nestjs-keycloak-auth 1.0.0

package/dist/services/keycloak-admin.service.js

@@ -0,0 +1,268 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var KeycloakAdminService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakAdminService = void 0;
+const crypto = __importStar(require("crypto"));
+const jwks_cache_service_1 = require("./jwks-cache.service");
+const keycloak_token_1 = require("../token/keycloak-token");
+const common_1 = require("@nestjs/common");
+const backchannel_logout_service_1 = require("./backchannel-logout.service");
+const token_validation_service_1 = require("./token-validation.service");
+const errors_1 = require("../errors");
+const keycloak_multitenant_service_1 = require("./keycloak-multitenant.service");
+const constants_1 = require("../constants");
+/**
+ * Encapsulates all business logic for Keycloak admin callbacks:
+ * push-not-before policy and OIDC back-channel logout.
+ */
+let KeycloakAdminService = KeycloakAdminService_1 = class KeycloakAdminService {
+    constructor(tenantConfig, keycloakOpts, multiTenant, tokenValidation, jwksCache, backchannelLogoutService) {
+        this.tenantConfig = tenantConfig;
+        this.keycloakOpts = keycloakOpts;
+        this.multiTenant = multiTenant;
+        this.tokenValidation = tokenValidation;
+        this.jwksCache = jwksCache;
+        this.backchannelLogoutService = backchannelLogoutService;
+        this.logger = new common_1.Logger(KeycloakAdminService_1.name);
+    }
+    /**
+    * Process a push-not-before admin callback.
+    * Verifies the token signature and updates the not-before policy.
+    */
+    processPushNotBefore(body, request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const payload = this.extractAdminPayload(body, request);
+            if (!payload) {
+                throw new errors_1.KeycloakConfigError('invalid token');
+            }
+            const token = new keycloak_token_1.KeycloakToken(payload);
+            if (!token.signed) {
+                throw new errors_1.KeycloakConfigError('invalid token');
+            }
+            const tenantConfig = yield this.resolveTenantConfig(request, token);
+            yield this.verifySignature(token, tenantConfig.realmUrl);
+            if (token.isExpired()) {
+                throw new errors_1.KeycloakAdminError('admin request failed: token expired');
+            }
+            if (token.content.action !== 'PUSH_NOT_BEFORE') {
+                throw new errors_1.KeycloakConfigError('unsupported action');
+            }
+            if (typeof token.content.notBefore !== 'number') {
+                throw new errors_1.KeycloakConfigError('invalid token');
+            }
+            this.tokenValidation.setNotBefore(token.content.notBefore, tenantConfig.realmUrl);
+            this.logger.log(`Push not-before (${tenantConfig.realm}): notBefore set to ${token.content.notBefore}`);
+        });
+    }
+    /**
+    * Process an OIDC back-channel logout token.
+    * Verifies signature, validates claims, and revokes the session/user.
+    */
+    processBackchannelLogout(body, request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const logoutTokenRaw = this.extractLogoutToken(body);
+            if (!logoutTokenRaw) {
+                throw new errors_1.KeycloakConfigError('invalid logout token');
+            }
+            const token = new keycloak_token_1.KeycloakToken(logoutTokenRaw);
+            if (!token.signed) {
+                throw new errors_1.KeycloakConfigError('invalid logout token');
+            }
+            const tenantConfig = yield this.resolveTenantConfig(request, token);
