nestjs-keycloak-auth 1.0.5 → 1.1.1

package/README.md

@@ -63,6 +63,8 @@ KeycloakAuthModule.register({
   bearerOnly: true,
   policyEnforcement: PolicyEnforcementMode.PERMISSIVE, // optional
   tokenValidation: TokenValidation.ONLINE, // optional
+  backchannelLogoutTtlMs: 24 * 60 * 60 * 1000, // optional, defaults to 24 hours
+  clockSkewSec: 5, // optional, defaults to 0; used by OFFLINE expiration checks
 });
 ```
 
@@ -98,6 +100,8 @@ export class KeycloakConfigService implements KeycloakAuthOptionsFactory {
       bearerOnly: true,
       policyEnforcement: PolicyEnforcementMode.PERMISSIVE,
       tokenValidation: TokenValidation.ONLINE,
+      backchannelLogoutTtlMs: 24 * 60 * 60 * 1000,
+      clockSkewSec: 5,
     };
   }
 }
@@ -346,12 +350,14 @@ Current test setup uses Jest + ts-jest and is configured to enforce 100% global
 
 ### Nest Keycloak Options
 
-| Option            | Description                                                                | Required | Default    |
-| ----------------- | -------------------------------------------------------------------------- | -------- | ---------- |
-| policyEnforcement | Sets the policy enforcement mode                                           | no       | PERMISSIVE |
-| tokenValidation   | Sets the token validation method                                           | no       | ONLINE     |
-| multiTenant       | Sets options for [multi-tenant configuration](#multi-tenant-configuration) | no       | -          |
-| roleMerge         | Sets the merge mode for `@Roles` decorator                                | no       | OVERRIDE   |
+| Option                 | Description                                                              | Required | Default    |
+| ---------------------- | ------------------------------------------------------------------------ | -------- | ---------- |
+| policyEnforcement      | Sets the policy enforcement mode                                         | no       | PERMISSIVE |
+| tokenValidation        | Sets the token validation method                                         | no       | ONLINE     |
+| multiTenant            | Sets options for multi-tenant configuration                              | no       | -          |
+| roleMerge              | Sets the merge mode for `@Roles` decorator                               | no       | OVERRIDE   |
+| backchannelLogoutTtlMs | TTL for in-memory back-channel logout revocation entries in milliseconds | no       | 86400000   |
+| clockSkewSec           | Allowed clock skew for OFFLINE token expiration checks in seconds        | no       | 0          |
 
 ### Common Keycloak Config Fields
 

package/dist/interface/keycloak-auth-options.interface.d.ts

@@ -45,6 +45,16 @@ export interface NestKeycloakConfig {
      * Role merging options.
      */
     roleMerge?: RoleMerge;
+    /**
+     * TTL for in-memory back-channel logout revocation entries in milliseconds.
+     * Defaults to 24 hours.
+     */
+    backchannelLogoutTtlMs?: number;
+    /**
+     * Allowed clock skew for OFFLINE token expiration checks in seconds.
+     * Defaults to 0.
+     */
+    clockSkewSec?: number;
 }
 /**
  * Keycloak Connect options.

package/dist/services/backchannel-logout.service.d.ts

@@ -1,3 +1,4 @@
+import { KeycloakAuthConfig } from '../interface/keycloak-auth-options.interface';
 /**
  * In-memory store tracking revoked sessions and users from
  * OIDC back-channel logout tokens.
@@ -6,10 +7,13 @@
  * (default 24 hours) to prevent unbounded memory growth.
  */
 export declare class BackchannelLogoutService {
+    private readonly keycloakOpts;
     private readonly logger;
+    private static readonly DEFAULT_TTL_MS;
     private readonly revokedSessions;
     private readonly revokedUsers;
     private readonly ttlMs;
+    constructor(keycloakOpts: KeycloakAuthConfig);
     /**
     * Mark a session and/or user as revoked.
     * At least one of `sid` or `sub` must be provided.
@@ -27,4 +31,10 @@ export declare class BackchannelLogoutService {
     * Remove entries older than the TTL to prevent unbounded growth.
     */
     private cleanup;
+    /**
+     * Resolve the TTL for in-memory revocation entries.
+     * Uses `backchannelLogoutTtlMs` when configured with a valid positive number,
+     * otherwise falls back to the default 24-hour retention window.
