@xemahq/platform-common 0.40.0 → 0.41.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/lib/request-context.d.ts +1 -0
- package/dist/lib/request-context.d.ts.map +1 -1
- package/dist/lib/request-context.js.map +1 -1
- package/dist/lib/untrusted-content/fence.d.ts +29 -0
- package/dist/lib/untrusted-content/fence.d.ts.map +1 -0
- package/dist/lib/untrusted-content/fence.js +98 -0
- package/dist/lib/untrusted-content/fence.js.map +1 -0
- package/dist/lib/untrusted-content/index.d.ts +4 -0
- package/dist/lib/untrusted-content/index.d.ts.map +1 -0
- package/dist/lib/untrusted-content/index.js +20 -0
- package/dist/lib/untrusted-content/index.js.map +1 -0
- package/dist/lib/untrusted-content/notice.d.ts +3 -0
- package/dist/lib/untrusted-content/notice.d.ts.map +1 -0
- package/dist/lib/untrusted-content/notice.js +11 -0
- package/dist/lib/untrusted-content/notice.js.map +1 -0
- package/dist/lib/untrusted-content/origin.d.ts +9 -0
- package/dist/lib/untrusted-content/origin.d.ts.map +1 -0
- package/dist/lib/untrusted-content/origin.js +13 -0
- package/dist/lib/untrusted-content/origin.js.map +1 -0
- package/dist/nestjs/auth/actor-classification.d.ts +1 -0
- package/dist/nestjs/auth/actor-classification.d.ts.map +1 -1
- package/dist/nestjs/auth/actor-classification.js +22 -0
- package/dist/nestjs/auth/actor-classification.js.map +1 -1
- package/dist/nestjs/auth/boundary-context-brand.d.ts +5 -0
- package/dist/nestjs/auth/boundary-context-brand.d.ts.map +1 -0
- package/dist/nestjs/auth/boundary-context-brand.js +17 -0
- package/dist/nestjs/auth/boundary-context-brand.js.map +1 -0
- package/dist/nestjs/auth/claim-authority.d.ts +25 -0
- package/dist/nestjs/auth/claim-authority.d.ts.map +1 -0
- package/dist/nestjs/auth/claim-authority.js +178 -0
- package/dist/nestjs/auth/claim-authority.js.map +1 -0
- package/dist/nestjs/auth/declared-subject-class.d.ts.map +1 -1
- package/dist/nestjs/auth/declared-subject-class.js +9 -6
- package/dist/nestjs/auth/declared-subject-class.js.map +1 -1
- package/dist/nestjs/auth/index.d.ts +2 -0
- package/dist/nestjs/auth/index.d.ts.map +1 -1
- package/dist/nestjs/auth/index.js +13 -1
- package/dist/nestjs/auth/index.js.map +1 -1
- package/dist/nestjs/auth/org-authority-fence.d.ts +16 -0
- package/dist/nestjs/auth/org-authority-fence.d.ts.map +1 -0
- package/dist/nestjs/auth/org-authority-fence.js +77 -0
- package/dist/nestjs/auth/org-authority-fence.js.map +1 -0
- package/dist/nestjs/auth/service-token.guard.d.ts.map +1 -1
- package/dist/nestjs/auth/service-token.guard.js +3 -1
- package/dist/nestjs/auth/service-token.guard.js.map +1 -1
- package/dist/nestjs/index.d.ts +1 -1
- package/dist/nestjs/index.d.ts.map +1 -1
- package/dist/nestjs/index.js +12 -2
- package/dist/nestjs/index.js.map +1 -1
- package/dist/nestjs/jwt-verification.guard.d.ts +1 -1
- package/dist/nestjs/jwt-verification.guard.d.ts.map +1 -1
- package/dist/nestjs/jwt-verification.guard.js +48 -8
- package/dist/nestjs/jwt-verification.guard.js.map +1 -1
- package/dist/nestjs/request-context.middleware.d.ts +0 -2
- package/dist/nestjs/request-context.middleware.d.ts.map +1 -1
- package/dist/nestjs/request-context.middleware.js +4 -69
- package/dist/nestjs/request-context.middleware.js.map +1 -1
- package/package.json +3 -3
