@xemahq/platform-common 0.39.0 → 0.41.0

package/dist/nestjs/auth/claim-authority.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnsupportedContextVersionError = exports.InvalidBoundaryContextError = exports.BoundarySubjectKind = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.PLATFORM_AUTHORITY_CLAIMS = exports.ACT_CLAIM = exports.TOKEN_CLASS_CLAIM = exports.DELEGATION_ID_CLAIM = exports.SUPPORTED_CONTEXT_VERSION = exports.CONTEXT_VERSION_CLAIM = void 0;
+exports.kernelSubjectKindForBoundary = kernelSubjectKindForBoundary;
+exports.normalizeClaimAuthorityClaims = normalizeClaimAuthorityClaims;
+exports.withoutPlatformAuthorityClaims = withoutPlatformAuthorityClaims;
+exports.resolveDelegationIdFromBoundaryClaims = resolveDelegationIdFromBoundaryClaims;
+const common_1 = require("@nestjs/common");
+const identity_client_1 = require("@xemahq/identity-client");
+const subject_1 = require("@xemahq/contracts/subject");
+const org_claim_1 = require("../../lib/auth/org-claim");
+const org_role_1 = require("../../lib/auth/org-role");
+const actor_classification_1 = require("./actor-classification");
+const boundary_context_brand_1 = require("./boundary-context-brand");
+exports.CONTEXT_VERSION_CLAIM = 'ctx_ver';
+exports.SUPPORTED_CONTEXT_VERSION = 1;
+exports.DELEGATION_ID_CLAIM = 'did';
+exports.TOKEN_CLASS_CLAIM = 'token_class';
+exports.ACT_CLAIM = 'act';
+exports.PLATFORM_AUTHORITY_CLAIMS = [
+    'realm_access',
+    boundary_context_brand_1.PLATFORM_ROLES_CLAIM,
+    org_role_1.OrgRolesClaimKey.Canonical,
+    org_claim_1.OrgClaimKey.Canonical,
+    exports.TOKEN_CLASS_CLAIM,
+    actor_classification_1.SUBJECT_KIND_CLAIM,
+    exports.ACT_CLAIM,
+    exports.DELEGATION_ID_CLAIM,
+    exports.CONTEXT_VERSION_CLAIM,
+    identity_client_1.PRINCIPAL_ID_CLAIM,
+];
+exports.FOREIGN_CALLER_IDENTITY_CLAIMS = [
+    'azp',
+    'client_id',
+];
+var BoundarySubjectKind;
+(function (BoundarySubjectKind) {
+    BoundarySubjectKind["User"] = "user";
+    BoundarySubjectKind["Workload"] = "workload";
+    BoundarySubjectKind["Agent"] = "agent";
+})(BoundarySubjectKind || (exports.BoundarySubjectKind = BoundarySubjectKind = {}));
+function kernelSubjectKindForBoundary(kind) {
+    switch (kind) {
+        case BoundarySubjectKind.User:
+            return subject_1.SubjectKind.User;
+        case BoundarySubjectKind.Workload:
+            return subject_1.SubjectKind.Service;
+        case BoundarySubjectKind.Agent:
+            return subject_1.SubjectKind.Agent;
+    }
+}
+function parseBoundarySubjectKind(value) {
+    return typeof value === 'string' &&
+        Object.values(BoundarySubjectKind).includes(value)
+        ? value
+        : null;
+}
+class InvalidBoundaryContextError extends common_1.UnauthorizedException {
+    constructor(issuer, reason) {
+        super(`The access token from claim authority '${issuer}' is refused: ${reason} ` +
+            `A claim-authority context carries its classification explicitly; ` +
+            `nothing is inferred from its absence.`);
+    }
+}
+exports.InvalidBoundaryContextError = InvalidBoundaryContextError;
+class UnsupportedContextVersionError extends InvalidBoundaryContextError {
+    constructor(issuer, declared) {
+        super(issuer, declared === undefined
+            ? `it carries no "${exports.CONTEXT_VERSION_CLAIM}" claim.`
+            : `"${exports.CONTEXT_VERSION_CLAIM}" is ${JSON.stringify(declared)}; this ` +
+                `kernel reads version ${exports.SUPPORTED_CONTEXT_VERSION} only.`);
+    }
+}
+exports.UnsupportedContextVersionError = UnsupportedContextVersionError;
+function normalizeClaimAuthorityClaims(payload, issuer) {
+    const ctxVer = payload[exports.CONTEXT_VERSION_CLAIM];
+    if (ctxVer !== exports.SUPPORTED_CONTEXT_VERSION) {
+        throw new UnsupportedContextVersionError(issuer, ctxVer);
+    }
+    const declaredClass = (0, actor_classification_1.asNonEmptyString)(payload[exports.TOKEN_CLASS_CLAIM]);
+    if (!declaredClass) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${exports.TOKEN_CLASS_CLAIM}" claim.`);
+    }
+    if (!Object.values(subject_1.TokenClass).includes(declaredClass)) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" ${JSON.stringify(declaredClass)} is not a known TokenClass.`);
+    }
+    const tokenClass = declaredClass;
+    if (!(actor_classification_1.SUBJECT_KIND_CLAIM in payload)) {
+        throw new InvalidBoundaryContextError(issuer, `it carries no "${actor_classification_1.SUBJECT_KIND_CLAIM}" claim.`);
+    }
+    const boundaryKind = parseBoundarySubjectKind(payload[actor_classification_1.SUBJECT_KIND_CLAIM]);
+    if (!boundaryKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${actor_classification_1.SUBJECT_KIND_CLAIM}" ${JSON.stringify(payload[actor_classification_1.SUBJECT_KIND_CLAIM])} ` +
+            `is not one of ${Object.values(BoundarySubjectKind).join(' | ')}.`);
+    }
+    const subjectKind = kernelSubjectKindForBoundary(boundaryKind);
+    if ((0, actor_classification_1.subjectKindForTokenClass)(tokenClass) !== subjectKind) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.TOKEN_CLASS_CLAIM}" '${tokenClass}' and "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+            `'${boundaryKind}' name different kinds of subject.`);
+    }
+    const rawRoles = payload[boundary_context_brand_1.PLATFORM_ROLES_CLAIM];
+    if (rawRoles !== undefined &&
+        (!Array.isArray(rawRoles) || rawRoles.some((r) => typeof r !== 'string'))) {
+        throw new InvalidBoundaryContextError(issuer, `"${boundary_context_brand_1.PLATFORM_ROLES_CLAIM}" must be an array of strings.`);
+    }
+    const platformRoles = rawRoles ?? [];
+    assertSingleOrgScope(payload, issuer);
+    const hasAct = payload[exports.ACT_CLAIM] !== undefined;
+    const hasDid = payload[exports.DELEGATION_ID_CLAIM] !== undefined;
+    if (hasDid && !(0, actor_classification_1.asNonEmptyString)(payload[exports.DELEGATION_ID_CLAIM])) {
+        throw new InvalidBoundaryContextError(issuer, `"${exports.DELEGATION_ID_CLAIM}" must be a non-empty string.`);
+    }
+    if (hasAct !== hasDid) {
+        throw new InvalidBoundaryContextError(issuer, hasAct
+            ? `it carries "${exports.ACT_CLAIM}" with no "${exports.DELEGATION_ID_CLAIM}" — a ` +
+                `delegation with no validated record.`
+            : `it carries "${exports.DELEGATION_ID_CLAIM}" with no "${exports.ACT_CLAIM}".`);
+    }
+    const normalized = { ...payload };
+    delete normalized['realm_access'];
+    normalized[exports.TOKEN_CLASS_CLAIM] = tokenClass;
+    normalized[actor_classification_1.SUBJECT_KIND_CLAIM] = subjectKind;
+    normalized[boundary_context_brand_1.PLATFORM_ROLES_CLAIM] = [...platformRoles];
+    if (hasAct) {
+        normalized[exports.ACT_CLAIM] = normalizeActHops(payload[exports.ACT_CLAIM], issuer);
+    }
+    normalized[boundary_context_brand_1.BOUNDARY_CONTEXT_CLAIMS] = true;
+    return normalized;
+}
+function withoutPlatformAuthorityClaims(payload) {
+    const stripped = { ...payload };
+    for (const claim of [
+        ...exports.PLATFORM_AUTHORITY_CLAIMS,
+        ...exports.FOREIGN_CALLER_IDENTITY_CLAIMS,
+    ]) {
+        delete stripped[claim];
+    }
+    return stripped;
+}
+function resolveDelegationIdFromBoundaryClaims(claims) {
+    return (0, actor_classification_1.asNonEmptyString)(claims[exports.DELEGATION_ID_CLAIM]);
+}
+function assertSingleOrgScope(payload, issuer) {
+    const orgRoles = (0, org_role_1.resolveOrgRoles)(payload);
+    const orgIds = Object.keys(orgRoles);
+    if (orgIds.length === 0)
+        return;
+    const tenant = (0, org_claim_1.resolveOrgClaim)(payload)?.value;
+    if (!tenant) {
+        throw new InvalidBoundaryContextError(issuer, `it carries "${org_role_1.OrgRolesClaimKey.Canonical}" but no ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" — a context is minted for ONE org.`);
+    }
+    const foreign = orgIds.filter((orgId) => orgId.toLowerCase() !== tenant.toLowerCase());
+    if (foreign.length > 0) {
+        throw new InvalidBoundaryContextError(issuer, `"${org_role_1.OrgRolesClaimKey.Canonical}" names org(s) other than the ` +
+            `"${org_claim_1.OrgClaimKey.Canonical}" it was minted for — a context carries ` +
+            `the roles of ONE org, never every membership.`);
+    }
+}
+function normalizeActHops(act, issuer) {
+    if (!act || typeof act !== 'object' || Array.isArray(act)) {
+        return act;
+    }
+    const hop = { ...act };
+    if (actor_classification_1.SUBJECT_KIND_CLAIM in hop) {
+        const kind = parseBoundarySubjectKind(hop[actor_classification_1.SUBJECT_KIND_CLAIM]);
+        if (!kind) {
+            throw new InvalidBoundaryContextError(issuer, `a delegation hop states "${actor_classification_1.SUBJECT_KIND_CLAIM}" ` +
+                `${JSON.stringify(hop[actor_classification_1.SUBJECT_KIND_CLAIM])}, outside the boundary vocabulary.`);
+        }
+        hop[actor_classification_1.SUBJECT_KIND_CLAIM] = kernelSubjectKindForBoundary(kind);
+    }
+    if (hop[exports.ACT_CLAIM] !== undefined) {
+        hop[exports.ACT_CLAIM] = normalizeActHops(hop[exports.ACT_CLAIM], issuer);
+    }
+    return hop;
+}
+//# sourceMappingURL=claim-authority.js.map

