSnapshotRuntimeNewer,
|
|
65
67
|
SessionErrorCode.LaunchWorkingFileSourceMissing,
|
|
66
68
|
SessionErrorCode.LaunchFinalizeFailed,
|
|
67
69
|
SessionErrorCode.LaunchFinalizeReadinessFailed,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"error-codes.js","sourceRoot":"","sources":["../../../src/lib/session-event-payloads/error-codes.ts"],"names":[],"mappings":";;;AAggBA,gFAaC;AAjfD,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,kCAAa,CAAA;IACb,sCAAiB,CAAA;IACjB,kDAA6B,CAAA;AAC/B,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B;AA6BD,IAAY,gBA+TX;AA/TD,WAAY,gBAAgB;IAM1B,qDAAiC,CAAA;IAMjC,qDAAiC,CAAA;IAUjC,gEAA4C,CAAA;IAO5C,sEAAkD,CAAA;IAKlD,gEAA4C,CAAA;IAU5C,mEAA+C,CAAA;IAkB/C,6EAAyD,CAAA;IAOzD,uEAAmD,CAAA;IAEnD,yEAAqD,CAAA;IAErD,2EAAuD,CAAA;IAWvD,yEAAqD,CAAA;IAQrD,uEAAmD,CAAA;IAenD,2EAAuD,CAAA;IAEvD,8DAA0C,CAAA;IAa1C,+EAA2D,CAAA;IAkB3D,8DAA0C,CAAA;IAqC1C,8DAA0C,CAAA;IAuB1C,qEAAiD,CAAA;IAYjD,6EAAyD,CAAA;IAazD,iFAA6D,CAAA;IAsB7D,4FAAwE,CAAA;IAYxE,kFAA8D,CAAA;IAiB9D,4DAAwC,CAAA;IAWxC,+EAA2D,CAAA;IAK3D,iEAA6C,CAAA;IAM7C,gEAA4C,CAAA;IAa5C,gEAA4C,CAAA;IAE5C,kEAA8C,CAAA;IAK9C,wDAAoC,CAAA;AACtC,CAAC,EA/TW,gBAAgB,gCAAhB,gBAAgB,QA+T3B;AAmBY,QAAA,wBAAwB,GAAG;IACtC,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,kBAAkB;IACnC,gBAAgB,CAAC,eAAe;IAChC,gBAAgB,CAAC,gBAAgB;CACiB,CAAC;AAoCxC,QAAA,0BAA0B,GAAG;IACxC,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,0BAA0B;IAC3C,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,2BAA2B;IAC5C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,qBAAqB;IACtC,gBAAgB,CAAC,yBAAyB;IAC1C,gBAAgB,CAAC,4BAA4B;IAC7C,gBAAgB,CAAC,8BAA8B;IAC/C,gBAAgB,CAAC,mCAAmC;IACpD,gBAAgB,CAAC,8BAA8B;IAC/C,gBAAgB,CAAC,oBAAoB;IACrC,gBAAgB,CAAC,6BAA6B;IAC9C,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,sBAAsB;IACvC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,eAAe;CACoB,CAAC;AAiB1C,QAAA,4BAA4B,GAErC,MAAM,CAAC,MAAM,CACf,MAAM,CAAC,WAAW,CAChB,kCAA0B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,CAAC,CAAC,CACvB,CAC5C,CAAC;AAuBF,SAAgB,kCAAkC,CAChD,iBAAyB;IAEzB,MAAM,IAAI,GAAG,oCAA4B,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,wBAAwB,iBAAiB,6BAA6B;YACpE,qEAAqE;YACrE,iDAAiD;YACjD,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -63,12 +63,12 @@ export declare const SESSION_EVENT_PAYLOAD_SCHEMAS: {
|
|
|
63
63
|
detail: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
|
|
64
64
|
}, z.core.$strict>, z.ZodObject<{
|
|
65
65
|
phase: z.ZodLiteral<SessionErrorPhase.Resume>;
|
|
66
|
-
code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
|
|
66
|
+
code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotRuntimeNewer | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
|
|
67
67
|
message: z.ZodString;
|
|
68
68
|
agentSlug: z.ZodOptional<z.ZodString>;
|
|
69
69
|
}, z.core.$strict>, z.ZodObject<{
|
|
70
70
|
phase: z.ZodLiteral<SessionErrorPhase.Provisioning>;
|
|
71
|
-
code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
|
|
71
|
+
code: z.ZodLiteral<import("./error-codes").SessionErrorCode.LaunchConfigResolutionFailed | import("./error-codes").SessionErrorCode.LaunchSelectionInvalid | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireTimeout | import("./error-codes").SessionErrorCode.LaunchWorkerAcquireRejected | import("./error-codes").SessionErrorCode.LaunchWorkerAllocationLost | import("./error-codes").SessionErrorCode.LaunchControlBundleFailed | import("./error-codes").SessionErrorCode.LaunchControlBundleRejected | import("./error-codes").SessionErrorCode.LaunchBootstrapFailed | import("./error-codes").SessionErrorCode.LaunchBootstrapContractBroken | import("./error-codes").SessionErrorCode.LaunchProvisionFailed | import("./error-codes").SessionErrorCode.LaunchStepUnreachable | import("./error-codes").SessionErrorCode.LaunchUnclassifiedFailure | import("./error-codes").SessionErrorCode.LaunchWorkspaceRestoreFailed | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotCorrupt | import("./error-codes").SessionErrorCode.LaunchWorkspaceSnapshotRuntimeNewer | import("./error-codes").SessionErrorCode.LaunchWorkingFileSourceMissing | import("./error-codes").SessionErrorCode.LaunchFinalizeFailed | import("./error-codes").SessionErrorCode.LaunchFinalizeReadinessFailed | import("./error-codes").SessionErrorCode.LaunchNoUsableProvider | import("./error-codes").SessionErrorCode.LaunchAgentUnavailable | import("./error-codes").SessionErrorCode.LaunchDeadlineExceeded | import("./error-codes").SessionErrorCode.LaunchIllegalTransition | import("./error-codes").SessionErrorCode.LaunchAbandoned>;
|
|
72
72
|
message: z.ZodString;
|
|
73
73
|
}, z.core.$strict>], "phase">;
|
|
74
74
|
};
|
|
@@ -11,6 +11,8 @@ export declare function asNonEmptyString(value: unknown): string | undefined;
|
|
|
11
11
|
export declare function resolveRolesFromClaims(claims: Record<string, unknown>): string[];
|
|
12
12
|
export declare function resolveClientIdFromClaims(claims: Record<string, unknown>): string | undefined;
|
|
13
13
|
export declare function resolveActAsFromClaims(claims: Record<string, unknown>): string | undefined;
|
|
14
|
+
export declare const SUBJECT_KIND_CLAIM = "subject_kind";
|
|
15
|
+
export declare function readDeclaredSubjectKind(claims: Record<string, unknown>): SubjectKind | null | undefined;
|
|
14
16
|
export declare function tryResolveSubjectAndClass(roles: string[], claims: Record<string, unknown>, actAs: string | undefined): {
|
|
15
17
|
kind: SubjectKind;
|
|
16
18
|
tokenClass: TokenClass;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actor-classification.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,
|
|
1
|
+
{"version":3,"file":"actor-classification.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAEX,UAAU,EACX,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAchE,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAEzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAKhC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAInE;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,EAAE,CAYV;AAuBD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,SAAS,CAEpB;AAYD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,SAAS,CAMpB;AAsBD,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAajD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,WAAW,GAAG,IAAI,GAAG,SAAS,CAMhC;AAsCD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAoB3D;AAWD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAO/C;AAUD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,cAAc,CAAC,WAAW,CAAC,CAgB7B;AAUD,wBAAgB,YAAY,CAC1B,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,cAAc,CAAC,WAAW,CAAC,CAK7B;AAOD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,mBAAmB,CAerB"}
|
|
@@ -1,9 +1,11 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.SUBJECT_KIND_CLAIM = void 0;
|
|
3
4
|
exports.asNonEmptyString = asNonEmptyString;
|
|
4
5
|
exports.resolveRolesFromClaims = resolveRolesFromClaims;
|
|
5
6
|
exports.resolveClientIdFromClaims = resolveClientIdFromClaims;