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAMjB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AA2BpE,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAuCjF,qBACa,oBAAqB,YAAW,WAAW;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAUhE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAK5C,WAAW,CAAC,EAAE,iBAAiB;IAK3B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAyDhD,WAAW;IA4BzB,OAAO,CAAC,oBAAoB;IAoD5B,OAAO,CAAC,mBAAmB;IA2D3B,OAAO,CAAC,YAAY;CAYrB"}
|
|
@@ -21,6 +21,12 @@ const auth_module_options_1 = require("./auth/auth-module-options");
|
|
|
21
21
|
const request_context_1 = require("../lib/request-context");
|
|
22
22
|
const oidc_guard_1 = require("@xemahq/oidc-guard");
|
|
23
23
|
const actor_classification_1 = require("./auth/actor-classification");
|
|
24
|
+
const boundary_context_brand_1 = require("./auth/boundary-context-brand");
|
|
25
|
+
const claim_authority_1 = require("./auth/claim-authority");
|
|
26
|
+
const delegation_chain_1 = require("./auth/delegation-chain");
|
|
27
|
+
const org_authority_fence_1 = require("./auth/org-authority-fence");
|
|
28
|
+
const org_claim_1 = require("../lib/auth/org-claim");
|
|
29
|
+
const org_role_1 = require("../lib/auth/org-role");
|
|
24
30
|
const realm_token_verifier_1 = require("./auth/realm-token-verifier");
|
|
25
31
|
const declared_subject_class_1 = require("./auth/declared-subject-class");
|
|
26
32
|
var declared_subject_class_2 = require("./auth/declared-subject-class");
|
|
@@ -52,11 +58,11 @@ let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
|
52
58
|
try {
|
|
53
59
|
const { payload, source } = await this.verifyToken(token);
|
|
54
60
|
this.attachRealmToContext(request, payload, source);
|
|
55
|
-
this.
|
|
61
|
+
this.applyVerifiedClaims(request, payload, source);
|
|
56
62
|
return true;
|
|
57
63
|
}
|
|
58
64
|
catch (error) {
|
|
59
|
-
if (error instanceof common_1.
|
|
65
|
+
if (error instanceof common_1.HttpException)
|
|
60
66
|
throw error;
|
|
61
67
|
const msg = error instanceof Error ? error.message : String(error);
|
|
62
68
|
this.logger.error({ message: 'JWT verification failed', error: msg });
|
|
@@ -88,17 +94,43 @@ let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
|
|
|
88
94
|
ctx.realmId = tenant;
|
|
89
95
|
}
|
|
90
96
|
}
|
|
91
|
-
|
|
97
|
+
applyVerifiedClaims(request, payload, source) {
|
|
92
98
|
const claims = (0, declared_subject_class_1.claimsWithDeclaredSubjectClass)(payload, source);
|
|
93
|
-
if (
|
|
99
|
+
if (source.kind === 'realm')
|
|
94
100
|
return;
|
|
95
101
|
const ctx = request[request_context_1.REQUEST_CONTEXT];
|
|
96
102
|
if (!ctx)
|
|
97
103
|
return;
|
|
98
|
-
const
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
104
|
+
const { roles, actAs, subjectKind, tokenClass, actorType } = (0, actor_classification_1.deriveActorClassification)(claims);
|
|
105
|
+
const actorChain = (0, delegation_chain_1.resolveActorChainFromClaims)(claims);
|
|
106
|
+
const clientId = (0, actor_classification_1.resolveClientIdFromClaims)(claims);
|
|
107
|
+
const principalId = (0, actor_classification_1.resolvePrincipalIdFromClaims)(claims);
|
|
108
|
+
const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
|
|
109
|
+
const delegationId = (0, boundary_context_brand_1.isBoundaryContextClaims)(claims)
|
|
110
|
+
? (0, claim_authority_1.resolveDelegationIdFromBoundaryClaims)(claims)
|
|
111
|
+
: undefined;
|
|
112
