prime-sdk 3.0.7 → 3.0.8-beta.0

package/dist/lib/entraID/entraID.service.js

@@ -0,0 +1,166 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraIDService = void 0;
+const common_1 = require("@nestjs/common");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const entraID_constants_1 = require("./entraID.constants");
+const internal_token_service_1 = require("./internal-token/internal-token.service");
+const microsoft_service_1 = require("./microsoft/microsoft.service");
+const security_service_1 = require("./security/security.service");
+const entraID_exception_1 = require("./customError/entraID.exception");
+const crypto_utils_1 = require("./utils/crypto.utils");
+const STATE_TTL_MS = 600_000;
+let EntraIDService = class EntraIDService {
+    constructor(config, microsoftService, securityService, internalTokenService) {
+        this.config = config;
+        this.microsoftService = microsoftService;
+        this.securityService = securityService;
+        this.internalTokenService = internalTokenService;
+    }
+    onModuleInit() {
+        const { tenantID, clientID, clientSecret, stateSecret, redirectUri } = this.config;
+        if (!tenantID ||
+            !clientID ||
+            !clientSecret ||
+            !stateSecret ||
+            !redirectUri) {
+            throw new entraID_exception_1.EntraIDException('INVALID_CONFIG');
+        }
+        const authorityUrl = this.config.authorityUrl ?? entraID_constants_1.MICROSOFT_AUTHORITY_URL;
+        this.jwksClientRsa = (0, jwks_rsa_1.default)({
+            jwksUri: `${authorityUrl}/${tenantID}/discovery/v2.0/keys`,
+            cache: true,
+            cacheMaxAge: 10 * 60 * 1000,
+        });
+    }
+    async handleCallback(params) {
+        this.securityService.validateCallbackParams(params);
+        const nonce = this.verifyStateAndReturnNonce(params.state);
+        const tokens = await this.microsoftService.exchangeCode(params.code);
+        const payload = await this.verifyIdToken(tokens.id_token, nonce);
+        const email = payload.preferred_username ?? payload.email ?? payload.upn;
+        if (!email) {
+            throw new entraID_exception_1.EntraIDException('PAYLOAD_ID_TOKEN_INVALID');
+        }
+        const result = await this.buildUserJwt(tokens.access_token, email, payload.name);
+        return { ...result, refreshToken: tokens.refresh_token };
+    }
+    async refresh(refreshToken) {
+        const tokens = await this.microsoftService.refreshToken(refreshToken);
+        const result = await this.buildUserJwt(tokens.access_token, '', '');
+        return { ...result, refreshToken: tokens.refresh_token };
+    }
+    async logout(userId) {
+        await this.microsoftService.revokeUserSessions(userId);
+    }
+    async initiateLogin() {
+        const { state, nonce } = this.createSignedState();
+        const { clientID, redirectUri, tenantID, scope, prompt } = this.config;
+        const authorityUrl = this.config.authorityUrl ?? entraID_constants_1.MICROSOFT_AUTHORITY_URL;
+        const params = new URLSearchParams({
+            client_id: clientID,
+            response_type: 'code',
+            redirect_uri: redirectUri,
+            response_mode: 'form_post',
+            scope: scope ?? 'openid profile email User.Read GroupMember.Read.All',
+            state,
+            nonce,
+            prompt: prompt ?? 'select_account',
+        });
+        return `${authorityUrl}/${tenantID}/oauth2/v2.0/authorize?${params.toString()}`;
+    }
+    decodeLocalToken(token) {
+        return this.internalTokenService.verify(token);
+    }
+    async verifyIdToken(idToken, nonce) {
+        const decoded = jsonwebtoken_1.default.decode(idToken, { complete: true });
+        if (!decoded?.header) {
+            throw new entraID_exception_1.EntraIDException('TOKEN_INVALID_HEADER');
+        }
+        const publicKey = await crypto_utils_1.CryptoUtils.getPublicKeyRsa(decoded.header.kid, this.jwksClientRsa);
+        const expectedIssuers = [
+            `https://login.microsoftonline.com/${this.config.tenantID}/v2.0`,
+            `https://sts.windows.net/${this.config.tenantID}/`,
+        ];
+        const payload = jsonwebtoken_1.default.verify(idToken, publicKey, {
+            algorithms: ['RS256'],
+            audience: this.config.clientID,
+            issuer: expectedIssuers,
+        });
+        if (payload.nonce !== nonce) {
+            throw new entraID_exception_1.EntraIDException('INVALID_NONCE');
+        }
+        return payload;
+    }
+    async buildUserJwt(accessToken, email, name) {
+        const msUser = await this.microsoftService.getMe(accessToken);
+        let groups = [];
+        try {
+            const raw = await this.microsoftService.getMemberOf(accessToken);
+            groups = raw.filter((g) => !!g.displayName);
+        }
+        catch { }
+        const user = {
+            entraId: msUser.id,
+            email: msUser.mail ?? msUser.userPrincipalName ?? email,
+            name: msUser.displayName ?? name,
+            tenantId: this.config.tenantID,
+            matricula: msUser.employeeId,
+            groups,
+        };
+        const token = await this.internalTokenService.sign({ user, accessToken });
+        return { token, user };
+    }
+    createSignedState() {
+        const { stateSecret } = this.config;
+        const nonce = crypto_utils_1.CryptoUtils.generateHash();
+        const payload = Buffer.from(JSON.stringify({ nonce, ts: Date.now() })).toString('base64url');
+        const state = crypto_utils_1.CryptoUtils.createSignedPayloadWithHMAC(payload, stateSecret);
+        return { nonce, state };
+    }
+    verifyStateAndReturnNonce(state) {
+        const { stateSecret } = this.config;
+        const parts = state.split('.');
+        crypto_utils_1.CryptoUtils.verifyPayloadWithHMAC(parts, stateSecret);
+        const payload = parts[0];
+        let nonce;
+        let ts;
+        try {
+            const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString());
+            nonce = parsed.nonce;
+            ts = parsed.ts;
+        }
+        catch {
+            throw new entraID_exception_1.EntraIDException('STATE_MISMATCH');
+        }
+        if (Date.now() - ts > STATE_TTL_MS) {
+            throw new entraID_exception_1.EntraIDException('STATE_MISMATCH');
+        }
+        return nonce;
+    }
+};
+exports.EntraIDService = EntraIDService;
+exports.EntraIDService = EntraIDService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(entraID_constants_1.ENTRA_ID_CONFIG)),
+    __metadata("design:paramtypes", [Object, microsoft_service_1.MicrosoftService,
+        security_service_1.SecurityService,
+        internal_token_service_1.InternalTokenService])
+], EntraIDService);
+//# sourceMappingURL=entraID.service.js.map