|
|
6
7
|
exports.resolveActAsFromClaims = resolveActAsFromClaims;
|
|
8
|
+
exports.readDeclaredSubjectKind = readDeclaredSubjectKind;
|
|
7
9
|
exports.tryResolveSubjectAndClass = tryResolveSubjectAndClass;
|
|
8
10
|
exports.resolveSubjectAndClass = resolveSubjectAndClass;
|
|
9
11
|
exports.actorTypeForSubjectKind = actorTypeForSubjectKind;
|
|
@@ -35,6 +37,14 @@ function resolveActAsFromClaims(claims) {
|
|
|
35
37
|
}
|
|
36
38
|
return asNonEmptyString(act['sub']);
|
|
37
39
|
}
|
|
40
|
+
exports.SUBJECT_KIND_CLAIM = 'subject_kind';
|
|
41
|
+
function readDeclaredSubjectKind(claims) {
|
|
42
|
+
if (!(exports.SUBJECT_KIND_CLAIM in claims)) {
|
|
43
|
+
return undefined;
|
|
44
|
+
}
|
|
45
|
+
const parsed = subject_1.SubjectKindSchema.safeParse(claims[exports.SUBJECT_KIND_CLAIM]);
|
|
46
|
+
return parsed.success ? parsed.data : null;
|
|
47
|
+
}
|
|
38
48
|
function subjectKindForTokenClass(tokenClass) {
|
|
39
49
|
switch (tokenClass) {
|
|
40
50
|
case subject_1.TokenClass.ServiceJwt:
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actor-classification.js","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"actor-classification.js","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":";;;AAmCA,4CAIC;AAGD,wDAcC;AAuBD,8DAIC;AAYD,wDAQC;AAmCD,0DAQC;AAsCD,8DAwBC;AAWD,wDAWC;AAUD,0DAkBC;AAUD,oCAQC;AAOD,8DAiBC;AA5SD,8DAI0C;AA+B1C,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAGD,SAAgB,sBAAsB,CACpC,MAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IACE,WAAW;QACX,OAAO,WAAW,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAE,WAAmC,CAAC,KAAK,CAAC,EACzD,CAAC;QACD,OAAQ,WAAoC,CAAC,KAAK,CAAC,MAAM,CACvD,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAuBD,SAAgB,yBAAyB,CACvC,MAA+B;IAE/B,OAAO,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC;AAYD,SAAgB,sBAAsB,CACpC,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAE,GAA+B,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAsBY,QAAA,kBAAkB,GAAG,cAAc,CAAC;AAajD,SAAgB,uBAAuB,CACrC,MAA+B;IAE/B,IAAI,CAAC,CAAC,0BAAkB,IAAI,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,2BAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,0BAAkB,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAsB;IACtD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,oBAAU,CAAC,UAAU;YACxB,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,oBAAU,CAAC,iBAAiB;YAC/B,OAAO,qBAAW,CAAC,KAAK,CAAC;QAC3B,KAAK,oBAAU,CAAC,oBAAoB;YAGlC,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,oBAAU,CAAC,oBAAoB;YAClC,OAAO,qBAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAU,CAAC,sBAAsB;YACpC,OAAO,qBAAW,CAAC,MAAM,CAAC;QAC5B,KAAK,oBAAU,CAAC,OAAO;YACrB,OAAO,qBAAW,CAAC,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAmBD,SAAgB,yBAAyB,CACvC,KAAe,EACf,MAA+B,EAC/B,KAAyB;IAEzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,oBAAU,CAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxE,CAAC,CAAE,QAAuB;YAC1B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,UAAU,EAAE,oBAAU,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAU,CAAC,UAAU,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,UAAU,EAAE,oBAAU,CAAC,iBAAiB,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAWD,SAAgB,sBAAsB,CACpC,KAAe,EACf,MAA+B,EAC/B,KAAyB;IAEzB,OAAO,CACL,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI;QACjD,IAAI,EAAE,qBAAW,CAAC,IAAI;QACtB,UAAU,EAAE,oBAAU,CAAC,OAAO;KAC/B,CACF,CAAC;AACJ,CAAC;AAUD,SAAgB,uBAAuB,CACrC,IAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAW,CAAC,OAAO,CAAC;QACzB,KAAK,qBAAW,CAAC,MAAM;YACrB,OAAO,SAAS,CAAC;QACnB,KAAK,qBAAW,CAAC,KAAK;YACpB,OAAO,OAAO,CAAC;QACjB,KAAK,qBAAW,CAAC,IAAI,CAAC;QACtB,KAAK,qBAAW,CAAC,eAAe,CAAC;QACjC,KAAK,qBAAW,CAAC,GAAG,CAAC;QACrB,KAAK,qBAAW,CAAC,SAAS,CAAC;QAC3B,KAAK,qBAAW,CAAC,KAAK,CAAC;QACvB,KAAK,qBAAW,CAAC,IAAI,CAAC;QACtB,KAAK,qBAAW,CAAC,IAAI;YACnB,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAUD,SAAgB,YAAY,CAC1B,WAAwB,EACxB,KAAyB;IAEzB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAOD,SAAgB,yBAAyB,CACvC,MAA+B;IAE/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAC9D,KAAK,EACL,MAAM,EACN,KAAK,CACN,CAAC;IACF,OAAO;QACL,KAAK;QACL,KAAK;QACL,WAAW;QACX,UAAU;QACV,SAAS,EAAE,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC;KAC5C,CAAC;AACJ,CAAC"}
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import type { TrustedIssuerEntry } from '@xemahq/oidc-guard';
|
|
1
2
|
export declare const AUTH_MODULE_OPTIONS: unique symbol;
|
|
2
3
|
export interface AuthModuleOptions {
|
|
3
4
|
jwksUrl?: string;
|
|
@@ -10,6 +11,8 @@ export interface AuthModuleOptions {
|
|
|
10
11
|
readonly discoveryBaseUrls: readonly string[];
|
|
11
12
|
readonly allowedRealms: readonly string[];
|
|
12
13
|
};
|
|
14
|
+
trustedIssuers?: readonly TrustedIssuerEntry[];
|
|
15
|
+
trustedIssuersProvider?: () => Promise<readonly TrustedIssuerEntry[]> | readonly TrustedIssuerEntry[];
|
|
13
16
|
enableRolesGuard?: boolean;
|
|
14
17
|
}
|
|
15
18
|
export interface AuthModuleAsyncOptions {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-module-options.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/auth-module-options.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"auth-module-options.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/auth-module-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAK7D,eAAO,MAAM,mBAAmB,eAAgC,CAAC;AAcjE,MAAM,WAAW,iBAAiB;IAOhC,OAAO,CAAC,EAAE,MAAM,CAAC;IAUjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAYhB,eAAe,CAAC,EAAE,MAAM,CAAC;IAOzB,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IAQvE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAOzB,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC;IAa3D,mBAAmB,CAAC,EAAE;QACpB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3C,CAAC;IA0BF,cAAc,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAO/C,sBAAsB,CAAC,EAAE,MACrB,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,GACtC,SAAS,kBAAkB,EAAE,CAAC;IAMlC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAKD,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-module-options.js","sourceRoot":"","sources":["../../../src/nestjs/auth/auth-module-options.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"auth-module-options.js","sourceRoot":"","sources":["../../../src/nestjs/auth/auth-module-options.ts"],"names":[],"mappings":";;;AAKa,QAAA,mBAAmB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC"}
|
|
@@ -1,8 +1,14 @@
|
|
|
1
1
|
import { BadRequestException } from '@nestjs/common';
|
|
2
|
-
import type { ActingForRef } from '@xemahq/kernel-contracts/subject';
|
|
2
|
+
import type { ActingForRef, SubjectKind } from '@xemahq/kernel-contracts/subject';
|
|
3
3
|
export declare class UnclassifiableActorHopError extends BadRequestException {
|
|
4
4
|
constructor(hopIndex: number, hopSub: string);
|
|
5
5
|
}
|
|
6
|
+
export declare class UnknownActorHopSubjectKindError extends BadRequestException {
|
|
7
|
+
constructor(hopIndex: number, hopSub: string, declared: unknown);
|
|
8
