nestjs-keycloak-auth 1.0.0

package/dist/token/keycloak-token.d.ts

@@ -0,0 +1,57 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { JwtContent, JwtHeader } from '../interface/jwt.interface';
+export { JwtContent, JwtHeader };
+export type { JwtPermission } from '../interface/jwt.interface';
+/**
+ * Native KeycloakToken class that replaces keycloak-connect's Token.
+ * Parses a JWT and provides role/permission checking methods.
+ */
+export declare class KeycloakToken {
+    private readonly _token;
+    private readonly clientId?;
+    readonly header: JwtHeader;
+    readonly content: JwtContent;
+    readonly signature: Buffer;
+    readonly signed: string;
+    constructor(_token: string, clientId?: string);
+    /**
+    * The raw JWT string. Matches keycloak-connect's `token.token` property.
+    */
+    get token(): string;
+    /**
+    * Check if the token has a specific role.
+    * Matches keycloak-connect's Token.hasRole() logic:
+    * - "realm:roleName" checks realm_access.roles
+    * - "clientId:roleName" checks resource_access[clientId].roles
+    * - "roleName" checks resource_access[this.clientId].roles
+    */
+    hasRole(name: string): boolean;
+    /**
+    * Check if the token has a realm-level role.
+    */
+    hasRealmRole(roleName: string): boolean;
+    /**
+    * Check if the token has an application/client-level role.
+    */
+    hasApplicationRole(clientId: string, roleName: string): boolean;
+    /**
+    * Check if the token has a specific permission (for UMA/resource server).
+    * Matches keycloak-connect's Token.hasPermission() semantics:
+    * - If matching resource found with no scope requested, returns true.
+    * - If matching resource found with scope requested and scopes array
+    *   exists with entries but does NOT include the scope, returns false.
+    * - If matching resource found with scope requested and scopes array
+    *   is empty or absent, returns true (permission is granted without scope restriction).
+    */
+    hasPermission(resource: string, scope?: string): boolean;
+    /**
+    * Check if the token is expired.
+    * Matches keycloak-connect's behavior: exp=0 is considered expired.
+    */
+    isExpired(): boolean;
+    /**
+    * Get the raw JWT string.
+    */
+    toString(): string;
+}

package/dist/token/keycloak-token.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeycloakToken = void 0;
+/**
+ * Native KeycloakToken class that replaces keycloak-connect's Token.
+ * Parses a JWT and provides role/permission checking methods.
+ */
+class KeycloakToken {
+    constructor(_token, clientId) {
+        this._token = _token;
+        this.clientId = clientId;
+        this.header = {};
+        this.content = { exp: 0 };
+        this.signature = Buffer.alloc(0);
+        this.signed = '';
+        if (_token) {
+            try {
+                const parts = _token.split('.');
+                this.header = JSON.parse(Buffer.from(parts[0], 'base64').toString('utf8'));
+                this.content = JSON.parse(Buffer.from(parts[1], 'base64').toString('utf8'));
+                this.signature = Buffer.from(parts[2], 'base64');
+                this.signed = `${parts[0]}.${parts[1]}`;
+            }
+            catch (_a) {
+                // defaults already set above
+            }
+        }
+    }
+    /**
+    * The raw JWT string. Matches keycloak-connect's `token.token` property.
+    */
+    get token() {
+        return this._token;
+    }
+    /**
+    * Check if the token has a specific role.
+    * Matches keycloak-connect's Token.hasRole() logic:
+    * - "realm:roleName" checks realm_access.roles
+    * - "clientId:roleName" checks resource_access[clientId].roles
+    * - "roleName" checks resource_access[this.clientId].roles
+    */
+    hasRole(name) {
+        if (!this.clientId) {
+            return false;
+        }
+        const parts = name.split(':');
+        if (parts.length === 1) {
+            // No prefix — check the default client's resource_access
+            return this.hasApplicationRole(this.clientId, parts[0]);
+        }
+        if (parts[0] === 'realm') {
+            return this.hasRealmRole(parts[1]);
+        }
+        return this.hasApplicationRole(parts[0], parts[1]);
+    }
+    /**
+    * Check if the token has a realm-level role.
+    */
+    hasRealmRole(roleName) {
+        var _a, _b, _c;
+        return (_c = (_b = (_a = this.content.realm_access) === null || _a === void 0 ? void 0 : _a.roles) === null || _b === void 0 ? void 0 : _b.includes(roleName)) !== null && _c !== void 0 ? _c : false;
+    }
+    /**
+    * Check if the token has an application/client-level role.
+    */
+    hasApplicationRole(clientId, roleName) {
+        var _a, _b, _c, _d;
+        return ((_d = (_c = (_b = (_a = this.content.resource_access) === null || _a === void 0 ? void 0 : _a[clientId]) === null || _b === void 0 ? void 0 : _b.roles) === null || _c === void 0 ? void 0 : _c.includes(roleName)) !== null && _d !== void 0 ? _d : false);
+    }
+    /**
+    * Check if the token has a specific permission (for UMA/resource server).
+    * Matches keycloak-connect's Token.hasPermission() semantics:
+    * - If matching resource found with no scope requested, returns true.
+    * - If matching resource found with scope requested and scopes array
+    *   exists with entries but does NOT include the scope, returns false.
+    * - If matching resource found with scope requested and scopes array
+    *   is empty or absent, returns true (permission is granted without scope restriction).
+    */
+    hasPermission(resource, scope) {
+        var _a, _b, _c;
+        const match = (_b = (_a = this.content.authorization) === null || _a === void 0 ? void 0 : _a.permissions) === null || _b === void 0 ? void 0 : _b.find((p) => p.rsid === resource || p.rsname === resource);
+        if (!match) {
+            return false;
+        }
+        // Scope requested and the permission has an explicit scope list that doesn't include it
+        if (scope && ((_c = match.scopes) === null || _c === void 0 ? void 0 : _c.length) > 0 && !match.scopes.includes(scope)) {
+            return false;
+        }
+        return true;
+    }
+    /**
+    * Check if the token is expired.
+    * Matches keycloak-connect's behavior: exp=0 is considered expired.
+    */
+    isExpired() {
+        return this.content.exp * 1000 < Date.now();
+    }
+    /**
+    * Get the raw JWT string.
+    */
+    toString() {
+        return this._token;
+    }
+}
+exports.KeycloakToken = KeycloakToken;