package/dist/lib/entraID/entraID.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID.service.js","sourceRoot":"","sources":["../../../src/lib/entraID/entraID.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,gEAAwC;AACxC,wDAAkC;AAClC,2DAA+E;AAC/E,oFAA+E;AAC/E,qEAAiE;AACjE,kEAA8D;AAS9D,uEAAmE;AAEnE,uDAAmD;AAGnD,MAAM,YAAY,GAAG,OAAO,CAAC;AAGtB,IAAM,cAAc,GAApB,MAAM,cAAc;IAGzB,YAC8C,MAAoB,EAC7C,gBAAkC,EAClC,eAAgC,EAChC,oBAA0C;QAHjB,WAAM,GAAN,MAAM,CAAc;QAC7C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,yBAAoB,GAApB,oBAAoB,CAAsB;IAC5D,CAAC;IAEJ,YAAY;QACV,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,GAClE,IAAI,CAAC,MAAM,CAAC;QAEd,IACE,CAAC,QAAQ;YACT,CAAC,QAAQ;YACT,CAAC,YAAY;YACb,CAAC,WAAW;YACZ,CAAC,WAAW,EACZ,CAAC;YACD,MAAM,IAAI,oCAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,2CAAuB,CAAC;QAEzE,IAAI,CAAC,aAAa,GAAG,IAAA,kBAAU,EAAC;YAC9B,OAAO,EAAE,GAAG,YAAY,IAAI,QAAQ,sBAAsB;YAC1D,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAsB;QACzC,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,oCAAgB,CAAC,0BAA0B,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CACpC,MAAM,CAAC,YAAY,EACnB,KAAK,EACL,OAAO,CAAC,IAAI,CACb,CAAC;QACF,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACvE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,2CAAuB,CAAC;QAEzE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,MAAM;YACrB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,WAAW;YAC1B,KAAK,EAAE,KAAK,IAAI,qDAAqD;YACrE,KAAK;YACL,KAAK;YACL,MAAM,EAAE,MAAM,IAAI,gBAAgB;SACnC,CAAC,CAAC;QAEH,OAAO,GAAG,YAAY,IAAI,QAAQ,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClF,CAAC;IAED,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,aAAa,CAC3B,OAAe,EACf,KAAa;QAEb,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAe,CAAC;QAEtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,0BAAW,CAAC,eAAe,CACjD,OAAO,CAAC,MAAM,CAAC,GAAG,EAClB,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,MAAM,eAAe,GAA0B;YAC7C,qCAAqC,IAAI,CAAC,MAAM,CAAC,QAAQ,OAAO;YAChE,2BAA2B,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG;SACnD,CAAC;QAEF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE;YAC7C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAS;YAC/B,MAAM,EAAE,eAAe;SACxB,CAA8B,CAAC;QAEhC,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,oCAAgB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,WAAmB,EACnB,KAAa,EACb,IAAY;QAEZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAE9D,IAAI,MAAM,GAA8B,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,MAAM,IAAI,GAAc;YACtB,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,iBAAiB,IAAI,KAAK;YACvD,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YAChC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,MAAM;SACP,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE1E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAES,iBAAiB;QACzB,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,0BAAW,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAC1C,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,0BAAW,CAAC,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAES,yBAAyB,CAAC,KAAa;QAC/C,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE/B,0BAAW,CAAC,qBAAqB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAEtD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAEzB,IAAI,KAAa,CAAC;QAClB,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CACZ,CAAC;YACnC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACrB,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oCAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,oCAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAtLY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;6CACa,oCAAgB;QACjB,kCAAe;QACV,6CAAoB;GAPpD,cAAc,CAsL1B"}

