prime-sdk 3.0.7 → 3.0.9-beta.0

package/.eslintrc.js

@@ -21,5 +21,9 @@ module.exports = {
     '@typescript-eslint/explicit-function-return-type': 'off',
     '@typescript-eslint/explicit-module-boundary-types': 'off',
     '@typescript-eslint/no-explicit-any': 'off',
+    '@typescript-eslint/no-unused-vars': [
+      'error',
+      { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+    ],
   },
 };

package/README.md

@@ -270,3 +270,310 @@ export class AppService {
 #### Next steps
 
 - Interface for Class to facilite test
+
+---
+
+### EntraID (Microsoft Entra ID / Azure AD)
+
+Módulo de autenticação SSO com Microsoft Entra ID via OAuth 2.0 + OIDC. Emite um JWT interno após validar o token do Azure, evitando expor o `access_token` da Microsoft para o frontend.
+
+#### Pré-requisitos no Azure
+
+No [Portal Azure](https://portal.azure.com), crie um **App Registration** e configure:
+
+| Campo | Valor |
+|---|---|
+| Redirect URI | `https://seu-dominio.com/auth/sso/callback` (tipo: Web) |
+| Client Secret | Gere em **Certificates & secrets** |
+| API Permissions | `openid`, `profile`, `email`, `User.Read`, `User.ReadBasic.All` |
+
+Anote o **Tenant ID**, **Client ID** e **Client Secret**.
+
+#### Variáveis de ambiente
+
+```env
+TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+CLIENT_SECRET=sua-secret-aqui
+REDIRECT_URI=http://localhost:3000/auth/sso/callback
+STATE_SECRET=string-aleatoria-32-chars
+JWT_SECRET=string-aleatoria-32-chars
+JWT_EXPIRES_IN=8h
+```
+
+#### 1. Registrar o módulo
+
+```typescript
+import { EntraIDModule } from 'prime-sdk';
+
+@Module({
+  imports: [
+    EntraIDModule.forRoot({
+      tenantID: process.env.TENANT_ID!,
+      clientID: process.env.CLIENT_ID!,
+      clientSecret: process.env.CLIENT_SECRET!,
+      stateSecret: process.env.STATE_SECRET!, 
+      redirectUri: process.env.REDIRECT_URI!,
+      jwtSecret: process.env.JWT_SECRET!,
+      jwtExpiresIn: process.env.JWT_EXPIRES_IN ?? '8h',
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+Com factory assíncrona (ex: usando `ConfigService`):
+
+```typescript
+EntraIDModule.forRootAsync({
+  imports: [ConfigModule],
+  inject: [ConfigService],
+  useFactory: (config: ConfigService) => ({
+    tenantID: config.get('TENANT_ID')!,
+    clientID: config.get('CLIENT_ID')!,
+    clientSecret: config.get('CLIENT_SECRET')!,
+    stateSecret: config.get('STATE_SECRET')!,
+    redirectUri: config.get('REDIRECT_URI')!,
+    jwtSecret: config.get('JWT_SECRET')!,
+  }),
+}),
+```
+
+O módulo é registrado como **global** — não é necessário importá-lo em outros módulos.