package/dist/nestjs/auth/claim-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim-authority.js","sourceRoot":"","sources":["../../../src/nestjs/auth/claim-authority.ts"],"names":[],"mappings":";;;AAmHA,oEAWC;AA2DD,sEAwFC;AAQD,wEAWC;AAQD,sFAIC;AAhTD,2CAAuD;AACvD,6DAA6D;AAC7D,uDAAoE;AAEpE,wDAAwE;AACxE,sDAA4E;AAC5E,iEAIgC;AAChC,qEAGkC;AAyBrB,QAAA,qBAAqB,GAAG,SAAS,CAAC;AAGlC,QAAA,yBAAyB,GAAG,CAAC,CAAC;AAG9B,QAAA,mBAAmB,GAAG,KAAK,CAAC;AAG5B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAGlC,QAAA,SAAS,GAAG,KAAK,CAAC;AAalB,QAAA,yBAAyB,GAAsB;IAC1D,cAAc;IACd,6CAAoB;IACpB,2BAAgB,CAAC,SAAS;IAC1B,uBAAW,CAAC,SAAS;IACrB,yBAAiB;IACjB,yCAAkB;IAClB,iBAAS;IACT,2BAAmB;IACnB,6BAAqB;IACrB,oCAAkB;CACnB,CAAC;AAiBW,QAAA,8BAA8B,GAAsB;IAC/D,KAAK;IACL,WAAW;CACZ,CAAC;AAOF,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,oCAAa,CAAA;IACb,4CAAqB,CAAA;IACrB,sCAAe,CAAA;AACjB,CAAC,EAJW,mBAAmB,mCAAnB,mBAAmB,QAI9B;AASD,SAAgB,4BAA4B,CAC1C,IAAyB;IAEzB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,mBAAmB,CAAC,IAAI;YAC3B,OAAO,qBAAW,CAAC,IAAI,CAAC;QAC1B,KAAK,mBAAmB,CAAC,QAAQ;YAC/B,OAAO,qBAAW,CAAC,OAAO,CAAC;QAC7B,KAAK,mBAAmB,CAAC,KAAK;YAC5B,OAAO,qBAAW,CAAC,KAAK,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC7B,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChE,CAAC,CAAE,KAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAGD,MAAa,2BAA4B,SAAQ,8BAAqB;IACpE,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CACH,0CAA0C,MAAM,iBAAiB,MAAM,GAAG;YACxE,mEAAmE;YACnE,uCAAuC,CAC1C,CAAC;IACJ,CAAC;CACF;AARD,kEAQC;AAOD,MAAa,8BAA+B,SAAQ,2BAA2B;IAC7E,YAAY,MAAc,EAAE,QAAiB;QAC3C,KAAK,CACH,MAAM,EACN,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,kBAAkB,6BAAqB,UAAU;YACnD,CAAC,CAAC,IAAI,6BAAqB,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBAChE,wBAAwB,iCAAyB,QAAQ,CAChE,CAAC;IACJ,CAAC;CACF;AAVD,wEAUC;AAwBD,SAAgB,6BAA6B,CAE3C,OAAU,EAAE,MAAc;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,6BAAqB,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,iCAAyB,EAAE,CAAC;QACzC,MAAM,IAAI,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,uCAAgB,EAAC,OAAO,CAAC,yBAAiB,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yBAAiB,UAAU,CAC9C,CAAC;IACJ,CAAC;IACD,IAAI,CAAE,MAAM,CAAC,MAAM,CAAC,oBAAU,CAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,KAAK,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,6BAA6B,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,aAA2B,CAAC;IAE/C,IAAI,CAAC,CAAC,yCAAkB,IAAI,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,kBAAkB,yCAAkB,UAAU,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,wBAAwB,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yCAAkB,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yCAAkB,CAAC,CAAC,GAAG;YACvE,iBAAiB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IAC/D,IAAI,IAAA,+CAAwB,EAAC,UAAU,CAAC,KAAK,WAAW,EAAE,CAAC;QACzD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,yBAAiB,MAAM,UAAU,UAAU,yCAAkB,IAAI;YACnE,IAAI,YAAY,oCAAoC,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,6CAAoB,CAAC,CAAC;IAC/C,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EACzE,CAAC;QACD,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,6CAAoB,gCAAgC,CACzD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAI,QAAiC,IAAI,EAAE,CAAC;IAE/D,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,iBAAS,CAAC,KAAK,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,2BAAmB,CAAC,KAAK,SAAS,CAAC;IAC1D,IAAI,MAAM,IAAI,CAAC,IAAA,uCAAgB,EAAC,OAAO,CAAC,2BAAmB,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAmB,+BAA+B,CACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,MAAM;YACJ,CAAC,CAAC,eAAe,iBAAS,cAAc,2BAAmB,QAAQ;gBAC/D,sCAAsC;YAC1C,CAAC,CAAC,eAAe,2BAAmB,cAAc,iBAAS,IAAI,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAqC,EAAE,GAAG,OAAO,EAAE,CAAC;IACpE,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;IAClC,UAAU,CAAC,yBAAiB,CAAC,GAAG,UAAU,CAAC;IAC3C,UAAU,CAAC,yCAAkB,CAAC,GAAG,WAAW,CAAC;IAC7C,UAAU,CAAC,6CAAoB,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,UAAU,CAAC,gDAAuB,CAAC,GAAG,IAAI,CAAC;IAC3C,OAAO,UAAe,CAAC;AACzB,CAAC;AAQD,SAAgB,8BAA8B,CAE5C,OAAU;IACV,MAAM,QAAQ,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI;QAClB,GAAG,iCAAyB;QAC5B,GAAG,sCAA8B;KAClC,EAAE,CAAC;QACF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAa,CAAC;AACvB,CAAC;AAQD,SAAgB,qCAAqC,CACnD,MAA+B;IAE/B,OAAO,IAAA,uCAAgB,EAAC,MAAM,CAAC,2BAAmB,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAgC,EAChC,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,IAAA,2BAAe,EAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,eAAe,2BAAgB,CAAC,SAAS,WAAW;YAClD,IAAI,uBAAW,CAAC,SAAS,sCAAsC,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CACxD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,IAAI,2BAAgB,CAAC,SAAS,gCAAgC;YAC5D,IAAI,uBAAW,CAAC,SAAS,0CAA0C;YACnE,+CAA+C,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,MAAc;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAG1D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAI,GAA+B,EAAE,CAAC;IAC7E,IAAI,yCAAkB,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,2BAA2B,CACnC,MAAM,EACN,4BAA4B,yCAAkB,IAAI;gBAChD,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yCAAkB,CAAC,CAAC,oCAAoC,CACjF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,yCAAkB,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,CAAC,iBAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,iBAAS,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,iBAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/nestjs/auth/declared-subject-class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AA+BlE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAW3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsBD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAc5C"}
+{"version":3,"file":"declared-subject-class.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAOvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiClE,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM;CAY3B;AAWD,qBAAa,gCAAiC,SAAQ,qBAAqB;gBAC7D,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM7C;AAsCD,wBAAgB,8BAA8B,CAC5C,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,CAe5C"}