|
+
}
|
|
9
|
+
export declare class ContradictoryActorHopKindError extends BadRequestException {
|
|
10
|
+
constructor(hopIndex: number, hopSub: string, declared: SubjectKind, derived: SubjectKind);
|
|
11
|
+
}
|
|
6
12
|
export declare class MalformedActorHopError extends BadRequestException {
|
|
7
13
|
constructor(hopIndex: number);
|
|
8
14
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-chain.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EACV,YAAY,
|
|
1
|
+
{"version":3,"file":"delegation-chain.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACZ,MAAM,kCAAkC,CAAC;AA8B1C,qBAAa,2BAA4B,SAAQ,mBAAmB;gBACtD,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS7C;AAWD,qBAAa,+BAAgC,SAAQ,mBAAmB;gBAC1D,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO;CAQhE;AAaD,qBAAa,8BAA+B,SAAQ,mBAAmB;gBAEnE,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,WAAW;CASvB;AAGD,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,QAAQ,EAAE,MAAM;CAO7B;AA0FD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,YAAY,EAAE,CAmBhB"}
|
|
@@ -1,19 +1,37 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.MalformedActorHopError = exports.UnclassifiableActorHopError = void 0;
|
|
3
|
+
exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = void 0;
|
|
4
4
|
exports.resolveActorChainFromClaims = resolveActorChainFromClaims;
|
|
5
5
|
const common_1 = require("@nestjs/common");
|
|
6
6
|
const actor_classification_1 = require("./actor-classification");
|
|
7
7
|
class UnclassifiableActorHopError extends common_1.BadRequestException {
|
|
8
8
|
constructor(hopIndex, hopSub) {
|
|
9
9
|
super(`Delegation hop #${hopIndex} (act.sub='${hopSub}') carries no ` +
|
|
10
|
-
`subject-kind signal: none of "token_class", a nested
|
|
11
|
-
`or a "realm_access.roles" entry is present on the hop. The token's ` +
|
|
10
|
+
`subject-kind signal: none of "subject_kind", "token_class", a nested ` +
|
|
11
|
+
`"act", or a "realm_access.roles" entry is present on the hop. The token's ` +
|
|
12
12
|
`delegation chain cannot be classified, so the request is refused ` +
|
|
13
13
|
`rather than assuming a kind.`);
|
|
14
14
|
}
|
|
15
15
|
}
|
|
16
16
|
exports.UnclassifiableActorHopError = UnclassifiableActorHopError;
|
|
17
|
+
class UnknownActorHopSubjectKindError extends common_1.BadRequestException {
|
|
18
|
+
constructor(hopIndex, hopSub, declared) {
|
|
19
|
+
super(`Delegation hop #${hopIndex} (act.sub='${hopSub}') declares ` +
|
|
20
|
+
`"${actor_classification_1.SUBJECT_KIND_CLAIM}": ${JSON.stringify(declared)}, which is not a ` +
|
|
21
|
+
`known SubjectKind. The hop is refused rather than classified from a ` +
|
|
22
|
+
`weaker signal, which would name a different principal than the issuer did.`);
|
|
23
|
+
}
|
|
24
|
+
}
|
|
25
|
+
exports.UnknownActorHopSubjectKindError = UnknownActorHopSubjectKindError;
|
|
26
|
+
class ContradictoryActorHopKindError extends common_1.BadRequestException {
|
|
27
|
+
constructor(hopIndex, hopSub, declared, derived) {
|
|
28
|
+
super(`Delegation hop #${hopIndex} (act.sub='${hopSub}') contradicts itself: ` +
|
|
29
|
+
`"${actor_classification_1.SUBJECT_KIND_CLAIM}" declares '${declared}' while its own ` +
|
|
30
|
+
`"token_class"/"realm_access.roles" imply '${derived}'. The hop is ` +
|
|
31
|
+
`refused rather than one statement being silently preferred.`);
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
exports.ContradictoryActorHopKindError = ContradictoryActorHopKindError;
|
|
17
35
|
class MalformedActorHopError extends common_1.BadRequestException {
|
|
18
36
|
constructor(hopIndex) {
|
|
19
37
|
super(`Delegation hop #${hopIndex} has no non-empty "sub" claim. An RFC 8693 ` +
|
|
@@ -28,11 +46,19 @@ function asClaimObject(value) {
|
|
|
28
46
|
: undefined;
|
|
29
47
|
}
|
|
30
48
|
function classifyHop(hop, hopIndex, hopSub) {
|
|
31
|
-
const
|
|
32
|
-
if (
|
|
49
|
+
const declared = (0, actor_classification_1.readDeclaredSubjectKind)(hop);
|
|
50
|
+
if (declared === null) {
|
|
51
|
+
throw new UnknownActorHopSubjectKindError(hopIndex, hopSub, hop[actor_classification_1.SUBJECT_KIND_CLAIM]);
|
|
52
|
+
}
|
|
53
|
+
const derived = (0, actor_classification_1.tryResolveSubjectAndClass)((0, actor_classification_1.resolveRolesFromClaims)(hop), hop, (0, actor_classification_1.resolveActAsFromClaims)(hop))?.kind;
|
|
54
|
+
if (declared !== undefined && derived !== undefined && declared !== derived) {
|
|
55
|
+
throw new ContradictoryActorHopKindError(hopIndex, hopSub, declared, derived);
|
|
56
|
+
}
|
|
57
|
+
const kind = declared ?? derived;
|
|
58
|
+
if (kind === undefined) {
|
|
33
59
|
throw new UnclassifiableActorHopError(hopIndex, hopSub);
|
|
34
60
|
}
|
|
35
|
-
return
|
|
61
|
+
return kind;
|
|
36
62
|
}
|
|
37
63
|
function resolveActorChainFromClaims(claims) {
|
|
38
64
|
const chain = [];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-chain.js","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"delegation-chain.js","sourceRoot":"","sources":["../../../src/nestjs/auth/delegation-chain.ts"],"names":[],"mappings":";;;AAgMA,kEAqBC;AArND,2CAAqD;AAMrD,iEAQgC;AAoBhC,MAAa,2BAA4B,SAAQ,4BAAmB;IAClE,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,gBAAgB;YAC7D,uEAAuE;YACvE,4EAA4E;YAC5E,mEAAmE;YACnE,8BAA8B,CACjC,CAAC;IACJ,CAAC;CACF;AAVD,kEAUC;AAWD,MAAa,+BAAgC,SAAQ,4BAAmB;IACtE,YAAY,QAAgB,EAAE,MAAc,EAAE,QAAiB;QAC7D,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,cAAc;YAC3D,IAAI,yCAAkB,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB;YACvE,sEAAsE;YACtE,4EAA4E,CAC/E,CAAC;IACJ,CAAC;CACF;AATD,0EASC;AAaD,MAAa,8BAA+B,SAAQ,4BAAmB;IACrE,YACE,QAAgB,EAChB,MAAc,EACd,QAAqB,EACrB,OAAoB;QAEpB,KAAK,CACH,mBAAmB,QAAQ,cAAc,MAAM,yBAAyB;YACtE,IAAI,yCAAkB,eAAe,QAAQ,kBAAkB;YAC/D,6CAA6C,OAAO,gBAAgB;YACpE,6DAA6D,CAChE,CAAC;IACJ,CAAC;CACF;AAdD,wEAcC;AAGD,MAAa,sBAAuB,SAAQ,4BAAmB;IAC7D,YAAY,QAAgB;QAC1B,KAAK,CACH,mBAAmB,QAAQ,6CAA6C;YACtE,sEAAsE;YACtE,+BAA+B,CAClC,CAAC;IACJ,CAAC;CACF;AARD,wDAQC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAwBD,SAAS,WAAW,CAClB,GAA4B,EAC5B,QAAgB,EAChB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,8CAAuB,EAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,+BAA+B,CACvC,QAAQ,EACR,MAAM,EACN,GAAG,CAAC,yCAAkB,CAAC,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAAyB,EACvC,IAAA,6CAAsB,EAAC,GAAG,CAAC,EAC3B,GAAG,EACH,IAAA,6CAAsB,EAAC,GAAG,CAAC,CAC5B,EAAE,IAAI,CAAC;IAER,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC5E,MAAM,IAAI,8BAA8B,CACtC,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,IAAI,OAAO,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AA2BD,SAAgB,2BAA2B,CACzC,MAA+B;IAE/B,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAA,uCAAgB,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,gDAAyB,EAAC,IAAI,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;YACtC,EAAE,EAAE,GAAG;YACP,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -13,5 +13,8 @@ export { OrgClaimKey, OrgHeaderName, ORG_CLAIM_KEYS, resolveOrgClaim, } from '..