+
+#### 2. Implementar o controller de autenticação
+
+```typescript
+// auth.controller.ts
+import { Controller, Get, Post, Body, Res, HttpCode, Redirect } from '@nestjs/common';
+import { Response } from 'express';
+import { EntraIDService, CallbackParams, CookieUtils } from 'prime-sdk';
+
+@Controller('auth')
+export class AuthController {
+  constructor(private readonly entraService: EntraIDService) {}
+
+  @Get('login')
+  @Redirect()
+  async login() {
+    const url = await this.entraService.initiateLogin();
+    return { url };
+  }
+
+  // Passo 2: a Microsoft faz POST aqui após o login bem-sucedido
+  @Post('sso/callback')
+  @HttpCode(302)
+  @Redirect()
+  async callback(@Body() body: CallbackParams, @Res({ passthrough: true }) res: Response) {
+    const { token, user, refreshToken } = await this.entraService.handleCallback(body);
+
+    CookieUtils.setAuthCookie(res, token);         // cookie httpOnly com o JWT
+    CookieUtils.setUserDataCookie(res, user);
+    if (refreshToken) {
+      res.cookie('refresh_token', refreshToken, { httpOnly: true, path: '/' });
+    }
+
+    return { url: 'http://localhost:9000/dashboard' };
+  }
+
+  // Renovar o JWT usando o refresh token
+  @Post('refresh')
+  @HttpCode(200)
+  async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    const refreshToken = req.cookies?.refresh_token;
+    const { token, user } = await this.entraService.refresh(refreshToken);
+
+    CookieUtils.setAuthCookie(res, token);
+    CookieUtils.setUserDataCookie(res, user);
+    return { user };
+  }
+
+  // Logout: revoga sessões no Azure e limpa cookies
+  @Post('logout')
+  @HttpCode(200)
+  async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
+    const token = req.cookies?.auth_token;
+    if (token) {
+      try {
+        const user = this.entraService.decodeLocalToken(token);
+        await this.entraService.logout(user.id);
+      } catch {}
+    }
+    CookieUtils.clearAuthCookies(res);
+    return { message: 'Logout realizado com sucesso' };
+  }
+}
+```
+
+#### 3. Proteger rotas com `@UseGuards(EntraAuthGuard)`
+
+```typescript
+// profile.controller.ts
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { EntraAuthGuard, CurrentUser, EntraUser } from 'prime-sdk';
+
+@Controller('profile')
+@UseGuards(EntraAuthGuard)   // protege todos os endpoints da classe
+export class ProfileController {
+
+  @Get()
+  getProfile(@CurrentUser() user: EntraUser) {
+    return { user };
+  }
+}
+```
+
+O `EntraAuthGuard` aceita o token via:
+- Header `Authorization: Bearer <token>`
+- Cookie `auth_token` (httpOnly)
+
+#### 4. Controlar acesso por grupos do Azure AD com `@Roles()` e `RolesGuard`
+
+As permissões vêm dos **grupos do Azure AD** aos quais o usuário pertence. Esses grupos são buscados automaticamente pelo SDK via Graph API e incluídos no JWT como `groups[]`. Não é necessário consultar banco de dados para autorização.
+
+```typescript
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { EntraAuthGuard, CurrentUser, EntraUser, RolesGuard, Roles } from 'prime-sdk';
+
+@Controller('pedidos')
+@UseGuards(EntraAuthGuard)
+export class PedidosController {
+
+  @Get()
+  listar(@CurrentUser() user: EntraUser) {
+    return { pedidos: [] };
+  }
+
+  @Get('aprovar')
+  @UseGuards(RolesGuard)
+  @Roles('portal-promo-dpsp-comercial-hml', 'portal-promo-dpsp-price-hml')
+  aprovar(@CurrentUser() user: EntraUser) {
+    // só chega aqui se user.groups[] contiver ao menos um dos grupos acima
+    return { aprovado: true };
+  }
+}
+```
+
+O `RolesGuard` verifica se `user.groups[].displayName` contém **ao menos um** dos grupos declarados em `@Roles()`. Se nenhum grupo bater, retorna **403** com a mensagem indicando quais grupos são necessários.
+
+> Os grupos são gerenciados exclusivamente pelo administrador do Azure AD — sem nenhuma alteração no código da aplicação.
+
+#### 5. Liberar rotas com `@Public()`
+
+Use `@Public()` em um método para que o guard **ignore a autenticação** naquele endpoint específico, mesmo que o controller inteiro seja protegido:
+
+```typescript
+import { Controller, Get, UseGuards } from '@nestjs/common';
+import { EntraAuthGuard, Public } from 'prime-sdk';
+
+@Controller('info')
+@UseGuards(EntraAuthGuard)
+export class InfoController {
+
+  @Get('status')
+  @Public()                  // acessível sem token
+  getStatus() {
+    return { status: 'online', timestamp: new Date().toISOString() };
+  }
+
+  @Get('me')                 // ainda requer autenticação
+  getMe(@CurrentUser() user: EntraUser) {
+    return { user };
+  }
+}
+```
+
+#### 5. Enriquecer o JWT com dados da aplicação
+
+Por padrão o JWT contém: `id`, `email`, `name`, `tenantId`, `matricula` e `groups`.