package/dist/nestjs/auth/declared-subject-class.js

@@ -4,15 +4,17 @@ exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerEr
 exports.claimsWithDeclaredSubjectClass = claimsWithDeclaredSubjectClass;
 const common_1 = require("@nestjs/common");
 const subject_1 = require("@xemahq/contracts/subject");
+const claim_authority_1 = require("./claim-authority");
 class UnclassifiableForeignBearerError extends common_1.UnauthorizedException {
     constructor(issuer) {
         super(`The access token was proved by trusted issuer '${issuer}', which ` +
-            `declares no "subjectClass", and the token carries no "token_class" ` +
-            `of its own. Nothing states what kind of subject this is, so it is ` +
+            `declares no "subjectClass". A token's own "token_class" is honoured ` +
+            `only from the claim authority, so nothing states what kind of ` +
+            `subject this is, and it is ` +
             `refused rather than assumed to be a user — the assumption that a ` +
             `signal-less token is a browser login holds for this deployment's own ` +
             `realm and for nothing else. Declare "subjectClass" on the issuer's ` +
-            `registry entry, or have the issuer stamp "token_class".`);
+            `registry entry, or "claimAuthority": true if it is the identity boundary.`);
     }
 }
 exports.UnclassifiableForeignBearerError = UnclassifiableForeignBearerError;
@@ -26,9 +28,10 @@ exports.UnknownDeclaredSubjectClassError = UnknownDeclaredSubjectClassError;
 function claimsWithDeclaredSubjectClass(payload, source) {
     if (source.kind !== 'trusted-issuer')
         return payload;
-    if (typeof payload.token_class === 'string' && payload.token_class) {
-        return payload;
+    if (source.entry.claimAuthority === true) {
+        return (0, claim_authority_1.normalizeClaimAuthorityClaims)(payload, source.entry.issuer);
     }
+    const foreign = (0, claim_authority_1.withoutPlatformAuthorityClaims)(payload);
     const declared = source.entry.subjectClass;
     if (!declared) {
         throw new UnclassifiableForeignBearerError(source.entry.issuer);
@@ -37,6 +40,6 @@ function claimsWithDeclaredSubjectClass(payload, source) {
     if (!parsed.success) {
         throw new UnknownDeclaredSubjectClassError(source.entry.issuer, declared);
     }
-    return { ...payload, token_class: parsed.data };
+    return { ...foreign, token_class: parsed.data };
 }
 //# sourceMappingURL=declared-subject-class.js.map