|
|
|
13
13
|
export { RequireOrgClaim, REQUIRE_ORG_CLAIM } from './org-claim-required';
|
|
14
14
|
export { OrgAuthoritySource, type OrgAuthorityVerdict, type OrgAuthorityCallerFacts, resolveOrgAuthority, isOrgAuthorityProven, orgAuthorityRequiresProof, OrgAuthorityMode, ORG_AUTHORITY_MODE_ENV, InvalidOrgAuthorityModeError, resolveOrgAuthorityMode, } from '../../lib/auth/org-authority';
|
|
15
15
|
export { ORG_AUTHORITY_OBSERVATION_LIMIT, UNKNOWN_CLIENT_ID, type OrgAuthorityObservation, type OrgAuthorityCensus, recordUnprovenOrgAuthority, orgAuthorityCensus, resetOrgAuthorityCensus, } from '../../lib/auth/org-authority-observations';
|
|
16
|
-
export { resolveActorChainFromClaims, UnclassifiableActorHopError, MalformedActorHopError, } from './delegation-chain';
|
|
16
|
+
export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorHopSubjectKindError, ContradictoryActorHopKindError, MalformedActorHopError, } from './delegation-chain';
|
|
17
|
+
export { SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, } from './actor-classification';
|
|
18
|
+
export { RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, } from './realm-token-verifier';
|
|
19
|
+
export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
|
|
17
20
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.MalformedActorHopError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.resolveOrgAuthorityMode = exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
|
|
3
|
+
exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.RealmTokenVerifier = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.resolveOrgAuthorityMode = exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
|
|
4
|
+
exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = void 0;
|
|
4
5
|
var auth_module_1 = require("./auth.module");
|
|
5
6
|
Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
|
|
6
7
|
var auth_module_options_1 = require("./auth-module-options");
|
|
@@ -59,5 +60,18 @@ Object.defineProperty(exports, "resetOrgAuthorityCensus", { enumerable: true, ge
|
|
|
59
60
|
var delegation_chain_1 = require("./delegation-chain");
|
|
60
61
|
Object.defineProperty(exports, "resolveActorChainFromClaims", { enumerable: true, get: function () { return delegation_chain_1.resolveActorChainFromClaims; } });
|
|
61
62
|
Object.defineProperty(exports, "UnclassifiableActorHopError", { enumerable: true, get: function () { return delegation_chain_1.UnclassifiableActorHopError; } });
|
|
63
|
+
Object.defineProperty(exports, "UnknownActorHopSubjectKindError", { enumerable: true, get: function () { return delegation_chain_1.UnknownActorHopSubjectKindError; } });
|
|
64
|
+
Object.defineProperty(exports, "ContradictoryActorHopKindError", { enumerable: true, get: function () { return delegation_chain_1.ContradictoryActorHopKindError; } });
|
|
62
65
|
Object.defineProperty(exports, "MalformedActorHopError", { enumerable: true, get: function () { return delegation_chain_1.MalformedActorHopError; } });
|
|
66
|
+
var actor_classification_1 = require("./actor-classification");
|
|
67
|
+
Object.defineProperty(exports, "SUBJECT_KIND_CLAIM", { enumerable: true, get: function () { return actor_classification_1.SUBJECT_KIND_CLAIM; } });
|
|
68
|
+
Object.defineProperty(exports, "readDeclaredSubjectKind", { enumerable: true, get: function () { return actor_classification_1.readDeclaredSubjectKind; } });
|
|
69
|
+
var realm_token_verifier_1 = require("./realm-token-verifier");
|
|
70
|
+
Object.defineProperty(exports, "RealmTokenVerifier", { enumerable: true, get: function () { return realm_token_verifier_1.RealmTokenVerifier; } });
|
|
71
|
+
var oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
72
|
+
Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
|
|
73
|
+
Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });
|
|
74
|
+
Object.defineProperty(exports, "TrustedIssuerConfigError", { enumerable: true, get: function () { return oidc_guard_1.TrustedIssuerConfigError; } });
|
|
75
|
+
Object.defineProperty(exports, "TrustedIssuerRegistry", { enumerable: true, get: function () { return oidc_guard_1.TrustedIssuerRegistry; } });
|
|
76
|
+
Object.defineProperty(exports, "parseTrustedIssuersFromEnv", { enumerable: true, get: function () { return oidc_guard_1.parseTrustedIssuersFromEnv; } });
|
|
63
77
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,2DAA0E;AAAjE,qHAAA,eAAe,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAC3C,8DAWsC;AAVpC,mHAAA,kBAAkB,OAAA;AAGlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AACzB,iHAAA,gBAAgB,OAAA;AAChB,uHAAA,sBAAsB,OAAA;AACtB,6HAAA,4BAA4B,OAAA;AAC5B,wHAAA,uBAAuB,OAAA;AAEzB,wFAQmD;AAPjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAGgC;AAF9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AAEzB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAUpB,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}
|
|
@@ -1,9 +1,15 @@
|
|
|
1
|
-
import type { DecodedJwtHeader, DecodedJwtPayload, IssuerTenantResolver } from '@xemahq/oidc-guard';
|
|
1
|
+
import type { DecodedJwtHeader, DecodedJwtPayload, IssuerTenantResolver, TrustedIssuerEntry } from '@xemahq/oidc-guard';
|
|
2
2
|
import type { AuthModuleOptions } from './auth-module-options';
|
|
3
3
|
export interface MultiRealmKeySource {
|
|
4
4
|
readonly discoveryBaseUrls: string[];
|
|
5
5
|
readonly allowedRealms: string[];
|
|
6
6
|
}
|
|
7
|
+
export type VerifiedTokenSource = {
|
|
8
|
+
readonly kind: 'realm';
|
|
9
|
+
} | {
|
|
10
|
+
readonly kind: 'trusted-issuer';
|
|
11
|
+
readonly entry: TrustedIssuerEntry;
|
|
12
|
+
};
|
|
7
13
|
export declare class RealmTokenVerifier {
|
|
8
14
|
private readonly options?;
|
|
9
15
|
private static readonly SINGLE_REALM_CACHE_KEY;
|
|
@@ -14,16 +20,24 @@ export declare class RealmTokenVerifier {
|
|
|
14
20
|
private readonly oidcVerifier;
|
|
15
21
|
private multiRealmConfig;
|
|
16
22
|
private resolvingConfig;
|
|
23
|
+
private readonly staticTrustedIssuers;
|
|
24
|
+
private trustedIssuers;
|
|
25
|
+
private resolvingTrustedIssuers;
|
|
17
26
|
constructor(options?: AuthModuleOptions | undefined);
|
|
18
27
|
decode(token: string): {
|
|
19
28
|
header: DecodedJwtHeader;
|
|
20
29
|
payload: DecodedJwtPayload;
|
|
21
30
|
};
|
|
22
31
|
verify(token: string): Promise<DecodedJwtPayload>;
|
|
32
|
+
verifyWithSource(token: string): Promise<{
|
|
33
|
+
payload: DecodedJwtPayload;
|
|
34
|
+
source: VerifiedTokenSource;
|
|
35
|
+
}>;
|
|
23
36
|
assertKeySourceResolvable(consumer: string): Promise<void>;
|
|
24
37
|
configuredIssuers(): string[];
|
|
25
38
|
private verifySingleRealm;
|
|
26
39
|
private resolveMultiRealmKeySource;
|
|
40
|
+
private resolveTrustedIssuers;
|
|
27
41
|
private resolveKeycloakBaseUrl;
|
|
28
42
|
private resolveAllowedRealms;
|
|
29
43
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"realm-token-verifier.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"realm-token-verifier.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;CAClC;AAWD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AA6C5E,qBAAa,kBAAkB;IAgDjB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IA9CrC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAgB;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAQ9D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAMlD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC;IAM/D,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAG9C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IAGjD,OAAO,CAAC,gBAAgB,CAAoC;IAG5D,OAAO,CAAC,eAAe,CAAoD;IAO3E,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAwB;IAG7D,OAAO,CAAC,cAAc,CAAsC;IAG5D,OAAO,CAAC,uBAAuB,CAA+C;gBAEjD,OAAO,CAAC,EAAE,iBAAiB,YAAA;IA0BxD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG;QACrB,MAAM,EAAE,gBAAgB,CAAC;QACzB,OAAO,EAAE,iBAAiB,CAAC;KAC5B;IAWK,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmBjD,gBAAgB,CACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,OAAO,EAAE,iBAAiB,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAC;IA0CjE,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8ChE,iBAAiB,IAAI,MAAM,EAAE;YAWf,iBAAiB;YAkDjB,0BAA0B;YAgE1B,qBAAqB;YA6BrB,sBAAsB;YAQtB,oBAAoB;CASnC"}
|
|
