@zetra/citrineos-util 1.8.3-fork.44 → 1.8.3-fork.47

package/dist/authorizer/RealTimeAuthorizer.d.ts

@@ -8,8 +8,8 @@ export interface RealTimeAuthorizationRequestBody {
     idTokenType: IdTokenEnumType;
     locationId?: string;
     stationId: string;
-    evseId: number;
-    connectorId: number;
+    evseId?: number;
+    connectorId?: number;
 }
 export interface RealTimeAuthorizationResponse {
     timestamp: string;

package/dist/authorizer/UnknownTokenOcpiAuthorizer.d.ts

@@ -0,0 +1,18 @@
+import { type AuthorizationStatusEnumType, type IdTokenEnumType, type IMessageContext, type SystemConfig } from '@zetra/citrineos-base';
+import type { ILocationRepository, ITenantPartnerRepository } from '@zetra/citrineos-data';
+import type { ILogObj } from 'tslog';
+import { Logger } from 'tslog';
+/**
+ * Delegates real-time authorization of unknown tokens to the OCPI module's
+ * `/realTimeAuth` endpoint, which performs the OCPI `POST /authorize` against the eMSP.
+ */
+export declare class UnknownTokenOcpiAuthorizer {
+    private readonly _locationRepository;
+    private readonly _tenantPartnerRepository;
+    private readonly _config;
+    private readonly _logger;
+    private readonly _oidcTokenProvider?;
+    constructor(locationRepository: ILocationRepository, tenantPartnerRepository: ITenantPartnerRepository, config: SystemConfig, logger?: Logger<ILogObj>);
+    authorize(idToken: string, idTokenType: IdTokenEnumType, context: IMessageContext): Promise<AuthorizationStatusEnumType>;
+    private _buildRealTimeAuthUrl;
+}