+
+Para adicionar campos extras (ex: dados do banco de dados consultados pelo email), estenda o `InternalTokenService` e sobrescreva `enrichTokenPayload`:
+
+```typescript
+// custom-token.service.ts
+import { Injectable } from '@nestjs/common';
+import { InternalTokenService, TokenEnrichmentContext } from 'prime-sdk';
+
+@Injectable()
+export class CustomTokenService extends InternalTokenService {
+  protected override async enrichTokenPayload(
+    context: TokenEnrichmentContext,
+  ): Promise<Record<string, unknown>> {
+    // context.user  → dados base do usuário (EntraUser)
+    // context.accessToken → token da Microsoft (para chamadas ao Graph API)
+
+    // Exemplo: lookup no banco usando o email como chave
+    const profile = await this.userRepository.findByEmail(context.user.email);
+
+    return {
+      role: profile?.role ?? 'USER',
+      cargo: profile?.cargo,
+      departamento: profile?.departamento,
+      permissoes: profile?.permissoes ?? [],
+    };
+  }
+}
+```
+
+Registre o serviço customizado na opção `internalTokenService` do `forRoot`:
+
+```typescript
+EntraIDModule.forRoot(
+  {
+    tenantID: process.env.TENANT_ID!,
+    // ... demais configurações
+  },
+  { internalTokenService: CustomTokenService },  // <-- aqui
+),
+```
+
+> **Atenção:** `enrichTokenPayload` não pode retornar claims reservados do JWT (`sub`, `iss`, `aud`, `exp`, `iat`, `nbf`, `jti`). O SDK lança `RESERVED_CLAIM_OVERRIDE` caso isso ocorra.
+
+#### 6. Tipar o usuário enriquecido
+
+Como `EntraUser` usa `& Record<string, unknown>` para os campos extras, crie uma interface própria para ter tipagem completa no seu projeto:
+
+```typescript
+// types/app-user.types.ts
+export interface AppUser {
+  id: string;
+  email: string;
+  name: string;
+  tenantId: string;
+  matricula?: string | null;
+  groups: { displayName: string }[];
+  // campos adicionados pelo CustomTokenService
+  role: 'ADMIN' | 'USER';
+  cargo: string;
+  departamento: string;
+  permissoes: string[];
+}
+```
+
+```typescript
+@Get('profile')
+getProfile(@CurrentUser() user: AppUser) {
+  return user;
+}
+```
+
+#### 7. Referência das exportações
+
+| Exportação | Tipo | Descrição |
+|---|---|---|
+| `EntraIDModule` | Module | Módulo principal — use `forRoot()` ou `forRootAsync()` |
+| `EntraIDService` | Service | `initiateLogin()`, `handleCallback()`, `refresh()`, `logout()`, `decodeLocalToken()` |
+| `EntraAuthGuard` | Guard | Valida o JWT no header ou cookie |
+| `RolesGuard` | Guard | Verifica se `user.groups[]` contém os grupos exigidos por `@Roles()` |
+| `InternalTokenService` | Service | Estenda para enriquecer o JWT via `enrichTokenPayload()` |
+| `CurrentUser` | Decorator | Injeta o usuário autenticado no parâmetro do método |
+| `Public` | Decorator | Marca um endpoint como público, ignorado pelo `EntraAuthGuard` |
+| `Roles` | Decorator | Define os grupos do Azure AD exigidos pelo `RolesGuard` |
+| `CookieUtils` | Class | `setAuthCookie()`, `setUserDataCookie()`, `clearAuthCookies()` |
+| `TokenUtils` | Class | `extractFromRequest()`, `extractUserDataFromCookie()` |
+| `EntraIDException` | Error | Erros tipados do SDK — acesse o código via `.code` |
+| `EntraUser` | Type | Tipo base do usuário no JWT |
+| `EntraIDSetup` | Type | Configuração do `forRoot()` |
+| `TokenEnrichmentContext` | Type | Parâmetro de `enrichTokenPayload()` |
+| `CallbackParams` | Type | Body do callback OAuth (`code`, `state`, `error`) |
+| `AuthResult` | Type | Retorno de `handleCallback()` e `refresh()` |

package/dist/index.d.ts

@@ -20,5 +20,19 @@ import { DocumentsModule } from './lib/documents/documents.module';
 import { Documents } from './lib/documents/documents';
 import { IBedrock, ITextract } from './lib/documents/interfaces/documents.interface';
 import { SimpleRedisSetup, ClusterRedisSetup, TypeRedis, PubSubRedis } from './external/redis/types/ioredis.types';
