libmodulor 0.1.0 → 0.2.0

package/dist/esm/target/lib/react/useUCOR.js

@@ -0,0 +1,80 @@
+import { useState } from 'react';
+function append(a, b) {
+    const { items, pagination: { total }, } = b;
+    const newItems = a.items.concat(items);
+    const newTotal = a.pagination.total + total;
+    return {
+        ...a,
+        items: newItems,
+        pagination: {
+            label: `${newItems.length}/${newTotal}`,
+            total: newTotal,
+        },
+    };
+}
+function remove(part, item) {
+    const newItems = part.items.filter((i) => i.id !== item.id);
+    const newTotal = part.pagination.total - 1;
+    return {
+        ...part,
+        items: part.items.filter((i) => i.id !== item.id),
+        pagination: {
+            label: `${newItems.length}/${newTotal}`,
+            total: newTotal,
+        },
+    };
+}
+function update(a, b) {
+    const { items } = b;
+    const updatedItemIds = new Map(items.map((i) => [i.id, i]));
+    const newItems = a.items.map((i) => {
+        const updatedItem = updatedItemIds.get(i.id);
+        if (!updatedItem) {
+            return i;
+        }
+        return updatedItem;
+    });
+    return {
+        ...a,
+        items: newItems,
+    };
+}
+export function useUCOR(ucor) {
+    const [part0, setPart0] = useState(ucor.part0());
+    const [part1, setPart1] = useState(ucor.part1());
+    const append0 = (ucor2) => setPart0((prev) => append(prev, ucor2.part0()));
+    const append1 = (ucor2) => setPart1((prev) => {
+        const b = ucor2.part1();
+        if (!prev || !b) {
+            return;
+        }
+        return append(prev, b);
+    });
+    const remove0 = (item) => setPart0((prev) => remove(prev, item));
+    const remove1 = (item) => setPart1((prev) => {
+        if (!prev) {
+            return;
+        }
+        return remove(prev, item);
+    });
+    const update0 = (ucor2) => setPart0((prev) => update(prev, ucor2.part0()));
+    const update1 = (ucor2) => setPart1((prev) => {
+        const b = ucor2.part1();
+        if (!prev || !b) {
+            return;
+        }
+        return update(prev, b);
+    });
+    return [
+        part0,
+        part1,
+        {
+            append0,
+            append1,
+            remove0,
+            remove1,
+            update0,
+            update1,
+        },
+    ];
+}

package/dist/esm/target/lib/server/AuthenticationChecker.d.ts

@@ -0,0 +1,30 @@
+import { type interfaces } from 'inversify';
+import type { AppManifest } from '../../../app/index.js';
+import type { Logger, Worker } from '../../../std/index.js';
+import { type UC, type UCAuth, type UCDef, type UCInput, type UCOPIBase, type UCPolicy } from '../../../uc/index.js';
+import { BasicAuthenticationChecker } from './BasicAuthenticationChecker.js';
+import { JWTAuthenticationChecker } from './JWTAuthenticationChecker.js';
+import { PrivateApiKeyAuthenticationChecker } from './PrivateApiKeyAuthenticationChecker.js';
+export interface AuthenticationCheckerInputRaw<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> {
+    appManifest: AppManifest;
+    ucd: UCDef<I, OPI0, OPI1>;
+}
+interface Input<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined> {
+    authCookie: string | string[] | undefined;
+    authorizationHeader: string | string[] | undefined;
+    uc: UC<I, OPI0, OPI1>;
+}
+interface Output {
+    allowed: boolean;
+    auth: UCAuth | null;
+}
+export declare class AuthenticationChecker implements Worker<Input, Promise<Output>> {
+    private basicAuthenticationChecker;
+    private jwtAuthenticationChecker;
+    private privateApiKeyAuthenticationChecker;
+    private logger;
+    private ucPolicyProvider;
+    constructor(basicAuthenticationChecker: BasicAuthenticationChecker, jwtAuthenticationChecker: JWTAuthenticationChecker, privateApiKeyAuthenticationChecker: PrivateApiKeyAuthenticationChecker, logger: Logger, ucPolicyProvider: interfaces.Provider<UCPolicy>);
+    exec<I extends UCInput | undefined = undefined, OPI0 extends UCOPIBase | undefined = undefined, OPI1 extends UCOPIBase | undefined = undefined>({ authCookie, authorizationHeader, uc, }: Input<I, OPI0, OPI1>): Promise<Output>;
+}
+export {};