package/dist/lib/entraID/guards/entra-auth.guard.d.ts

@@ -0,0 +1,21 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import type { Request } from 'express';
+import { InternalTokenService } from '../internal-token/internal-token.service';
+import { EntraUser } from '../types/entraID.type';
+import { Reflector } from '@nestjs/core';
+export declare class EntraAuthGuard implements CanActivate {
+    private readonly internalTokenService;
+    private readonly reflector;
+    constructor(internalTokenService: InternalTokenService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    protected isTokenRevoked(_payload: EntraUser, _request: Request): Promise<boolean>;
+    protected transformPayload(payload: EntraUser): Promise<unknown>;
+    protected extractToken(request: {
+        headers: {
+            authorization?: string;
+        };
+        cookies?: {
+            auth_token?: string;
+        };
+    }): string | undefined;
+}

package/dist/lib/entraID/guards/entra-auth.guard.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const internal_token_service_1 = require("../internal-token/internal-token.service");
+const entraID_exception_1 = require("../customError/entraID.exception");
+const core_1 = require("@nestjs/core");
+const public_decorator_1 = require("../decorators/public.decorator");
+let EntraAuthGuard = class EntraAuthGuard {
+    constructor(internalTokenService, reflector) {
+        this.internalTokenService = internalTokenService;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic)
+            return true;
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractToken(request);
+        if (!token)
+            throw new common_1.UnauthorizedException();
+        let payload;
+        try {
+            payload = this.internalTokenService.verify(token);
+        }
+        catch (error) {
+            if (error instanceof entraID_exception_1.EntraIDException) {
+                throw new common_1.UnauthorizedException(error.message);
+            }
+            throw error;
+        }
+        const revoke = await this.isTokenRevoked(payload, request);
+        if (revoke) {
+            throw new common_1.UnauthorizedException('TOKEN_REVOKED');
+        }
+        request.user = await this.transformPayload(payload);
+        return true;
+    }
+    async isTokenRevoked(_payload, _request) {
+        return false;
+    }
+    async transformPayload(payload) {
+        return payload;
+    }
+    extractToken(request) {
+        const auth = request.headers.authorization;
+        if (auth?.startsWith('Bearer '))
+            return auth.slice(7);
+        return request.cookies?.auth_token;
+    }
+};
+exports.EntraAuthGuard = EntraAuthGuard;
+exports.EntraAuthGuard = EntraAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [internal_token_service_1.InternalTokenService,
+        core_1.Reflector])
+], EntraAuthGuard);
+//# sourceMappingURL=entra-auth.guard.js.map

package/dist/lib/entraID/guards/entra-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entra-auth.guard.js","sourceRoot":"","sources":["../../../../src/lib/entraID/guards/entra-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,qFAAgF;AAChF,wEAAoE;AAEpE,uCAAyC;AACzC,qEAA+D;AAGxD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,oBAA0C,EAC1C,SAAoB;QADpB,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;QAE9C,IAAI,OAAkB,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oCAAgB,EAAE,CAAC;gBACtC,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO,IAAI,CAAC;IACd,CAAC;IAES,KAAK,CAAC,cAAc,CAE5B,QAAmB,EAGnB,QAAiB;QAEjB,OAAO,KAAK,CAAC;IACf,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,OAAkB;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAES,YAAY,CAAC,OAGtB;QACC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC;IACrC,CAAC;CACF,CAAA;AA9DY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAG8B,6CAAoB;QAC/B,gBAAS;GAH5B,cAAc,CA8D1B"}

