@xemahq/platform-common 0.2.19 → 0.2.21
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/nestjs/auth/actor-classification.d.ts +20 -0
- package/dist/nestjs/auth/actor-classification.d.ts.map +1 -0
- package/dist/nestjs/auth/actor-classification.js +105 -0
- package/dist/nestjs/auth/actor-classification.js.map +1 -0
- package/dist/nestjs/index.d.ts +1 -0
- package/dist/nestjs/index.d.ts.map +1 -1
- package/dist/nestjs/index.js +10 -2
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.d.ts +2 -2
- package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.d.ts.map +1 -1
- package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.js +9 -5
- package/dist/nestjs/integration-webhooks/integration-webhook-envelope.dto.js.map +1 -1
- package/dist/nestjs/request-context.middleware.d.ts +0 -6
- package/dist/nestjs/request-context.middleware.d.ts.map +1 -1
- package/dist/nestjs/request-context.middleware.js +4 -81
- package/dist/nestjs/request-context.middleware.js.map +1 -1
- package/package.json +1 -1
- package/dist/nestjs/jwks/issuer-metadata-resolver.d.ts +0 -7
- package/dist/nestjs/jwks/issuer-metadata-resolver.d.ts.map +0 -1
- package/dist/nestjs/jwks/issuer-metadata-resolver.js +0 -36
- package/dist/nestjs/jwks/issuer-metadata-resolver.js.map +0 -1
- package/dist/nestjs/jwks/jwks-verifier.d.ts +0 -48
- package/dist/nestjs/jwks/jwks-verifier.d.ts.map +0 -1
- package/dist/nestjs/jwks/jwks-verifier.js +0 -177
- package/dist/nestjs/jwks/jwks-verifier.js.map +0 -1
- package/dist/nestjs/route-metadata-keys.d.ts +0 -3
- package/dist/nestjs/route-metadata-keys.d.ts.map +0 -1
- package/dist/nestjs/route-metadata-keys.js +0 -6
- package/dist/nestjs/route-metadata-keys.js.map +0 -1
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import { SubjectKind, TokenClass } from '@xemahq/kernel-contracts/subject';
|
|
2
|
+
import type { RequestContext } from '../../lib/request-context';
|
|
3
|
+
export interface ActorClassification {
|
|
4
|
+
readonly roles: string[];
|
|
5
|
+
readonly actAs: string | undefined;
|
|
6
|
+
readonly subjectKind: SubjectKind;
|
|
7
|
+
readonly tokenClass: TokenClass;
|
|
8
|
+
readonly actorType: RequestContext['actorType'];
|
|
9
|
+
}
|
|
10
|
+
export declare function asNonEmptyString(value: unknown): string | undefined;
|
|
11
|
+
export declare function resolveRolesFromClaims(claims: Record<string, unknown>): string[];
|
|
12
|
+
export declare function resolveActAsFromClaims(claims: Record<string, unknown>): string | undefined;
|
|
13
|
+
export declare function resolveSubjectAndClass(roles: string[], claims: Record<string, unknown>, actAs: string | undefined): {
|
|
14
|
+
kind: SubjectKind;
|
|
15
|
+
tokenClass: TokenClass;
|
|
16
|
+
};
|
|
17
|
+
export declare function actorTypeForSubjectKind(kind: SubjectKind): RequestContext['actorType'];
|
|
18
|
+
export declare function actorTypeFor(subjectKind: SubjectKind, actAs: string | undefined): RequestContext['actorType'];
|
|
19
|
+
export declare function deriveActorClassification(claims: Record<string, unknown>): ActorClassification;
|
|
20
|
+
//# sourceMappingURL=actor-classification.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"actor-classification.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,UAAU,EACX,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAchE,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAEzB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAEnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAKhC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAInE;AAGD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,EAAE,CAYV;AAMD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,GAAG,SAAS,CAMpB;AA8BD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EAAE,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,UAAU,CAAA;CAAE,CAoB/C;AAUD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,cAAc,CAAC,WAAW,CAAC,CAgB7B;AAUD,wBAAgB,YAAY,CAC1B,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,cAAc,CAAC,WAAW,CAAC,CAK7B;AAOD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,mBAAmB,CAerB"}
|
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.asNonEmptyString = asNonEmptyString;
|
|
4
|
+
exports.resolveRolesFromClaims = resolveRolesFromClaims;
|
|
5
|
+
exports.resolveActAsFromClaims = resolveActAsFromClaims;
|
|
6
|
+
exports.resolveSubjectAndClass = resolveSubjectAndClass;
|
|
7
|
+
exports.actorTypeForSubjectKind = actorTypeForSubjectKind;
|
|
8
|
+
exports.actorTypeFor = actorTypeFor;
|
|
9
|
+
exports.deriveActorClassification = deriveActorClassification;
|
|
10
|
+
const subject_1 = require("@xemahq/kernel-contracts/subject");
|
|
11
|
+
function asNonEmptyString(value) {
|
|
12
|
+
if (typeof value !== 'string')
|
|
13
|
+
return undefined;
|
|
14
|
+
const trimmed = value.trim();
|
|
15
|
+
return trimmed.length > 0 ? trimmed : undefined;
|
|
16
|
+
}
|
|
17
|
+
function resolveRolesFromClaims(claims) {
|
|
18
|
+
const realmAccess = claims.realm_access;
|
|
19
|
+
if (realmAccess &&
|
|
20
|
+
typeof realmAccess === 'object' &&
|
|
21
|
+
Array.isArray(realmAccess.roles)) {
|
|
22
|
+
return realmAccess.roles.filter((role) => typeof role === 'string');
|
|
23
|
+
}
|
|
24
|
+
return [];
|
|
25
|
+
}
|
|
26
|
+
function resolveActAsFromClaims(claims) {
|
|
27
|
+
const act = claims['act'];
|
|
28
|
+
if (!act || typeof act !== 'object' || Array.isArray(act)) {
|
|
29
|
+
return undefined;
|
|
30
|
+
}
|
|
31
|
+
return asNonEmptyString(act['sub']);
|
|
32
|
+
}
|
|
33
|
+
function subjectKindForTokenClass(tokenClass) {
|
|
34
|
+
switch (tokenClass) {
|
|
35
|
+
case subject_1.TokenClass.ServiceJwt:
|
|
36
|
+
return subject_1.SubjectKind.Service;
|
|
37
|
+
case subject_1.TokenClass.AgentRuntimeToken:
|
|
38
|
+
return subject_1.SubjectKind.Agent;
|
|
39
|
+
case subject_1.TokenClass.WorkflowRuntimeToken:
|
|
40
|
+
return subject_1.SubjectKind.Service;
|
|
41
|
+
case subject_1.TokenClass.ExternalSessionToken:
|
|
42
|
+
return subject_1.SubjectKind.ExternalSubject;
|
|
43
|
+
case subject_1.TokenClass.RunnerAttestationToken:
|
|
44
|
+
return subject_1.SubjectKind.Runner;
|
|
45
|
+
case subject_1.TokenClass.UserJwt:
|
|
46