package/dist/esm/target/lib/server/AuthenticationChecker.js

@@ -0,0 +1,108 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+import { ForbiddenError, UnauthorizedError } from '../../../error/index.js';
+import { DEFAULT_UC_SEC_AT, } from '../../../uc/index.js';
+import { BasicAuthenticationChecker } from './BasicAuthenticationChecker.js';
+import { JWTAuthenticationChecker } from './JWTAuthenticationChecker.js';
+import { PrivateApiKeyAuthenticationChecker } from './PrivateApiKeyAuthenticationChecker.js';
+let AuthenticationChecker = class AuthenticationChecker {
+    basicAuthenticationChecker;
+    jwtAuthenticationChecker;
+    privateApiKeyAuthenticationChecker;
+    logger;
+    ucPolicyProvider;
+    constructor(basicAuthenticationChecker, jwtAuthenticationChecker, privateApiKeyAuthenticationChecker, logger, ucPolicyProvider) {
+        this.basicAuthenticationChecker = basicAuthenticationChecker;
+        this.jwtAuthenticationChecker = jwtAuthenticationChecker;
+        this.privateApiKeyAuthenticationChecker = privateApiKeyAuthenticationChecker;
+        this.logger = logger;
+        this.ucPolicyProvider = ucPolicyProvider;
+    }
+    async exec({ authCookie, authorizationHeader, uc, }) {
+        this.logger.trace('Checking auth', {
+            authCookie,
+            authorizationHeader,
+        });
+        const output = {
+            allowed: false,
+            auth: null,
+        };
+        const { lifecycle: { server }, sec, } = uc.def;
+        if (typeof server !== 'object') {
+            return output;
+        }
+        const authType = sec?.authType ?? DEFAULT_UC_SEC_AT;
+        const policy = (await this.ucPolicyProvider(server.policy));
+        const canBeExecutedPreAuth = await policy.canBeExecutedPreAuth();
+        if (canBeExecutedPreAuth) {
+            const { allowed } = await policy.exec({
+                uc,
+            });
+            output.allowed = allowed;
+        }
+        else {
+            switch (authType) {
+                case 'apiKey':
+                    if (authorizationHeader &&
+                        !Array.isArray(authorizationHeader)) {
+                        output.auth =
+                            await this.privateApiKeyAuthenticationChecker.exec({
+                                rawValue: authorizationHeader,
+                            });
+                    }
+                    break;
+                case 'basic':
+                    if (authorizationHeader &&
+                        !Array.isArray(authorizationHeader)) {
+                        output.auth =
+                            await this.basicAuthenticationChecker.exec({
+                                rawValue: authorizationHeader,
+                            });
+                    }
+                    break;
+                case 'jwt':
+                    if (authCookie && !Array.isArray(authCookie)) {
+                        output.auth = await this.jwtAuthenticationChecker.exec({
+                            rawValue: authCookie,
+                        });
+                    }
+                    break;
+                default:
+                    ((_) => { })(authType);
+            }
+            uc.auth = output.auth;
+            const { allowed } = await policy.exec({ uc });
+            output.allowed = allowed;
+        }
+        if (!output.allowed) {
+            if (uc.auth) {
+                throw new ForbiddenError();
+            }
+            throw new UnauthorizedError();
+        }
+        return output;
+    }
+};
+AuthenticationChecker = __decorate([
+    injectable(),
+    __param(0, inject(BasicAuthenticationChecker)),
+    __param(1, inject(JWTAuthenticationChecker)),
+    __param(2, inject(PrivateApiKeyAuthenticationChecker)),
+    __param(3, inject('Logger')),
+    __param(4, inject('Provider<UCPolicy>')),
+    __metadata("design:paramtypes", [BasicAuthenticationChecker,
+        JWTAuthenticationChecker,
+        PrivateApiKeyAuthenticationChecker, Object, Function])
+], AuthenticationChecker);
+export { AuthenticationChecker };

package/dist/esm/target/lib/server/BasicAuthenticationChecker.d.ts

@@ -0,0 +1,17 @@
+import type { BufferManager, Configurable, Logger, SettingsManager, Worker } from '../../../std/index.js';
+import type { UCAuth } from '../../../uc/index.js';
+import type { ServerManagerSettings } from './ServerManager.js';
+interface Input {
+    rawValue: string | undefined;
+}
+export type Output = UCAuth;
+type S = Pick<ServerManagerSettings, 'server_basic_auth_entries'>;
+export declare class BasicAuthenticationChecker implements Configurable<S>, Worker<Input, Promise<Output | null>> {
+    private bufferManager;
+    private logger;
+    private settingsManager;
+    constructor(bufferManager: BufferManager, logger: Logger, settingsManager: SettingsManager<S>);
+    s(): S;
+    exec({ rawValue }: Input): Promise<Output | null>;
+}
+export {};