package/dist/authorizer/UnknownTokenOcpiAuthorizer.js

@@ -0,0 +1,107 @@
+// SPDX-FileCopyrightText: 2025 Contributors to the CitrineOS Project
+//
+// SPDX-License-Identifier: Apache-2.0
+import { AuthorizationStatusEnum, } from '@zetra/citrineos-base';
+import { Logger } from 'tslog';
+import { OidcTokenProvider } from '../authorization/index.js';
+// The hub TenantPartner that unknown tokens are delegated to for real-time authorization.
+// Warning : As of now, only one hub partner is supported. In case of several partners, need for a rework to send authorization to all partners.
+const HUB_PARTNER_COUNTRY_CODE = 'FR';
+const HUB_PARTNER_PARTY_IDS = ['007', '107'];
+/**
+ * Delegates real-time authorization of unknown tokens to the OCPI module's
+ * `/realTimeAuth` endpoint, which performs the OCPI `POST /authorize` against the eMSP.
+ */
+export class UnknownTokenOcpiAuthorizer {
+    _locationRepository;
+    _tenantPartnerRepository;
+    _config;
+    _logger;
+    _oidcTokenProvider;
+    constructor(locationRepository, tenantPartnerRepository, config, logger) {
+        this._locationRepository = locationRepository;
+        this._tenantPartnerRepository = tenantPartnerRepository;
+        this._config = config;
+        this._logger = logger
+            ? logger.getSubLogger({ name: this.constructor.name })
+            : new Logger({ name: this.constructor.name });
+        if (config.oidcClient) {
+            this._oidcTokenProvider = new OidcTokenProvider(config.oidcClient, this._logger);
+        }
+    }
+    async authorize(idToken, idTokenType, context) {
+        const hubPartner = await this._tenantPartnerRepository.getHubPartner(context.tenantId, HUB_PARTNER_COUNTRY_CODE, HUB_PARTNER_PARTY_IDS);
+        if (!hubPartner?.id) {
+            this._logger.debug(`No hub TenantPartner found for tenant ${context.tenantId} (${HUB_PARTNER_COUNTRY_CODE} ${HUB_PARTNER_PARTY_IDS.join('/')}); cannot delegate real-time authorization`);
+            return AuthorizationStatusEnum.Unknown;
+        }
+        const chargingStation = await this._locationRepository.readChargingStationByStationId(context.tenantId, context.stationId);
+        const payload = {
+            tenantPartnerId: hubPartner.id,
+            idToken,
+            idTokenType,
+            locationId: chargingStation?.locationId?.toString(),
+            stationId: context.stationId,
+        };
+        const url = this._buildRealTimeAuthUrl();
+        this._logger.debug(`Delegating unknown-token real-time authorization for partner ${hubPartner.id} to ${url}`);
+        try {
+            const headers = {
+                'Content-Type': 'application/json',
+            };
+            // The OCPI `/realTimeAuth` endpoint is an admin endpoint. When citrineos-ocpi is
+            // configured with OIDC, it expects a Bearer JWT (client-credentials); otherwise we
+            // fall back to the legacy `Token <adminToken>` scheme.
+            if (this._oidcTokenProvider) {
+                try {
+                    const token = await this._oidcTokenProvider.getToken();
+                    headers['Authorization'] = `Bearer ${token}`;
+                }
+                catch (error) {
+                    this._logger.error('Failed to get OIDC token for real-time authorization:', error);
+                    return AuthorizationStatusEnum.Unknown;
+                }
+            }
+            else if (this._config.ocpiServer.adminToken) {
+                headers['Authorization'] = `Token ${this._config.ocpiServer.adminToken}`;
+            }
+            const response = await fetch(url, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(payload),
+            });
+            if (!response.ok) {
+                const responseBody = await response.text();
+                this._logger.error(`Real-time authorization request to ${url} failed: HTTP ${response.status} ${responseBody}`);
+                return AuthorizationStatusEnum.Unknown;
+            }
+            const responseJson = (await response.json());
+            this._logger.debug(`Real-time auth response: ${responseJson?.data?.allowed}`);
+            switch (responseJson?.data?.allowed) {
+                case 'ALLOWED':
+                    return AuthorizationStatusEnum.Accepted;
+                case 'BLOCKED':
+                    return AuthorizationStatusEnum.Blocked;
+                case 'EXPIRED':
+                    return AuthorizationStatusEnum.Expired;
+                case 'NO_CREDIT':
+                    return AuthorizationStatusEnum.NoCredit;
+                case 'NOT_ALLOWED':
+                    return AuthorizationStatusEnum.NotAtThisLocation;
+                default:
+                    return AuthorizationStatusEnum.Unknown;
+            }
+        }
+        catch (error) {
+            this._logger.error(`Real-time authorization for unknown token failed: ${error}`);
+            return AuthorizationStatusEnum.Unknown;
+        }
+    }
+    _buildRealTimeAuthUrl() {
+        const { host, port, version } = this._config.ocpiServer;
+        // Mirrors the citrineos-ocpi route: global '/ocpi' prefix + Tokens controller
+        // base '/:role(cpo|emsp)/:versionId/tokens' + the '/realTimeAuth' admin endpoint.
+        return `http://${host}:${port}/ocpi/emsp/${version}/tokens/realTimeAuth`;
+    }
+}
+//# sourceMappingURL=UnknownTokenOcpiAuthorizer.js.map