|
+
const orgId = ctx.orgId ?? '';
|
|
113
|
+
(0, org_authority_fence_1.assertOrgHeaderPresentForCaller)(orgId, actorType);
|
|
114
|
+
(0, org_authority_fence_1.assertOrgClaimMatchesHeader)(this.logger, claims, orgId, org_claim_1.OrgHeaderName.Canonical);
|
|
115
|
+
const orgAuthority = (0, org_authority_fence_1.fenceOrgAuthority)(this.logger, claims, orgId, { tokenClass, subjectKind, clientId, delegated: actorChain.length > 0 }, `${request.method ?? ''} ${request.originalUrl ?? request.url ?? ''}`, ctx.correlationId);
|
|
116
|
+
const { actingFor: _staleActingFor, ...subjectRest } = ctx.subject;
|
|
117
|
+
ctx.subject = {
|
|
118
|
+
...subjectRest,
|
|
119
|
+
kind: subjectKind,
|
|
120
|
+
roles,
|
|
121
|
+
...(actorChain.length > 0 ? { actingFor: actorChain[0] } : {}),
|
|
122
|
+
};
|
|
123
|
+
ctx.tokenClass = tokenClass;
|
|
124
|
+
ctx.actorType = actorType;
|
|
125
|
+
ctx.actorChain = actorChain;
|
|
126
|
+
ctx.roles = roles;
|
|
127
|
+
ctx.orgAuthority = orgAuthority;
|
|
128
|
+
assignOptional(ctx, 'actAs', actAs);
|
|
129
|
+
assignOptional(ctx, 'clientId', clientId);
|
|
130
|
+
assignOptional(ctx, 'principalId', principalId);
|
|
131
|
+
assignOptional(ctx, 'delegationId', delegationId);
|
|
132
|
+
assignOptional(ctx, 'orgRoles', Object.keys(orgRoles).length > 0 ? orgRoles : undefined);
|
|
133
|
+
assignOptional(ctx, 'orgRole', orgRoles[orgId]);
|
|
102
134
|
}
|
|
103
135
|
isPublicPath(path) {
|
|
104
136
|
for (const prefix of PUBLIC_PATH_PREFIXES) {
|
|
@@ -119,4 +151,12 @@ exports.JwtVerificationGuard = JwtVerificationGuard = JwtVerificationGuard_1 = _
|
|
|
119
151
|
__param(0, (0, common_1.Inject)(auth_module_options_1.AUTH_MODULE_OPTIONS)),
|
|
120
152
|
__metadata("design:paramtypes", [Object])
|
|
121
153
|
], JwtVerificationGuard);
|
|
154
|
+
function assignOptional(ctx, key, value) {
|
|
155
|
+
if (value === undefined) {
|
|
156
|
+
delete ctx[key];
|
|
157
|
+
}
|
|
158
|
+
else {
|
|
159
|
+
ctx[key] = value;
|
|
160
|
+
}
|
|
161
|
+
}
|
|
122
162
|
//# sourceMappingURL=jwt-verification.guard.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,4DAAyD;AAEzD,mDAA2D;AAE3D,sEAIqC;AACrC,0EAAwE;AACxE,4DAA+E;AAC/E,8DAAsE;AACtE,oEAIoC;AACpC,qDAAsD;AACtD,mDAAuD;AACvD,sEAAiE;AACjE,0EAA+E;AAM/E,wEAAiF;AAAxE,0IAAA,gCAAgC,OAAA;AAMzC,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAiCnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACd,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAU/C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,gCAAa,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAG7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAG1D,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAIpD,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAEnD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAMf,IAAI,KAAK,YAAY,sBAAa;gBAAE,MAAM,KAAK,CAAC;YAEhD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAUO,KAAK,CAAC,WAAW,CACvB,KAAa;QAEb,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAiBO,oBAAoB,CAC1B,OAAgB,EAChB,OAAmB,EACnB,MAA2B;QAE3B,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,gBAAgB;YAC9B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM;YACrB,CAAC,CAAC,OAAO,CAAC,GAAG;gBACX,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;oBAC3D,SAAS,CAAC;gBACZ,CAAC,CAAC,SAAS,CAAC;QAClB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