package/dist/esm/target/lib/server/BasicAuthenticationChecker.js

@@ -0,0 +1,69 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+import { capitalize } from '../../../utils/index.js';
+let BasicAuthenticationChecker = class BasicAuthenticationChecker {
+    bufferManager;
+    logger;
+    settingsManager;
+    constructor(bufferManager, logger, settingsManager) {
+        this.bufferManager = bufferManager;
+        this.logger = logger;
+        this.settingsManager = settingsManager;
+    }
+    s() {
+        return {
+            server_basic_auth_entries: this.settingsManager.get()('server_basic_auth_entries'),
+        };
+    }
+    async exec({ rawValue }) {
+        const basicAuth = rawValue?.replace('Basic ', '');
+        if (!basicAuth) {
+            return null;
+        }
+        const [username, password] = this.bufferManager
+            .decodeBase64(basicAuth)
+            .split(':');
+        this.logger.trace('Credentials', { password, username });
+        if (!username || !password) {
+            return null;
+        }
+        const realPassword = this.s().server_basic_auth_entries[username];
+        if (!realPassword) {
+            return null;
+        }
+        const passwordsMatch = password === realPassword;
+        if (!passwordsMatch) {
+            return null;
+        }
+        return {
+            organization: {
+                id: '',
+            },
+            role: username === 'admin' ? 'admin' : 'regular',
+            user: {
+                firstname: capitalize(username),
+                id: '',
+                initials: '',
+            },
+        };
+    }
+};
+BasicAuthenticationChecker = __decorate([
+    injectable(),
+    __param(0, inject('BufferManager')),
+    __param(1, inject('Logger')),
+    __param(2, inject('SettingsManager')),
+    __metadata("design:paramtypes", [Object, Object, Object])
+], BasicAuthenticationChecker);
+export { BasicAuthenticationChecker };

package/dist/esm/target/lib/server/CSPDirectivesBuilder.d.ts

@@ -0,0 +1,22 @@
+import type { Configurable, EnvironmentManager, Logger, SettingsManager, Worker } from '../../../std/index.js';
+import type { ServerManagerSettings } from './ServerManager.js';
+export type CSPDirectives = Record<string, null | string[]>;
+interface Input {
+    defaultDirectives: CSPDirectives;
+}
+interface Output {
+    directives: CSPDirectives;
+}
+type S = Pick<ServerManagerSettings, 'server_csp_default_src' | 'server_csp_img_src' | 'server_csp_script_src'>;
+export declare class CSPDirectivesBuilder implements Configurable<S>, Worker<Input, Output> {
+    private environmentManager;
+    private logger;
+    private settingsManager;
+    private static DEFAULT_SRC;
+    private static IMG_SRC;
+    private static SCRIPT_SRC;
+    constructor(environmentManager: EnvironmentManager, logger: Logger, settingsManager: SettingsManager<S>);
+    s(): S;
+    exec({ defaultDirectives }: Input): Output;
+}
+export {};