@@ -14,6 +14,9 @@ class RealmTokenVerifier {
|
|
|
14
14
|
oidcVerifier;
|
|
15
15
|
multiRealmConfig = null;
|
|
16
16
|
resolvingConfig = null;
|
|
17
|
+
staticTrustedIssuers;
|
|
18
|
+
trustedIssuers = null;
|
|
19
|
+
resolvingTrustedIssuers = null;
|
|
17
20
|
constructor(options) {
|
|
18
21
|
this.options = options;
|
|
19
22
|
this.tenantResolver = (0, idp_tenant_resolver_1.selectTenantResolver)(process.env.IDP_KIND);
|
|
@@ -22,12 +25,28 @@ class RealmTokenVerifier {
|
|
|
22
25
|
issuerMetadata: this.issuerMetadata,
|
|
23
26
|
tenantResolver: this.tenantResolver,
|
|
24
27
|
});
|
|
28
|
+
this.staticTrustedIssuers = new oidc_guard_1.TrustedIssuerRegistry([
|
|
29
|
+
...(this.options?.trustedIssuers ?? []),
|
|
30
|
+
...(0, oidc_guard_1.parseTrustedIssuersFromEnv)(),
|
|
31
|
+
], this.jwks);
|
|
32
|
+
if (this.staticTrustedIssuers.size > 0) {
|
|
33
|
+
this.trustedIssuers = this.staticTrustedIssuers;
|
|
34
|
+
}
|
|
25
35
|
}
|
|
26
36
|
decode(token) {
|
|
27
37
|
return this.jwks.decode(token);
|
|
28
38
|
}
|
|
29
39
|
async verify(token) {
|
|
40
|
+
return (await this.verifyWithSource(token)).payload;
|
|
41
|
+
}
|
|
42
|
+
async verifyWithSource(token) {
|
|
30
43
|
const { payload } = this.decode(token);
|
|
44
|
+
const trusted = await this.resolveTrustedIssuers();
|
|
45
|
+
const entry = trusted.find(payload.iss);
|
|
46
|
+
if (entry) {
|
|
47
|
+
await trusted.verify(token, entry);
|
|
48
|
+
return { payload, source: { kind: 'trusted-issuer', entry } };
|
|
49
|
+
}
|
|
31
50
|
const multiRealm = await this.resolveMultiRealmKeySource();
|
|
32
51
|
if (multiRealm) {
|
|
33
52
|
await this.oidcVerifier.verify(token, {
|
|
@@ -35,10 +54,10 @@ class RealmTokenVerifier {
|
|
|
35
54
|
allowedRealms: [...multiRealm.allowedRealms],
|
|
36
55
|
expectedIssuers: this.configuredIssuers(),
|
|
37
56
|
});
|
|
38
|
-
return payload;
|
|
57
|
+
return { payload, source: { kind: 'realm' } };
|
|
39
58
|
}
|
|
40
59
|
await this.verifySingleRealm(token, payload);
|
|
41
|
-
return payload;
|
|
60
|
+
return { payload, source: { kind: 'realm' } };
|
|
42
61
|
}
|
|
43
62
|
async assertKeySourceResolvable(consumer) {
|
|
44
63
|
if (!this.options) {
|
|
@@ -47,6 +66,12 @@ class RealmTokenVerifier {
|
|
|
47
66
|
'this for you), or provide AUTH_MODULE_OPTIONS locally as public-gateway-api ' +
|
|
48
67
|
'does in RouteSourcesModule.');
|
|
49
68
|
}
|
|
69
|
+
const trusted = await this.resolveTrustedIssuers();
|
|
70
|
+
if (trusted.size > 0) {
|
|
71
|
+
this.logger.log(`Trusted issuers configured (${trusted.size}): ` +
|
|
72
|
+
`[${trusted.issuers().join(', ')}]`);
|
|
73
|
+
return;
|
|
74
|
+
}
|
|
50
75
|
let multiRealm;
|
|
51
76
|
try {
|
|
52
77
|
multiRealm = await this.resolveMultiRealmKeySource();
|
|
@@ -59,10 +84,11 @@ class RealmTokenVerifier {
|
|
|
59
84
|
return;
|
|
60
85
|
if (this.options.jwksUrl)
|
|
61
86
|
return;
|
|
62
|
-
throw new Error(`${consumer}: no
|
|
63
|
-
'
|
|
64
|
-
|
|
65
|
-
|
|
87
|
+
throw new Error(`${consumer}: no key source is configured. AUTH_MODULE_OPTIONS resolved ` +
|
|
88
|
+
'no multi-realm pair (keycloakBaseUrl + allowedRealms, or their lazy ' +
|
|
89
|
+
`providers), no single-realm jwksUrl, and no trusted issuers (options ` +
|
|
90
|
+
`\`trustedIssuers\` / \`trustedIssuersProvider\`, or ${oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR}). ` +
|
|
91
|
+
'Every service token would be refused at runtime.');
|
|
66
92
|
}
|
|
67
93
|
configuredIssuers() {
|
|
68
94
|
const raw = this.options?.issuer;
|
|
@@ -139,6 +165,33 @@ class RealmTokenVerifier {
|
|
|
139
165
|
})();
|
|
140
166
|
return this.resolvingConfig;
|
|
141
167
|
}
|
|
168
|
+
async resolveTrustedIssuers() {
|
|
169
|
+
if (this.trustedIssuers)
|
|
170
|
+
return this.trustedIssuers;
|
|
171
|
+
if (this.resolvingTrustedIssuers)
|
|
172
|
+
return this.resolvingTrustedIssuers;
|
|
173
|
+
const provider = this.options?.trustedIssuersProvider;
|
|
174
|
+
if (!provider) {
|
|
175
|
+
this.trustedIssuers = this.staticTrustedIssuers;
|
|
176
|
+
return this.trustedIssuers;
|
|
177
|
+
}
|
|
178
|
+
this.resolvingTrustedIssuers = (async () => {
|
|
179
|
+
try {
|
|
180
|
+
const provided = await provider();
|
|
181
|
+
const merged = new oidc_guard_1.TrustedIssuerRegistry([
|
|
182
|
+
...(this.options?.trustedIssuers ?? []),
|
|
183
|
+
...(0, oidc_guard_1.parseTrustedIssuersFromEnv)(),
|
|
184
|
+
...provided,
|
|
185
|
+
], this.jwks);
|
|
186
|
+
this.trustedIssuers = merged;
|
|
187
|
+
return merged;
|
|
188
|
+
}
|
|
189
|
+
finally {
|
|
190
|
+
this.resolvingTrustedIssuers = null;
|
|
191
|
+
}
|
|
192
|
+
})();
|
|
193
|
+
return this.resolvingTrustedIssuers;
|
|
194
|
+
}
|
|
142
195
|
async resolveKeycloakBaseUrl() {
|
|
143
196
|
if (this.options?.keycloakBaseUrl)
|
|
144
197
|
return this.options.keycloakBaseUrl;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"realm-token-verifier.js","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AACxC,
|
|
1
|
+
{"version":3,"file":"realm-token-verifier.js","sourceRoot":"","sources":["../../../src/nestjs/auth/realm-token-verifier.ts"],"names":[],"mappings":";;;AAAA,2CAAwC;AACxC,mDAQ4B;AAS5B,+DAA6D;AAmE7D,MAAa,kBAAkB;IAgDA;IA9CrB,MAAM,CAAU,sBAAsB,GAAG,YAAY,CAAC;IAE7C,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAQ7C,IAAI,GAAG,IAAI,yBAAY,CAAC,OAAO,CAAC,CAAC;IAMjC,cAAc,GAAG,IAAI,mCAAsB,EAAE,CAAC;IAMtD,cAAc,CAAuB;IAG7B,YAAY,CAAoB;IAGzC,gBAAgB,GAA+B,IAAI,CAAC;IAGpD,eAAe,GAA+C,IAAI,CAAC;IAO1D,oBAAoB,CAAwB;IAGrD,cAAc,GAAiC,IAAI,CAAC;IAGpD,uBAAuB,GAA0C,IAAI,CAAC;IAE9E,YAA6B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;QAItD,IAAI,CAAC,cAAc,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAiB,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QAIH,IAAI,CAAC,oBAAoB,GAAG,IAAI,kCAAqB,CACnD;YACE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;YACvC,GAAG,IAAA,uCAA0B,GAAE;SAChC,EACD,IAAI,CAAC,IAAI,CACV,CAAC;QACF,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAClD,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,KAAa;QAIlB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IASD,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,gBAAgB,CACpB,KAAa;QAEb,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,iBAAiB,EAAE,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC;gBACpD,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC;gBAK5C,eAAe,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAC1C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;IAChD,CAAC;IAgBD,KAAK,CAAC,yBAAyB,CAAC,QAAgB;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,mEAAmE;gBAC5E,8EAA8E;gBAC9E,8EAA8E;gBAC9E,6BAA6B,CAChC,CAAC;QACJ,CAAC;QAMD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,+BAA+B,OAAO,CAAC,IAAI,KAAK;gBAC9C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,sEAAsE;gBAC/E,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,UAAU;YAAE,OAAO;QAEvB,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO;QAEjC,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,8DAA8D;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,uDAAuD,oCAAuB,KAAK;YACnF,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAGD,iBAAiB;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG;aACP,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAIO,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,OAA0B;QAE1B,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;QAC5C,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,kCAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAKhD,MAAM,OAAO,GAAG;gBACd,GAAG,IAAI,GAAG,CACR,cAAc;qBACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBACvD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CACzD;aACF,CAAC;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YACxB,MAAM,aAAa,GACjB,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CACvD,CAAC;YACJ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,kCAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kCAAqB,CAC7B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,kBAAkB,CAAC,sBAAsB;YACnD,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAOO,KAAK,CAAC,0BAA0B;QACtC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QACxD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