;QACvB,CAAC;IACH,CAAC;IAgCO,mBAAmB,CACzB,OAAgB,EAChB,OAAmB,EACnB,MAA2B;QAE3B,MAAM,MAAM,GAAG,IAAA,uDAA8B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO;QAEpC,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GACxD,IAAA,gDAAyB,EAAC,MAAM,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAA,8CAA2B,EAAC,MAAM,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAA,gDAAyB,EAAC,MAAM,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAA,mDAA4B,EAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAA,gDAAuB,EAAC,MAAM,CAAC;YAClD,CAAC,CAAC,IAAA,uDAAqC,EAAC,MAAM,CAAC;YAC/C,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAA,qDAA+B,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,IAAA,iDAA2B,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,yBAAa,CAAC,SAAS,CAAC,CAAC;QACjF,MAAM,YAAY,GAAG,IAAA,uCAAiB,EACpC,IAAI,CAAC,MAAM,EACX,MAAM,EACN,KAAK,EACL,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,EACvE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,EACrE,GAAG,CAAC,aAAa,CAClB,CAAC;QAEF,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,WAAW,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;QACnE,GAAG,CAAC,OAAO,GAAG;YACZ,GAAG,WAAW;YACd,IAAI,EAAE,WAAW;YACjB,KAAK;YACL,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC5B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAClB,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;QAChC,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,cAAc,CAAC,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;QAChD,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAClD,cAAc,CACZ,GAAG,EACH,UAAU,EACV,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;QACF,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,CAAC,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AArOY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GAfnB,oBAAoB,CAqOhC;AAOD,SAAS,cAAc,CACrB,GAAmB,EACnB,GAAM,EACN,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;AACH,CAAC"}
|
|
@@ -19,8 +19,6 @@ export declare class RequestContextMiddleware implements NestMiddleware {
|
|
|
19
19
|
private decodeJwtPayload;
|
|
20
20
|
private assertOrgHeaderGrammar;
|
|
21
21
|
private assertProjectGrammar;
|
|
22
|
-
private assertOrgClaimMatchesHeader;
|
|
23
|
-
private resolveAndRecordOrgAuthority;
|
|
24
22
|
private resolveActorId;
|
|
25
23
|
private extractProjectIdFromPath;
|
|
26
24
|
private parseApprovalMode;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.middleware.d.ts","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"request-context.middleware.d.ts","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAgCzD,UAAU,wBAAwB;IAChC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,UAAU,kBAAmB,SAAQ,wBAAwB;IAC3D,CAAC,eAAe,CAAC,CAAC,EAAE,cAAc,CAAC;CACpC;AAED,qBACa,wBAAyB,YAAW,cAAc;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;IAEpE,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,GAAG,IAAI;IAiLnE,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,kBAAkB;IAc1B,OAAO,CAAC,gBAAgB;IA+ExB,OAAO,CAAC,sBAAsB;IA+D9B,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,sBAAsB;CAK/B"}
|
|
@@ -15,8 +15,7 @@ const space_1 = require("@xemahq/contracts/space");
|
|
|
15
15
|
const approval_mode_1 = require("../lib/approval-mode");
|
|
16
16
|
const org_claim_1 = require("../lib/auth/org-claim");
|
|
17
17
|