package/dist/nestjs/auth/declared-subject-class.js.map

@@ -1 +1 @@
-{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AAsFA,wEAgBC;AAtGD,2CAAuD;AACvD,uDAA6D;AAiC7D,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,qEAAqE;YACrE,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;CACF;AAZD,4EAYC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsBD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}
+{"version":3,"file":"declared-subject-class.js","sourceRoot":"","sources":["../../../src/nestjs/auth/declared-subject-class.ts"],"names":[],"mappings":";;;AA6GA,wEAiBC;AA9HD,2CAAuD;AACvD,uDAA6D;AAE7D,uDAG2B;AAkC3B,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc;QACxB,KAAK,CACH,kDAAkD,MAAM,WAAW;YACjE,sEAAsE;YACtE,gEAAgE;YAChE,6BAA6B;YAC7B,mEAAmE;YACnE,uEAAuE;YACvE,qEAAqE;YACrE,2EAA2E,CAC9E,CAAC;IACJ,CAAC;CACF;AAbD,4EAaC;AAWD,MAAa,gCAAiC,SAAQ,8BAAqB;IACzE,YAAY,MAAc,EAAE,QAAgB;QAC1C,KAAK,CACH,mBAAmB,MAAM,0BAA0B;YACjD,IAAI,QAAQ,qCAAqC,CACpD,CAAC;IACJ,CAAC;CACF;AAPD,4EAOC;AAsCD,SAAgB,8BAA8B,CAE5C,OAAU,EAAE,MAA2B;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,IAAA,+CAA6B,EAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,gDAA8B,EAAC,OAAO,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,0BAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gCAAgC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/dist/nestjs/auth/index.d.ts

@@ -20,5 +20,7 @@ export { resolveActorChainFromClaims, UnclassifiableActorHopError, UnknownActorH
 export { SUBJECT_KIND_CLAIM, readDeclaredSubjectKind, UnknownTokenClassError, } from './actor-classification';
 export { RealmTokenVerifier, type MultiRealmKeySource, type VerifiedTokenSource, } from './realm-token-verifier';
 export { UnclassifiableForeignBearerError, UnknownDeclaredSubjectClassError, claimsWithDeclaredSubjectClass, } from './declared-subject-class';
+export { BoundarySubjectKind, CONTEXT_VERSION_CLAIM, DELEGATION_ID_CLAIM, FOREIGN_CALLER_IDENTITY_CLAIMS, InvalidBoundaryContextError, PLATFORM_AUTHORITY_CLAIMS, SUPPORTED_CONTEXT_VERSION, UnsupportedContextVersionError, kernelSubjectKindForBoundary, } from './claim-authority';
+export { PLATFORM_ROLES_CLAIM } from './boundary-context-brand';
 export { DEFAULT_TRUSTED_ISSUER_ALGORITHMS, TRUSTED_ISSUERS_ENV_VAR, TrustedIssuerConfigError, TrustedIssuerRegistry, parseTrustedIssuersFromEnv, type TrustedIssuerEntry, } from '@xemahq/oidc-guard';
 //# sourceMappingURL=index.d.ts.map

package/dist/nestjs/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,mBAAmB,EACnB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,cAAc,GACf,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,+BAA+B,EAC/B,iBAAiB,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,gCAAgC,EAChC,gCAAgC,EAChC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,EAC9B,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC"}