|
+
return subject_1.SubjectKind.User;
|
|
47
|
+
}
|
|
48
|
+
}
|
|
49
|
+
function resolveSubjectAndClass(roles, claims, actAs) {
|
|
50
|
+
const explicit = asNonEmptyString(claims.token_class);
|
|
51
|
+
if (explicit) {
|
|
52
|
+
const matched = Object.values(subject_1.TokenClass).includes(explicit)
|
|
53
|
+
? explicit
|
|
54
|
+
: undefined;
|
|
55
|
+
if (matched) {
|
|
56
|
+
return { kind: subjectKindForTokenClass(matched), tokenClass: matched };
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
if (actAs) {
|
|
60
|
+
return { kind: subject_1.SubjectKind.User, tokenClass: subject_1.TokenClass.UserJwt };
|
|
61
|
+
}
|
|
62
|
+
if (roles.includes('micro-service') || roles.includes('service-account')) {
|
|
63
|
+
return { kind: subject_1.SubjectKind.Service, tokenClass: subject_1.TokenClass.ServiceJwt };
|
|
64
|
+
}
|
|
65
|
+
if (roles.includes('agent')) {
|
|
66
|
+
return { kind: subject_1.SubjectKind.Agent, tokenClass: subject_1.TokenClass.AgentRuntimeToken };
|
|
67
|
+
}
|
|
68
|
+
return { kind: subject_1.SubjectKind.User, tokenClass: subject_1.TokenClass.UserJwt };
|
|
69
|
+
}
|
|
70
|
+
function actorTypeForSubjectKind(kind) {
|
|
71
|
+
switch (kind) {
|
|
72
|
+
case subject_1.SubjectKind.Service:
|
|
73
|
+
case subject_1.SubjectKind.Runner:
|
|
74
|
+
return 'service';
|
|
75
|
+
case subject_1.SubjectKind.Agent:
|
|
76
|
+
return 'agent';
|
|
77
|
+
case subject_1.SubjectKind.User:
|
|
78
|
+
case subject_1.SubjectKind.ExternalSubject:
|
|
79
|
+
case subject_1.SubjectKind.App:
|
|
80
|
+
case subject_1.SubjectKind.AppClient:
|
|
81
|
+
case subject_1.SubjectKind.Group:
|
|
82
|
+
case subject_1.SubjectKind.Role:
|
|
83
|
+
case subject_1.SubjectKind.Anon:
|
|
84
|
+
return 'human';
|
|
85
|
+
}
|
|
86
|
+
}
|
|
87
|
+
function actorTypeFor(subjectKind, actAs) {
|
|
88
|
+
if (actAs) {
|
|
89
|
+
return 'human';
|
|
90
|
+
}
|
|
91
|
+
return actorTypeForSubjectKind(subjectKind);
|
|
92
|
+
}
|
|
93
|
+
function deriveActorClassification(claims) {
|
|
94
|
+
const roles = resolveRolesFromClaims(claims);
|
|
95
|
+
const actAs = resolveActAsFromClaims(claims);
|
|
96
|
+
const { kind: subjectKind, tokenClass } = resolveSubjectAndClass(roles, claims, actAs);
|
|
97
|
+
return {
|
|
98
|
+
roles,
|
|
99
|
+
actAs,
|
|
100
|
+
subjectKind,
|
|
101
|
+
tokenClass,
|
|
102
|
+
actorType: actorTypeFor(subjectKind, actAs),
|
|
103
|
+
};
|
|
104
|
+
}
|
|
105
|
+
//# sourceMappingURL=actor-classification.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"actor-classification.js","sourceRoot":"","sources":["../../../src/nestjs/auth/actor-classification.ts"],"names":[],"mappings":";;AAkCA,4CAIC;AAGD,wDAcC;AAMD,wDAQC;AA8BD,wDAwBC;AAUD,0DAkBC;AAUD,oCAQC;AAOD,8DAiBC;AAjMD,8DAG0C;AA+B1C,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAGD,SAAgB,sBAAsB,CACpC,MAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IACE,WAAW;QACX,OAAO,WAAW,KAAK,QAAQ;QAC/B,KAAK,CAAC,OAAO,CAAE,WAAmC,CAAC,KAAK,CAAC,EACzD,CAAC;QACD,OAAQ,WAAoC,CAAC,KAAK,CAAC,MAAM,CACvD,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAMD,SAAgB,sBAAsB,CACpC,MAA+B;IAE/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,gBAAgB,CAAE,GAA+B,CAAC,KAAK,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAsB;IACtD,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,oBAAU,CAAC,UAAU;YACxB,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,oBAAU,CAAC,iBAAiB;YAC/B,OAAO,qBAAW,CAAC,KAAK,CAAC;QAC3B,KAAK,oBAAU,CAAC,oBAAoB;YAGlC,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,oBAAU,CAAC,oBAAoB;YAClC,OAAO,qBAAW,CAAC,eAAe,CAAC;QACrC,KAAK,oBAAU,CAAC,sBAAsB;YACpC,OAAO,qBAAW,CAAC,MAAM,CAAC;QAC5B,KAAK,oBAAU,CAAC,OAAO;YACrB,OAAO,qBAAW,CAAC,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAWD,SAAgB,sBAAsB,CACpC,KAAe,EACf,MAA+B,EAC/B,KAAyB;IAEzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GAAI,MAAM,CAAC,MAAM,CAAC,oBAAU,CAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxE,CAAC,CAAE,QAAuB;YAC1B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,UAAU,EAAE,oBAAU,CAAC,OAAO,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,OAAO,EAAE,UAAU,EAAE,oBAAU,CAAC,UAAU,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,KAAK,EAAE,UAAU,EAAE,oBAAU,CAAC,iBAAiB,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,qBAAW,CAAC,IAAI,EAAE,UAAU,EAAE,oBAAU,CAAC,OAAO,EAAE,CAAC;AACpE,CAAC;AAUD,SAAgB,uBAAuB,CACrC,IAAiB;IAEjB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,qBAAW,CAAC,OAAO,CAAC;QACzB,KAAK,qBAAW,CAAC,MAAM;YACrB,OAAO,SAAS,CAAC;QACnB,KAAK,qBAAW,CAAC,KAAK;YACpB,OAAO,OAAO,CAAC;QACjB,KAAK,qBAAW,CAAC,IAAI,CAAC;QACtB,KAAK,qBAAW,CAAC,eAAe,CAAC;QACjC,KAAK,qBAAW,CAAC,GAAG,CAAC;QACrB,KAAK,qBAAW,CAAC,SAAS,CAAC;QAC3B,KAAK,qBAAW,CAAC,KAAK,CAAC;QACvB,KAAK,qBAAW,CAAC,IAAI,CAAC;QACtB,KAAK,qBAAW,CAAC,IAAI;YACnB,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAUD,SAAgB,YAAY,CAC1B,WAAwB,EACxB,KAAyB;IAEzB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAOD,SAAgB,yBAAyB,CACvC,MAA+B;IAE/B,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,sBAAsB,CAC9D,KAAK,EACL,MAAM,EACN,KAAK,CACN,CAAC;IACF,OAAO;QACL,KAAK;QACL,KAAK;QACL,WAAW;QACX,UAAU;QACV,SAAS,EAAE,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC;KAC5C,CAAC;AACJ,CAAC"}
|
package/dist/nestjs/index.d.ts
CHANGED
|
@@ -3,6 +3,7 @@ export { getCorsConfig } from './cors.config';
|
|
|
3
3
|
export { getEnvOrThrow } from './get-env-or-throw';
|
|
4
4
|
export { ResponseEnvelopeInterceptor } from './response-envelope.interceptor';
|
|
5
5
|
export { RequestContextMiddleware } from './request-context.middleware';
|
|
6
|
+
export { deriveActorClassification, actorTypeForSubjectKind, actorTypeFor, resolveSubjectAndClass, resolveRolesFromClaims, resolveActAsFromClaims, asNonEmptyString, type ActorClassification, } from './auth/actor-classification';
|
|
6
7
|
export { AmbientOrgContextMiddleware } from './ambient-org-context.middleware';
|
|
7
8
|
export { ErrorResponseDto } from './error-response.dto';
|
|
8
9
|