package/dist/esm/target/lib/server/CSPDirectivesBuilder.js

@@ -0,0 +1,63 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CSPDirectivesBuilder_1;
+import { inject, injectable } from 'inversify';
+let CSPDirectivesBuilder = class CSPDirectivesBuilder {
+    static { CSPDirectivesBuilder_1 = this; }
+    environmentManager;
+    logger;
+    settingsManager;
+    static DEFAULT_SRC = 'default-src';
+    static IMG_SRC = 'img-src';
+    static SCRIPT_SRC = 'script-src';
+    constructor(environmentManager, logger, settingsManager) {
+        this.environmentManager = environmentManager;
+        this.logger = logger;
+        this.settingsManager = settingsManager;
+    }
+    s() {
+        return {
+            server_csp_default_src: this.settingsManager.get()('server_csp_default_src'),
+            server_csp_img_src: this.settingsManager.get()('server_csp_img_src'),
+            server_csp_script_src: this.settingsManager.get()('server_csp_script_src'),
+        };
+    }
+    exec({ defaultDirectives }) {
+        this.logger.info('Default CSP directives', defaultDirectives);
+        const directives = { ...defaultDirectives };
+        if (!this.environmentManager.isProd()) {
+            this.logger.warn('Disabling upgrade-insecure-requests');
+            directives['upgrade-insecure-requests'] = null;
+            this.logger.warn('Enabling unsafe-eval');
+            directives[CSPDirectivesBuilder_1.SCRIPT_SRC]?.push("'unsafe-eval'");
+            this.logger.warn('Enabling unsafe-inline');
+            directives[CSPDirectivesBuilder_1.SCRIPT_SRC]?.push("'unsafe-inline'");
+        }
+        this.logger.info('Adding specific CSP directives');
+        directives[CSPDirectivesBuilder_1.DEFAULT_SRC]?.push(...this.s().server_csp_default_src);
+        directives[CSPDirectivesBuilder_1.IMG_SRC]?.push(...this.s().server_csp_img_src);
+        directives[CSPDirectivesBuilder_1.SCRIPT_SRC]?.push(...this.s().server_csp_script_src);
+        this.logger.info('Final CSP directives', directives);
+        return {
+            directives,
+        };
+    }
+};
+CSPDirectivesBuilder = CSPDirectivesBuilder_1 = __decorate([
+    injectable(),
+    __param(0, inject('EnvironmentManager')),
+    __param(1, inject('Logger')),
+    __param(2, inject('SettingsManager')),
+    __metadata("design:paramtypes", [Object, Object, Object])
+], CSPDirectivesBuilder);
+export { CSPDirectivesBuilder };

package/dist/esm/target/lib/server/CustomerFacingErrorBuilder.d.ts

@@ -0,0 +1,15 @@
+import { CustomError } from '../../../error/index.js';
+import type { EnvironmentManager, Logger, Worker } from '../../../std/index.js';
+interface Input {
+    error: Error;
+}
+interface Output {
+    error: CustomError;
+}
+export declare class CustomerFacingErrorBuilder implements Worker<Input, Output> {
+    private environmentManager;
+    private logger;
+    constructor(environmentManager: EnvironmentManager, logger: Logger);
+    exec({ error }: Input): Output;
+}
+export {};

package/dist/esm/target/lib/server/CustomerFacingErrorBuilder.js

@@ -0,0 +1,42 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+import { CustomError, InternalServerError } from '../../../error/index.js';
+let CustomerFacingErrorBuilder = class CustomerFacingErrorBuilder {
+    environmentManager;
+    logger;
+    constructor(environmentManager, logger) {
+        this.environmentManager = environmentManager;
+        this.logger = logger;
+    }
+    exec({ error }) {
+        if (error instanceof CustomError) {
+            return {
+                error,
+            };
+        }
+        this.logger.error(error);
+        return {
+            error: new InternalServerError(this.environmentManager.isProd()
+                ? undefined
+                : error.message),
+        };
+    }
+};
+CustomerFacingErrorBuilder = __decorate([
+    injectable(),
+    __param(0, inject('EnvironmentManager')),
+    __param(1, inject('Logger')),
+    __metadata("design:paramtypes", [Object, Object])
+], CustomerFacingErrorBuilder);
+export { CustomerFacingErrorBuilder };

package/dist/esm/target/lib/server/EntrypointsBuilder.d.ts

@@ -0,0 +1,15 @@
+import type { URL } from '../../../dt/index.js';
+import type { Configurable, SettingsManager, Worker } from '../../../std/index.js';
+import type { ServerManagerSettings } from './ServerManager.js';
+interface Output {
+    http: URL;
+    tcp: string;
+}
+type S = Pick<ServerManagerSettings, 'server_binding_host' | 'server_binding_port'>;
+export declare class EntrypointsBuilder implements Configurable<S>, Worker<void, Output> {
+    private settingsManager;
+    constructor(settingsManager: SettingsManager<S>);
+    s(): S;
+    exec(): Output;
+}
+export {};

package/dist/esm/target/lib/server/EntrypointsBuilder.js

@@ -0,0 +1,46 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+let EntrypointsBuilder = class EntrypointsBuilder {
+    settingsManager;
+    constructor(settingsManager) {
+        this.settingsManager = settingsManager;
+    }
+    s() {
+        return {
+            server_binding_host: this.settingsManager.get()('server_binding_host'),
+            server_binding_port: this.settingsManager.get()('server_binding_port'),
+        };
+    }
+    exec() {
+        const host = this.s().server_binding_host;
+        const port = this.s().server_binding_port;
+        const tcp = `tcp://${host}:${port}`;
+        if (port !== 443) {
+            return {
+                http: `http://${host}${port === 80 ? '' : [':', port].join('')}`,
+                tcp,
+            };
+        }
+        return {
+            http: `https://${host}`,
+            tcp,
+        };
+    }
+};
+EntrypointsBuilder = __decorate([
+    injectable(),
+    __param(0, inject('SettingsManager')),
+    __metadata("design:paramtypes", [Object])
+], EntrypointsBuilder);
+export { EntrypointsBuilder };