+            yield this.verifySignature(token, tenantConfig.realmUrl);
+            if (token.isExpired()) {
+                throw new errors_1.KeycloakAdminError('admin request failed: logout token expired');
+            }
+            // Validate typ is "logout+jwt" or "JWT" (per OIDC Back-Channel Logout spec)
+            const typ = (_a = token.header) === null || _a === void 0 ? void 0 : _a.typ;
+            if (typ !== 'logout+jwt' && typ !== 'JWT') {
+                throw new errors_1.KeycloakConfigError('invalid logout token type');
+            }
+            // Validate events claim contains back-channel logout event
+            const events = (_b = token.content) === null || _b === void 0 ? void 0 : _b.events;
+            if (!events ||
+                typeof events !== 'object' ||
+                !('http://schemas.openid.net/event/backchannel-logout' in events)) {
+                throw new errors_1.KeycloakConfigError('missing backchannel-logout event');
+            }
+            const sid = typeof token.content.sid === 'string'
+                ? token.content.sid
+                : undefined;
+            const sub = typeof token.content.sub === 'string'
+                ? token.content.sub
+                : undefined;
+            if (!sid && !sub) {
+                throw new errors_1.KeycloakConfigError('logout token must contain sid or sub');
+            }
+            this.backchannelLogoutService.revoke(sid, sub);
+            this.logger.log(`Back-channel logout processed: sid=${sid || 'n/a'}, sub=${sub || 'n/a'}`);
+        });
+    }
+    extractAdminPayload(body, request) {
+        if (typeof body === 'string' && body.trim() !== '') {
+            return body.trim();
+        }
+        if (Buffer.isBuffer(body) && body.length > 0) {
+            return body.toString('utf8').trim();
+        }
+        if (typeof request.rawBody === 'string' && request.rawBody.trim() !== '') {
+            return request.rawBody.trim();
+        }
+        if (Buffer.isBuffer(request.rawBody) && request.rawBody.length > 0) {
+            return request.rawBody.toString('utf8').trim();
+        }
+        if (body && typeof body === 'object') {
+            const map = body;
+            if (typeof map.token === 'string' && map.token.trim() !== '') {
+                return map.token.trim();
+            }
+            // URL-encoded bodies can be parsed as { "<jwt>": "" }.
+            const keys = Object.keys(map);
+            if (keys.length === 1 && map[keys[0]] === '') {
+                return keys[0];
+            }
+        }
+        return null;
+    }
+    extractLogoutToken(body) {
+        if (body && typeof body === 'object') {
+            const map = body;
+            if (typeof map.logout_token === 'string' &&
+                map.logout_token.trim() !== '') {
+                return map.logout_token.trim();
+            }
+        }
+        return null;
+    }
+    verifySignature(token, realmUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const kid = token.header && typeof token.header.kid === 'string'
+                ? token.header.kid
+                : undefined;
+            if (!kid) {
+                throw new errors_1.KeycloakAdminError('admin request failed: missing token kid');
+            }
+            let key;
+            try {
+                key = yield this.jwksCache.getKey(realmUrl, kid);
+            }
+            catch (err) {
+                throw new errors_1.KeycloakAdminError(`failed to load public key to verify token. Reason: ${err}`);
+            }
+            const alg = token.header && typeof token.header.alg === 'string'