package/dist/nestjs/auth/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resetOrgAuthorityCensus = exports.orgAuthorityRelayCensus = exports.orgAuthorityCensus = exports.recordServiceRelayedOrgAuthority = exports.recordUnprovenOrgAuthority = exports.UNKNOWN_CLIENT_ID = exports.ORG_AUTHORITY_OBSERVATION_LIMIT = exports.orgScopedClaim = exports.mintOrgScopedToken = exports.describeOrgScopeWitness = exports.orgScopeFromPlatformSweep = exports.orgScopeFromOwningRow = exports.orgScopeFromProvenRequest = exports.UnprovenOrgScopeError = exports.OrgScopeProvenance = exports.orgAuthorityRequiresProof = exports.isOrgAuthorityProven = exports.resolveOrgAuthority = exports.OrgAuthoritySource = exports.REQUIRE_PROVEN_ORG_AUTHORITY = exports.RequireProvenOrgAuthority = exports.resolveOrgClaim = exports.ORG_CLAIM_KEYS = exports.OrgHeaderName = exports.OrgClaimKey = exports.configureAuthMiddleware = exports.PlatformAdminGuard = exports.resolveOrgAuthorityInstrument = exports.holdsOrgAuthority = exports.hasPlatformRole = exports.PlatformRole = exports.orgRoleSatisfies = exports.resolveOrgRoleForOrg = exports.resolveOrgRoles = exports.ORG_ROLES_CLAIM_KEYS = exports.OrgRolesClaimKey = exports.OrgRole = exports.ServiceOrOrgRoleGuard = exports.REQUIRE_ORG_ROLE = exports.RequireOrgRole = exports.OrgRoleGuard = exports.REQUIRE_TOKEN_CLASS = exports.RequireTokenClass = exports.TokenClassGuard = exports.isDirectServiceActor = exports.ServiceActorGuard = exports.InternalCallerGuard = exports.ServiceTokenGuard = exports.AUTH_MODULE_OPTIONS = exports.AuthModule = void 0;
-exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
+exports.parseTrustedIssuersFromEnv = exports.TrustedIssuerRegistry = exports.TrustedIssuerConfigError = exports.TRUSTED_ISSUERS_ENV_VAR = exports.DEFAULT_TRUSTED_ISSUER_ALGORITHMS = exports.PLATFORM_ROLES_CLAIM = exports.kernelSubjectKindForBoundary = exports.UnsupportedContextVersionError = exports.SUPPORTED_CONTEXT_VERSION = exports.PLATFORM_AUTHORITY_CLAIMS = exports.InvalidBoundaryContextError = exports.FOREIGN_CALLER_IDENTITY_CLAIMS = exports.DELEGATION_ID_CLAIM = exports.CONTEXT_VERSION_CLAIM = exports.BoundarySubjectKind = exports.claimsWithDeclaredSubjectClass = exports.UnknownDeclaredSubjectClassError = exports.UnclassifiableForeignBearerError = exports.RealmTokenVerifier = exports.UnknownTokenClassError = exports.readDeclaredSubjectKind = exports.SUBJECT_KIND_CLAIM = exports.MalformedActorHopError = exports.ContradictoryActorHopKindError = exports.UnknownActorHopSubjectKindError = exports.UnclassifiableActorHopError = exports.resolveActorChainFromClaims = void 0;
 var auth_module_1 = require("./auth.module");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
 var auth_module_options_1 = require("./auth-module-options");
@@ -86,6 +86,18 @@ var declared_subject_class_1 = require("./declared-subject-class");
 Object.defineProperty(exports, "UnclassifiableForeignBearerError", { enumerable: true, get: function () { return declared_subject_class_1.UnclassifiableForeignBearerError; } });
 Object.defineProperty(exports, "UnknownDeclaredSubjectClassError", { enumerable: true, get: function () { return declared_subject_class_1.UnknownDeclaredSubjectClassError; } });
 Object.defineProperty(exports, "claimsWithDeclaredSubjectClass", { enumerable: true, get: function () { return declared_subject_class_1.claimsWithDeclaredSubjectClass; } });
+var claim_authority_1 = require("./claim-authority");
+Object.defineProperty(exports, "BoundarySubjectKind", { enumerable: true, get: function () { return claim_authority_1.BoundarySubjectKind; } });
+Object.defineProperty(exports, "CONTEXT_VERSION_CLAIM", { enumerable: true, get: function () { return claim_authority_1.CONTEXT_VERSION_CLAIM; } });
+Object.defineProperty(exports, "DELEGATION_ID_CLAIM", { enumerable: true, get: function () { return claim_authority_1.DELEGATION_ID_CLAIM; } });
+Object.defineProperty(exports, "FOREIGN_CALLER_IDENTITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.FOREIGN_CALLER_IDENTITY_CLAIMS; } });
+Object.defineProperty(exports, "InvalidBoundaryContextError", { enumerable: true, get: function () { return claim_authority_1.InvalidBoundaryContextError; } });
+Object.defineProperty(exports, "PLATFORM_AUTHORITY_CLAIMS", { enumerable: true, get: function () { return claim_authority_1.PLATFORM_AUTHORITY_CLAIMS; } });
+Object.defineProperty(exports, "SUPPORTED_CONTEXT_VERSION", { enumerable: true, get: function () { return claim_authority_1.SUPPORTED_CONTEXT_VERSION; } });
+Object.defineProperty(exports, "UnsupportedContextVersionError", { enumerable: true, get: function () { return claim_authority_1.UnsupportedContextVersionError; } });
+Object.defineProperty(exports, "kernelSubjectKindForBoundary", { enumerable: true, get: function () { return claim_authority_1.kernelSubjectKindForBoundary; } });
+var boundary_context_brand_1 = require("./boundary-context-brand");
+Object.defineProperty(exports, "PLATFORM_ROLES_CLAIM", { enumerable: true, get: function () { return boundary_context_brand_1.PLATFORM_ROLES_CLAIM; } });
 var oidc_guard_1 = require("@xemahq/oidc-guard");
 Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_ALGORITHMS", { enumerable: true, get: function () { return oidc_guard_1.DEFAULT_TRUSTED_ISSUER_ALGORITHMS; } });
 Object.defineProperty(exports, "TRUSTED_ISSUERS_ENV_VAR", { enumerable: true, get: function () { return oidc_guard_1.TRUSTED_ISSUERS_ENV_VAR; } });

package/dist/nestjs/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAQhC,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nestjs/auth/index.ts"],"names":[],"mappings":";;;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,6DAI+B;AAH7B,0HAAA,mBAAmB,OAAA;AAIrB,6DAA0D;AAAjD,wHAAA,iBAAiB,OAAA;AAC1B,iEAA8D;AAArD,4HAAA,mBAAmB,OAAA;AAC5B,6DAG+B;AAF7B,wHAAA,iBAAiB,OAAA;AACjB,2HAAA,oBAAoB,OAAA;AAEtB,yDAI6B;AAH3B,oHAAA,eAAe,OAAA;AACf,sHAAA,iBAAiB,OAAA;AACjB,wHAAA,mBAAmB,OAAA;AAErB,mDAI0B;AAHxB,8GAAA,YAAY,OAAA;AACZ,gHAAA,cAAc,OAAA;AACd,kHAAA,gBAAgB,OAAA;AAElB,yEAAoE;AAA3D,kIAAA,qBAAqB,OAAA;AAC9B,oDAOiC;AAN/B,mGAAA,OAAO,OAAA;AACP,4GAAA,gBAAgB,OAAA;AAChB,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AACf,gHAAA,oBAAoB,OAAA;AACpB,4GAAA,gBAAgB,OAAA;AAElB,iDAAgE;AAAvD,6GAAA,YAAY,OAAA;AAAE,gHAAA,eAAe,OAAA;AACtC,6DAI+B;AAH7B,wHAAA,iBAAiB,OAAA;AACjB,oIAAA,6BAA6B,OAAA;AAG/B,+DAA4D;AAAnD,0HAAA,kBAAkB,OAAA;AAC3B,yEAGqC;AAFnC,oIAAA,uBAAuB,OAAA;AAGzB,sDAKkC;AAJhC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AACb,2GAAA,cAAc,OAAA;AACd,4GAAA,eAAe,OAAA;AAEjB,iFAA0G;AAAjG,0IAAA,yBAAyB,OAAA;AAAE,6IAAA,4BAA4B,OAAA;AAChE,8DAQsC;AAPpC,mHAAA,kBAAkB,OAAA;AAIlB,oHAAA,mBAAmB,OAAA;AACnB,qHAAA,oBAAoB,OAAA;AACpB,0HAAA,yBAAyB,OAAA;AAE3B,gEAYuC;AAXrC,oHAAA,kBAAkB,OAAA;AAGlB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,yHAAA,uBAAuB,OAAA;AACvB,oHAAA,kBAAkB,OAAA;AAElB,gHAAA,cAAc,OAAA;AAEhB,wFAUmD;AATjD,6IAAA,+BAA+B,OAAA;AAC/B,+HAAA,iBAAiB,OAAA;AAGjB,wIAAA,0BAA0B,OAAA;AAC1B,8IAAA,gCAAgC,OAAA;AAChC,gIAAA,kBAAkB,OAAA;AAClB,qIAAA,uBAAuB,OAAA;AACvB,qIAAA,uBAAuB,OAAA;AAEzB,uDAM4B;AAL1B,+HAAA,2BAA2B,OAAA;AAC3B,+HAAA,2BAA2B,OAAA;AAC3B,mIAAA,+BAA+B,OAAA;AAC/B,kIAAA,8BAA8B,OAAA;AAC9B,0HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAClB,+HAAA,uBAAuB,OAAA;AACvB,8HAAA,sBAAsB,OAAA;AAExB,+DAIgC;AAH9B,0HAAA,kBAAkB,OAAA;AAIpB,mEAIkC;AAHhC,0IAAA,gCAAgC,OAAA;AAChC,0IAAA,gCAAgC,OAAA;AAChC,wIAAA,8BAA8B,OAAA;AAEhC,qDAU2B;AATzB,sHAAA,mBAAmB,OAAA;AACnB,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iIAAA,8BAA8B,OAAA;AAC9B,8HAAA,2BAA2B,OAAA;AAC3B,4HAAA,yBAAyB,OAAA;AACzB,4HAAA,yBAAyB,OAAA;AACzB,iIAAA,8BAA8B,OAAA;AAC9B,+HAAA,4BAA4B,OAAA;AAE9B,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAO7B,iDAO4B;AAN1B,+HAAA,iCAAiC,OAAA;AACjC,qHAAA,uBAAuB,OAAA;AACvB,sHAAA,wBAAwB,OAAA;AACxB,mHAAA,qBAAqB,OAAA;AACrB,wHAAA,0BAA0B,OAAA"}