export { ApiStandardOperation, ApiDataResponse, ApiDataArrayResponse, ApiCreatedDataResponse, ApiPaginatedResponse, ApiStandardErrors, } from './swagger.decorators';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,EACjC,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,GAAG,EACR,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAKjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EAGnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAIhB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,8BAA8B,EAKnC,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EAIf,eAAe,EACf,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,mBAAmB,GACpB,MAAM,eAAe,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,4BAA4B,EAC5B,iCAAiC,EACjC,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,GAAG,EACR,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAKjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EAGnB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAIhB,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,8BAA8B,EAKnC,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EAIf,eAAe,EACf,iBAAiB,GAClB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,0BAA0B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,mBAAmB,GACpB,MAAM,eAAe,CAAC"}
|
package/dist/nestjs/index.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
4
|
-
exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_PRISMA_CLIENT = exports.PrismaIdempotencyService = exports.IDEMPOTENCY_RECORD_PRISMA_MODEL = exports.ApiIntegrationEnvelope = exports.IntegrationEnvelopePipe = exports.IntegrationWebhookEnvelopeDto = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = void 0;
|
|
3
|
+
exports.fetchJson = exports.fetchEnvelopeOptional = exports.fetchEnvelope = exports.fetchWithRetry = exports.buildPaginatedResponse = exports.parsePagination = exports.PaginationMeta = exports.PaginationQueryDto = exports.Ctx = exports.requirePipelineRunId = exports.requireProjectId = exports.RAW_RESPONSE_KEY = exports.RawResponse = exports.IS_PUBLIC_KEY = exports.Public = exports.extractRealmFromIssuer = exports.OidcDiscoveryIssuerTenantResolver = exports.KeycloakIssuerTenantResolver = exports.OidcTokenVerifier = exports.IssuerMetadataResolver = exports.JwksVerificationError = exports.JwksVerifier = exports.selectTenantResolver = exports.DEFAULT_IDP_KIND = exports.IdpKind = exports.JwtVerificationGuard = exports.buildKeycloakSwaggerUiOptions = exports.enrichOpenApiWithKeycloakSecurity = exports.getKeycloakSwaggerUrls = exports.enhanceOpenApiDocumentation = exports.ApiStandardErrors = exports.ApiPaginatedResponse = exports.ApiCreatedDataResponse = exports.ApiDataArrayResponse = exports.ApiDataResponse = exports.ApiStandardOperation = exports.ErrorResponseDto = exports.AmbientOrgContextMiddleware = exports.asNonEmptyString = exports.resolveActAsFromClaims = exports.resolveRolesFromClaims = exports.resolveSubjectAndClass = exports.actorTypeFor = exports.actorTypeForSubjectKind = exports.deriveActorClassification = exports.RequestContextMiddleware = exports.ResponseEnvelopeInterceptor = exports.getEnvOrThrow = exports.getCorsConfig = exports.applyStandardBodyParsers = void 0;
|
|
4
|
+
exports.IDEMPOTENCY_SERVICE = exports.IDEMPOTENCY_PRISMA_CLIENT = exports.PrismaIdempotencyService = exports.IDEMPOTENCY_RECORD_PRISMA_MODEL = exports.ApiIntegrationEnvelope = exports.IntegrationEnvelopePipe = exports.IntegrationWebhookEnvelopeDto = exports.REQUIRE_ORG_CLAIM = exports.RequireOrgClaim = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = exports.GlobalExceptionFilter = exports.RolesGuard = exports.ROLES_KEY = exports.Roles = void 0;
|
|
5
5
|
var body_parsers_1 = require("./body-parsers");
|
|
6
6
|
Object.defineProperty(exports, "applyStandardBodyParsers", { enumerable: true, get: function () { return body_parsers_1.applyStandardBodyParsers; } });
|
|
7
7
|
var cors_config_1 = require("./cors.config");
|
|
@@ -12,6 +12,14 @@ var response_envelope_interceptor_1 = require("./response-envelope.interceptor")
|
|
|
12
12
|
Object.defineProperty(exports, "ResponseEnvelopeInterceptor", { enumerable: true, get: function () { return response_envelope_interceptor_1.ResponseEnvelopeInterceptor; } });
|
|
13
13
|
var request_context_middleware_1 = require("./request-context.middleware");
|
|
14
14
|
Object.defineProperty(exports, "RequestContextMiddleware", { enumerable: true, get: function () { return request_context_middleware_1.RequestContextMiddleware; } });
|
|
15
|
+
var actor_classification_1 = require("./auth/actor-classification");
|
|
16
|
+
Object.defineProperty(exports, "deriveActorClassification", { enumerable: true, get: function () { return actor_classification_1.deriveActorClassification; } });
|
|
17
|
+
Object.defineProperty(exports, "actorTypeForSubjectKind", { enumerable: true, get: function () { return actor_classification_1.actorTypeForSubjectKind; } });
|
|
18
|
+
Object.defineProperty(exports, "actorTypeFor", { enumerable: true, get: function () { return actor_classification_1.actorTypeFor; } });
|
|
19
|
+
Object.defineProperty(exports, "resolveSubjectAndClass", { enumerable: true, get: function () { return actor_classification_1.resolveSubjectAndClass; } });
|
|
20
|
+
Object.defineProperty(exports, "resolveRolesFromClaims", { enumerable: true, get: function () { return actor_classification_1.resolveRolesFromClaims; } });
|
|
21
|
+
Object.defineProperty(exports, "resolveActAsFromClaims", { enumerable: true, get: function () { return actor_classification_1.resolveActAsFromClaims; } });
|
|
22
|
+
Object.defineProperty(exports, "asNonEmptyString", { enumerable: true, get: function () { return actor_classification_1.asNonEmptyString; } });
|
|
15
23
|
var ambient_org_context_middleware_1 = require("./ambient-org-context.middleware");
|
|
16
24
|
Object.defineProperty(exports, "AmbientOrgContextMiddleware", { enumerable: true, get: function () { return ambient_org_context_middleware_1.AmbientOrgContextMiddleware; } });
|
|
17
25
|
var error_response_dto_1 = require("./error-response.dto");
|
