nestjs-keycloak-auth 1.0.0

package/dist/keycloak-auth.providers.js

@@ -0,0 +1,122 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKeycloakAuthOptionProvider = exports.keycloakProvider = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const errors_1 = require("./errors");
+const keycloak_auth_module_1 = require("./keycloak-auth.module");
+const constants_1 = require("./constants");
+/**
+ * Resolve environment variable references in config values.
+ * Matches keycloak-connect config.js resolveValue() logic.
+ * Supports: ${env.MY_VAR} and ${env.MY_VAR:fallback}
+ */
+function resolveValue(value) {
+    var _a;
+    if (typeof value !== 'string') {
+        return value;
+    }
+    const regex = /^\$\{env\.([^:}]*?)(?::([^}]*))?\}$/;
+    const match = value.match(regex);
+    if (!match) {
+        return value;
+    }
+    const envVar = match[1];
+    const fallbackVal = (_a = match[2]) !== null && _a !== void 0 ? _a : '';
+    const envVal = process.env[envVar];
+    return envVal !== null && envVal !== void 0 ? envVal : fallbackVal;
+}
+/**
+ * Resolves a KeycloakAuthConfig into a ResolvedTenantConfig.
+ */
+const resolveConfig = (opts) => {
+    var _a, _b, _c, _d;
+    const authServerUrl = resolveValue(opts.authServerUrl ||
+        opts['auth-server-url'] ||
+        opts.serverUrl ||
+        opts['server-url'] ||
+        '').replace(/\/+$/, '');
+    const realm = resolveValue(opts.realm || '');
+    const clientId = resolveValue(opts.clientId || opts['client-id'] || opts.resource || '');
+    const secret = resolveValue(opts.secret || (opts.credentials && opts.credentials.secret) || '');
+    const realmUrl = realm ? `${authServerUrl}/realms/${realm}` : authServerUrl;
+    const realmAdminUrl = realm
+        ? `${authServerUrl}/admin/realms/${realm}`
+        : authServerUrl;
+    const isPublic = !!resolveValue((_b = (_a = opts['public-client']) !== null && _a !== void 0 ? _a : opts.public) !== null && _b !== void 0 ? _b : false);
+    const bearerOnly = !!resolveValue((_d = (_c = opts['bearer-only']) !== null && _c !== void 0 ? _c : opts.bearerOnly) !== null && _d !== void 0 ? _d : false);
+    return {
+        authServerUrl,
+        realm,
+        clientId,
+        secret,
+        realmUrl,
+        realmAdminUrl,
+        isPublic,
+        bearerOnly,
+    };
+};
+exports.keycloakProvider = {
+    provide: constants_1.KEYCLOAK_INSTANCE,
+    useFactory: (opts) => {
+        if (typeof opts === 'string') {
+            throw new errors_1.KeycloakConfigError('Keycloak configuration should have been parsed by this point.');
+        }
+        // Warn if using token validation none
+        if (opts.tokenValidation && opts.tokenValidation === constants_1.TokenValidation.NONE) {
+            keycloak_auth_module_1.KeycloakAuthModule.logger.warn('Token validation is disabled, please only do this on development/special use-cases.');
+        }
+        return resolveConfig(opts);
+    },
+    inject: [constants_1.KEYCLOAK_AUTH_OPTIONS],
+};
+const parseConfig = (opts, config) => {
+    if (typeof opts === 'string') {
+        const configPathRelative = path.join(__dirname, opts);
+        const configPathRoot = path.join(process.cwd(), opts);
+        let configPath;
+        if (fs.existsSync(configPathRelative)) {
+            configPath = configPathRelative;
+        }
+        else if (fs.existsSync(configPathRoot)) {
+            configPath = configPathRoot;
+        }
+        else {
+            throw new errors_1.KeycloakConfigError(`Cannot find files, looked in [ ${configPathRelative}, ${configPathRoot} ]`);
+        }
+        const json = fs.readFileSync(configPath);
+        const keycloakConfig = JSON.parse(json.toString());
+        return Object.assign(keycloakConfig, config);
+    }
+    return opts;
+};
+const createKeycloakAuthOptionProvider = (opts, config) => {
+    return {
+        provide: constants_1.KEYCLOAK_AUTH_OPTIONS,
+        useValue: parseConfig(opts, config),
+    };
+};
+exports.createKeycloakAuthOptionProvider = createKeycloakAuthOptionProvider;

package/dist/services/backchannel-logout.service.d.ts

@@ -0,0 +1,30 @@
+/**
+ * In-memory store tracking revoked sessions and users from
+ * OIDC back-channel logout tokens.
+ *
+ * Entries are automatically cleaned up after the configured TTL
+ * (default 24 hours) to prevent unbounded memory growth.
+ */
+export declare class BackchannelLogoutService {
+    private readonly logger;
+    private readonly revokedSessions;
+    private readonly revokedUsers;
+    private readonly ttlMs;
+    /**
+    * Mark a session and/or user as revoked.
+    * At least one of `sid` or `sub` must be provided.
+    */
+    revoke(sid?: string, sub?: string): void;
+    /**
+    * Check whether a session or user has been revoked.
+    * @param sid  Session ID from the token
+    * @param sub  Subject (user ID) from the token
+    * @param iat  Issued-at timestamp (seconds) from the token — tokens issued
+    *             after the revocation are from a new session and should be allowed.
+    */
+    isRevoked(sid?: string, sub?: string, iat?: number): boolean;
+    /**
+    * Remove entries older than the TTL to prevent unbounded growth.
+    */
+    private cleanup;
+}