+import { EntraIDModule, ENTRA_ID_CONFIG } from './lib/entraID/entraID.module';
+import type { EntraIDModuleOptions } from './lib/entraID/entraID.module';
+import { EntraIDService } from './lib/entraID/entraID.service';
+import { EntraAuthGuard } from './lib/entraID/guards/entra-auth.guard';
+import { RolesGuard } from './lib/entraID/guards/roles.guard';
+import { InternalTokenService } from './lib/entraID/internal-token/internal-token.service';
+import { CurrentUser } from './lib/entraID/decorators/current-user.decorator';
+import { Public } from './lib/entraID/decorators/public.decorator';
+import { Roles } from './lib/entraID/decorators/roles.decorator';
+import { CookieUtils, TokenUtils } from './lib/entraID/utils';
+import { SecurityService } from './lib/entraID/security/security.service';
+import { EntraIDException } from './lib/entraID/customError/entraID.exception';
+import type { EntraUser, AuthResult, CallbackParams, TokenEnrichmentContext, CookieDomainOptions } from './lib/entraID/types/entraID.type';
+import type { EntraIDSetup, EntraIDAsyncOptions } from './lib/entraID/types/entraID-module-init.types';
 import { SNSSetup } from './external/aws/sns/sns.provider';
-export { QueueModule, Queue, IConsumer, StorageModule, Storage, IStorage, EventModule, Events, IEvent, SNSSetup, EmailModule, Email, IEmail, CryptoModule, Crypto, ICrypto, CacheModule, Cache, ICache, DocumentsModule, Documents, IBedrock, ITextract, SimpleRedisSetup, ClusterRedisSetup, TypeRedis, PubSubRedis, };
+export { QueueModule, Queue, IConsumer, StorageModule, Storage, IStorage, EventModule, Events, IEvent, SNSSetup, EmailModule, Email, IEmail, CryptoModule, Crypto, ICrypto, CacheModule, Cache, ICache, DocumentsModule, Documents, IBedrock, ITextract, SimpleRedisSetup, ClusterRedisSetup, TypeRedis, PubSubRedis, EntraIDModule, EntraIDModuleOptions, ENTRA_ID_CONFIG, EntraIDService, EntraAuthGuard, RolesGuard, InternalTokenService, CurrentUser, Public, Roles, CookieUtils, TokenUtils, SecurityService, EntraIDException, EntraIDSetup, EntraIDAsyncOptions, EntraUser, AuthResult, CallbackParams, TokenEnrichmentContext, CookieDomainOptions, };

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TypeRedis = exports.ITextract = exports.IBedrock = exports.Documents = exports.DocumentsModule = exports.ICache = exports.Cache = exports.CacheModule = exports.ICrypto = exports.Crypto = exports.CryptoModule = exports.IEmail = exports.Email = exports.EmailModule = exports.IEvent = exports.Events = exports.EventModule = exports.IStorage = exports.Storage = exports.StorageModule = exports.IConsumer = exports.Queue = exports.QueueModule = void 0;
+exports.EntraIDException = exports.SecurityService = exports.TokenUtils = exports.CookieUtils = exports.Roles = exports.Public = exports.CurrentUser = exports.InternalTokenService = exports.RolesGuard = exports.EntraAuthGuard = exports.EntraIDService = exports.ENTRA_ID_CONFIG = exports.EntraIDModule = exports.TypeRedis = exports.ITextract = exports.IBedrock = exports.Documents = exports.DocumentsModule = exports.ICache = exports.Cache = exports.CacheModule = exports.ICrypto = exports.Crypto = exports.CryptoModule = exports.IEmail = exports.Email = exports.EmailModule = exports.IEvent = exports.Events = exports.EventModule = exports.IStorage = exports.Storage = exports.StorageModule = exports.IConsumer = exports.Queue = exports.QueueModule = void 0;
 const queue_module_1 = require("./lib/queue/queue.module");
 Object.defineProperty(exports, "QueueModule", { enumerable: true, get: function () { return queue_module_1.QueueModule; } });
 const queue_1 = require("./lib/queue/queue");
@@ -46,4 +46,28 @@ Object.defineProperty(exports, "IBedrock", { enumerable: true, get: function ()
 Object.defineProperty(exports, "ITextract", { enumerable: true, get: function () { return documents_interface_1.ITextract; } });