package/dist/esm/target/lib/server/JWTAuthenticationChecker.d.ts

@@ -0,0 +1,17 @@
+import type { Configurable, JWTManager, JWTManagerPayload, JWTManagerSettings, Logger, SettingsManager, Worker } from '../../../std/index.js';
+import type { UCAuth } from '../../../uc/index.js';
+interface Input {
+    rawValue: string | undefined;
+}
+type Output = JWTManagerPayload & UCAuth;
+type S = Pick<JWTManagerSettings, 'jwt_manager_invalidate_issued_before'>;
+export declare class JWTAuthenticationChecker implements Configurable<S>, Worker<Input, Promise<Output | null>> {
+    private jwtManager;
+    private logger;
+    private settingsManager;
+    constructor(jwtManager: JWTManager, logger: Logger, settingsManager: SettingsManager<S>);
+    s(): S;
+    exec({ rawValue }: Input): Promise<Output | null>;
+    private mustBeInvalidated;
+}
+export {};

package/dist/esm/target/lib/server/JWTAuthenticationChecker.js

@@ -0,0 +1,78 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { inject, injectable } from 'inversify';
+import { UnauthorizedError } from '../../../error/index.js';
+let JWTAuthenticationChecker = class JWTAuthenticationChecker {
+    jwtManager;
+    logger;
+    settingsManager;
+    constructor(jwtManager, logger, settingsManager) {
+        this.jwtManager = jwtManager;
+        this.logger = logger;
+        this.settingsManager = settingsManager;
+    }
+    s() {
+        return {
+            jwt_manager_invalidate_issued_before: this.settingsManager.get()('jwt_manager_invalidate_issued_before'),
+        };
+    }
+    async exec({ rawValue }) {
+        const value = rawValue?.replace('JWT ', '');
+        if (!value) {
+            return null;
+        }
+        try {
+            const payload = await this.jwtManager.decode(value);
+            this.logger.trace('JWT', { payload });
+            const toInvalidate = this.mustBeInvalidated(payload);
+            if (toInvalidate) {
+                return null;
+            }
+            return payload;
+        }
+        catch (err) {
+            if (err instanceof UnauthorizedError) {
+                return null;
+            }
+            throw err;
+        }
+    }
+    mustBeInvalidated(payload) {
+        const limit = this.s().jwt_manager_invalidate_issued_before;
+        if (limit === null) {
+            return false;
+        }
+        const { iat } = payload;
+        if (iat === undefined) {
+            this.logger.warn('JWT has no iat => mark as to invalidate', {
+                iat,
+                limit,
+            });
+            return true;
+        }
+        const diff = limit - iat;
+        if (diff >= 0) {
+            this.logger.warn('JWT issued before the limit => mark as to invalidate', { diff, iat, limit });
+            return true;
+        }
+        return false;
+    }
+};
+JWTAuthenticationChecker = __decorate([
+    injectable(),
+    __param(0, inject('JWTManager')),
+    __param(1, inject('Logger')),
+    __param(2, inject('SettingsManager')),
+    __metadata("design:paramtypes", [Object, Object, Object])
+], JWTAuthenticationChecker);
+export { JWTAuthenticationChecker };

package/dist/esm/target/lib/server/PrivateApiKeyAuthenticationChecker.d.ts

@@ -0,0 +1,15 @@
+import type { Configurable, SettingsManager, Worker } from '../../../std/index.js';
+import type { UCAuth } from '../../../uc/index.js';
+import type { ServerManagerSettings } from './ServerManager.js';
+interface Input {
+    rawValue: string | undefined;
+}
+type Output = UCAuth;
+type S = Pick<ServerManagerSettings, 'server_private_api_key_entries'>;
+export declare class PrivateApiKeyAuthenticationChecker implements Configurable<S>, Worker<Input, Promise<Output | null>> {
+    private settingsManager;
+    constructor(settingsManager: SettingsManager<S>);
+    s(): S;
+    exec({ rawValue }: Input): Promise<Output | null>;
+}
+export {};