QAEtD,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAExD,IAAI,CAAC,eAAe,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACnD,OAAO,IAAI,CAAC;gBACd,CAAC;gBAMD,MAAM,aAAa,GAAG,eAAe;qBAClC,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;gBAM3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBACpD,MAAM,iBAAiB,GAAG;oBACxB,GAAG,IAAI,GAAG,CAAC;wBACT,GAAG,aAAa;wBAChB,GAAG,CAAC,SAAS,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC5B;qBACF,CAAC;iBACH,CAAC;gBACF,MAAM,YAAY,GAAG;oBACnB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;iBACpE,CAAC;gBAEF,IAAI,CAAC,gBAAgB,GAAG,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;gBAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qCAAqC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC1G,CAAC,SAAS;wBACR,CAAC,CAAC,WAAW,SAAS,CAAC,iBAAiB,CAAC,MAAM,yBAAyB;wBACxE,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;gBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAC/B,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAYO,KAAK,CAAC,qBAAqB;QACjC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,IAAI,IAAI,CAAC,uBAAuB;YAAE,OAAO,IAAI,CAAC,uBAAuB,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC;YAChD,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,uBAAuB,GAAG,CAAC,KAAK,IAAI,EAAE;YACzC,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,IAAI,kCAAqB,CACtC;oBACE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,IAAI,EAAE,CAAC;oBACvC,GAAG,IAAA,uCAA0B,GAAE;oBAC/B,GAAG,QAAQ;iBACZ,EACD,IAAI,CAAC,IAAI,CACV,CAAC;gBACF,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;gBAC7B,OAAO,MAAM,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,IAAI,IAAI,CAAC,OAAO,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QACvE,IAAI,IAAI,CAAC,OAAO,EAAE,uBAAuB,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,IAAI,SAAS,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,qBAAqB,EAAE,CAAC;YACxC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;;AA/WH,gDAgXC"}
|
package/dist/nestjs/index.d.ts
CHANGED
|
@@ -3,8 +3,9 @@ export { getCorsConfig } from './cors.config';
|
|
|
3
3
|
export { getEnvOrThrow } from './get-env-or-throw';
|
|
4
4
|
export { ResponseEnvelopeInterceptor } from './response-envelope.interceptor';
|
|
5
5
|
export { RequestContextMiddleware } from './request-context.middleware';
|
|
6
|
-
export { deriveActorClassification, actorTypeForSubjectKind, actorTypeFor, resolveSubjectAndClass, tryResolveSubjectAndClass, resolveRolesFromClaims, resolveActAsFromClaims, resolveClientIdFromClaims, asNonEmptyString, type ActorClassification, } from './auth/actor-classification';
|
|
7
|
-
export { resolveActorChainFromClaims, UnclassifiableActorHopError, MalformedActorHopError, } from './auth/delegation-chain';
|
|
6
|
+
export { deriveActorClassification, actorTypeForSubjectKind, actorTypeFor, resolveSubjectAndClass, tryResolveSubjectAndClass, resolveRolesFromClaims, resolveActAsFromClaims, resolveClientIdFromClaims, SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, asNonEmptyString, type ActorClassification, } from './auth/actor-classification';
|
|
7
|
+
export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorHopSubjectKindError, ContradictoryActorHopKindError, MalformedActorHopError, } from './auth/delegation-chain';
|
|
8
|
+
export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
|
|
8
9
|
export { AmbientOrgContextMiddleware } from './ambient-org-context.middleware';
|
|
9
10
|
export { ErrorResponseDto } from './error-response.dto';
|
|
10
11
|
export { ApiStandardOperation, ApiDataResponse, ApiDataArrayResponse, ApiCreatedDataResponse, ApiAcceptedDataResponse, ApiPaginatedResponse, ApiStandardErrors, } from './swagger.decorators';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EAGtB,yBAAyB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EAGtB,yBAAyB,EAGzB,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAIjC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,EACjC,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,GAAG,EACR,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAKjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EAGnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAIhB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,8BAA8B,EAKnC,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EAIf,eAAe,EACf,iBAAiB,EAOjB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,wBAAwB,EACxB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,cAAc,gCAAgC,CAAC"}
|
package/dist/nestjs/index.js
CHANGED
|
@@ -14,9 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
|
|
|
14
14
|
for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
|
|
15
15
|
};
|
|
16
16
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
17
|
-
exports.
|
|
18
|
-
exports.
|
|
19
|
-
exports.REDACT_RESPONSE_KEY = exports.RedactResponse = exports.RedactionInterceptor = exports.RedactionService = exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_DATA_STORE_CLIENT = exports.DataStoreIdempotencyService = exports.IDEMPOTENCY_RECORD_MODEL = exports.ApiConnectorEnvelope = exports.ConnectorEnvelopePipe = exports.ConnectorWebhookEnvelopeDto = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.resolveOrgAuthorityMode = exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.orgAuthorityRequiresProof = void 0;
|
|
17
|
+
exports.extractRealmFromIssuer = exports.OidcDiscoveryIssuerTenantResolver = exports.KeycloakIssuerTenantResolver = exports.OidcTokenVerifier = exports.IssuerMetadataResolver = exports.JwksVerificationError = exports.JwksVerifier = exports.selectTenantResolver = exports.DEFAULT_IDP_KIND = exports.IdpKind = exports.JwtVerificationGuard = exports.buildKeycloakSwaggerUiOptions = exports.enrichOpenApiWithKeycloakSecurity = exports.getKeycloakSwaggerUrls = exports.enhanceOpenApiDocumentation = exports.ApiStandardErrors = exports.ApiPaginatedResponse = exports.ApiAcceptedDataResponse = exports.ApiCreatedDataResponse = exports.ApiDataArrayResponse = exports.ApiDataResponse = exports.ApiStandardOperation = exports.ErrorResponseDto = exports.AmbientOrgContextMiddleware = exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = exports.asNonEmptyString = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.resolveClientIdFromClaims = exports.resolveActAsFromClaims = exports.resolveRolesFromClaims = exports.tryResolveSubjectAndClass = exports.resolveSubjectAndClass = exports.actorTypeFor = exports.actorTypeForSubjectKind = exports.deriveActorClassification = exports.RequestContextMiddleware = exports.ResponseEnvelopeInterceptor = exports.getEnvOrThrow = exports.getCorsConfig = exports.applyStandardBodyParsers = void 0;
|
|
18
|
+
exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = exports.GlobalExceptionFilter = exports.RolesGuard = exports.ROLES_KEY = exports.Roles = exports.fetchJson = exports.fetchEnvelopeOptional = exports.fetchEnvelope = exports.SA_TOKEN_PATH = exports.SA_NS_PATH = exports.SA_CA_PATH = exports.ClusterCaDispatcher = exports.fetchWithRetry = exports.buildPaginatedResponse = exports.parsePagination = exports.PaginationMeta = exports.PaginationQueryDto = exports.Ctx = exports.requirePipelineRunId = exports.requireProjectId = exports.RAW_RESPONSE_KEY = exports.RawResponse = exports.collectPublicRouteExcludes = exports.registerPublicRouteDeclaration = exports.joinNestPaths = exports.readSwaggerOperationId = exports.readNestHttpVerb = exports.readNestPath = exports.readNestControllerPath = exports.IS_PUBLIC_KEY = exports.Public = void 0;
|
|
19
|
+
exports.REDACT_RESPONSE_KEY = exports.RedactResponse = exports.RedactionInterceptor = exports.RedactionService = exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_DATA_STORE_CLIENT = exports.DataStoreIdempotencyService = exports.IDEMPOTENCY_RECORD_MODEL = exports.ApiConnectorEnvelope = exports.ConnectorEnvelopePipe = exports.ConnectorWebhookEnvelopeDto = exports.resetOrgAuthorityCensus = exports.orgAuthorityCensus = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.resolveOrgAuthorityMode = exports.InvalidOrgAuthorityModeError = exports.ORG_AUTHORITY_MODE_ENV = exports.OrgAuthorityMode = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = void 0;
|
|
20
20