package/dist/types/conditional-scope.type.d.ts

@@ -0,0 +1,2 @@
+import { KeycloakToken } from '../token/keycloak-token';
+export type ConditionalScopeFn = (request: unknown, token: KeycloakToken) => string[];

package/dist/types/conditional-scope.type.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/util.d.ts

@@ -0,0 +1,3 @@
+import { JwtPayload } from './interface/jwt.interface';
+export { JwtPayload };
+export declare const parseToken: (token: string) => JwtPayload;

package/dist/util.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseToken = void 0;
+const errors_1 = require("./errors");
+const parseToken = (token) => {
+    const parts = token.split('.');
+    if (parts.length < 2) {
+        throw new errors_1.KeycloakTokenError('Malformed JWT: expected at least 2 segments');
+    }
+    try {
+        return JSON.parse(Buffer.from(parts[1], 'base64').toString());
+    }
+    catch (_a) {
+        throw new errors_1.KeycloakTokenError('Malformed JWT: payload is not valid JSON');
+    }
+};
+exports.parseToken = parseToken;

package/package.json

@@ -0,0 +1,130 @@
+{
+  "name": "nestjs-keycloak-auth",
+  "version": "1.0.0",
+  "description": "Keycloak authentication and authorization module for NestJS",
+  "author": "B. Joshua Adedigba",
+  "contributors": [
+    {
+      "name": "B. Joshua Adedigba",
+      "email": "tbannaarr@gmail.com",
+      "url": "https://github.com/bannaarr01"
+    }
+  ],
+  "license": "MIT",
+  "scripts": {
+    "start:dev": "tsc -w",
+    "clean": "rimraf dist",
+    "build": "tsc",
+    "test": "jest",
+    "test:cov": "jest --coverage --runInBand",
+    "release": "release-it",
+    "release:alpha": "release-it --preReleaseId=alpha --npm.tag=next --github.preRelease",
+    "format": "prettier src --write",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "prepare": "husky"
+  },
+  "keywords": [
+    "nestjs",
+    "nest",
+    "keycloak",
+    "nest-keycloak",
+    "keycloak-nest",
+    "typescript",
+    "authentication",
+    "authorization",
+    "oauth2",
+    "openid-connect",
+    "oidc",
+    "rbac",
+    "guard",
+    "uma",
+    "multi-tenant",
+    "jwt",
+    "sso",
+    "access-control"
+  ],
+  "homepage": "https://github.com/bannaarr01/nestjs-keycloak-auth#readme",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/bannaarr01/nestjs-keycloak-auth"
+  },
+  "bugs": "https://github.com/bannaarr01/nestjs-keycloak-auth/issues",
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "dist/index.d.ts": [
+        "dist/index.d.ts"
+      ],
+      "*": [
+        "dist/*"
+      ]
+    }
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./*": "./dist/*"
+  },
+  "peerDependencies": {
+    "@nestjs/axios": ">=3.0.0",
+    "@nestjs/common": ">=10.0.0 <12.0.0",
+    "@nestjs/core": ">=10.0.0 <12.0.0",
+    "axios": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@nestjs/axios": "^4.0.0",
+    "@nestjs/common": "^11.0.6",
+    "@nestjs/core": "^11.0.6",
+    "@nestjs/graphql": "^13.0.2",
+    "@release-it/conventional-changelog": "^10.0.6",
+    "@types/express": "^4.17.21",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^18.19.23",
+    "axios": "^1.7.0",
+    "class-transformer": "0.5.1",
+    "class-validator": "0.14.1",
+    "cpr": "3.0.1",
+    "eslint": "^9.39.4",
+    "eslint-config-prettier": "9.1.0",
+    "eslint-plugin-prettier": "5.1.3",
+    "eslint-plugin-unused-imports": "^4.4.1",
+    "graphql": "^16.10.0",
+    "husky": "^9.1.7",
+    "jest": "^30.3.0",
+    "lint-staged": "^15.5.2",
+    "prettier": "3.2.5",
+    "reflect-metadata": "0.2.1",
+    "release-it": "^19.2.4",
+    "rimraf": "3.0.2",
+    "rxjs": "7.8.1",
+    "ts-jest": "^29.4.6",
+    "ts-node": "10.8.2",
+    "typescript": "5.4.2",
+    "typescript-eslint": "^8.57.1"
+  },
+  "peerDependenciesMeta": {
+    "@nestjs/axios": {
+      "optional": false
+    },
+    "axios": {
+      "optional": false
+    }
+  },
+  "volta": {
+    "node": "21.7.1"
+  },
+  "lint-staged": {
+    "**/*.ts": [
+      "eslint"
+    ]
+  },
+  "overrides": {
+    "release-it": {
+      "undici": "^7.0.0"
+    }
+  }
+}