package/dist/nestjs/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAG1B,6CAA8C;AAArC,4GAAA,aAAa,OAAA;AACtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,mFAA+E;AAAtE,6IAAA,2BAA2B,OAAA;AACpC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,2DAO8B;AAN5B,0HAAA,oBAAoB,OAAA;AACpB,qHAAA,eAAe,OAAA;AACf,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AACtB,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AAEnB,iEAGiC;AAF/B,oIAAA,2BAA2B,OAAA;AAG7B,uDAQ4B;AAP1B,0HAAA,sBAAsB,OAAA;AACtB,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAM/B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,kEAIoC;AAHlC,8GAAA,OAAO,OAAA;AACP,uHAAA,gBAAgB,OAAA;AAChB,2HAAA,oBAAoB,OAAA;AAKtB,iDAc4B;AAb1B,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,+HAAA,iCAAiC,OAAA;AACjC,oHAAA,sBAAsB,OAAA;AAQxB,uDAA2D;AAAlD,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC9B,mEAAyE;AAAhE,qHAAA,WAAW,OAAA;AAAE,0HAAA,gBAAgB,OAAA;AACtC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,iDAAsC;AAA7B,oGAAA,GAAG,OAAA;AACZ,2CAKsB;AAJpB,gHAAA,kBAAkB,OAAA;AAClB,4GAAA,cAAc,OAAA;AACd,6GAAA,eAAe,OAAA;AACf,oHAAA,sBAAsB,OAAA;AAExB,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AACvB,mDAI0B;AAHxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2GAAA,SAAS,OAAA;AAEX,qDAAqD;AAA5C,wGAAA,KAAK,OAAA;AAAE,4GAAA,SAAS,OAAA;AACzB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,+BA8CgB;AA7Cd,kGAAA,UAAU,OAAA;AACV,2GAAA,mBAAmB,OAAA;AAGnB,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,yGAAA,iBAAiB,OAAA;AAKjB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AAGnB,oGAAA,YAAY,OAAA;AACZ,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,uGAAA,eAAe,OAAA;AACf,4GAAA,oBAAoB,OAAA;AACpB,wGAAA,gBAAgB,OAAA;AAIhB,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAMvB,mGAAA,WAAW,OAAA;AACX,qGAAA,aAAa,OAAA;AACb,sGAAA,cAAc,OAAA;AACd,uGAAA,eAAe,OAAA;AAIf,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AAEnB,+DAMgC;AAL9B,qIAAA,6BAA6B,OAAA;AAC7B,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAIxB,6CASuB;AANrB,8HAAA,+BAA+B,OAAA;AAC/B,uHAAA,wBAAwB,OAAA;AACxB,wHAAA,yBAAyB,OAAA;AAGzB,kHAAA,mBAAmB,OAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nestjs/index.ts"],"names":[],"mappings":";;;;AAAA,+CAGwB;AAFtB,wHAAA,wBAAwB,OAAA;AAG1B,6CAA8C;AAArC,4GAAA,aAAa,OAAA;AACtB,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AACtB,iFAA8E;AAArE,4IAAA,2BAA2B,OAAA;AACpC,2EAAwE;AAA/D,sIAAA,wBAAwB,OAAA;AACjC,oEASqC;AARnC,iIAAA,yBAAyB,OAAA;AACzB,+HAAA,uBAAuB,OAAA;AACvB,oHAAA,YAAY,OAAA;AACZ,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,8HAAA,sBAAsB,OAAA;AACtB,wHAAA,gBAAgB,OAAA;AAGlB,mFAA+E;AAAtE,6IAAA,2BAA2B,OAAA;AACpC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,2DAO8B;AAN5B,0HAAA,oBAAoB,OAAA;AACpB,qHAAA,eAAe,OAAA;AACf,0HAAA,oBAAoB,OAAA;AACpB,4HAAA,sBAAsB,OAAA;AACtB,0HAAA,oBAAoB,OAAA;AACpB,uHAAA,iBAAiB,OAAA;AAEnB,iEAGiC;AAF/B,oIAAA,2BAA2B,OAAA;AAG7B,uDAQ4B;AAP1B,0HAAA,sBAAsB,OAAA;AACtB,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAM/B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,kEAIoC;AAHlC,8GAAA,OAAO,OAAA;AACP,uHAAA,gBAAgB,OAAA;AAChB,2HAAA,oBAAoB,OAAA;AAKtB,iDAc4B;AAb1B,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AACtB,+GAAA,iBAAiB,OAAA;AACjB,0HAAA,4BAA4B,OAAA;AAC5B,+HAAA,iCAAiC,OAAA;AACjC,oHAAA,sBAAsB,OAAA;AAQxB,uDAA2D;AAAlD,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC9B,mEAAyE;AAAhE,qHAAA,WAAW,OAAA;AAAE,0HAAA,gBAAgB,OAAA;AACtC,2DAAwD;AAA/C,sHAAA,gBAAgB,OAAA;AACzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,iDAAsC;AAA7B,oGAAA,GAAG,OAAA;AACZ,2CAKsB;AAJpB,gHAAA,kBAAkB,OAAA;AAClB,4GAAA,cAAc,OAAA;AACd,6GAAA,eAAe,OAAA;AACf,oHAAA,sBAAsB,OAAA;AAExB,uDAAuE;AAA9D,kHAAA,cAAc,OAAA;AACvB,mDAI0B;AAHxB,+GAAA,aAAa,OAAA;AACb,uHAAA,qBAAqB,OAAA;AACrB,2GAAA,SAAS,OAAA;AAEX,qDAAqD;AAA5C,wGAAA,KAAK,OAAA;AAAE,4GAAA,SAAS,OAAA;AACzB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,+BA8CgB;AA7Cd,kGAAA,UAAU,OAAA;AACV,2GAAA,mBAAmB,OAAA;AAGnB,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AACnB,yGAAA,iBAAiB,OAAA;AAKjB,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AACjB,2GAAA,mBAAmB,OAAA;AAGnB,oGAAA,YAAY,OAAA;AACZ,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,wGAAA,gBAAgB,OAAA;AAChB,4GAAA,oBAAoB,OAAA;AACpB,uGAAA,eAAe,OAAA;AACf,4GAAA,oBAAoB,OAAA;AACpB,wGAAA,gBAAgB,OAAA;AAIhB,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,0GAAA,kBAAkB,OAAA;AAClB,+GAAA,uBAAuB,OAAA;AAMvB,mGAAA,WAAW,OAAA;AACX,qGAAA,aAAa,OAAA;AACb,sGAAA,cAAc,OAAA;AACd,uGAAA,eAAe,OAAA;AAIf,uGAAA,eAAe,OAAA;AACf,yGAAA,iBAAiB,OAAA;AAEnB,+DAMgC;AAL9B,qIAAA,6BAA6B,OAAA;AAC7B,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAIxB,6CASuB;AANrB,8HAAA,+BAA+B,OAAA;AAC/B,uHAAA,wBAAwB,OAAA;AACxB,wHAAA,yBAAyB,OAAA;AAGzB,kHAAA,mBAAmB,OAAA"}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import { AdapterKey,
|
|
1
|
+
import { AdapterKey, WebhookEntityKind } from '../../lib/integration-webhooks';
|
|
2
2
|
export declare class IntegrationWebhookEnvelopeDto<TPayload = unknown> {
|
|
3
|
-
provider:
|
|
3
|
+
provider: string;
|
|
4
4
|
adapterKey: AdapterKey;
|
|
5
5
|
event: string;
|
|
6
6
|
entityKind: WebhookEntityKind;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"integration-webhook-envelope.dto.d.ts","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"integration-webhook-envelope.dto.d.ts","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,UAAU,EACV,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAqBxC,qBAAa,6BAA6B,CAAC,QAAQ,GAAG,OAAO;IAa3D,QAAQ,EAAG,MAAM,CAAC;IASlB,UAAU,EAAG,UAAU,CAAC;IAQxB,KAAK,EAAG,MAAM,CAAC;IAIf,UAAU,EAAG,iBAAiB,CAAC;IAQ/B,UAAU,EAAG,MAAM,CAAC;IAOpB,UAAU,EAAG,MAAM,CAAC;IAQpB,aAAa,EAAG,MAAM,CAAC;IASvB,UAAU,CAAC,EAAE,MAAM,CAAC;IASpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAK1B,OAAO,EAAG,QAAQ,CAAC;CACpB"}
|
|
@@ -28,12 +28,16 @@ class IntegrationWebhookEnvelopeDto {
|
|
|
28
28
|
exports.IntegrationWebhookEnvelopeDto = IntegrationWebhookEnvelopeDto;
|
|
29
29
|
__decorate([
|
|
30
30
|
(0, swagger_1.ApiProperty)({
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
31
|
+
type: String,
|
|
32
|
+
description: 'Open provider key of the external provider that emitted the webhook. ' +
|
|
33
|
+
'Any curated ConnectorKind value (e.g. "GITHUB") OR a contributed ' +
|
|
34
|
+
'provider key (UPPER_SNAKE) is valid — validity is enforced at the ' +
|
|
35
|
+
'ingress seam by the connector registry (assertKnownConnectionProviderKey), ' +
|
|
36
|
+
'not by this DTO. See the H1 open-provider design.',
|
|
37
|
+
example: 'GITHUB',
|
|
35
38
|
}),
|
|
36
|
-
(0, class_validator_1.