+                ? token.header.alg
+                : 'RS256';
+            if (!KeycloakAdminService_1.ALLOWED_ALGS.has(alg)) {
+                throw new errors_1.KeycloakAdminError(`admin request failed: unsupported token algorithm: ${alg}`);
+            }
+            if (!this.verifyTokenSignature(token.signed, token.signature, key, alg)) {
+                throw new errors_1.KeycloakAdminError('admin request failed: invalid token (signature)');
+            }
+        });
+    }
+    verifyTokenSignature(signed, signature, key, jwtAlg) {
+        const hashMap = {
+            RS256: 'SHA256', RS384: 'SHA384', RS512: 'SHA512',
+            ES256: 'SHA256', ES384: 'SHA384', ES512: 'SHA512',
+            PS256: 'SHA256', PS384: 'SHA384', PS512: 'SHA512',
+        };
+        const hash = hashMap[jwtAlg] || 'SHA256';
+        if (jwtAlg.startsWith('PS')) {
+            return crypto.verify(hash, Buffer.from(signed), { key, padding: crypto.constants.RSA_PKCS1_PSS_PADDING }, signature);
+        }
+        // crypto.verify() auto-detects key type (RSA vs EC) from the KeyObject
+        return crypto.verify(hash, Buffer.from(signed), key, signature);
+    }
+    resolveTenantConfig(request, token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if ((_a = this.keycloakOpts.multiTenant) === null || _a === void 0 ? void 0 : _a.realmResolver) {
+                try {
+                    const resolvedRealm = this.keycloakOpts.multiTenant.realmResolver(request);
+                    const realm = resolvedRealm instanceof Promise
+                        ? yield resolvedRealm
+                        : resolvedRealm;
+                    if (!realm) {
+                        throw new errors_1.KeycloakConfigError('admin request failed: realm resolver returned an empty realm');
+                    }
+                    return yield this.multiTenant.get(realm, request);
+                }
+                catch (err) {
+                    if (err instanceof errors_1.KeycloakConfigError) {
+                        throw err;
+                    }
+                    throw new errors_1.KeycloakConfigError(`admin request failed: cannot resolve tenant config. Reason: ${err}`);
+                }
+            }
+            // Single-tenant configured realm: use static tenant config.
+            if (this.keycloakOpts.realm) {
+                return this.tenantConfig;
+            }
+            // Do NOT fall back to the token's iss claim — an attacker from a
+            // different realm on the same Keycloak server could forge admin
+            // callbacks by setting iss to their own realm.
+            throw new errors_1.KeycloakConfigError('admin request failed: cannot resolve realm — configure realm or multiTenant.realmResolver for admin callbacks');
+        });
+    }
+};
+exports.KeycloakAdminService = KeycloakAdminService;
+KeycloakAdminService.ALLOWED_ALGS = new Set([
+    'RS256', 'RS384', 'RS512',
+    'ES256', 'ES384', 'ES512',
+    'PS256', 'PS384', 'PS512',
+]);
+exports.KeycloakAdminService = KeycloakAdminService = KeycloakAdminService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_INSTANCE)),
+    __param(1, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __param(2, (0, common_1.Inject)(constants_1.KEYCLOAK_MULTITENANT_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, keycloak_multitenant_service_1.KeycloakMultiTenantService,
+        token_validation_service_1.TokenValidationService,
+        jwks_cache_service_1.JwksCacheService,
+        backchannel_logout_service_1.BackchannelLogoutService])
+], KeycloakAdminService);

