prime-sdk 3.0.7-beta.0 → 3.0.7

package/src/lib/entraID/guards/roles.guard.ts

@@ -1,34 +0,0 @@
-import {
-  CanActivate,
-  ExecutionContext,
-  ForbiddenException,
-  Injectable,
-} from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { ROLES_KEY } from '../decorators/roles.decorator';
-
-@Injectable()
-export class RolesGuard implements CanActivate {
-  constructor(private readonly reflector: Reflector) {}
-
-  canActivate(context: ExecutionContext): boolean {
-    const required = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
-      context.getHandler(),
-      context.getClass(),
-    ]);
-
-    if (!required?.length) return true;
-
-    const { user } = context.switchToHttp().getRequest();
-    const userGroups: string[] = (user?.groups ?? []).map(
-      (g: { displayName: string }) => g.displayName,
-    );
-
-    const allowed = required.some((role) => userGroups.includes(role));
-    if (!allowed) {
-      throw new ForbiddenException('INVALID_GROUP');
-    }
-
-    return true;
-  }
-}

package/src/lib/entraID/interfaces/entraID-service.interface.ts

@@ -1,12 +0,0 @@
-import {
-  AuthResult,
-  CallbackParams,
-  UrlRedirectSso,
-} from '../types/entraID.type';
-
-export interface IEntraIDService {
-  handleCallback(params: CallbackParams): Promise<AuthResult>;
-  initiateLogin(): Promise<UrlRedirectSso>;
-  refresh(refreshToken: string): Promise<AuthResult>;
-  logout(userId: string): Promise<void>;
-}

package/src/lib/entraID/internal-token/internal-token.module.ts

@@ -1,8 +0,0 @@
-import { Module } from '@nestjs/common';
-import { InternalTokenService } from './internal-token.service';
-
-@Module({
-  providers: [InternalTokenService],
-  exports: [InternalTokenService],
-})
-export class InternalTokenModule {}

package/src/lib/entraID/internal-token/internal-token.service.ts

@@ -1,66 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { randomUUID } from 'crypto';
-import jwt from 'jsonwebtoken';
-import { ENTRA_ID_CONFIG } from '../entraID.constants';
-import { EntraIDException } from '../customError/entraID.exception';
-import { EntraIDSetup } from '../types/entraID-module-init.types';
-import { EntraUser, TokenEnrichmentContext } from '../types/entraID.type';
-
-@Injectable()
-export class InternalTokenService {
-  constructor(@Inject(ENTRA_ID_CONFIG) private readonly config: EntraIDSetup) {}
-
-  async sign(context: TokenEnrichmentContext): Promise<string> {
-    const customClaims = await this.enrichTokenPayload(context);
-
-    this.assertNoReservedClaimCollision(customClaims);
-
-    return jwt.sign(
-      { jti: randomUUID(), ...context.user, ...customClaims },
-      this.config.jwtSecret,
-      {
-        algorithm: 'HS256',
-        expiresIn: (this.config.jwtExpiresIn ??
-          '8h') as jwt.SignOptions['expiresIn'],
-      },
-    );
-  }
-
-  protected async enrichTokenPayload(
-    _context: TokenEnrichmentContext,
-  ): Promise<Record<string, unknown>> {
-    return {};
-  }
-
-  verify(token: string): EntraUser {
-    try {
-      return jwt.verify(token, this.config.jwtSecret, {
-        algorithms: ['HS256'],
-      }) as unknown as EntraUser;
-    } catch (err) {
-      if (err instanceof jwt.TokenExpiredError) {
-        throw new EntraIDException('TOKEN_EXPIRED');
-      }
-      throw new EntraIDException('TOKEN_INVALID');
-    }
-  }
-
-  private assertNoReservedClaimCollision(
-    customClaims: Record<string, unknown>,
-  ) {
-    const reserved = [
-      'sub',
-      'iss',
-      'aud',
-      'exp',
-      'iat',
-      'nbf',
-      'jti',
-      'groups',
-    ];
-    const collision = reserved.find((claim) => claim in customClaims);
-    if (collision) {
-      throw new EntraIDException('RESERVED_CLAIM_OVERRIDE');
-    }
-  }
-}

package/src/lib/entraID/microsoft/microsoft.module.ts

@@ -1,8 +0,0 @@
-import { Module } from '@nestjs/common';
-import { MicrosoftService } from './microsoft.service';
-
-@Module({
-  providers: [MicrosoftService],
-  exports: [MicrosoftService],
-})
-export class MicrosoftModule {}