|
var body_parsers_1 = require("./body-parsers");
|
|
21
21
|
Object.defineProperty(exports, "applyStandardBodyParsers", { enumerable: true, get: function () { return body_parsers_1.applyStandardBodyParsers; } });
|
|
22
22
|
var cors_config_1 = require("./cors.config");
|
|
@@ -36,11 +36,21 @@ Object.defineProperty(exports, "tryResolveSubjectAndClass", { enumerable: true,
|
|
|
36
36
|
Object.defineProperty(exports, "resolveRolesFromClaims", { enumerable: true, get: function () { return actor_classification_1.resolveRolesFromClaims; } });
|
|
37
37
|
Object.defineProperty(exports, "resolveActAsFromClaims", { enumerable: true, get: function () { return actor_classification_1.resolveActAsFromClaims; } });
|
|
38
38
|
Object.defineProperty(exports, "resolveClientIdFromClaims", { enumerable: true, get: function () { return actor_classification_1.resolveClientIdFromClaims; } });
|
|
39
|
+
Object.defineProperty(exports, "SUBJECT_KIND_CLAIM", { enumerable: true, get: function () { return actor_classification_1.SUBJECT_KIND_CLAIM; } });
|
|
40
|
+
Object.defineProperty(exports, "readDeclaredSubjectKind", { enumerable: true, get: function () { return actor_classification_1.readDeclaredSubjectKind; } });
|
|
39
41
|
Object.defineProperty(exports, "asNonEmptyString", { enumerable: true, get: function () { return actor_classification_1.asNonEmptyString; } });
|
|
40
42
|
var delegation_chain_1 = require("./auth/delegation-chain");
|
|
41
43
|
Object.defineProperty(exports, "resolveActorChainFromClaims", { enumerable: true, get: function () { return delegation_chain_1.resolveActorChainFromClaims; } });
|
|
42
44
|
Object.defineProperty(exports, "UnclassifiableActorHopError", { enumerable: true, get: function () { return delegation_chain_1.UnclassifiableActorHopError; } });
|
|
45
|
+
Object.defineProperty(exports, "UnknownActorHopSubjectKindError", { enumerable: true, get: function () { return delegation_chain_1.UnknownActorHopSubjectKindError; } });
|
|
46
|
+
Object.defineProperty(exports, "ContradictoryActorHopKindError", { enumerable: true, get: function () { return delegation_chain_1.ContradictoryActorHopKindError; } });
|
|
43
47
|
Object.defineProperty(exports, "MalformedActorHopError", { enumerable: true, get: function () { return delegation_chain_1.MalformedActorHopError; } });
|
|
48
|
+
var oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
49
|
+
Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
|
|
50
|
+
Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });
|
|
51
|
+
Object.defineProperty(exports, "TrustedIssuerConfigError", { enumerable: true, get: function () { return oidc_guard_1.TrustedIssuerConfigError; } });
|
|
52
|
+
Object.defineProperty(exports, "TrustedIssuerRegistry", { enumerable: true, get: function () { return oidc_guard_1.TrustedIssuerRegistry; } });
|
|
53
|
+
Object.defineProperty(exports, "parseTrustedIssuersFromEnv", { enumerable: true, get: function () { return oidc_guard_1.parseTrustedIssuersFromEnv; } });
|
|
44
54
|
var ambient_org_context_middleware_1 = require("./ambient-org-context.middleware");
|
|
45
55
|
Object.defineProperty(exports, "AmbientOrgContextMiddleware", { enumerable: true, get: function () { return ambient_org_context_middleware_1.AmbientOrgContextMiddleware; } });
|
|
46
56
|
var error_response_dto_1 = require("./error-response.dto");
|
|
@@ -65,14 +75,14 @@ var idp_tenant_resolver_1 = require("./auth/idp-tenant-resolver");
|
|
|
65
75
|
Object.defineProperty(exports, "IdpKind", { enumerable: true, get: function () { return idp_tenant_resolver_1.IdpKind; } });
|
|
66
76
|
Object.defineProperty(exports, "DEFAULT_IDP_KIND", { enumerable: true, get: function () { return idp_tenant_resolver_1.DEFAULT_IDP_KIND; } });
|
|
67
77
|
Object.defineProperty(exports, "selectTenantResolver", { enumerable: true, get: function () { return idp_tenant_resolver_1.selectTenantResolver; } });
|
|
68
|
-
var
|
|
69
|
-
Object.defineProperty(exports, "JwksVerifier", { enumerable: true, get: function () { return
|
|
70
|
-
Object.defineProperty(exports, "JwksVerificationError", { enumerable: true, get: function () { return
|
|
71
|
-
Object.defineProperty(exports, "IssuerMetadataResolver", { enumerable: true, get: function () { return
|
|
72
|
-
Object.defineProperty(exports, "OidcTokenVerifier", { enumerable: true, get: function () { return
|
|
73
|
-
Object.defineProperty(exports, "KeycloakIssuerTenantResolver", { enumerable: true, get: function () { return
|
|
74
|
-
Object.defineProperty(exports, "OidcDiscoveryIssuerTenantResolver", { enumerable: true, get: function () { return
|
|
75
|
-
Object.defineProperty(exports, "extractRealmFromIssuer", { enumerable: true, get: function () { return
|
|
78
|
+
var oidc_guard_2 = require("@xemahq/oidc-guard");
|
|
79
|
+
Object.defineProperty(exports, "JwksVerifier", { enumerable: true, get: function () { return oidc_guard_2.JwksVerifier; } });
|
|
80
|
+
Object.defineProperty(exports, "JwksVerificationError", { enumerable: true, get: function () { return oidc_guard_2.JwksVerificationError; } });
|
|
81
|
+
Object.defineProperty(exports, "IssuerMetadataResolver", { enumerable: true, get: function () { return oidc_guard_2.IssuerMetadataResolver; } });
|
|
82
|
+
Object.defineProperty(exports, "OidcTokenVerifier", { enumerable: true, get: function () { return oidc_guard_2.OidcTokenVerifier; } });
|
|
83
|
+
Object.defineProperty(exports, "KeycloakIssuerTenantResolver", { enumerable: true, get: function () { return oidc_guard_2.KeycloakIssuerTenantResolver; } });
|
|
84
|
+
Object.defineProperty(exports, "OidcDiscoveryIssuerTenantResolver", { enumerable: true, get: function () { return oidc_guard_2.OidcDiscoveryIssuerTenantResolver; } });
|
|
85
|
+
Object.defineProperty(exports, "extractRealmFromIssuer", { enumerable: true, get: function () { return oidc_guard_2.extractRealmFromIssuer; } });
|
|
76
86
|
var public_decorator_1 = require("./public.decorator");
|
|
77
87
|
Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return public_decorator_1.Public; } });
|
|
78
88
|
Object.defineProperty(exports, "IS_PUBLIC_KEY", { enumerable: true, get: function () { return public_decorator_1.IS_PUBLIC_KEY; } });
|
package/dist/nestjs/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAG1B,6CAA8C;AAArC,4GAAA,aAAa,OAAA;AACtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAG1B,6CAA8C;AAArC,4GAAA,aAAa,OAAA;AACtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,oEAiBqC;AAhBnC,iIAAA,yBAAyB,OAAA;AACzB,+HAAA,uBAAuB,OAAA;AACvB,oHAAA,YAAY,OAAA;AACZ,8HAAA,sBAAsB,OAAA;AACtB,iIAAA,yBAAyB,OAAA;AACzB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AAGtB,iIAAA,yBAAyB,OAAA;AAGzB,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,wHAAA,gBAAgB,OAAA;AAOlB,4DAMiC;AAL/B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAKxB,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA;AAG5B,mFAA+E;AAAtE,6IAAA,2BAA2B,OAAA;AACpC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,2DAQ8B;AAP5B,0HAAA,oBAAoB,OAAA;AACpB,qHAAA,eAAe,OAAA;AACf,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AACtB,6HAAA,uBAAuB,OAAA;AACvB,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AAEnB,iEAGiC;AAF/B,oIAAA,2BAA2B,OAAA;AAG7B,uDAQ4B;AAP1B,0HAAA,sBAAsB,OAAA;AACtB,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAM/B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,kEAIoC;AAHlC,8GAAA,OAAO,OAAA;AACP,uHAAA,gBAAgB,OAAA;AAChB,2HAAA,oBAAoB,OAAA;AAKtB,iDAc4B;AAb1B,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,+HAAA,iCAAiC,OAAA;AACjC,oHAAA,sBAAsB,OAAA;AAQxB,uDAA2D;AAAlD,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAG9B,6DAM+B;AAL7B,6HAAA,sBAAsB,OAAA;AACtB,mHAAA,YAAY,OAAA;AACZ,uHAAA,gBAAgB,OAAA;AAChB,6HAAA,sBAAsB,OAAA;AACtB,oHAAA,aAAa,OAAA;AAMf,iEAGiC;AAF/B,uIAAA,8BAA8B,OAAA;AAC9B,mIAAA,0BAA0B,OAAA;AAE5B,mEAAyE;AAAhE,qHAAA,WAAW,OAAA;AAAE,0HAAA,gBAAgB,OAAA;AACtC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,iDAAsC;AAA7B,oGAAA,GAAG,OAAA;AACZ,2CAKsB;AAJpB,gHAAA,kBAAkB,OAAA;AAClB,4GAAA,cAAc,OAAA;AACd,6GAAA,eAAe,OAAA;AACf,oHAAA,sBAAsB,OAAA;AAExB,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AACvB,iEAKiC;AAJ/B,4HAAA,mBAAmB,OAAA;AACnB,mHAAA,UAAU,OAAA;AACV,mHAAA,UAAU,OAAA;AACV,sHAAA,aAAa,OAAA;AAEf,mDAI0B;AAHxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2GAAA,SAAS,OAAA;AAEX,qDAAqD;AAA5C,wGAAA,KAAK,OAAA;AAAE,4GAAA,SAAS,OAAA;AACzB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,+BAqEgB;AApEd,kGAAA,UAAU,OAAA;AACV,2GAAA,mBAAmB,OAAA;AAGnB,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,yGAAA,iBAAiB,OAAA;AAKjB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AAGnB,oGAAA,YAAY,OAAA;AACZ,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,uGAAA,eAAe,OAAA;AACf,4GAAA,oBAAoB,OAAA;AACpB,wGAAA,gBAAgB,OAAA;AAIhB,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAMvB,mGAAA,WAAW,OAAA;AACX,qGAAA,aAAa,OAAA;AACb,sGAAA,cAAc,OAAA;AACd,uGAAA,eAAe,OAAA;AAIf,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AAOjB,0GAAA,kBAAkB,OAAA;AAGlB,2GAAA,mBAAmB,OAAA;AACnB,4GAAA,oBAAoB,OAAA;AACpB,iHAAA,yBAAyB,OAAA;AACzB,wGAAA,gBAAgB,OAAA;AAChB,8GAAA,sBAAsB,OAAA;AACtB,oHAAA,4BAA4B,OAAA;AAC5B,+GAAA,uBAAuB,OAAA;AACvB,uHAAA,+BAA+B,OAAA;AAC/B,yGAAA,iBAAiB,OAAA;AAGjB,kHAAA,0BAA0B,OAAA;AAC1B,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAEzB,2DAM8B;AAL5B,iIAAA,2BAA2B,OAAA;AAC3B,2HAAA,qBAAqB,OAAA;AACrB,0HAAA,oBAAoB,OAAA;AAItB,6CASuB;AANrB,uHAAA,wBAAwB,OAAA;AACxB,0HAAA,2BAA2B,OAAA;AAC3B,4HAAA,6BAA6B,OAAA;AAG7B,kHAAA,mBAAmB,OAAA;AAIrB,yCAKqB;AAJnB,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AACd,gHAAA,mBAAmB,OAAA;AAIrB,iEAA+C"}
|
|
@@ -7,6 +7,7 @@ export declare class JwtVerificationGuard implements CanActivate {
|
|
|
7
7
|
canActivate(context: ExecutionContext): Promise<boolean>;
|
|
8
8
|
private verifyToken;
|
|
9
9
|
private attachRealmToContext;
|
|
10
|
+
private applyDeclaredSubjectClass;
|
|
10
11
|
private isPublicPath;
|
|
11
12
|
}
|
|
12
13
|
//# sourceMappingURL=jwt-verification.guard.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAiDpE,qBACa,oBAAqB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAUhE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAK3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAmDhD,WAAW;IA4BzB,OAAO,CAAC,oBAAoB;IA+C5B,OAAO,CAAC,yBAAyB;IAoCjC,OAAO,CAAC,YAAY;CAYrB"}
|
|
@@ -20,6 +20,8 @@ const public_decorator_1 = require("./public.decorator");
|
|
|
20
20
|
const auth_module_options_1 = require("./auth/auth-module-options");
|
|
21
21
|
const request_context_1 = require("../lib/request-context");
|
|
22
22
|
const oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
23
|
+
const subject_1 = require("@xemahq/kernel-contracts/subject");
|
|
24
|
+
const actor_classification_1 = require("./auth/actor-classification");
|
|
23
25
|
const realm_token_verifier_1 = require("./auth/realm-token-verifier");
|
|
24
26
|
const PUBLIC_PATH_PREFIXES = ['/health', '/api/docs', '/api/openapi.json'];
|
|
25
27
|
const PUBLIC_WEBHOOK_PREFIX = '/webhooks';
|
|
@@ -46,8 +48,9 @@ let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
|
46
48
|
}
|
|
47
49
|
const token = authHeader.substring(7);
|
|
48
50
|
try {
|
|
49
|
-
const payload = await this.verifyToken(token);
|
|
50
|
-
this.attachRealmToContext(request, payload);
|
|
51
|
+
const { payload, source } = await this.verifyToken(token);
|
|
52
|
+
this.attachRealmToContext(request, payload, source);
|
|
53
|
+
this.applyDeclaredSubjectClass(request, payload, source);
|
|
51
54
|
return true;
|
|
52
55
|
}
|
|
53
56
|
catch (error) {
|
|
@@ -60,7 +63,7 @@ let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
|
60
63
|
}
|
|
61
64
|
async verifyToken(token) {
|
|
62
65
|
try {
|
|
63
|
-
return await this.verifier.
|
|
66
|
+
return await this.verifier.verifyWithSource(token);
|
|
64
67
|
}
|
|
65
68
|
catch (error) {
|
|
66
69
|
if (error instanceof oidc_guard_1.JwksVerificationError) {
|
|
@@ -69,16 +72,43 @@ let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
|
69
72
|
throw error;
|
|
70
73
|
}
|
|
71
74
|
}
|
|
72
|
-
attachRealmToContext(request, payload) {
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
75
|
+
attachRealmToContext(request, payload, source) {
|
|
76
|
+
const tenant = source.kind === 'trusted-issuer'
|
|
77
|
+
? source.entry.tenant
|
|
78
|
+
: payload.iss
|
|
79
|
+
? (this.verifier.tenantResolver.tenantFromIssuer(payload.iss) ??
|
|
80
|
+
undefined)
|
|
81
|
+
: undefined;
|
|
82
|
+
if (!tenant)
|
|
77
83
|
return;
|
|
78
84
|
const ctx = request[request_context_1.REQUEST_CONTEXT];
|
|
79
85
|
if (ctx) {
|
|
80
|
-
ctx.realmId =
|
|
86
|
+
ctx.realmId = tenant;
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
applyDeclaredSubjectClass(request, payload, source) {
|
|
90
|
+
if (source.kind !== 'trusted-issuer')
|
|
91
|
+
return;
|
|
92
|
+
const declared = source.entry.subjectClass;
|
|
93
|
+
if (!declared)
|
|
94
|
+
return;
|
|
95
|
+
if (typeof payload.token_class === 'string' && payload.token_class)
|
|
96
|
+
return;
|
|
97
|
+
const ctx = request[request_context_1.REQUEST_CONTEXT];
|
|
98
|
+
if (!ctx)
|
|
99
|
+
return;
|
|
100
|
+
const parsed = subject_1.TokenClassSchema.safeParse(declared);
|
|
101
|
+
if (!parsed.success) {
|
|
102
|
+
throw new common_1.UnauthorizedException(`Trusted issuer '${source.entry.issuer}' declares subjectClass ` +
|
|
103
|
+
`'${declared}', which is not a known TokenClass.`);
|
|
81
104
|
}
|
|
105
|
+
const classified = (0, actor_classification_1.deriveActorClassification)({
|
|
106
|
+
...payload,
|
|
107
|
+
token_class: parsed.data,
|
|
108
|
+
});
|
|
109
|
+
ctx.tokenClass = classified.tokenClass;
|
|
110
|
+
ctx.subject = { ...ctx.subject, kind: classified.subjectKind };
|
|
111
|
+
ctx.actorType = classified.actorType;
|
|
82
112
|
}
|
|
83
113
|
isPublicPath(path) {
|
|
84
114
|
for (const prefix of PUBLIC_PATH_PREFIXES) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,4DAAyD;AAEzD,mDAA2D;AAE3D,sEAAiE;
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,4DAAyD;AAEzD,mDAA2D;AAE3D,8DAAoE;AACpE,sEAAwE;AACxE,sEAAiE;AASjE,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAiCnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACd,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAU/C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,gCAAa,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAG7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAG1D,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAGpD,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB;gBAAE,MAAM,KAAK,CAAC;YAExD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAUO,KAAK,CAAC,WAAW,CACvB,KAAa;QAEb,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAiBO,oBAAoB,CAC1B,OAAgB,EAChB,OAAmB,EACnB,MAA2B;QAE3B,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAC9B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;YACrB,CAAC,CAAC,OAAO,CAAC,GAAG;gBACX,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;oBAC3D,SAAS,CAAC;gBACZ,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IA2BO,yBAAyB,CAC/B,OAAgB,EAChB,OAAmB,EACnB,MAA2B;QAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO;QAE3E,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAKpB,MAAM,IAAI,8BAAqB,CAC7B,mBAAmB,MAAM,CAAC,KAAK,CAAC,MAAM,0BAA0B;gBAC9D,IAAI,QAAQ,qCAAqC,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,gDAAyB,EAAC;YAC3C,GAAG,OAAO;YACV,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB,CAAC,CAAC;QACH,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;QACvC,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;QAC/D,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,CAAC,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAnMY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GAfnB,oBAAoB,CAmMhC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/platform-common",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.18.0",
|
|
4
4
|
"description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
}
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@xemahq/oidc-guard": "^0.
|
|
41
|
+
"@xemahq/oidc-guard": "^0.6.0",
|
|
42
42
|
"jwks-rsa": "^3.2.2",
|
|
43
43
|
"undici": "^7.29.0",
|
|
44
44
|
"zod": "^4.3.6"
|
|
@@ -62,7 +62,7 @@
|
|
|
62
62
|
"rxjs": "7.8.2",
|
|
63
63
|
"ts-jest": "^29.4.9",
|
|
64
64
|
"typescript": "5.9.3",
|
|
65
|
-
"@xemahq/kernel-contracts": "^
|
|
65
|
+
"@xemahq/kernel-contracts": "^22.0.0"
|
|
66
66
|
},
|
|
67
67
|
"exports": {
|
|
68
68
|
".": {
|