package/dist/services/keycloak-grant.service.d.ts

@@ -0,0 +1,23 @@
+import { KeycloakGrant } from '../token/keycloak-grant';
+import { TokenValidationService } from './token-validation.service';
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
+/**
+ * Service for creating and validating Keycloak grants.
+ * Bearer-only: no refresh token or ID token handling.
+ */
+export declare class KeycloakGrantService {
+    private readonly keycloakOpts;
+    private readonly tokenValidation;
+    private readonly logger;
+    private readonly clientId;
+    constructor(keycloakOpts: KeycloakAuthConfig, tokenValidation: TokenValidationService);
+    /**
+    * Create a Grant object from raw JSON data (string or object).
+    * Parses the access token and validates.
+    */
+    createGrant(rawData: string | Record<string, unknown>, realmUrl: string, clientId?: string, secret?: string): Promise<KeycloakGrant>;
+    /**
+    * Validate the access token in a grant.
+    */
+    validateGrant(grant: KeycloakGrant, realmUrl: string, clientId?: string): Promise<KeycloakGrant>;
+}

package/dist/services/keycloak-grant.service.js

@@ -0,0 +1,88 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var KeycloakGrantService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakGrantService = void 0;
+const errors_1 = require("../errors");
+const constants_1 = require("../constants");
+const keycloak_grant_1 = require("../token/keycloak-grant");
+const keycloak_token_1 = require("../token/keycloak-token");
+const common_1 = require("@nestjs/common");
+const token_validation_service_1 = require("./token-validation.service");
+/**
+ * Service for creating and validating Keycloak grants.
+ * Bearer-only: no refresh token or ID token handling.
+ */
+let KeycloakGrantService = KeycloakGrantService_1 = class KeycloakGrantService {
+    constructor(keycloakOpts, tokenValidation) {
+        this.keycloakOpts = keycloakOpts;
+        this.tokenValidation = tokenValidation;
+        this.logger = new common_1.Logger(KeycloakGrantService_1.name);
+        this.clientId =
+            this.keycloakOpts.clientId ||
+                this.keycloakOpts['client-id'] ||
+                this.keycloakOpts.resource ||
+                '';
+    }
+    /**
+    * Create a Grant object from raw JSON data (string or object).
+    * Parses the access token and validates.
+    */
+    createGrant(rawData, realmUrl, clientId, secret) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const grantData = (typeof rawData === 'string' ? JSON.parse(rawData) : rawData);
+            const cId = clientId || this.clientId;
+            const grant = new keycloak_grant_1.KeycloakGrant({
+                access_token: grantData.access_token
+                    ? new keycloak_token_1.KeycloakToken(grantData.access_token, cId)
+                    : undefined,
+                expires_in: grantData.expires_in,
+                token_type: grantData.token_type,
+                __raw: typeof rawData === 'string' ? rawData : JSON.stringify(rawData),
+            });
+            yield this.validateGrant(grant, realmUrl, cId);
+            return grant;
+        });
+    }
+    /**
+    * Validate the access token in a grant.
+    */
+    validateGrant(grant, realmUrl, clientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const cId = clientId || this.clientId;
+            if (grant.access_token) {
+                const isValid = yield this.tokenValidation.validateOffline(grant.access_token.token, realmUrl, cId, 'Bearer');
+                if (!isValid) {
+                    throw new errors_1.KeycloakTokenError('Grant validation failed. Reason: invalid access_token');
+                }
+            }
+            return grant;
+        });
+    }
+};
+exports.KeycloakGrantService = KeycloakGrantService;
+exports.KeycloakGrantService = KeycloakGrantService = KeycloakGrantService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object, token_validation_service_1.TokenValidationService])
+], KeycloakGrantService);

package/dist/services/keycloak-http.service.d.ts

@@ -0,0 +1,41 @@
+import { HttpService } from '@nestjs/axios';
+import { OidcDiscoveryService } from './oidc-discovery.service';
+import { JwksResponse } from '../interface/jwks.interface';
+import { KeycloakGrantResponse, KeycloakPermission, KeycloakUserInfoResponse, PermissionCheckOptions } from '../interface/keycloak-grant.interface';
+export declare class KeycloakHttpService {
+    private readonly httpService;
+    private readonly oidcDiscovery;
+    constructor(httpService: HttpService, oidcDiscovery: OidcDiscoveryService);
+    /**
+    * Build authorization headers for token endpoint requests.
+    * Public clients send only client_id in the body; confidential clients
+    * use HTTP Basic auth.
+    */
+    private buildAuthHeaders;
+    /**
+    * Fetch the JWKS (JSON Web Key Set) from the discovered jwks_uri.
+    */
+    fetchJwks(realmUrl: string): Promise<JwksResponse>;
+    /**
+    * Introspect a token using the discovered introspection_endpoint.
+    * Returns the introspection response (with `active` boolean).
+    */
+    introspectToken(realmUrl: string, clientId: string, secret: string, token: string): Promise<{
+        active: boolean;
+        [key: string]: unknown;
+    }>;
+    /**
+    * Obtain a token using the client credentials grant (service account).
+    */
+    obtainClientCredentialsGrant(realmUrl: string, clientId: string, secret: string, scope?: string, isPublic?: boolean): Promise<KeycloakGrantResponse>;
+    /**
+    * Fetch user info from the discovered userinfo_endpoint.
+    */
+    getUserInfo(realmUrl: string, accessToken: string): Promise<KeycloakUserInfoResponse>;
+    /**
+    * Check permissions using the discovered token_endpoint (UMA grant).
+    * Supports response_mode 'decision' (returns boolean), 'permissions'
+    * (returns permission list), and 'token' (returns grant response).
+    */
+    checkPermission(realmUrl: string, clientId: string, secret: string, accessToken: string, permissions: string[], options?: PermissionCheckOptions): Promise<boolean | KeycloakPermission[] | KeycloakGrantResponse>;
+}

