nestjs-keycloak-auth 1.0.5 → 1.1.0

package/README.md

@@ -63,6 +63,7 @@ KeycloakAuthModule.register({
   bearerOnly: true,
   policyEnforcement: PolicyEnforcementMode.PERMISSIVE, // optional
   tokenValidation: TokenValidation.ONLINE, // optional
+  backchannelLogoutTtlMs: 24 * 60 * 60 * 1000, // optional, defaults to 24 hours
 });
 ```
 
@@ -98,6 +99,7 @@ export class KeycloakConfigService implements KeycloakAuthOptionsFactory {
       bearerOnly: true,
       policyEnforcement: PolicyEnforcementMode.PERMISSIVE,
       tokenValidation: TokenValidation.ONLINE,
+      backchannelLogoutTtlMs: 24 * 60 * 60 * 1000,
     };
   }
 }
@@ -352,6 +354,7 @@ Current test setup uses Jest + ts-jest and is configured to enforce 100% global
 | tokenValidation   | Sets the token validation method                                           | no       | ONLINE     |
 | multiTenant       | Sets options for [multi-tenant configuration](#multi-tenant-configuration) | no       | -          |
 | roleMerge         | Sets the merge mode for `@Roles` decorator                                | no       | OVERRIDE   |
+| backchannelLogoutTtlMs | TTL for in-memory back-channel logout revocation entries in milliseconds | no | 86400000 |
 
 ### Common Keycloak Config Fields
 

package/dist/interface/keycloak-auth-options.interface.d.ts

@@ -45,6 +45,11 @@ export interface NestKeycloakConfig {
      * Role merging options.
      */
     roleMerge?: RoleMerge;
+    /**
+     * TTL for in-memory back-channel logout revocation entries in milliseconds.
+     * Defaults to 24 hours.
+     */
+    backchannelLogoutTtlMs?: number;
 }
 /**
  * Keycloak Connect options.

package/dist/services/backchannel-logout.service.d.ts

@@ -1,3 +1,4 @@
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
 /**
  * In-memory store tracking revoked sessions and users from
  * OIDC back-channel logout tokens.
@@ -6,10 +7,13 @@
  * (default 24 hours) to prevent unbounded memory growth.
  */
 export declare class BackchannelLogoutService {
+    private readonly keycloakOpts;
     private readonly logger;
+    private static readonly DEFAULT_TTL_MS;
     private readonly revokedSessions;
     private readonly revokedUsers;
     private readonly ttlMs;
+    constructor(keycloakOpts: KeycloakAuthConfig);
     /**
     * Mark a session and/or user as revoked.
     * At least one of `sid` or `sub` must be provided.
@@ -27,4 +31,10 @@ export declare class BackchannelLogoutService {
     * Remove entries older than the TTL to prevent unbounded growth.
     */
     private cleanup;
+    /**
+     * Resolve the TTL for in-memory revocation entries.
+     * Uses `backchannelLogoutTtlMs` when configured with a valid positive number,
+     * otherwise falls back to the default 24-hour retention window.
+     */
+    private resolveTtlMs;
 }

package/dist/services/backchannel-logout.service.js

@@ -5,9 +5,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var BackchannelLogoutService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BackchannelLogoutService = void 0;
+const constants_1 = require("../constants");
 const common_1 = require("@nestjs/common");
 /**
  * In-memory store tracking revoked sessions and users from
@@ -17,11 +24,12 @@ const common_1 = require("@nestjs/common");
  * (default 24 hours) to prevent unbounded memory growth.
  */
 let BackchannelLogoutService = BackchannelLogoutService_1 = class BackchannelLogoutService {
-    constructor() {
+    constructor(keycloakOpts) {
+        this.keycloakOpts = keycloakOpts;
         this.logger = new common_1.Logger(BackchannelLogoutService_1.name);
         this.revokedSessions = new Map(); // sid → revokedAt
         this.revokedUsers = new Map(); // sub → revokedAt
-        this.ttlMs = 24 * 60 * 60 * 1000; // 24 hours
+        this.ttlMs = this.resolveTtlMs();
     }
     /**
     * Mark a session and/or user as revoked.
@@ -93,8 +101,25 @@ let BackchannelLogoutService = BackchannelLogoutService_1 = class BackchannelLog
             }
         }
     }
+    /**
+     * Resolve the TTL for in-memory revocation entries.
+     * Uses `backchannelLogoutTtlMs` when configured with a valid positive number,
+     * otherwise falls back to the default 24-hour retention window.
+     */
+    resolveTtlMs() {
+        const configuredTtl = this.keycloakOpts.backchannelLogoutTtlMs;
+        if (typeof configuredTtl === 'number' &&
+            Number.isFinite(configuredTtl) &&
+            configuredTtl > 0) {
+            return configuredTtl;
+        }
+        return BackchannelLogoutService_1.DEFAULT_TTL_MS;
+    }
 };
 exports.BackchannelLogoutService = BackchannelLogoutService;
+BackchannelLogoutService.DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 exports.BackchannelLogoutService = BackchannelLogoutService = BackchannelLogoutService_1 = __decorate([
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
 ], BackchannelLogoutService);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nestjs-keycloak-auth",
-  "version": "1.0.5",
+  "version": "1.1.0",
   "description": "Keycloak authentication and authorization module for NestJS",
   "author": "B. Joshua Adedigba",
   "contributors": [