|
|
39
|
+
(0, class_validator_1.IsString)(),
|
|
40
|
+
(0, class_validator_1.IsNotEmpty)(),
|
|
37
41
|
__metadata("design:type", String)
|
|
38
42
|
], IntegrationWebhookEnvelopeDto.prototype, "provider", void 0);
|
|
39
43
|
__decorate([
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"integration-webhook-envelope.dto.js","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,
|
|
1
|
+
{"version":3,"file":"integration-webhook-envelope.dto.js","sourceRoot":"","sources":["../../../src/nestjs/integration-webhooks/integration-webhook-envelope.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,qDAOyB;AAEzB,yEAGwC;AAqBxC,MAAa,6BAA6B;IAaxC,QAAQ,CAAU;IASlB,UAAU,CAAc;IAQxB,KAAK,CAAU;IAIf,UAAU,CAAqB;IAQ/B,UAAU,CAAU;IAOpB,UAAU,CAAU;IAQpB,aAAa,CAAU;IASvB,UAAU,CAAU;IASpB,gBAAgB,CAAU;IAK1B,OAAO,CAAY;CACpB;AAjFD,sEAiFC;AApEC;IAZC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,MAAM;QACZ,WAAW,EACT,uEAAuE;YACvE,mEAAmE;YACnE,oEAAoE;YACpE,6EAA6E;YAC7E,mDAAmD;QACrD,OAAO,EAAE,QAAQ;KAClB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+DACK;AASlB;IADC,IAAA,wBAAM,EAAC,iCAAU,CAAC;;iEACK;AAQxB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,2HAA2H;QAC7H,OAAO,EAAE,kBAAkB;KAC5B,CAAC;IACD,IAAA,0BAAQ,GAAE;;4DACI;AAIf;IADC,IAAA,wBAAM,EAAC,wCAAiB,CAAC;;iEACK;AAQ/B;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yHAAyH;QAC3H,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,0BAAQ,GAAE;;iEACS;AAOpB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,0BAA0B;KACpC,CAAC;IACD,IAAA,2BAAS,GAAE;;iEACQ;AAQpB;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,uFAAuF;QACzF,OAAO,EAAE,sCAAsC;KAChD,CAAC;IACD,IAAA,wBAAM,GAAE;;oEACc;AASvB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4EAA4E;QAC9E,OAAO,EAAE,WAAW;KACrB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iEACS;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,gGAAgG;QAClG,OAAO,EAAE,cAAc;KACxB,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uEACe"}
|
|
@@ -19,15 +19,9 @@ export declare class RequestContextMiddleware implements NestMiddleware {
|
|
|
19
19
|
private decodeJwtPayload;
|
|
20
20
|
private assertOrgClaimMatchesHeader;
|
|
21
21
|
private resolveActorId;
|
|
22
|
-
private resolveActAs;
|
|
23
|
-
private resolveRoles;
|
|
24
|
-
private resolveActorType;
|
|
25
|
-
private resolveSubjectAndClass;
|
|
26
|
-
private subjectKindForTokenClass;
|
|
27
22
|
private resolveActorChain;
|
|
28
23
|
private extractProjectIdFromPath;
|
|
29
24
|
private parseApprovalMode;
|
|
30
|
-
private asNonEmptyString;
|
|
31
25
|
private extractRealmFromIssuer;
|
|
32
26
|
}
|
|
33
27
|
export {};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.middleware.d.ts","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"request-context.middleware.d.ts","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA2BzD,UAAU,wBAAwB;IAChC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,kBAAmB,SAAQ,wBAAwB;IAC3D,CAAC,eAAe,CAAC,CAAC,EAAE,cAAc,CAAC;CACpC;AAED,qBACa,wBAAyB,YAAW,cAAc;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IAEpE,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAsHnE,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,gBAAgB;IAgCxB,OAAO,CAAC,2BAA2B;IAwBnC,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,wBAAwB;IAKhC,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,sBAAsB;CAK/B"}
|
|
@@ -15,6 +15,7 @@ const subject_1 = require("@xemahq/kernel-contracts/subject");
|
|
|
15
15
|
const approval_mode_1 = require("../lib/approval-mode");
|
|
16
16
|
const org_claim_1 = require("./auth/org-claim");
|
|
17
17
|
const org_role_1 = require("./auth/org-role");
|
|
18
|
+
const actor_classification_1 = require("./auth/actor-classification");
|
|
18
19
|
let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContextMiddleware {
|
|
19
20
|
logger = new common_1.Logger(RequestContextMiddleware_1.name);
|
|
20
21
|
use(req, _res, next) {
|
|
@@ -32,10 +33,7 @@ let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContext
|
|
|
32
33
|
const causationId = this.readHeader(req, 'X-Causation-Id') ?? undefined;
|
|
33
34
|
const claims = this.decodeJwtPayload(token);
|
|
34
35
|
const actorId = this.resolveActorId(claims);
|
|
35
|
-
const actAs =
|
|
36
|
-
const roles = this.resolveRoles(claims);
|
|
37
|
-
const actorType = this.resolveActorType(roles, claims, actAs);
|
|
38
|
-
const { kind: subjectKind, tokenClass } = this.resolveSubjectAndClass(roles, claims, actAs);
|
|
36
|
+
const { roles, actAs, subjectKind, tokenClass, actorType } = (0, actor_classification_1.deriveActorClassification)(claims);
|
|
39
37
|
const actorChain = this.resolveActorChain(claims);
|
|
40
38
|
const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
|
|
41
39
|
if (!orgId && actorType !== 'service') {
|
|
@@ -137,86 +135,17 @@ let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContext
|
|
|
137
135
|
}
|
|
138
136
|
}
|
|
139
137
|
resolveActorId(claims) {
|
|
140
|
-
const actorId =
|
|
138
|
+
const actorId = (0, actor_classification_1.asNonEmptyString)(claims.sub);
|
|
141
139
|
if (!actorId) {
|
|
142
140
|
throw new common_1.BadRequestException('JWT token missing required "sub" claim');
|
|
143
141
|
}
|
|
144
142
|
return actorId;
|
|
145
143
|
}
|
|
146
|
-
resolveActAs(claims) {
|
|
147
|
-
const act = claims['act'];
|
|
148
|
-
if (!act || typeof act !== 'object' || Array.isArray(act)) {
|
|
149
|
-
return undefined;
|
|
150
|
-
}
|
|
151
|
-
return this.asNonEmptyString(act['sub']);
|
|
152
|
-
}
|
|
153
|
-
resolveRoles(claims) {
|
|
154
|
-
const realmAccess = claims.realm_access;
|
|
155
|
-
if (realmAccess &&
|
|
156
|
-
typeof realmAccess === 'object' &&
|
|
157
|
-
Array.isArray(realmAccess.roles)) {
|
|
158
|
-
return realmAccess.roles.filter((role) => typeof role === 'string');
|
|
159
|
-
}
|
|
160
|
-
return [];
|
|
161
|
-
}
|
|
162
|
-
resolveActorType(roles, claims, actAs) {
|
|
163
|
-
const explicitType = this.asNonEmptyString(claims.actor_type);
|
|
164
|
-
if (explicitType && ['human', 'agent', 'service'].includes(explicitType)) {
|
|
165
|
-
return explicitType;
|
|
166
|
-
}
|
|
167
|
-
if (actAs) {
|
|
168
|
-
return 'human';
|
|
169
|
-
}
|
|
170
|
-
if (roles.includes('micro-service') || roles.includes('service-account')) {
|
|
171
|
-
return 'service';
|
|
172
|
-
}
|
|
173
|
-
if (roles.includes('agent')) {
|
|
174
|
-
return 'agent';
|
|
175
|
-
}
|
|
176
|
-
return 'human';
|
|
177
|
-
}
|
|
178
|
-
resolveSubjectAndClass(roles, claims, actAs) {
|
|
179
|
-
const explicit = this.asNonEmptyString(claims.token_class);
|
|
180
|
-
if (explicit) {
|
|
181
|
-
const matched = Object.values(subject_1.TokenClass).includes(explicit)
|
|
182
|
-
? explicit
|
|
183
|
-
: undefined;
|
|
184
|
-
if (matched) {
|
|
185
|
-
return { kind: this.subjectKindForTokenClass(matched), tokenClass: matched };
|
|
186
|
-
}
|
|
187
|
-
}
|
|
188
|
-
if (actAs) {
|
|
189
|
-
return { kind: subject_1.SubjectKind.User, tokenClass: subject_1.TokenClass.UserJwt };
|
|
190
|
-
}
|
|
191
|
-
if (roles.includes('micro-service') || roles.includes('service-account')) {
|
|
192
|
-
return { kind: subject_1.SubjectKind.Service, tokenClass: subject_1.TokenClass.ServiceJwt };
|
|
193
|
-
}
|
|
194
|
-
if (roles.includes('agent')) {
|
|
195
|