package/dist/services/keycloak-http.service.js

@@ -0,0 +1,211 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakHttpService = void 0;
+const rxjs_1 = require("rxjs");
+const axios_1 = require("@nestjs/axios");
+const common_1 = require("@nestjs/common");
+const errors_1 = require("../errors");
+const oidc_discovery_service_1 = require("./oidc-discovery.service");
+const X_CLIENT = 'nestjs-keycloak-auth';
+let KeycloakHttpService = class KeycloakHttpService {
+    constructor(httpService, oidcDiscovery) {
+        this.httpService = httpService;
+        this.oidcDiscovery = oidcDiscovery;
+    }
+    /**
+    * Build authorization headers for token endpoint requests.
+    * Public clients send only client_id in the body; confidential clients
+    * use HTTP Basic auth.
+    */
+    buildAuthHeaders(clientId, secret, isPublic) {
+        const headers = {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            'X-Client': X_CLIENT,
+        };
+        if (!isPublic) {
+            headers.Authorization = `Basic ${Buffer.from(`${clientId}:${secret}`).toString('base64')}`;
+        }
+        return headers;
+    }
+    /**
+    * Fetch the JWKS (JSON Web Key Set) from the discovered jwks_uri.
+    */
+    fetchJwks(realmUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const endpoints = yield this.oidcDiscovery.getEndpoints(realmUrl);
+            const { data } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                url: endpoints.jwks_uri,
+                method: 'GET',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Client': X_CLIENT,
+                },
+                timeout: 10000,
+            }));
+            return data;
+        });
+    }
+    /**
+    * Introspect a token using the discovered introspection_endpoint.
+    * Returns the introspection response (with `active` boolean).
+    */
+    introspectToken(realmUrl, clientId, secret, token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const endpoints = yield this.oidcDiscovery.getEndpoints(realmUrl);
+            const body = new URLSearchParams({
+                client_id: clientId,
+                client_secret: secret,
+                token,
+            }).toString();
+            const { data } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                url: endpoints.introspection_endpoint,
+                method: 'POST',
+                data: body,
+                headers: {
+                    'Content-Type': 'application/x-www-form-urlencoded',
+                    'X-Client': X_CLIENT,
+                },
+                timeout: 10000,
+            }));
+            return data;
+        });
+    }
+    /**
+    * Obtain a token using the client credentials grant (service account).
+    */
+    obtainClientCredentialsGrant(realmUrl_1, clientId_1, secret_1, scope_1) {
+        return __awaiter(this, arguments, void 0, function* (realmUrl, clientId, secret, scope, isPublic = false) {
+            const endpoints = yield this.oidcDiscovery.getEndpoints(realmUrl);
+            const params = new URLSearchParams({
+                grant_type: 'client_credentials',
+                scope: scope || 'openid',
+                client_id: clientId,
+            });
+            const { data } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                url: endpoints.token_endpoint,
+                method: 'POST',
+                data: params.toString(),
+                headers: this.buildAuthHeaders(clientId, secret, isPublic),
+                timeout: 10000,
+            }));
+            return data;
+        });
+    }
+    /**
+    * Fetch user info from the discovered userinfo_endpoint.
+    */
+    getUserInfo(realmUrl, accessToken) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const endpoints = yield this.oidcDiscovery.getEndpoints(realmUrl);
+            const { data } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                url: endpoints.userinfo_endpoint,
+                method: 'GET',
+                headers: {
+                    Authorization: `Bearer ${accessToken}`,
+                    Accept: 'application/json',
+                    'X-Client': X_CLIENT,
+                },
+                timeout: 10000,
+            }));
+            return data;
+        });
+    }
+    /**
+    * Check permissions using the discovered token_endpoint (UMA grant).
+    * Supports response_mode 'decision' (returns boolean), 'permissions'
+    * (returns permission list), and 'token' (returns grant response).
+    */
+    checkPermission(realmUrl, clientId, secret, accessToken, permissions, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const endpoints = yield this.oidcDiscovery.getEndpoints(realmUrl);