+     */
+    private resolveTtlMs;
 }

package/dist/services/backchannel-logout.service.js

@@ -5,9 +5,16 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var BackchannelLogoutService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BackchannelLogoutService = void 0;
+const constants_1 = require("../constants");
 const common_1 = require("@nestjs/common");
 /**
  * In-memory store tracking revoked sessions and users from
@@ -17,11 +24,12 @@ const common_1 = require("@nestjs/common");
  * (default 24 hours) to prevent unbounded memory growth.
  */
 let BackchannelLogoutService = BackchannelLogoutService_1 = class BackchannelLogoutService {
-    constructor() {
+    constructor(keycloakOpts) {
+        this.keycloakOpts = keycloakOpts;
         this.logger = new common_1.Logger(BackchannelLogoutService_1.name);
         this.revokedSessions = new Map(); // sid → revokedAt
         this.revokedUsers = new Map(); // sub → revokedAt
-        this.ttlMs = 24 * 60 * 60 * 1000; // 24 hours
+        this.ttlMs = this.resolveTtlMs();
     }
     /**
     * Mark a session and/or user as revoked.
@@ -93,8 +101,25 @@ let BackchannelLogoutService = BackchannelLogoutService_1 = class BackchannelLog
             }
         }
     }
+    /**
+     * Resolve the TTL for in-memory revocation entries.
+     * Uses `backchannelLogoutTtlMs` when configured with a valid positive number,
+     * otherwise falls back to the default 24-hour retention window.
+     */
+    resolveTtlMs() {
+        const configuredTtl = this.keycloakOpts.backchannelLogoutTtlMs;
+        if (typeof configuredTtl === 'number' &&
+            Number.isFinite(configuredTtl) &&
+            configuredTtl > 0) {
+            return configuredTtl;
+        }
+        return BackchannelLogoutService_1.DEFAULT_TTL_MS;
+    }
 };
 exports.BackchannelLogoutService = BackchannelLogoutService;
+BackchannelLogoutService.DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 exports.BackchannelLogoutService = BackchannelLogoutService = BackchannelLogoutService_1 = __decorate([
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.KEYCLOAK_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
 ], BackchannelLogoutService);

package/dist/services/token-validation.service.d.ts

@@ -26,4 +26,5 @@ export declare class TokenValidationService {
     */
     validateOffline(jwt: string, realmUrl: string, clientId?: string, expectedType?: string): Promise<boolean>;
     private verifySignature;
+    private getClockSkewSec;
 }

package/dist/services/token-validation.service.js

@@ -123,7 +123,7 @@ let TokenValidationService = TokenValidationService_1 = class TokenValidationSer
                     return false;
                 }
                 // Check expiry
-                if (token.isExpired()) {
+                if (token.isExpired(this.getClockSkewSec())) {
                     this.logger.verbose('invalid token (expired)');
                     return false;
                 }
@@ -200,6 +200,12 @@ let TokenValidationService = TokenValidationService_1 = class TokenValidationSer
         // crypto.verify() auto-detects key type (RSA vs EC) from the KeyObject
         return crypto.verify(hash, Buffer.from(signed), keyObj, signature);
     }
+    getClockSkewSec() {
+        const clockSkewSec = this.keycloakOpts.clockSkewSec;
+        return typeof clockSkewSec === 'number' && Number.isFinite(clockSkewSec) && clockSkewSec > 0
+            ? clockSkewSec
+            : 0;
+    }
 };
 exports.TokenValidationService = TokenValidationService;
 TokenValidationService.ALLOWED_ALGS = new Set([

package/dist/token/keycloak-token.d.ts

@@ -49,7 +49,7 @@ export declare class KeycloakToken {
     * Check if the token is expired.
     * Matches keycloak-connect's behavior: exp=0 is considered expired.
     */
-    isExpired(): boolean;
+    isExpired(clockSkewSec?: number): boolean;
     /**
     * Get the raw JWT string.
     */

package/dist/token/keycloak-token.js

@@ -92,8 +92,8 @@ class KeycloakToken {
     * Check if the token is expired.
     * Matches keycloak-connect's behavior: exp=0 is considered expired.
     */
-    isExpired() {
-        return this.content.exp * 1000 < Date.now();
+    isExpired(clockSkewSec = 0) {
+        return (this.content.exp + clockSkewSec) * 1000 < Date.now();
     }
     /**
     * Get the raw JWT string.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nestjs-keycloak-auth",
-  "version": "1.0.5",
+  "version": "1.1.1",
   "description": "Keycloak authentication and authorization module for NestJS",
   "author": "B. Joshua Adedigba",
   "contributors": [