-
return { kind: subject_1.SubjectKind.Agent, tokenClass: subject_1.TokenClass.AgentRuntimeToken };
|
|
196
|
-
}
|
|
197
|
-
return { kind: subject_1.SubjectKind.User, tokenClass: subject_1.TokenClass.UserJwt };
|
|
198
|
-
}
|
|
199
|
-
subjectKindForTokenClass(tokenClass) {
|
|
200
|
-
switch (tokenClass) {
|
|
201
|
-
case subject_1.TokenClass.ServiceJwt:
|
|
202
|
-
return subject_1.SubjectKind.Service;
|
|
203
|
-
case subject_1.TokenClass.AgentRuntimeToken:
|
|
204
|
-
return subject_1.SubjectKind.Agent;
|
|
205
|
-
case subject_1.TokenClass.WorkflowRuntimeToken:
|
|
206
|
-
return subject_1.SubjectKind.Service;
|
|
207
|
-
case subject_1.TokenClass.ExternalSessionToken:
|
|
208
|
-
return subject_1.SubjectKind.ExternalSubject;
|
|
209
|
-
case subject_1.TokenClass.RunnerAttestationToken:
|
|
210
|
-
return subject_1.SubjectKind.Runner;
|
|
211
|
-
case subject_1.TokenClass.UserJwt:
|
|
212
|
-
return subject_1.SubjectKind.User;
|
|
213
|
-
}
|
|
214
|
-
}
|
|
215
144
|
resolveActorChain(claims) {
|
|
216
145
|
const chain = [];
|
|
217
146
|
let node = claims['act'];
|
|
218
147
|
while (node && typeof node === 'object' && !Array.isArray(node)) {
|
|
219
|
-
const sub =
|
|
148
|
+
const sub = (0, actor_classification_1.asNonEmptyString)(node['sub']);
|
|
220
149
|
if (!sub)
|
|
221
150
|
break;
|
|
222
151
|
chain.push({ kind: subject_1.SubjectKind.Service, id: sub });
|
|
@@ -237,12 +166,6 @@ let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContext
|
|
|
237
166
|
}
|
|
238
167
|
throw new common_1.BadRequestException(`Invalid X-Approval-Mode-Override value: "${value}". Must be "AUTO" or "HUMAN_REQUIRED"`);
|
|
239
168
|
}
|
|
240
|
-
asNonEmptyString(value) {
|
|
241
|
-
if (typeof value !== 'string')
|
|
242
|
-
return undefined;
|
|
243
|
-
const trimmed = value.trim();
|
|
244
|
-
return trimmed.length > 0 ? trimmed : undefined;
|
|
245
|
-
}
|
|
246
169
|
extractRealmFromIssuer(issuer) {
|
|
247
170
|
if (!issuer || typeof issuer !== 'string')
|
|
248
171
|
return undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AACxB,6CAAyC;AAGzC,4DAAyD;AACzD,
|
|
1
|
+
{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AACxB,6CAAyC;AAGzC,4DAAyD;AACzD,8DAI0C;AAE1C,wDAAkE;AAClE,gDAAkE;AAClE,8CAAkD;AAClD,sEAGqC;AA0B9B,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAClB,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAuB,EAAE,IAAa,EAAE,IAAgB;QAI1D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,yBAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC;YACpC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,IAAI,SAAS,CAAC;QACnF,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CACjD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC,CACjD,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAA,wBAAU,GAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,SAAS,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAK5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GACxD,IAAA,gDAAyB,EAAC,MAAM,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;QAazC,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAC3B,4BAA4B,yBAAa,CAAC,SAAS,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC;QAWlC,IAAI,CAAC,2BAA2B,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAOvE,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAO;gBACd,KAAK;gBACL,KAAK;gBACL,SAAS;gBACT,KAAK,EAAE,GAAG,aAAa,IAAI,UAAU,EAAE;gBACvC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAe;YAC1B,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,OAAO;YACX,KAAK;YACL,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QAEF,GAAG,CAAC,iCAAe,CAAC,GAAG;YACrB,KAAK,EAAE,aAAa;YACpB,SAAS;YACT,OAAO;YACP,UAAU;YACV,UAAU;YACV,OAAO;YACP,SAAS;YACT,aAAa;YACb,WAAW;YACX,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,WAAW,EAAE,KAAK;YAClB,aAAa;YACb,gBAAgB;YAChB,oBAAoB;YACpB,KAAK;YACL,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAyB,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAWO,UAAU,CAChB,GAA6B,EAC7B,IAAY;QAEZ,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,CAAC;IAEO,kBAAkB,CAAC,GAA6B;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAKpC,MAAM,IAAI,4BAAmB,CAC3B,2EAA2E,KAAK,CAAC,MAAM,GAAG;gBACxF,iBAAiB,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAkC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAUO,2BAA2B,CACjC,MAA+B,EAC/B,WAAmB,EACnB,UAAyB;QAEzB,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,uBAAuB;gBAChC,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,IAAI,SAAS,mBAAmB;gBAC3D,OAAO,QAAQ,CAAC,GAAG,6BAA6B,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,IAAA,uCAAgB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAOO,iBAAiB,CAAC,MAA+B;QACvD,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,GAAG,GAAG,IAAA,uCAAgB,EAAE,IAAgC,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,GAAG;gBAAE,MAAM;YAChB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAW,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACnD,IAAI,GAAI,IAAgC,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,wBAAwB,CAAC,IAAY;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACjD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAEO,iBAAiB,CACvB,KAAyB;QAEzB,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,0CAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,KAA6B,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,4BAAmB,CAC3B,4CAA4C,KAAK,uCAAuC,CACzF,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,MAA0B;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF,CAAA;AA1PY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CA0PpC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/platform-common",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.21",
|
|
4
4
|
"description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"issuer-metadata-resolver.d.ts","sourceRoot":"","sources":["../../../src/nestjs/jwks/issuer-metadata-resolver.ts"],"names":[],"mappings":"AAuBA,qBAAa,sBAAsB;IAOrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IANvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6D;gBAMtD,UAAU,GAAE,MAAkB;IAOrD,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAgC5D"}
|
|
@@ -1,36 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.IssuerMetadataResolver = void 0;
|
|
4
|
-
const jwks_verifier_1 = require("./jwks-verifier");
|
|
5
|
-
class IssuerMetadataResolver {
|
|
6
|
-
cacheTtlMs;
|
|
7
|
-
cache = new Map();
|
|
8
|
-
constructor(cacheTtlMs = 3_600_000) {
|
|
9
|
-
this.cacheTtlMs = cacheTtlMs;
|
|
10
|
-
}
|
|
11
|
-
async resolveJwksUri(discoveryUrl) {
|
|
12
|
-
const cached = this.cache.get(discoveryUrl);
|
|
13
|
-
if (cached && Date.now() - cached.fetchedAt < this.cacheTtlMs) {
|
|
14
|
-
return cached.jwksUri;
|
|
15
|
-
}
|
|
16
|
-
let response;
|
|
17
|
-
try {
|
|
18
|
-
response = await fetch(discoveryUrl);
|
|
19
|
-
}
|
|
20
|
-
catch (error) {
|
|
21
|
-
const msg = error instanceof Error ? error.message : String(error);
|
|
22
|
-
throw new jwks_verifier_1.JwksVerificationError(`Failed to reach OIDC discovery endpoint ${discoveryUrl}: ${msg}`);
|
|
23
|
-
}
|
|
24
|
-
if (!response.ok) {
|
|
25
|
-
throw new jwks_verifier_1.JwksVerificationError(`Failed to fetch OIDC discovery from ${discoveryUrl}: ${response.status}`);
|
|
26
|
-