package/dist/authorizer/UnknownTokenOcpiAuthorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnknownTokenOcpiAuthorizer.js","sourceRoot":"","sources":["../../src/authorizer/UnknownTokenOcpiAuthorizer.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,sCAAsC;AACtC,OAAO,EACL,uBAAuB,GAKxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAM9D,0FAA0F;AAC1F,gJAAgJ;AAChJ,MAAM,wBAAwB,GAAG,IAAI,CAAC;AACtC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE7C;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACpB,mBAAmB,CAAsB;IACzC,wBAAwB,CAA2B;IACnD,OAAO,CAAe;IACtB,OAAO,CAAkB;IACzB,kBAAkB,CAAqB;IAExD,YACE,kBAAuC,EACvC,uBAAiD,EACjD,MAAoB,EACpB,MAAwB;QAExB,IAAI,CAAC,mBAAmB,GAAG,kBAAkB,CAAC;QAC9C,IAAI,CAAC,wBAAwB,GAAG,uBAAuB,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM;YACnB,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACtD,CAAC,CAAC,IAAI,MAAM,CAAU,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,CAAC,kBAAkB,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAAe,EACf,WAA4B,EAC5B,OAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAClE,OAAO,CAAC,QAAQ,EAChB,wBAAwB,EACxB,qBAAqB,CACtB,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,yCAAyC,OAAO,CAAC,QAAQ,KAAK,wBAAwB,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,CACtK,CAAC;YACF,OAAO,uBAAuB,CAAC,OAAO,CAAC;QACzC,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,8BAA8B,CACnF,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF,MAAM,OAAO,GAAqC;YAChD,eAAe,EAAE,UAAU,CAAC,EAAE;YAC9B,OAAO;YACP,WAAW;YACX,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE;YACnD,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,gEAAgE,UAAU,CAAC,EAAE,OAAO,GAAG,EAAE,CAC1F,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,OAAO,GAA8B;gBACzC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,iFAAiF;YACjF,mFAAmF;YACnF,uDAAuD;YACvD,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;oBACvD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;gBAC/C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,KAAK,CAAC,CAAC;oBACnF,OAAO,uBAAuB,CAAC,OAAO,CAAC;gBACzC,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC9C,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,sCAAsC,GAAG,iBAAiB,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAC5F,CAAC;gBACF,OAAO,uBAAuB,CAAC,OAAO,CAAC;YACzC,CAAC;YAED,MAAM,YAAY,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAE9E,QAAQ,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACpC,KAAK,SAAS;oBACZ,OAAO,uBAAuB,CAAC,QAAQ,CAAC;gBAC1C,KAAK,SAAS;oBACZ,OAAO,uBAAuB,CAAC,OAAO,CAAC;gBACzC,KAAK,SAAS;oBACZ,OAAO,uBAAuB,CAAC,OAAO,CAAC;gBACzC,KAAK,WAAW;oBACd,OAAO,uBAAuB,CAAC,QAAQ,CAAC;gBAC1C,KAAK,aAAa;oBAChB,OAAO,uBAAuB,CAAC,iBAAiB,CAAC;gBACnD;oBACE,OAAO,uBAAuB,CAAC,OAAO,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qDAAqD,KAAK,EAAE,CAAC,CAAC;YACjF,OAAO,uBAAuB,CAAC,OAAO,CAAC;QACzC,CAAC;IACH,CAAC;IAEO,qBAAqB;QAC3B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxD,8EAA8E;QAC9E,kFAAkF;QAClF,OAAO,UAAU,IAAI,IAAI,IAAI,cAAc,OAAO,sBAAsB,CAAC;IAC3E,CAAC;CACF"}

package/dist/authorizer/index.d.ts

@@ -1 +1,2 @@
 export * from './RealTimeAuthorizer.js';
+export * from './UnknownTokenOcpiAuthorizer.js';

package/dist/authorizer/index.js

@@ -2,4 +2,5 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 export * from './RealTimeAuthorizer.js';
+export * from './UnknownTokenOcpiAuthorizer.js';
 //# sourceMappingURL=index.js.map

package/dist/authorizer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorizer/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,sCAAsC;AACtC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorizer/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,sCAAsC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iCAAiC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zetra/citrineos-util",
-  "version": "1.8.3-fork.44",
+  "version": "1.8.3-fork.47",
   "description": "The OCPP util module which supplies helpful utilities like cache and queue connectors, etc.",
   "type": "module",
   "main": "dist/index.js",
@@ -24,8 +24,8 @@
     "@types/jsrsasign": "10.5.14"
   },
   "dependencies": {
-    "@zetra/citrineos-base": "1.8.3-fork.44",
-    "@zetra/citrineos-data": "1.8.3-fork.44",
+    "@zetra/citrineos-base": "1.8.3-fork.47",
+    "@zetra/citrineos-data": "1.8.3-fork.47",
     "@fastify/swagger": "9.4.0",
     "@fastify/swagger-ui": "5.2.0",
     "@google-cloud/storage": "7.18.0",