package/src/lib/entraID/microsoft/microsoft.service.ts

@@ -1,158 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { EntraIDException } from '../customError/entraID.exception';
-import { AzureTokenResponse, GraphUser } from '../types/entraID.type';
-import { EntraIDSetup } from '../types/entraID-module-init.types';
-import { ENTRA_ID_CONFIG, MICROSOFT_AUTHORITY_URL } from '../entraID.constants';
-
-const GRAPH_BASE = 'https://graph.microsoft.com/v1.0';
-const FETCH_TIMEOUT_MS = 15_000;
-
-@Injectable()
-export class MicrosoftService {
-  constructor(@Inject(ENTRA_ID_CONFIG) private readonly config: EntraIDSetup) {}
-
-  async exchangeCode(code: string): Promise<AzureTokenResponse> {
-    const body = new URLSearchParams({
-      client_id: this.config.clientID,
-      client_secret: this.config.clientSecret,
-      code,
-      redirect_uri: this.config.redirectUri,
-      grant_type: 'authorization_code',
-      scope:
-        this.config.scope ??
-        'openid profile email User.Read GroupMember.Read.All',
-    });
-
-    const authorityUrl = this.config.authorityUrl ?? MICROSOFT_AUTHORITY_URL;
-
-    const response = await fetch(
-      `${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      },
-    );
-
-    if (!response.ok) throw new EntraIDException('CODE_EXCHANGE_FAILED');
-
-    const tokens = (await response.json()) as AzureTokenResponse;
-
-    if (!tokens.access_token || !tokens.id_token) {
-      throw new EntraIDException('CODE_EXCHANGE_FAILED');
-    }
-
-    return tokens;
-  }
-
-  async refreshToken(refreshToken: string): Promise<AzureTokenResponse> {
-    const body = new URLSearchParams({
-      client_id: this.config.clientID,
-      client_secret: this.config.clientSecret,
-      refresh_token: refreshToken,
-      grant_type: 'refresh_token',
-    });
-
-    const authorityUrl = this.config.authorityUrl ?? MICROSOFT_AUTHORITY_URL;
-
-    const response = await fetch(
-      `${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      },
-    );
-
-    if (!response.ok) throw new EntraIDException('REFRESH_TOKEN_FAILED');
-
-    const tokens = (await response.json()) as AzureTokenResponse;
-
-    if (!tokens.access_token)
-      throw new EntraIDException('REFRESH_TOKEN_FAILED');
-
-    return tokens;
-  }
-
-  // Requer Application permission "User.RevokeSessions.All"
-  async revokeUserSessions(userId: string): Promise<void> {
-    const adminToken = await this.getClientCredentialsToken();
-
-    const response = await fetch(
-      `${GRAPH_BASE}/users/${userId}/revokeSignInSessions`,
-      {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${adminToken}` },
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      },
-    );
-
-    if (!response.ok) throw new EntraIDException('REVOKE_SESSIONS_FAILED');
-  }
-
-  private async getClientCredentialsToken(): Promise<string> {
-    const authorityUrl = this.config.authorityUrl ?? MICROSOFT_AUTHORITY_URL;
-
-    const body = new URLSearchParams({
-      client_id: this.config.clientID,
-      client_secret: this.config.clientSecret,
-      scope: 'https://graph.microsoft.com/.default',
-      grant_type: 'client_credentials',
-    });
-
-    const response = await fetch(
-      `${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`,
-      {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: body.toString(),
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      },
-    );
-
-    if (!response.ok) throw new EntraIDException('REVOKE_SESSIONS_FAILED');
-
-    const data = (await response.json()) as { access_token: string };
-    return data.access_token;
-  }
-
-  async getMe(accessToken: string): Promise<GraphUser> {
-    const response = await fetch(
-      `${GRAPH_BASE}/me?$select=id,displayName,mail,userPrincipalName,employeeId`,
-      {
-        headers: { Authorization: `Bearer ${accessToken}` },
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      },
-    );
-
-    if (!response.ok) throw new EntraIDException('GRAPH_FETCH_FAILED');
-
-    return (await response.json()) as GraphUser;
-  }
-
-  async getMemberOf(accessToken: string): Promise<{ displayName: string }[]> {
-    const allGroups: { displayName: string }[] = [];
-    let url: string | null =
-      `${GRAPH_BASE}/me/memberOf?$select=displayName&$top=100`;
-
-    while (url) {
-      const response = await fetch(url, {
-        headers: { Authorization: `Bearer ${accessToken}` },
-        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-      });
-      if (!response.ok) throw new EntraIDException('GRAPH_FETCH_FAILED');
-
-      const data = (await response.json()) as {
-        value: { displayName: string }[];
-        '@odata.nextLink'?: string;
-      };
-
-      allGroups.push(...data.value);
-      url = data['@odata.nextLink'] ?? null;
-    }
-
-    return allGroups;
-  }
-}