+            const responseMode = (options === null || options === void 0 ? void 0 : options.response_mode) || 'decision';
+            const audience = (options === null || options === void 0 ? void 0 : options.audience) || clientId;
+            const isPublic = (_a = options === null || options === void 0 ? void 0 : options.isPublic) !== null && _a !== void 0 ? _a : false;
+            const params = new URLSearchParams({
+                grant_type: 'urn:ietf:params:oauth:grant-type:uma-ticket',
+                audience,
+            });
+            // Only set response_mode for 'decision' and 'permissions';
+            // 'token' mode omits it to get a grant response (matching original behavior)
+            if (responseMode === 'decision' || responseMode === 'permissions') {
+                params.set('response_mode', responseMode);
+            }
+            for (const permission of permissions) {
+                params.append('permission', permission);
+            }
+            if (options === null || options === void 0 ? void 0 : options.claims) {
+                // Keycloak expects every claim value to be a Collection (array).
+                // Normalize scalar values to single-element arrays so consumers
+                // can return plain strings from their claims() functions.
+                const normalized = {};
+                for (const [key, value] of Object.entries(options.claims)) {
+                    normalized[key] = Array.isArray(value) ? value : [value];
+                }
+                params.set('claim_token', Buffer.from(JSON.stringify(normalized)).toString('base64'));
+                params.set('claim_token_format', 'urn:ietf:params:oauth:token-type:jwt');
+            }
+            if (options === null || options === void 0 ? void 0 : options.subject_token) {
+                params.set('subject_token', options.subject_token);
+            }
+            else if (!isPublic) {
+                // Confidential clients send the user bearer as subject_token.
+                params.set('subject_token', accessToken);
+            }
+            try {
+                const headers = isPublic
+                    ? {
+                        Authorization: `Bearer ${accessToken}`,
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        'X-Client': X_CLIENT,
+                    }
+                    : this.buildAuthHeaders(clientId, secret, false);
+                const { data: result } = yield (0, rxjs_1.firstValueFrom)(this.httpService.request({
+                    url: endpoints.token_endpoint,
+                    method: 'POST',
+                    data: params.toString(),
+                    headers,
+                    timeout: 10000,
+                }));
+                if (responseMode === 'decision') {
+                    return (result === null || result === void 0 ? void 0 : result.result) === true;
+                }
+                // 'permissions' and 'token' modes return the raw response
+                if (responseMode === 'permissions') {
+                    return result;
+                }
+                return result;
+            }
+            catch (_b) {
+                if (responseMode === 'decision') {
+                    return false;
+                }
+                throw new errors_1.KeycloakPermissionError('Permission check failed');
+            }
+        });
+    }
+};
+exports.KeycloakHttpService = KeycloakHttpService;
+exports.KeycloakHttpService = KeycloakHttpService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [axios_1.HttpService,
+        oidc_discovery_service_1.OidcDiscoveryService])
+], KeycloakHttpService);

package/dist/services/keycloak-multitenant.service.d.ts

@@ -0,0 +1,24 @@
+import { ResolvedTenantConfig } from '../interface/tenant-config.interface';
+import { KeycloakAuthOptions } from '../interface/keycloak-auth-options.interface';
+/**
+ * Stores resolved tenant configurations for multi-tenant scenarios.
+ */
+export declare class KeycloakMultiTenantService {
+    private keycloakOpts;
+    private configs;
+    constructor(keycloakOpts: KeycloakAuthOptions);
+    /**
+    * Clears the cached tenant configurations.
+    */
+    clear(): void;
+    /**
+    * Retrieves a resolved tenant config based on the realm provided.
+    * @param realm the realm to retrieve from
+    * @param request the request instance, defaults to undefined
+    * @returns the resolved tenant configuration
+    */
+    get(realm: string, request?: unknown): Promise<ResolvedTenantConfig>;
+    resolveAuthServerUrl(realm: string, request?: unknown): Promise<string>;
+    resolveClientId(realm: string, request?: unknown): Promise<string>;
+    resolveSecret(realm: string, request?: unknown): Promise<string>;
+}