const org_role_1 = require("../lib/auth/org-role");
|
|
18
|
-
const
|
|
19
|
-
const org_authority_observations_1 = require("../lib/auth/org-authority-observations");
|
|
18
|
+
const org_authority_fence_1 = require("./auth/org-authority-fence");
|
|
20
19
|
const actor_classification_1 = require("./auth/actor-classification");
|
|
21
20
|
const delegation_chain_1 = require("./auth/delegation-chain");
|
|
22
21
|
let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContextMiddleware {
|
|
@@ -41,14 +40,12 @@ let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContext
|
|
|
41
40
|
const clientId = (0, actor_classification_1.resolveClientIdFromClaims)(claims);
|
|
42
41
|
const principalId = (0, actor_classification_1.resolvePrincipalIdFromClaims)(claims);
|
|
43
42
|
const orgRoles = (0, org_role_1.resolveOrgRoles)(claims);
|
|
44
|
-
|
|
45
|
-
throw new common_1.BadRequestException(`Missing required header: ${org_claim_1.OrgHeaderName.Canonical}`);
|
|
46
|
-
}
|
|
43
|
+
(0, org_authority_fence_1.assertOrgHeaderPresentForCaller)(orgId, actorType);
|
|
47
44
|
this.assertOrgHeaderGrammar(orgId);
|
|
48
45
|
this.assertProjectGrammar(projectId, projectHeaderValue === undefined ? 'url' : 'header');
|
|
49
46
|
const resolvedOrgId = orgId ?? '';
|
|
50
|
-
|
|
51
|
-
const orgAuthority = this.
|
|
47
|
+
(0, org_authority_fence_1.assertOrgClaimMatchesHeader)(this.logger, claims, resolvedOrgId, orgHeaderName);
|
|
48
|
+
const orgAuthority = (0, org_authority_fence_1.fenceOrgAuthority)(this.logger, claims, resolvedOrgId, { tokenClass, subjectKind, clientId, delegated: actorChain.length > 0 }, `${requestMethod} ${requestUrl}`, correlationId);
|
|
52
49
|
if (actAs) {
|
|
53
50
|
this.logger.log({
|
|
54
51
|
message: 'DELEGATED_REQUEST',
|
|
@@ -157,68 +154,6 @@ let RequestContextMiddleware = RequestContextMiddleware_1 = class RequestContext
|
|
|
157
154
|
`alphanumeric, then alphanumerics plus "_", "." or "-". No "/", no ` +
|
|
158
155
|
`whitespace, no "@".`);
|
|
159
156
|
}
|
|
160
|
-
assertOrgClaimMatchesHeader(claims, headerValue, headerName) {
|
|
161
|
-
const resolved = (0, org_claim_1.resolveOrgClaim)(claims);
|
|
162
|
-
if (!resolved) {
|
|
163
|
-
return;
|
|
164
|
-
}
|
|
165
|
-
if (resolved.value.toLowerCase() !== headerValue.toLowerCase()) {
|
|
166
|
-
this.logger.warn({
|
|
167
|
-
message: 'tenant-claim-mismatch',
|
|
168
|
-
claim: resolved.key,
|
|
169
|
-
claimValue: resolved.value,
|
|
170
|
-
header: headerName,
|
|
171
|
-
headerValue,
|
|
172
|
-
});
|
|
173
|
-
throw new common_1.ForbiddenException(`${headerName} (${headerValue || '<empty>'}) does not match ` +
|
|
174
|
-
`the ${resolved.key} claim on the access token.`);
|
|
175
|
-
}
|
|
176
|
-
}
|
|
177
|
-
resolveAndRecordOrgAuthority(claims, resolvedOrgId, facts, route, correlationId) {
|
|
178
|
-
const verdict = (0, org_authority_1.resolveOrgAuthority)(claims, resolvedOrgId, {
|
|
179
|
-
subjectKind: facts.subjectKind,
|
|
180
|
-
delegated: facts.delegated,
|
|
181
|
-
});
|
|
182
|
-
const callerFacts = {
|
|
183
|
-
clientId: facts.clientId ?? org_authority_observations_1.UNKNOWN_CLIENT_ID,
|
|
184
|
-
tokenClass: facts.tokenClass,
|
|
185
|
-
subjectKind: facts.subjectKind,
|
|
186
|
-
delegated: facts.delegated,
|
|
187
|
-
};
|
|
188
|
-
if (verdict.source === org_authority_1.OrgAuthoritySource.ServiceRelayedContext) {