}
|
|
27
|
-
const doc = (await response.json());
|
|
28
|
-
if (typeof doc.jwks_uri !== 'string' || doc.jwks_uri.length === 0) {
|
|
29
|
-
throw new jwks_verifier_1.JwksVerificationError(`OIDC discovery at ${discoveryUrl} did not provide a jwks_uri`);
|
|
30
|
-
}
|
|
31
|
-
this.cache.set(discoveryUrl, { jwksUri: doc.jwks_uri, fetchedAt: Date.now() });
|
|
32
|
-
return doc.jwks_uri;
|
|
33
|
-
}
|
|
34
|
-
}
|
|
35
|
-
exports.IssuerMetadataResolver = IssuerMetadataResolver;
|
|
36
|
-
//# sourceMappingURL=issuer-metadata-resolver.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"issuer-metadata-resolver.js","sourceRoot":"","sources":["../../../src/nestjs/jwks/issuer-metadata-resolver.ts"],"names":[],"mappings":";;;AAAA,mDAAwD;AAuBxD,MAAa,sBAAsB;IAOJ;IANZ,KAAK,GAAG,IAAI,GAAG,EAAkD,CAAC;IAMnF,YAA6B,aAAqB,SAAS;QAA9B,eAAU,GAAV,UAAU,CAAoB;IAAG,CAAC;IAO/D,KAAK,CAAC,cAAc,CAAC,YAAoB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnE,MAAM,IAAI,qCAAqB,CAC7B,2CAA2C,YAAY,KAAK,GAAG,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,qCAAqB,CAC7B,uCAAuC,YAAY,KAAK,QAAQ,CAAC,MAAM,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,qCAAqB,CAC7B,qBAAqB,YAAY,6BAA6B,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;CACF;AA9CD,wDA8CC"}
|
|
@@ -1,48 +0,0 @@
|
|
|
1
|
-
export interface DecodedJwtHeader {
|
|
2
|
-
alg: string;
|
|
3
|
-
typ?: string;
|
|
4
|
-
kid?: string;
|
|
5
|
-
}
|
|
6
|
-
export interface DecodedJwtPayload {
|
|
7
|
-
iss?: string;
|
|
8
|
-
sub?: string;
|
|
9
|
-
exp?: number;
|
|
10
|
-
iat?: number;
|
|
11
|
-
nbf?: number;
|
|
12
|
-
aud?: string | string[];
|
|
13
|
-
[key: string]: unknown;
|
|
14
|
-
}
|
|
15
|
-
export interface Jwk {
|
|
16
|
-
kty: string;
|
|
17
|
-
kid: string;
|
|
18
|
-
use?: string;
|
|
19
|
-
n?: string;
|
|
20
|
-
e?: string;
|
|
21
|
-
x5c?: string[];
|
|
22
|
-
alg?: string;
|
|
23
|
-
}
|
|
24
|
-
export declare class JwksVerificationError extends Error {
|
|
25
|
-
constructor(message: string);
|
|
26
|
-
}
|
|
27
|
-
export interface JwksVerifyOptions {
|
|
28
|
-
jwksUrl: string;
|
|
29
|
-
cacheKey: string;
|
|
30
|
-
expectedIssuers?: readonly string[];
|
|
31
|
-
}
|
|
32
|
-
export declare class JwksVerifier {
|
|
33
|
-
private readonly cacheTtlMs;
|
|
34
|
-
private readonly caches;
|
|
35
|
-
constructor(cacheTtlMs?: number);
|
|
36
|
-
decode(jwt: string): {
|
|
37
|
-
header: DecodedJwtHeader;
|
|
38
|
-
payload: DecodedJwtPayload;
|
|
39
|
-
};
|
|
40
|
-
verify(jwt: string, options: JwksVerifyOptions): Promise<DecodedJwtPayload>;
|
|
41
|
-
private assertIssuer;
|
|
42
|
-
private verifySignature;
|
|
43
|
-
private getSigningKey;
|
|
44
|
-
private fetchJwks;
|
|
45
|
-
private resolveKey;
|
|
46
|
-
private mapAlgorithm;
|
|
47
|
-
}
|
|
48
|
-
//# sourceMappingURL=jwks-verifier.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-verifier.d.ts","sourceRoot":"","sources":["../../../src/nestjs/jwks/jwks-verifier.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAOD,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAMD,MAAM,WAAW,GAAG;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAuBD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAKD,MAAM,WAAW,iBAAiB;IAKhC,OAAO,EAAE,MAAM,CAAC;IAMhB,QAAQ,EAAE,MAAM,CAAC;IASjB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAkBD,qBAAa,YAAY;IASX,OAAO,CAAC,QAAQ,CAAC,UAAU;IAPvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAO9B,UAAU,GAAE,MAAgB;IAQzD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,iBAAiB,CAAA;KAAE;IAyBvE,MAAM,CACV,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,iBAAiB,CAAC;IAoC7B,OAAO,CAAC,YAAY;IAsBpB,OAAO,CAAC,eAAe;YAqBT,aAAa;YAsBb,SAAS;IAiCvB,OAAO,CAAC,UAAU;IAkBlB,OAAO,CAAC,YAAY;CAYrB"}
|
|
@@ -1,177 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
3
|
-
if (k2 === undefined) k2 = k;
|
|
4
|
-
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
5
|
-
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
6
|
-
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
7
|
-
}
|
|
8
|
-
Object.defineProperty(o, k2, desc);
|
|
9
|
-
}) : (function(o, m, k, k2) {
|
|
10
|
-
if (k2 === undefined) k2 = k;
|
|
11
|
-
o[k2] = m[k];
|
|
12
|
-
}));
|
|
13
|
-
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
14
|
-
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
15
|
-
}) : function(o, v) {
|
|
16
|
-
o["default"] = v;
|
|
17
|
-
});
|
|
18
|
-
var __importStar = (this && this.__importStar) || (function () {
|
|
19
|
-
var ownKeys = function(o) {
|
|
20
|
-
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
21
|
-
var ar = [];
|
|
22
|
-
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
23
|
-
return ar;
|
|
24
|
-
};
|
|
25
|
-
return ownKeys(o);
|
|
26
|
-
};
|
|
27
|
-
return function (mod) {
|
|
28
|
-
if (mod && mod.__esModule) return mod;
|
|
29
|
-
var result = {};
|
|
30
|
-
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
31
|
-
__setModuleDefault(result, mod);
|
|
32
|
-
return result;
|
|
33
|
-
};
|
|
34
|
-
})();
|
|
35
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
36
|
-
exports.JwksVerifier = exports.JwksVerificationError = void 0;
|
|
37
|
-
const crypto = __importStar(require("node:crypto"));
|
|
38
|
-
class JwksVerificationError extends Error {
|
|
39
|
-
constructor(message) {
|
|
40
|
-
super(message);
|
|
41
|
-
this.name = 'JwksVerificationError';
|
|
42
|
-
}
|
|
43
|
-
}
|
|
44
|
-
exports.JwksVerificationError = JwksVerificationError;
|
|
45
|
-
class JwksVerifier {
|
|
46
|
-
cacheTtlMs;
|
|
47
|
-
caches = new Map();
|
|
48
|
-
constructor(cacheTtlMs = 600_000) {
|
|
49
|
-
this.cacheTtlMs = cacheTtlMs;
|
|
50
|
-
}
|
|
51
|
-
decode(jwt) {
|
|
52
|
-
const [headerB64, payloadB64, signatureB64] = jwt.split('.');
|
|
53
|
-
if (!headerB64 || !payloadB64 || !signatureB64) {
|
|
54
|
-
throw new JwksVerificationError('Invalid token format');
|
|
55
|
-
}
|
|
56
|
-
let header;
|
|
57
|
-
let payload;
|
|
58
|
-
try {
|
|
59
|
-
header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
|
|
60
|
-
payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
|
|
61
|
-
}
|
|
62
|
-
catch {
|
|
63
|
-
throw new JwksVerificationError('Invalid token format');
|
|
64
|
-
}
|
|
65
|
-
return { header, payload };
|
|
66
|
-
}
|
|
67
|
-
async verify(jwt, options) {
|
|
68
|
-
const [headerB64, payloadB64, signatureB64] = jwt.split('.');
|
|
69
|
-
if (!headerB64 || !payloadB64 || !signatureB64) {
|
|
70
|
-
throw new JwksVerificationError('Invalid token format');
|
|
71
|
-
}
|
|
72
|
-
const { header, payload } = this.decode(jwt);
|
|
73
|
-
const nowMs = Date.now();
|
|
74
|
-
if (typeof payload.exp === 'number' && nowMs >= payload.exp * 1000) {
|
|
75
|
-
throw new JwksVerificationError('Token expired');
|
|
76
|
-
}
|
|
77
|
-
if (typeof payload.nbf === 'number' && nowMs < payload.nbf * 1000) {
|
|
78
|
-
throw new JwksVerificationError('Token not yet valid');
|
|
79
|
-
}
|
|
80
|
-
if (options.expectedIssuers && options.expectedIssuers.length > 0) {
|
|
81
|
-
this.assertIssuer(payload.iss, options.expectedIssuers);
|
|
82
|
-
}
|
|
83
|
-
const publicKey = await this.getSigningKey(options.cacheKey, options.jwksUrl, header.kid);
|
|
84
|
-
this.verifySignature(headerB64, payloadB64, signatureB64, header.alg, publicKey);