package/src/lib/entraID/security/security.module.ts

@@ -1,8 +0,0 @@
-import { Module } from '@nestjs/common';
-import { SecurityService } from './security.service';
-
-@Module({
-  providers: [SecurityService],
-  exports: [SecurityService],
-})
-export class SecurityModule {}

package/src/lib/entraID/security/security.service.ts

@@ -1,68 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { EntraIDException } from '../customError/entraID.exception';
-
-const PATH_TRAVERSAL_PATTERNS = [
-  /\.\.[/\\]/,
-  /\.\.[/\\].*\.\.[/\\]/,
-  /%2e%2e[/\\]/i,
-  /%2e%2e%2f/i,
-  /%2e%2e%5c/i,
-];
-
-const NULL_BYTE_PATTERN = /\0|%00/;
-
-const DANGEROUS_CHARS = /<|>|"|'|`|\$\{|javascript:/i;
-
-@Injectable()
-export class SecurityService {
-  validateInput(value: string, field = 'input'): string {
-    if (NULL_BYTE_PATTERN.test(value)) {
-      throw new EntraIDException('SECURITY_NULL_BYTE');
-    }
-
-    if (PATH_TRAVERSAL_PATTERNS.some((p) => p.test(value))) {
-      throw new EntraIDException('SECURITY_PATH_TRAVERSAL');
-    }
-
-    if (DANGEROUS_CHARS.test(value)) {
-      throw new EntraIDException('SECURITY_INVALID_CHARS');
-    }
-
-    void field;
-    return value.trim();
-  }
-
-  validateRedirectUri(uri: string, allowedUri: string): void {
-    try {
-      const parsed = new URL(uri);
-      const allowed = new URL(allowedUri);
-
-      if (
-        parsed.hostname !== allowed.hostname ||
-        parsed.protocol !== allowed.protocol
-      ) {
-        throw new EntraIDException('SECURITY_OPEN_REDIRECT');
-      }
-    } catch (err) {
-      if (err instanceof EntraIDException) throw err;
-      throw new EntraIDException('SECURITY_INVALID_URL');
-    }
-  }
-
-  validateCallbackParams(params: {
-    code?: string;
-    state?: string;
-    error?: string;
-  }): void {
-    if (params.error) {
-      throw new EntraIDException('OAUTH_PROVIDER_ERROR');
-    }
-
-    if (!params.code || !params.state) {
-      throw new EntraIDException('OAUTH_MISSING_PARAMS');
-    }
-
-    this.validateInput(params.code, 'code');
-    this.validateInput(params.state, 'state');
-  }
-}

package/src/lib/entraID/types/entraID-module-init.types.ts

@@ -1,25 +0,0 @@
-import {
-  InjectionToken,
-  ModuleMetadata,
-  OptionalFactoryDependency,
-} from '@nestjs/common';
-
-export type EntraIDSetup = {
-  tenantID: string;
-  clientID: string;
-  clientSecret: string;
-  stateSecret: string;
-  scope?: string;
-  prompt?: string;
-  authorityUrl?: string;
-  redirectUri: string;
-
-  jwtSecret: string;
-  jwtExpiresIn?: string | number;
-};
-
-export type EntraIDAsyncOptions = {
-  imports?: ModuleMetadata['imports'];
-  inject?: Array<InjectionToken | OptionalFactoryDependency>;
-  useFactory: (...args: any[]) => EntraIDSetup | Promise<EntraIDSetup>;
-};

package/src/lib/entraID/types/entraID.type.ts

@@ -1,57 +0,0 @@
-export type CreateStateNonce = { nonce: string; state: string };
-
-export type UrlRedirectSso = string;
-
-export type CallbackParams = {
-  code?: string;
-  state?: string;
-  error?: string;
-  error_description?: string;
-};
-
-export type AzureTokenResponse = {
-  access_token: string;
-  id_token: string;
-  refresh_token?: string;
-  token_type: string;
-  expires_in: number;
-};
-
-export type IdTokenPayload = {
-  sub: string;
-  name: string;
-  preferred_username?: string;
-  email?: string;
-  upn?: string;
-  nonce: string;
-  aud: string;
-  iss: string;
-  exp: number;
-};
-
-export type TokenEnrichmentContext = {
-  user: EntraUser;
-  accessToken: string;
-};
-
-export type GraphUser = {
-  id: string;
-  displayName: string;
-  mail: string | null;
-  userPrincipalName: string;
-  employeeId?: string | null;
-};
-
-export type EntraUser = {
-  entraId: string;
-  email: string;
-  name: string;
-  tenantId: string;
-  matricula?: string | null;
-} & Record<string, unknown>;
-
-export type AuthResult = {
-  token: string;
-  user: EntraUser;
-  refreshToken?: string;
-};