package/dist/nestjs/auth/org-authority-fence.d.ts

@@ -0,0 +1,16 @@
+import type { SubjectKind, TokenClass } from '@xemahq/contracts/subject';
+import { OrgHeaderName } from '../../lib/auth/org-claim';
+import { type OrgAuthorityVerdict } from '../../lib/auth/org-authority';
+export interface OrgAuthorityLogger {
+    log(message: unknown): void;
+    warn(message: unknown): void;
+}
+export declare function assertOrgHeaderPresentForCaller(orgId: string | undefined, actorType: 'human' | 'agent' | 'service'): void;
+export declare function assertOrgClaimMatchesHeader(logger: OrgAuthorityLogger, claims: Record<string, unknown>, headerValue: string, headerName: OrgHeaderName): void;
+export declare function fenceOrgAuthority(logger: OrgAuthorityLogger, claims: Record<string, unknown>, resolvedOrgId: string, facts: {
+    tokenClass: TokenClass;
+    subjectKind: SubjectKind;
+    clientId: string | undefined;
+    delegated: boolean;
+}, route: string, correlationId: string): OrgAuthorityVerdict;
+//# sourceMappingURL=org-authority-fence.d.ts.map

package/dist/nestjs/auth/org-authority-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-fence.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-fence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEzE,OAAO,EAAe,aAAa,EAAmB,MAAM,0BAA0B,CAAC;AACvF,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,8BAA8B,CAAC;AAqBtC,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9B;AAMD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,GACvC,IAAI,CAMN;AAiBD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,aAAa,GACxB,IAAI,CAkBN;AAgCD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE;IACL,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,OAAO,CAAC;CACpB,EACD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,mBAAmB,CAiDrB"}

package/dist/nestjs/auth/org-authority-fence.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertOrgHeaderPresentForCaller = assertOrgHeaderPresentForCaller;
+exports.assertOrgClaimMatchesHeader = assertOrgClaimMatchesHeader;
+exports.fenceOrgAuthority = fenceOrgAuthority;
+const common_1 = require("@nestjs/common");
+const org_claim_1 = require("../../lib/auth/org-claim");
+const org_authority_1 = require("../../lib/auth/org-authority");
+const org_authority_observations_1 = require("../../lib/auth/org-authority-observations");
+function assertOrgHeaderPresentForCaller(orgId, actorType) {
+    if (!orgId && actorType !== 'service') {
+        throw new common_1.BadRequestException(`Missing required header: ${org_claim_1.OrgHeaderName.Canonical}`);
+    }
+}
+function assertOrgClaimMatchesHeader(logger, claims, headerValue, headerName) {
+    const resolved = (0, org_claim_1.resolveOrgClaim)(claims);
+    if (!resolved) {
+        return;
+    }
+    if (resolved.value.toLowerCase() !== headerValue.toLowerCase()) {
+        logger.warn({
+            message: 'tenant-claim-mismatch',
+            claim: resolved.key,
+            claimValue: resolved.value,
+            header: headerName,
+            headerValue,
+        });
+        throw new common_1.ForbiddenException(`${headerName} (${headerValue || '<empty>'}) does not match ` +
+            `the ${resolved.key} claim on the access token.`);
+    }
+}
+function fenceOrgAuthority(logger, claims, resolvedOrgId, facts, route, correlationId) {
+    const verdict = (0, org_authority_1.resolveOrgAuthority)(claims, resolvedOrgId, {
+        subjectKind: facts.subjectKind,
+        delegated: facts.delegated,
+    });
+    const callerFacts = {
+        clientId: facts.clientId ?? org_authority_observations_1.UNKNOWN_CLIENT_ID,
+        tokenClass: facts.tokenClass,
+        subjectKind: facts.subjectKind,
+        delegated: facts.delegated,
+    };
+    if (verdict.source === org_authority_1.OrgAuthoritySource.ServiceRelayedContext) {
+        if ((0, org_authority_observations_1.recordServiceRelayedOrgAuthority)(callerFacts)) {
+            logger.log({
+                message: 'ORG_AUTHORITY_SERVICE_RELAY',
+                source: verdict.source,
+                orgId: verdict.assertedOrgId,
+                ...callerFacts,
+                route,
+                correlationId,
+            });
+        }
+        return verdict;
+    }
+    if (!(0, org_authority_1.orgAuthorityRequiresProof)(verdict)) {
+        return verdict;
+    }
+    if ((0, org_authority_observations_1.recordUnprovenOrgAuthority)(callerFacts)) {
+        logger.warn({
+            message: 'ORG_AUTHORITY_UNPROVEN',
+            source: verdict.source,
+            orgId: verdict.assertedOrgId,
+            ...callerFacts,
+            route,
+            correlationId,
+        });
+    }
+    throw new common_1.ForbiddenException({
+        code: 'ORG_AUTHORITY_UNPROVEN',
+        message: `The caller asserted ${org_claim_1.OrgHeaderName.Canonical}=` +
+            `"${verdict.assertedOrgId}" but the access token carries neither an ` +
+            `${org_claim_1.OrgClaimKey.Canonical} claim for that org nor an org_roles ` +
+            `membership in it. A tenant cannot be named by header alone.`,
+    });
+}
+//# sourceMappingURL=org-authority-fence.js.map