package/dist/services/backchannel-logout.service.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var BackchannelLogoutService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackchannelLogoutService = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * In-memory store tracking revoked sessions and users from
+ * OIDC back-channel logout tokens.
+ *
+ * Entries are automatically cleaned up after the configured TTL
+ * (default 24 hours) to prevent unbounded memory growth.
+ */
+let BackchannelLogoutService = BackchannelLogoutService_1 = class BackchannelLogoutService {
+    constructor() {
+        this.logger = new common_1.Logger(BackchannelLogoutService_1.name);
+        this.revokedSessions = new Map(); // sid → revokedAt
+        this.revokedUsers = new Map(); // sub → revokedAt
+        this.ttlMs = 24 * 60 * 60 * 1000; // 24 hours
+    }
+    /**
+    * Mark a session and/or user as revoked.
+    * At least one of `sid` or `sub` must be provided.
+    */
+    revoke(sid, sub) {
+        const now = Date.now();
+        if (sid) {
+            this.revokedSessions.set(sid, now);
+            this.logger.log(`Session revoked: ${sid}`);
+        }
+        if (sub) {
+            this.revokedUsers.set(sub, now);
+            this.logger.log(`User revoked: ${sub}`);
+        }
+        this.cleanup();
+    }
+    /**
+    * Check whether a session or user has been revoked.
+    * @param sid  Session ID from the token
+    * @param sub  Subject (user ID) from the token
+    * @param iat  Issued-at timestamp (seconds) from the token — tokens issued
+    *             after the revocation are from a new session and should be allowed.
+    */
+    isRevoked(sid, sub, iat) {
+        const cutoff = Date.now() - this.ttlMs;
+        const issuedAtMs = iat ? iat * 1000 : 0;
+        if (sid) {
+            const revokedAt = this.revokedSessions.get(sid);
+            if (revokedAt !== undefined) {
+                if (revokedAt < cutoff) {
+                    this.revokedSessions.delete(sid);
+                }
+                else {
+                    return true;
+                }
+            }
+        }
+        if (sub) {
+            const revokedAt = this.revokedUsers.get(sub);
+            if (revokedAt !== undefined) {
+                if (revokedAt < cutoff) {
+                    this.revokedUsers.delete(sub);
+                }
+                else if (issuedAtMs > revokedAt) {
+                    // Token was issued after the revocation — new session, allow it
+                    return false;
+                }
+                else {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+    * Remove entries older than the TTL to prevent unbounded growth.
+    */
+    cleanup() {
+        const cutoff = Date.now() - this.ttlMs;
+        for (const [key, revokedAt] of this.revokedSessions) {
+            if (revokedAt < cutoff) {
+                this.revokedSessions.delete(key);
+            }
+        }
+        for (const [key, revokedAt] of this.revokedUsers) {
+            if (revokedAt < cutoff) {
+                this.revokedUsers.delete(key);
+            }
+        }
+    }
+};
+exports.BackchannelLogoutService = BackchannelLogoutService;
+exports.BackchannelLogoutService = BackchannelLogoutService = BackchannelLogoutService_1 = __decorate([
+    (0, common_1.Injectable)()
+], BackchannelLogoutService);

package/dist/services/jwks-cache.service.d.ts

@@ -0,0 +1,25 @@
+/// <reference types="node" />
+import * as crypto from 'crypto';
+import { KeycloakHttpService } from './keycloak-http.service';
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+export declare class JwksCacheService {
+    private readonly keycloakHttp;
+    private readonly logger;
+    private readonly cache;
+    private minTimeBetweenRequestsMs;
+    constructor(keycloakOpts: KeycloakAuthConfig, keycloakHttp: KeycloakHttpService);
+    /**
+    * Set the minimum time between JWKS requests (for rate limiting).
+    */
+    setMinTimeBetweenRequests(ms: number): void;
+    /**
+    * Get the public key for a given realm URL and key ID.
+    * Fetches JWKS if not cached, or if the kid is not found and rate limit allows.
+    */
+    getKey(realmUrl: string, kid: string): Promise<crypto.KeyObject>;
+    /**
+    * Clear all cached JWKS keys. Matches keycloak-connect Rotation.clearCache().
+    */
+    clearCache(): void;
+    private fetchAndCache;
+}