package/dist/lib/entraID/guards/roles.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class RolesGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/lib/entraID/guards/roles.guard.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const roles_decorator_1 = require("../decorators/roles.decorator");
+let RolesGuard = class RolesGuard {
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const required = this.reflector.getAllAndOverride(roles_decorator_1.ROLES_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!required?.length)
+            return true;
+        const { user } = context.switchToHttp().getRequest();
+        const userGroups = (user?.groups ?? []).map((g) => g.displayName);
+        const allowed = required.some((role) => userGroups.includes(role));
+        if (!allowed) {
+            throw new common_1.ForbiddenException('INVALID_GROUP');
+        }
+        return true;
+    }
+};
+exports.RolesGuard = RolesGuard;
+exports.RolesGuard = RolesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], RolesGuard);
+//# sourceMappingURL=roles.guard.js.map

package/dist/lib/entraID/guards/roles.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../../../src/lib/entraID/guards/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,mEAA0D;AAGnD,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,2BAAS,EAAE;YACrE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,UAAU,GAAa,CAAC,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CACnD,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAC9C,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,2BAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAvBY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,UAAU,CAuBtB"}

package/dist/lib/entraID/interfaces/entraID-service.interface.d.ts

@@ -0,0 +1,7 @@
+import { AuthResult, CallbackParams, UrlRedirectSso } from '../types/entraID.type';
+export interface IEntraIDService {
+    handleCallback(params: CallbackParams): Promise<AuthResult>;
+    initiateLogin(): Promise<UrlRedirectSso>;
+    refresh(refreshToken: string): Promise<AuthResult>;
+    logout(userId: string): Promise<void>;
+}

package/dist/lib/entraID/interfaces/entraID-service.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entraID-service.interface.js.map

package/dist/lib/entraID/interfaces/entraID-service.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID-service.interface.js","sourceRoot":"","sources":["../../../../src/lib/entraID/interfaces/entraID-service.interface.ts"],"names":[],"mappings":""}

package/dist/lib/entraID/internal-token/internal-token.module.d.ts

@@ -0,0 +1,2 @@
+export declare class InternalTokenModule {
+}

package/dist/lib/entraID/internal-token/internal-token.module.js

@@ -0,0 +1,21 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalTokenModule = void 0;
+const common_1 = require("@nestjs/common");
+const internal_token_service_1 = require("./internal-token.service");
+let InternalTokenModule = class InternalTokenModule {
+};
+exports.InternalTokenModule = InternalTokenModule;
+exports.InternalTokenModule = InternalTokenModule = __decorate([
+    (0, common_1.Module)({
+        providers: [internal_token_service_1.InternalTokenService],
+        exports: [internal_token_service_1.InternalTokenService],
+    })
+], InternalTokenModule);
+//# sourceMappingURL=internal-token.module.js.map

package/dist/lib/entraID/internal-token/internal-token.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-token.module.js","sourceRoot":"","sources":["../../../../src/lib/entraID/internal-token/internal-token.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,qEAAgE;AAMzD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IAJ/B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,6CAAoB,CAAC;QACjC,OAAO,EAAE,CAAC,6CAAoB,CAAC;KAChC,CAAC;GACW,mBAAmB,CAAG"}

package/dist/lib/entraID/internal-token/internal-token.service.d.ts

@@ -0,0 +1,10 @@
+import { EntraIDSetup } from '../types/entraID-module-init.types';
+import { EntraUser, TokenEnrichmentContext } from '../types/entraID.type';
+export declare class InternalTokenService {
+    private readonly config;
+    constructor(config: EntraIDSetup);
+    sign(context: TokenEnrichmentContext): Promise<string>;
+    protected enrichTokenPayload(_context: TokenEnrichmentContext): Promise<Record<string, unknown>>;
+    verify(token: string): EntraUser;
+    private assertNoReservedClaimCollision;
+}