package/dist/nestjs/auth/org-authority-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-authority-fence.js","sourceRoot":"","sources":["../../../src/nestjs/auth/org-authority-fence.ts"],"names":[],"mappings":";;AAuCA,0EASC;AAiBD,kEAuBC;AAgCD,8CA6DC;AArLD,2CAAyE;AAGzE,wDAAuF;AACvF,gEAKsC;AACtC,0FAImD;AAyBnD,SAAgB,+BAA+B,CAC7C,KAAyB,EACzB,SAAwC;IAExC,IAAI,CAAC,KAAK,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,4BAAmB,CAC3B,4BAA4B,yBAAa,CAAC,SAAS,EAAE,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAiBD,SAAgB,2BAA2B,CACzC,MAA0B,EAC1B,MAA+B,EAC/B,WAAmB,EACnB,UAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,uBAAuB;YAChC,KAAK,EAAE,QAAQ,CAAC,GAAG;YACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;YAC1B,MAAM,EAAE,UAAU;YAClB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,IAAI,SAAS,mBAAmB;YAC3D,OAAO,QAAQ,CAAC,GAAG,6BAA6B,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAgCD,SAAgB,iBAAiB,CAC/B,MAA0B,EAC1B,MAA+B,EAC/B,aAAqB,EACrB,KAKC,EACD,KAAa,EACb,aAAqB;IAErB,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,8CAAiB;QAC7C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,kCAAkB,CAAC,qBAAqB,EAAE,CAAC;QAChE,IAAI,IAAA,6DAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC;gBACT,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,aAAa;gBAC5B,GAAG,WAAW;gBACd,KAAK;gBACL,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,IAAA,yCAAyB,EAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,IAAA,uDAA0B,EAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC;YACV,OAAO,EAAE,wBAAwB;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,aAAa;YAC5B,GAAG,WAAW;YACd,KAAK;YACL,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,OAAO,EACL,uBAAuB,yBAAa,CAAC,SAAS,GAAG;YACjD,IAAI,OAAO,CAAC,aAAa,4CAA4C;YACrE,GAAG,uBAAW,CAAC,SAAS,uCAAuC;YAC/D,6DAA6D;KAChE,CAAC,CAAC;AACL,CAAC"}

package/dist/nestjs/auth/service-token.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAO/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyH9D,OAAO,CAAC,wBAAwB;IAiIhC,OAAO,CAAC,uBAAuB;YAmCjB,WAAW;IAgBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA4BpC"}
+{"version":3,"file":"service-token.guard.d.ts","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":"AAyEA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKhB,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AAYxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAQ/D,qBACa,iBAAkB,YAAW,WAAW,EAAE,sBAAsB;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAoB3B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA8H9D,OAAO,CAAC,wBAAwB;IAiIhC,OAAO,CAAC,uBAAuB;YAmCjB,WAAW;IAiBzB,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,2BAA2B;CA4BpC"}

package/dist/nestjs/auth/service-token.guard.js

@@ -21,6 +21,7 @@ const org_authority_1 = require("../../lib/auth/org-authority");
 const org_claim_1 = require("../../lib/auth/org-claim");
 const auth_module_options_1 = require("./auth-module-options");
 const proven_org_authority_required_1 = require("./proven-org-authority-required");
+const declared_subject_class_1 = require("./declared-subject-class");
 const realm_token_verifier_1 = require("./realm-token-verifier");
 const decorator_metadata_1 = require("../decorator-metadata");
 let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
@@ -145,7 +146,8 @@ let ServiceTokenGuard = ServiceTokenGuard_1 = class ServiceTokenGuard {
     }
     async verifyToken(token) {
         try {
-            return await this.verifier.verify(token);
+            const { payload, source } = await this.verifier.verifyWithSource(token);
+            return (0, declared_subject_class_1.claimsWithDeclaredSubjectClass)(payload, source);
         }
         catch (error) {
             if (error instanceof oidc_guard_1.JwksVerificationError) {

package/dist/nestjs/auth/service-token.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAoE;AACpE,mDAA2D;AAG3D,gEAIsC;AACtC,wDAA0E;AAC1E,+DAA4D;AAE5D,mFAA+E;AAC/E,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;gBAC3D,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YAad,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAGA,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAiDO,wBAAwB,CAC9B,MAAkB,EAClB,OAA8C;QAE9C,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QAEvE,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;YACzD,WAAW,EAAE,qBAAW,CAAC,OAAO;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;SACjE,CAAC,CAAC;QAEH,IAAI,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,kCAAkB,CAAC,aAAa;gBACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,aAAa;gBAKnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,qCAAqC;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,OAAO,CAAC,aAAa;iBACnC,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,GAAG,UAAU,wDAAwD;iBAC/E,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,qBAAqB,CAAC;YAC9C,KAAK,kCAAkB,CAAC,QAAQ;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,6CAA6C;oBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,QAAQ,CAAC;YACjC,KAAK,kCAAkB,CAAC,aAAa;gBAInC,OAAO;QACX,CAAC;QAKD,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IA8DO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,oDAAoD;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAlYY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAkY7B"}
+{"version":3,"file":"service-token.guard.js","sourceRoot":"","sources":["../../../src/nestjs/auth/service-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAyEA,2CAUwB;AACxB,uDAAoE;AACpE,mDAA2D;AAG3D,gEAIsC;AACtC,wDAA0E;AAC1E,+DAA4D;AAE5D,mFAA+E;AAC/E,qEAA0E;AAC1E,iEAA4D;AAC5D,8DAA8D;AAKvD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAiBD,KAAK,CAAC,sBAAsB;QAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAmC,CAAC;QAEvE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YAMH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAc9C,MAAM,yBAAyB,GAC7B,IAAA,0CAAqB,EAAU,4DAA4B,EAAE;gBAC3D,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,KAAK,IAAI,CAAC;YAad,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,2BAA2B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAGA,OAAmC,CAAC,WAAW,GAAG,OAAO,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAKf,IACE,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,2BAAkB,EACnC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,mCAAmC;gBAC5C,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;YACH,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAiDO,wBAAwB,CAC9B,MAAkB,EAClB,OAA8C;QAE9C,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC;QAEvE,MAAM,OAAO,GAAG,IAAA,mCAAmB,EAAC,MAAM,EAAE,aAAa,EAAE;YACzD,WAAW,EAAE,qBAAW,CAAC,OAAO;YAChC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI;SACjE,CAAC,CAAC;QAEH,IAAI,IAAA,oCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,kCAAkB,CAAC,aAAa;gBACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,8BAA8B,UAAU,iBAAiB;iBACnE,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,aAAa;gBAKnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,qCAAqC;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,UAAU;oBAClB,WAAW,EAAE,OAAO,CAAC,aAAa;iBACnC,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,GAAG,UAAU,wDAAwD;iBAC/E,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,qBAAqB,CAAC;YAC9C,KAAK,kCAAkB,CAAC,QAAQ;gBAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EAAE,6CAA6C;oBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EACL,gEAAgE;wBAChE,qBAAqB;iBACxB,CAAC,CAAC;YACL,KAAK,kCAAkB,CAAC,QAAQ,CAAC;YACjC,KAAK,kCAAkB,CAAC,aAAa;gBAInC,OAAO;QACX,CAAC;QAKD,MAAM,IAAI,2BAAkB,CAAC;YAC3B,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IA8DO,uBAAuB,CAAC,OAAmB;QACjD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,gEAAgE;oBAChE,oEAAoE;oBACpE,iEAAiE;oBACjE,oDAAoD;aACvD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,UAAU,KAAK,oBAAU,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,8BAA8B;gBACvC,UAAU;aACX,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,2DAA2D;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAQO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxE,OAAO,IAAA,uDAA8B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOO,WAAW,CACjB,OAA8C,EAC9C,IAAY;QAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAU,EAAE,EAAE,CAC1E,GAAG,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IASO,2BAA2B,CACjC,MAAkB,EAClB,OAA8C;QAE9C,MAAM,QAAQ,GAAG,IAAA,2BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,qCAAqC;gBAC9C,KAAK,EAAE,QAAQ,CAAC,GAAG;gBACnB,UAAU,EAAE,QAAQ,CAAC,KAAK;gBAC1B,MAAM,EAAE,UAAU;gBAClB,WAAW;aACZ,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAC1B,GAAG,UAAU,KAAK,WAAW,wBAAwB,QAAQ,CAAC,GAAG,8BAA8B,CAChG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AAxYY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GANnB,iBAAiB,CAwY7B"}