|
|
189
|
-
if ((0, org_authority_observations_1.recordServiceRelayedOrgAuthority)(callerFacts)) {
|
|
190
|
-
this.logger.log({
|
|
191
|
-
message: 'ORG_AUTHORITY_SERVICE_RELAY',
|
|
192
|
-
source: verdict.source,
|
|
193
|
-
orgId: verdict.assertedOrgId,
|
|
194
|
-
...callerFacts,
|
|
195
|
-
route,
|
|
196
|
-
correlationId,
|
|
197
|
-
});
|
|
198
|
-
}
|
|
199
|
-
return verdict;
|
|
200
|
-
}
|
|
201
|
-
if (!(0, org_authority_1.orgAuthorityRequiresProof)(verdict)) {
|
|
202
|
-
return verdict;
|
|
203
|
-
}
|
|
204
|
-
if ((0, org_authority_observations_1.recordUnprovenOrgAuthority)(callerFacts)) {
|
|
205
|
-
this.logger.warn({
|
|
206
|
-
message: 'ORG_AUTHORITY_UNPROVEN',
|
|
207
|
-
source: verdict.source,
|
|
208
|
-
orgId: verdict.assertedOrgId,
|
|
209
|
-
...callerFacts,
|
|
210
|
-
route,
|
|
211
|
-
correlationId,
|
|
212
|
-
});
|
|
213
|
-
}
|
|
214
|
-
throw new common_1.ForbiddenException({
|
|
215
|
-
code: 'ORG_AUTHORITY_UNPROVEN',
|
|
216
|
-
message: `The caller asserted ${org_claim_1.OrgHeaderName.Canonical}=` +
|
|
217
|
-
`"${verdict.assertedOrgId}" but the access token carries neither an ` +
|
|
218
|
-
`${org_claim_1.OrgClaimKey.Canonical} claim for that org nor an org_roles ` +
|
|
219
|
-
`membership in it. A tenant cannot be named by header alone.`,
|
|
220
|
-
});
|
|
221
|
-
}
|
|
222
157
|
resolveActorId(claims) {
|
|
223
158
|
const actorId = (0, actor_classification_1.asNonEmptyString)(claims.sub);
|
|
224
159
|
if (!actorId) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"request-context.middleware.js","sourceRoot":"","sources":["../../src/nestjs/request-context.middleware.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAKwB;AACxB,6CAAyC;AAGzC,4DAAyD;AAEzD,mDAAmE;AAEnE,wDAAkE;AAClE,qDAAsD;AACtD,mDAAuD;AACvD,oEAIoC;AACpC,sEAKqC;AACrC,8DAAsE;AA0B/D,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAClB,MAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEpE,GAAG,CAAC,GAAuB,EAAE,IAAa,EAAE,IAAgB;QAI1D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,yBAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,yBAAa,CAAC,SAAS,CAAC;QAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAChE,MAAM,SAAS,GACb,kBAAkB,IAAI,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,SAAS,CAAC;QAC7E,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,sBAAsB,CAAC,IAAI,SAAS,CAAC;QACnF,MAAM,oBAAoB,GAAG,IAAI,CAAC,iBAAiB,CACjD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,0BAA0B,CAAC,CACjD,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,IAAI,IAAA,wBAAU,GAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,SAAS,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAK5C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GACxD,IAAA,gDAAyB,EAAC,MAAM,CAAC,CAAC;QAIpC,MAAM,UAAU,GAAG,IAAA,8CAA2B,EAAC,MAAM,CAAC,CAAC;QAGvD,MAAM,QAAQ,GAAG,IAAA,gDAAyB,EAAC,MAAM,CAAC,CAAC;QAMnD,MAAM,WAAW,GAAG,IAAA,mDAA4B,EAAC,MAAM,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,MAAM,CAAC,CAAC;QAazC,IAAA,qDAA+B,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,oBAAoB,CACvB,SAAS,EACT,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CACpD,CAAC;QACF,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC;QAuBlC,IAAA,iDAA2B,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;QAqB/E,MAAM,YAAY,GAAG,IAAA,uCAAiB,EACpC,IAAI,CAAC,MAAM,EACX,MAAM,EACN,aAAa,EACb,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,EACvE,GAAG,aAAa,IAAI,UAAU,EAAE,EAChC,aAAa,CACd,CAAC;QAUF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,OAAO;gBACd,KAAK;gBACL,KAAK;gBACL,SAAS;gBACT,KAAK,EAAE,GAAG,aAAa,IAAI,UAAU,EAAE;gBACvC,aAAa;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAe;YAC1B,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,OAAO;YACX,KAAK;YACL,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QAEF,GAAG,CAAC,iCAAe,CAAC,GAAG;YACrB,KAAK,EAAE,aAAa;YACpB,YAAY;YACZ,SAAS;YACT,OAAO;YACP,UAAU;YACV,UAAU;YACV,OAAO;YACP,SAAS;YACT,aAAa;YACb,WAAW;YACX,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,WAAW,EAAE,KAAK;YAClB,aAAa;YACb,gBAAgB;YAChB,oBAAoB;YACpB,KAAK;YACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAyB,CAAC;YACtE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC;IAWO,UAAU,CAChB,GAA6B,EAC7B,IAAY;QAEZ,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,CAAC;IAEO,kBAAkB,CAAC,GAA6B;QACtD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAC3B,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,gBAAgB,CAAC,KAAa;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAKpC,MAAM,IAAI,4BAAmB,CAC3B,2EAA2E,KAAK,CAAC,MAAM,GAAG;gBACxF,iBAAiB,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,OAAkC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAyDO,sBAAsB,CAAC,KAAyB;QACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,IAAI,gCAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAID,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,MAAM,IAAI,4BAAmB,CAC3B,WAAW,yBAAa,CAAC,SAAS,aAAa,KAAK,mBAAmB;YACrE,qCAAqC,gCAAwB,KAAK;YAClE,uEAAuE;YACvE,wBAAwB,CAC3B,CAAC;IACJ,CAAC;IA8CO,oBAAoB,CAC1B,SAA6B,EAC7B,MAAwB;QAExB,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,gCAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAGD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,MAAM,MAAM,GACV,MAAM,KAAK,QAAQ;YACjB,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,qCAAqC,CAAC;QAC5C,MAAM,IAAI,4BAAmB,CAC3B,2BAA2B,MAAM,MAAM,KAAK,yBAAyB;YACnE,+BAA+B,gCAAwB,WAAW;YAClE,oEAAoE;YACpE,qBAAqB,CACxB,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,IAAA,uCAAgB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAcO,wBAAwB,CAAC,IAAY;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACrD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAEO,iBAAiB,CACvB,KAAyB;QAEzB,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,0CAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,KAA6B,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,4BAAmB,CAC3B,4CAA4C,KAAK,uCAAuC,CACzF,CAAC;IACJ,CAAC;IAEO,sBAAsB,CAAC,MAA0B;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACjD,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;CACF,CAAA;AAhaY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;GACA,wBAAwB,CAgapC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/platform-common",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.41.0",
|
|
4
4
|
"description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -40,8 +40,8 @@
|
|
|
40
40
|
}
|
|
41
41
|
},
|
|
42
42
|
"dependencies": {
|
|
43
|
-
"@xemahq/identity-client": "
|
|
44
|
-
"@xemahq/oidc-guard": "^0.
|
|
43
|
+
"@xemahq/identity-client": ">=0.9.7",
|
|
44
|
+
"@xemahq/oidc-guard": "^0.7.0",
|
|
45
45
|
"jwks-rsa": "^3.2.2",
|
|
46
46
|
"undici": "^7.29.0",
|
|
47
47
|
"zod": "^4.3.6"
|