package/dist/lib/entraID/internal-token/internal-token.service.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const entraID_constants_1 = require("../entraID.constants");
+const entraID_exception_1 = require("../customError/entraID.exception");
+let InternalTokenService = class InternalTokenService {
+    constructor(config) {
+        this.config = config;
+    }
+    async sign(context) {
+        const customClaims = await this.enrichTokenPayload(context);
+        this.assertNoReservedClaimCollision(customClaims);
+        return jsonwebtoken_1.default.sign({ jti: (0, crypto_1.randomUUID)(), ...context.user, ...customClaims }, this.config.jwtSecret, {
+            algorithm: 'HS256',
+            expiresIn: (this.config.jwtExpiresIn ??
+                '8h'),
+        });
+    }
+    async enrichTokenPayload(_context) {
+        return {};
+    }
+    verify(token) {
+        try {
+            return jsonwebtoken_1.default.verify(token, this.config.jwtSecret, {
+                algorithms: ['HS256'],
+            });
+        }
+        catch (err) {
+            if (err instanceof jsonwebtoken_1.default.TokenExpiredError) {
+                throw new entraID_exception_1.EntraIDException('TOKEN_EXPIRED');
+            }
+            throw new entraID_exception_1.EntraIDException('TOKEN_INVALID');
+        }
+    }
+    assertNoReservedClaimCollision(customClaims) {
+        const reserved = [
+            'sub',
+            'iss',
+            'aud',
+            'exp',
+            'iat',
+            'nbf',
+            'jti',
+            'groups',
+        ];
+        const collision = reserved.find((claim) => claim in customClaims);
+        if (collision) {
+            throw new entraID_exception_1.EntraIDException('RESERVED_CLAIM_OVERRIDE');
+        }
+    }
+};
+exports.InternalTokenService = InternalTokenService;
+exports.InternalTokenService = InternalTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(entraID_constants_1.ENTRA_ID_CONFIG)),
+    __metadata("design:paramtypes", [Object])
+], InternalTokenService);
+//# sourceMappingURL=internal-token.service.js.map

package/dist/lib/entraID/internal-token/internal-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../../src/lib/entraID/internal-token/internal-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAoC;AACpC,gEAA+B;AAC/B,4DAAuD;AACvD,wEAAoE;AAK7D,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAAsD,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE9E,KAAK,CAAC,IAAI,CAAC,OAA+B;QACxC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAAC;QAElD,OAAO,sBAAG,CAAC,IAAI,CACb,EAAE,GAAG,EAAE,IAAA,mBAAU,GAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,YAAY,EAAE,EACvD,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB;YACE,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY;gBAClC,IAAI,CAAiC;SACxC,CACF,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,kBAAkB,CAChC,QAAgC;QAEhC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC;YACH,OAAO,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;gBAC9C,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAyB,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;gBACzC,MAAM,IAAI,oCAAgB,CAAC,eAAe,CAAC,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,oCAAgB,CAAC,eAAe,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAEO,8BAA8B,CACpC,YAAqC;QAErC,MAAM,QAAQ,GAAG;YACf,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,KAAK;YACL,QAAQ;SACT,CAAC;QACF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,YAAY,CAAC,CAAC;QAClE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,oCAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;CACF,CAAA;AAxDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;;GADzB,oBAAoB,CAwDhC"}

package/dist/lib/entraID/microsoft/microsoft.module.d.ts

@@ -0,0 +1,2 @@
+export declare class MicrosoftModule {
+}

package/dist/lib/entraID/microsoft/microsoft.module.js

@@ -0,0 +1,21 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MicrosoftModule = void 0;
+const common_1 = require("@nestjs/common");
+const microsoft_service_1 = require("./microsoft.service");
+let MicrosoftModule = class MicrosoftModule {
+};
+exports.MicrosoftModule = MicrosoftModule;
+exports.MicrosoftModule = MicrosoftModule = __decorate([
+    (0, common_1.Module)({
+        providers: [microsoft_service_1.MicrosoftService],
+        exports: [microsoft_service_1.MicrosoftService],
+    })
+], MicrosoftModule);
+//# sourceMappingURL=microsoft.module.js.map

package/dist/lib/entraID/microsoft/microsoft.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.module.js","sourceRoot":"","sources":["../../../../src/lib/entraID/microsoft/microsoft.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,2DAAuD;AAMhD,IAAM,eAAe,GAArB,MAAM,eAAe;CAAG,CAAA;AAAlB,0CAAe;0BAAf,eAAe;IAJ3B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,eAAe,CAAG"}

package/dist/lib/entraID/microsoft/microsoft.service.d.ts

@@ -0,0 +1,14 @@
+import { AzureTokenResponse, GraphUser } from '../types/entraID.type';
+import { EntraIDSetup } from '../types/entraID-module-init.types';
+export declare class MicrosoftService {
+    private readonly config;
+    constructor(config: EntraIDSetup);
+    exchangeCode(code: string): Promise<AzureTokenResponse>;
+    refreshToken(refreshToken: string): Promise<AzureTokenResponse>;
+    revokeUserSessions(userId: string): Promise<void>;
+    private getClientCredentialsToken;
+    getMe(accessToken: string): Promise<GraphUser>;
+    getMemberOf(accessToken: string): Promise<{
+        displayName: string;
+    }[]>;
+}