package/dist/nestjs/cors.config.d.ts

@@ -1,4 +1,5 @@
 import type { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';
 export declare function isOriginAllowed(origin: string, allowedOrigins?: string): boolean;
 export declare function getCorsConfig(allowedOrigins?: string): CorsOptions;
+export declare function getExactCorsConfig(origins: readonly string[]): CorsOptions;
 //# sourceMappingURL=cors.config.d.ts.map

package/dist/nestjs/cors.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.config.d.ts","sourceRoot":"","sources":["../../src/nestjs/cors.config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2DAA2D,CAAC;AA2B7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAShF;AASD,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,WAAW,CA4FlE"}
+{"version":3,"file":"cors.config.d.ts","sourceRoot":"","sources":["../../src/nestjs/cors.config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2DAA2D,CAAC;AAoG7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAShF;AASD,wBAAgB,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,WAAW,CAqDlE;AAqBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAwC1E"}

package/dist/nestjs/cors.config.js

@@ -2,9 +2,41 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isOriginAllowed = isOriginAllowed;
 exports.getCorsConfig = getCorsConfig;
+exports.getExactCorsConfig = getExactCorsConfig;
 const common_1 = require("@nestjs/common");
 const execution_environment_1 = require("@xemahq/contracts/execution-environment");
 const logger = new common_1.Logger('CORS');
+const OPAQUE_ORIGIN = 'null';
+const REFUSE_WITH_VARY = [];
+const CORS_POLICY = {
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+    allowedHeaders: [
+        'Content-Type',
+        'Authorization',
+        'X-Requested-With',
+        'Accept',
+        'Origin',
+        'X-Xema-Org-Id',
+        'X-Org-Id',
+        'X-Project-Id',
+        'X-Correlation-Id',
+        'X-Request-Id',
+        'X-Last-Seen-Sequence',
+        'Last-Event-ID',
+        'Idempotency-Key',
+        'If-Match',
+        'x-api-key',
+        'x-internal-token',
+        execution_environment_1.EXECUTION_ENVIRONMENT_HEADER,
+    ],
+    exposedHeaders: [
+        'X-RateLimit-Limit',
+        'X-RateLimit-Remaining',
+        'X-RateLimit-Reset',
+        'ETag',
+    ],
+};
 function originMatchesPattern(origin, pattern) {
     const trimmedPattern = pattern.trim();
     if (trimmedPattern.includes('*')) {
@@ -19,7 +51,7 @@ function originMatchesPattern(origin, pattern) {
         origin === trimmedPattern);
 }
 function isOriginAllowed(origin, allowedOrigins) {
-    if (!allowedOrigins) {
+    if (!allowedOrigins || origin === OPAQUE_ORIGIN) {
         return false;
     }
     return allowedOrigins
@@ -56,34 +88,47 @@ function getCorsConfig(allowedOrigins) {
             }
             else {
                 logger.warn(`CORS blocked origin: ${origin}`);
-                callback(null, false);
+                callback(null, REFUSE_WITH_VARY);
+            }
+        },
+        ...CORS_POLICY,
+    };
+}
+function getExactCorsConfig(origins) {
+    if (origins.length === 0) {
+        throw new Error('getExactCorsConfig needs at least one origin.');
+    }
+    const allowed = new Map();
+    for (const entry of origins) {
+        let canonical;
+        try {
+            canonical = new URL(entry).origin;
+        }
+        catch {
+            throw new Error(`CORS origin "${entry}" is not a URL origin.`);
+        }
+        if (canonical !== entry || canonical === OPAQUE_ORIGIN || entry.includes('*')) {
+            throw new Error(`CORS origin "${entry}" must be a canonical origin ("scheme://host[:port]", ` +
+                'lower-case, no default port, no path, query or trailing slash).');
+        }
+        if (allowed.has(entry)) {
+            throw new Error(`CORS origin "${entry}" is listed twice.`);
+        }
+        allowed.set(entry, entry);
+    }
+    return {
+        origin: (origin, callback) => {
+            const entry = origin === undefined ? undefined : allowed.get(origin);
+            if (entry !== undefined) {
+                callback(null, entry);
+                return;
+            }
+            if (origin !== undefined) {
+                logger.warn(`CORS blocked origin: ${origin}`);
             }
+            callback(null, REFUSE_WITH_VARY);
         },
-        credentials: true,
-        methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
-        allowedHeaders: [
-            'Content-Type',
-            'Authorization',
-            'X-Requested-With',
-            'Accept',
-            'Origin',
-            'X-Xema-Org-Id',
-            'X-Org-Id',
-            'X-Project-Id',
-            'X-Correlation-Id',
-            'X-Request-Id',
-            'X-Last-Seen-Sequence',
-            'Last-Event-ID',
-            'Idempotency-Key',
-            'x-api-key',
-            'x-internal-token',
-            execution_environment_1.EXECUTION_ENVIRONMENT_HEADER,
-        ],
-        exposedHeaders: [
-            'X-RateLimit-Limit',
-            'X-RateLimit-Remaining',
-            'X-RateLimit-Reset',
-        ],
+        ...CORS_POLICY,
     };
 }
 //# sourceMappingURL=cors.config.js.map