package/src/lib/entraID/utils/cookie.utils.ts

@@ -1,50 +0,0 @@
-import { Response } from 'express';
-import { EntraUser } from '../types/entraID.type';
-
-const IS_PRODUCTION = process.env.NODE_ENV === 'production';
-
-const BASE_COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: IS_PRODUCTION,
-  sameSite: (IS_PRODUCTION ? 'none' : 'lax') as 'none' | 'lax',
-  path: '/',
-};
-
-const REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60 * 1000; // 30 dias
-
-export class CookieUtils {
-  static setAuthCookie(
-    res: Response,
-    token: string,
-    refreshToken?: string,
-  ): void {
-    res.cookie('auth_token', token, {
-      ...BASE_COOKIE_OPTIONS,
-      maxAge: 24 * 60 * 60 * 1000,
-    });
-
-    if (refreshToken) {
-      res.cookie('refresh_token', refreshToken, {
-        ...BASE_COOKIE_OPTIONS,
-        maxAge: REFRESH_TOKEN_MAX_AGE,
-      });
-    }
-  }
-
-  static setUserDataCookie(res: Response, user: EntraUser): void {
-    res.cookie('user_data', JSON.stringify(user), {
-      ...BASE_COOKIE_OPTIONS,
-      maxAge: 60 * 1000,
-    });
-  }
-
-  static clearAuthCookies(res: Response): void {
-    const clearOptions = {
-      ...BASE_COOKIE_OPTIONS,
-      maxAge: 0,
-    };
-    res.clearCookie('auth_token', clearOptions);
-    res.clearCookie('user_data', clearOptions);
-    res.clearCookie('refresh_token', clearOptions);
-  }
-}

package/src/lib/entraID/utils/crypto.utils.ts

@@ -1,53 +0,0 @@
-import crypto from 'crypto';
-import { EntraIDException } from '../customError/entraID.exception';
-import jwksClient from 'jwks-rsa';
-
-export class CryptoUtils {
-  static createSignedPayloadWithHMAC(payload: string, secret: string): string {
-    const hash = crypto
-      .createHmac('sha256', secret)
-      .update(payload)
-      .digest('base64url');
-
-    return `${payload}.${hash}`;
-  }
-
-  static generateHash(length: number = 32): string {
-    return crypto.randomBytes(length).toString('hex');
-  }
-
-  static verifyPayloadWithHMAC(parts: string[], secret: string) {
-    if (parts.length !== 2) {
-      throw new EntraIDException('STATE_MISMATCH');
-    }
-
-    const [payload, receivedSig] = parts;
-
-    const expectedSig = crypto
-      .createHmac('sha256', secret)
-      .update(payload)
-      .digest('base64url');
-
-    const sigBuf = new Uint8Array(Buffer.from(receivedSig));
-    const expectedBuf = new Uint8Array(Buffer.from(expectedSig));
-
-    if (
-      sigBuf.length !== expectedBuf.length ||
-      !crypto.timingSafeEqual(sigBuf, expectedBuf)
-    ) {
-      throw new EntraIDException('STATE_MISMATCH');
-    }
-  }
-
-  static async getPublicKeyRsa(
-    kid: string,
-    jwksClientInstance: ReturnType<typeof jwksClient>,
-  ): Promise<crypto.KeyObject> {
-    try {
-      const key = await jwksClientInstance.getSigningKey(kid);
-      return crypto.createPublicKey(key.getPublicKey());
-    } catch {
-      throw new EntraIDException('JWKS_KEY_NOT_FOUND');
-    }
-  }
-}

package/src/lib/entraID/utils/index.ts

@@ -1,2 +0,0 @@
-export { CookieUtils } from './cookie.utils';
-export { TokenUtils } from './token.utils';

package/src/lib/entraID/utils/token.utils.ts

@@ -1,20 +0,0 @@
-import { Request } from 'express';
-import { EntraUser } from '../types/entraID.type';
-
-export class TokenUtils {
-  static extractFromRequest(req: Request): string | undefined {
-    const auth = req.headers.authorization;
-    if (auth?.startsWith('Bearer ')) return auth.slice(7);
-    return req.cookies?.auth_token as string | undefined;
-  }
-
-  static extractUserDataFromCookie(req: Request): EntraUser | null {
-    const raw = req.cookies?.user_data as string | undefined;
-    if (!raw) return null;
-    try {
-      return JSON.parse(raw) as EntraUser;
-    } catch {
-      return null;
-    }
-  }
-}