|
|
85
|
-
return payload;
|
|
86
|
-
}
|
|
87
|
-
assertIssuer(iss, expectedIssuers) {
|
|
88
|
-
if (!iss) {
|
|
89
|
-
throw new JwksVerificationError('Token missing required issuer claim');
|
|
90
|
-
}
|
|
91
|
-
const realmSuffixes = [
|
|
92
|
-
...new Set(expectedIssuers
|
|
93
|
-
.map((candidate) => candidate.match(/(\/realms\/[^/]+)$/)?.[1])
|
|
94
|
-
.filter((suffix) => Boolean(suffix))),
|
|
95
|
-
];
|
|
96
|
-
const matched = expectedIssuers.includes(iss) ||
|
|
97
|
-
realmSuffixes.some((suffix) => iss.endsWith(suffix));
|
|
98
|
-
if (!matched) {
|
|
99
|
-
throw new JwksVerificationError('Invalid token issuer');
|
|
100
|
-
}
|
|
101
|
-
}
|
|
102
|
-
verifySignature(headerB64, payloadB64, signatureB64, alg, publicKey) {
|
|
103
|
-
const data = `${headerB64}.${payloadB64}`;
|
|
104
|
-
const signature = Buffer.from(signatureB64, 'base64url');
|
|
105
|
-
const algorithm = this.mapAlgorithm(alg);
|
|
106
|
-
const isValid = crypto.verify(algorithm, Buffer.from(data), publicKey, signature);
|
|
107
|
-
if (!isValid) {
|
|
108
|
-
throw new JwksVerificationError('Invalid token signature');
|
|
109
|
-
}
|
|
110
|
-
}
|
|
111
|
-
async getSigningKey(cacheKey, jwksUrl, kid) {
|
|
112
|
-
let cache = this.caches.get(cacheKey);
|
|
113
|
-
if (cache &&
|
|
114
|
-
kid &&
|
|
115
|
-
cache.keys.has(kid) &&
|
|
116
|
-
Date.now() - cache.lastFetch < this.cacheTtlMs) {
|
|
117
|
-
return cache.keys.get(kid);
|
|
118
|
-
}
|
|
119
|
-
const keys = await this.fetchJwks(jwksUrl);
|
|
120
|
-
cache = { keys, lastFetch: Date.now() };
|
|
121
|
-
this.caches.set(cacheKey, cache);
|
|
122
|
-
return this.resolveKey(cache, kid);
|
|
123
|
-
}
|
|
124
|
-
async fetchJwks(jwksUrl) {
|
|
125
|
-
let response;
|
|
126
|
-
try {
|
|
127
|
-
response = await fetch(jwksUrl);
|
|
128
|
-
}
|
|
129
|
-
catch (error) {
|
|
130
|
-
const msg = error instanceof Error ? error.message : String(error);
|
|
131
|
-
throw new JwksVerificationError(`Failed to reach JWKS endpoint ${jwksUrl}: ${msg}`);
|
|
132
|
-
}
|
|
133
|
-
if (!response.ok) {
|
|
134
|
-
throw new JwksVerificationError(`Failed to fetch JWKS from ${jwksUrl}: ${response.status}`);
|
|
135
|
-
}
|
|
136
|
-
const jwks = (await response.json());
|
|
137
|
-
const keys = new Map();
|
|
138
|
-
for (const key of jwks.keys) {
|
|
139
|
-
if (key.kty === 'RSA' && key.n && key.e) {
|
|
140
|
-
const publicKey = crypto.createPublicKey({
|
|
141
|
-
key: { kty: 'RSA', n: key.n, e: key.e },
|
|
142
|
-
format: 'jwk',
|
|
143
|
-
});
|
|
144
|
-
keys.set(key.kid, publicKey);
|
|
145
|
-
}
|
|
146
|
-
}
|
|
147
|
-
return keys;
|
|
148
|
-
}
|
|
149
|
-
resolveKey(cache, kid) {
|
|
150
|
-
if (kid) {
|
|
151
|
-
const key = cache.keys.get(kid);
|
|
152
|
-
if (!key) {
|
|
153
|
-
throw new JwksVerificationError(`Signing key not found for kid: ${kid}`);
|
|
154
|
-
}
|
|
155
|
-
return key;
|
|
156
|
-
}
|
|
157
|
-
const firstKey = cache.keys.values().next().value;
|
|
158
|
-
if (!firstKey) {
|
|
159
|
-
throw new JwksVerificationError('No valid signing keys found in JWKS');
|
|
160
|
-
}
|
|
161
|
-
return firstKey;
|
|
162
|
-
}
|
|
163
|
-
mapAlgorithm(alg) {
|
|
164
|
-
switch (alg) {
|
|
165
|
-
case 'RS256':
|
|
166
|
-
return 'sha256';
|
|
167
|
-
case 'RS384':
|
|
168
|
-
return 'sha384';
|
|
169
|
-
case 'RS512':
|
|
170
|
-
return 'sha512';
|
|
171
|
-
default:
|
|
172
|
-
throw new JwksVerificationError(`Unsupported JWT algorithm: ${alg}`);
|
|
173
|
-
}
|
|
174
|
-
}
|
|
175
|
-
}
|
|
176
|
-
exports.JwksVerifier = JwksVerifier;
|
|
177
|
-
//# sourceMappingURL=jwks-verifier.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"jwks-verifier.js","sourceRoot":"","sources":["../../../src/nestjs/jwks/jwks-verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,oDAAsC;AA6DtC,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AA4CD,MAAa,YAAY;IASM;IAPZ,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAO3D,YAA6B,aAAqB,OAAO;QAA5B,eAAU,GAAV,UAAU,CAAkB;IAAG,CAAC;IAQ7D,MAAM,CAAC,GAAW;QAChB,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,MAAwB,CAAC;QAC7B,IAAI,OAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CACjB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC,KAAK,CAClB,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;IAOD,KAAK,CAAC,MAAM,CACV,GAAW,EACX,OAA0B;QAE1B,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE7C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YACnE,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CACxC,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,GAAG,CACX,CAAC;QACF,IAAI,CAAC,eAAe,CAClB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,MAAM,CAAC,GAAG,EACV,SAAS,CACV,CAAC;QAEF,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,YAAY,CAClB,GAAuB,EACvB,eAAkC;QAElC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,aAAa,GAAG;YACpB,GAAG,IAAI,GAAG,CACR,eAAe;iBACZ,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC9D,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACzD;SACF,CAAC;QACF,MAAM,OAAO,GACX,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,eAAe,CACrB,SAAiB,EACjB,UAAkB,EAClB,YAAoB,EACpB,GAAW,EACX,SAA2B;QAE3B,MAAM,IAAI,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,SAAS,EACT,SAAS,CACV,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,QAAgB,EAChB,OAAe,EACf,GAAuB;QAEvB,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IACE,KAAK;YACL,GAAG;YACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACnB,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,UAAU,EAC9C,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC9B,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEjC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,SAAS,CACrB,OAAe;QAEf,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnE,MAAM,IAAI,qBAAqB,CAC7B,iCAAiC,OAAO,KAAK,GAAG,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,qBAAqB,CAC7B,6BAA6B,OAAO,KAAK,QAAQ,CAAC,MAAM,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxC,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;oBACvC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;oBACvC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAChB,KAAoB,EACpB,GAAuB;QAEvB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,GAAW;QAC9B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB,KAAK,OAAO;gBACV,OAAO,QAAQ,CAAC;YAClB;gBACE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;CACF;AAjND,oCAiNC"}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"route-metadata-keys.d.ts","sourceRoot":"","sources":["../../src/nestjs/route-metadata-keys.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAGrD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC"}
|
|
@@ -1,6 +0,0 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.XEMA_INTERNAL_ROUTE = exports.XEMA_PUBLIC_ROUTE = void 0;
|
|
4
|
-
exports.XEMA_PUBLIC_ROUTE = 'xema:public-route';
|
|
5
|
-
exports.XEMA_INTERNAL_ROUTE = 'xema:internal-route';
|
|
6
|
-
//# sourceMappingURL=route-metadata-keys.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"route-metadata-keys.js","sourceRoot":"","sources":["../../src/nestjs/route-metadata-keys.ts"],"names":[],"mappings":";;;AAwBa,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAGxC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC"}
|