package/dist/services/jwks-cache.service.js

@@ -0,0 +1,130 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var JwksCacheService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksCacheService = void 0;
+const crypto = __importStar(require("crypto"));
+const errors_1 = require("../errors");
+const constants_1 = require("../constants");
+const keycloak_http_service_1 = require("./keycloak-http.service");
+const common_1 = require("@nestjs/common");
+let JwksCacheService = JwksCacheService_1 = class JwksCacheService {
+    constructor(keycloakOpts, keycloakHttp) {
+        var _a;
+        this.keycloakHttp = keycloakHttp;
+        this.logger = new common_1.Logger(JwksCacheService_1.name);
+        this.cache = new Map();
+        // Wire minTimeBetweenJwksRequests from config.
+        // Original keycloak-connect uses seconds (default 10);
+        // we convert to milliseconds internally.
+        const configValue = (_a = keycloakOpts.minTimeBetweenJwksRequests) !== null && _a !== void 0 ? _a : keycloakOpts['min-time-between-jwks-requests'];
+        this.minTimeBetweenRequestsMs =
+            configValue != null ? configValue * 1000 : 10000;
+    }
+    /**
+    * Set the minimum time between JWKS requests (for rate limiting).
+    */
+    setMinTimeBetweenRequests(ms) {
+        this.minTimeBetweenRequestsMs = ms;
+    }
+    /**
+    * Get the public key for a given realm URL and key ID.
+    * Fetches JWKS if not cached, or if the kid is not found and rate limit allows.
+    */
+    getKey(realmUrl, kid) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let cached = this.cache.get(realmUrl);
+            // First fetch
+            if (!cached) {
+                cached = yield this.fetchAndCache(realmUrl);
+            }
+            // Try to find the key
+            let jwk = cached.keys.get(kid);
+            // Key not found — may be key rotation, try refetching if allowed
+            if (!jwk) {
+                const now = Date.now();
+                if (now - cached.fetchedAt >= this.minTimeBetweenRequestsMs) {
+                    this.logger.verbose(`Key '${kid}' not found, refetching JWKS for ${realmUrl}`);
+                    cached = yield this.fetchAndCache(realmUrl);
+                    jwk = cached.keys.get(kid);
+                }
+            }
+            if (!jwk) {
+                throw new errors_1.KeycloakTokenError(`Key '${kid}' not found in JWKS for realm: ${realmUrl}`);
+            }
+            return crypto.createPublicKey({
+                key: jwk,
+                format: 'jwk',
+            });
+        });
+    }
+    /**
+    * Clear all cached JWKS keys. Matches keycloak-connect Rotation.clearCache().
+    */
+    clearCache() {
+        this.cache.clear();
+    }
+    fetchAndCache(realmUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.keycloakHttp.fetchJwks(realmUrl);
+            const keys = new Map();
+            for (const key of response.keys) {
+                if (key.kid) {
+                    keys.set(key.kid, key);
+                }
+            }
+            const cached = { keys, fetchedAt: Date.now() };
+            this.cache.set(realmUrl, cached);
+            return cached;
+        });
+    }
+};
+exports.JwksCacheService = JwksCacheService;
+exports.JwksCacheService = JwksCacheService = JwksCacheService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object, keycloak_http_service_1.KeycloakHttpService])
+], JwksCacheService);

package/dist/services/keycloak-admin.service.d.ts

@@ -0,0 +1,37 @@
+import { JwksCacheService } from './jwks-cache.service';
+import { ServerRequest } from '../interface/server.interface';
+import { BackchannelLogoutService } from './backchannel-logout.service';
+import { TokenValidationService } from './token-validation.service';
+import { ResolvedTenantConfig } from '../interface/tenant-config.interface';
+import { KeycloakMultiTenantService } from './keycloak-multitenant.service';
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+/**
+ * Encapsulates all business logic for Keycloak admin callbacks:
+ * push-not-before policy and OIDC back-channel logout.
+ */
+export declare class KeycloakAdminService {
+    private readonly tenantConfig;
+    private readonly keycloakOpts;
+    private readonly multiTenant;
+    private readonly tokenValidation;
+    private readonly jwksCache;
+    private readonly backchannelLogoutService;
+    private readonly logger;
+    constructor(tenantConfig: ResolvedTenantConfig, keycloakOpts: KeycloakAuthConfig, multiTenant: KeycloakMultiTenantService, tokenValidation: TokenValidationService, jwksCache: JwksCacheService, backchannelLogoutService: BackchannelLogoutService);
+    /**
+    * Process a push-not-before admin callback.
+    * Verifies the token signature and updates the not-before policy.
+    */
+    processPushNotBefore(body: unknown, request: ServerRequest): Promise<void>;
+    /**
+    * Process an OIDC back-channel logout token.
+    * Verifies signature, validates claims, and revokes the session/user.
+    */
+    processBackchannelLogout(body: unknown, request: ServerRequest): Promise<void>;
+    private extractAdminPayload;
+    private extractLogoutToken;
+    private static readonly ALLOWED_ALGS;
+    private verifySignature;
+    private verifyTokenSignature;
+    private resolveTenantConfig;
+}