 const ioredis_types_1 = require("./external/redis/types/ioredis.types");
 Object.defineProperty(exports, "TypeRedis", { enumerable: true, get: function () { return ioredis_types_1.TypeRedis; } });
+const entraID_module_1 = require("./lib/entraID/entraID.module");
+Object.defineProperty(exports, "EntraIDModule", { enumerable: true, get: function () { return entraID_module_1.EntraIDModule; } });
+Object.defineProperty(exports, "ENTRA_ID_CONFIG", { enumerable: true, get: function () { return entraID_module_1.ENTRA_ID_CONFIG; } });
+const entraID_service_1 = require("./lib/entraID/entraID.service");
+Object.defineProperty(exports, "EntraIDService", { enumerable: true, get: function () { return entraID_service_1.EntraIDService; } });
+const entra_auth_guard_1 = require("./lib/entraID/guards/entra-auth.guard");
+Object.defineProperty(exports, "EntraAuthGuard", { enumerable: true, get: function () { return entra_auth_guard_1.EntraAuthGuard; } });
+const roles_guard_1 = require("./lib/entraID/guards/roles.guard");
+Object.defineProperty(exports, "RolesGuard", { enumerable: true, get: function () { return roles_guard_1.RolesGuard; } });
+const internal_token_service_1 = require("./lib/entraID/internal-token/internal-token.service");
+Object.defineProperty(exports, "InternalTokenService", { enumerable: true, get: function () { return internal_token_service_1.InternalTokenService; } });
+const current_user_decorator_1 = require("./lib/entraID/decorators/current-user.decorator");
+Object.defineProperty(exports, "CurrentUser", { enumerable: true, get: function () { return current_user_decorator_1.CurrentUser; } });
+const public_decorator_1 = require("./lib/entraID/decorators/public.decorator");
+Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return public_decorator_1.Public; } });
+const roles_decorator_1 = require("./lib/entraID/decorators/roles.decorator");
+Object.defineProperty(exports, "Roles", { enumerable: true, get: function () { return roles_decorator_1.Roles; } });
+const utils_1 = require("./lib/entraID/utils");
+Object.defineProperty(exports, "CookieUtils", { enumerable: true, get: function () { return utils_1.CookieUtils; } });
+Object.defineProperty(exports, "TokenUtils", { enumerable: true, get: function () { return utils_1.TokenUtils; } });
+const security_service_1 = require("./lib/entraID/security/security.service");
+Object.defineProperty(exports, "SecurityService", { enumerable: true, get: function () { return security_service_1.SecurityService; } });
+const entraID_exception_1 = require("./lib/entraID/customError/entraID.exception");
+Object.defineProperty(exports, "EntraIDException", { enumerable: true, get: function () { return entraID_exception_1.EntraIDException; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2DAAuD;AAuCrD,4FAvCO,0BAAW,OAuCP;AAtCb,6CAA0C;AAuCxC,sFAvCO,aAAK,OAuCP;AAtCP,kFAAsE;AAuCpE,0FAvCO,8BAAS,OAuCP;AArCX,iEAA6D;AAsC3D,8FAtCO,8BAAa,OAsCP;AArCf,mDAAgD;AAsC9C,wFAtCO,iBAAO,OAsCP;AArCT,kFAAsE;AAsCpE,yFAtCO,4BAAQ,OAsCP;AApCV,4DAAwD;AAqCtD,4FArCO,0BAAW,OAqCP;AApCb,gDAA6C;AAqC3C,uFArCO,eAAM,OAqCP;AApCR,6EAAiE;AAqC/D,uFArCO,wBAAM,OAqCP;AAnCR,2DAAuD;AAqCrD,4FArCO,0BAAW,OAqCP;AApCb,6CAA0C;AAqCxC,sFArCO,aAAK,OAqCP;AApCP,4EAAgE;AAqC9D,uFArCO,wBAAM,OAqCP;AAnCR,8DAA0D;AAoCxD,6FApCO,4BAAY,OAoCP;AAnCd,gDAA6C;AAoC3C,uFApCO,eAAM,OAoCP;AAnCR,+EAAmE;AAoCjE,wFApCO,0BAAO,OAoCP;AAlCT,2DAAuD;AAmCrD,4FAnCO,0BAAW,OAmCP;AAlCb,6CAA0C;AAmCxC,sFAnCO,aAAK,OAmCP;AAlCP,4EAAgE;AAmC9D,uFAnCO,wBAAM,OAmCP;AAlCR,uEAAmE;AAmCjE,gGAnCO,kCAAe,OAmCP;AAlCjB,yDAAsD;AAmCpD,0FAnCO,qBAAS,OAmCP;AAlCX,wFAGwD;AAgCtD,yFAlCA,8BAAQ,OAkCA;AACR,0FAlCA,+BAAS,OAkCA;AAhCX,wEAK8C;AA8B5C,0FAhCA,yBAAS,OAgCA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,2DAAuD;AA8DrD,4FA9DO,0BAAW,OA8DP;AA7Db,6CAA0C;AA8DxC,sFA9DO,aAAK,OA8DP;AA7DP,kFAAsE;AA8DpE,0FA9DO,8BAAS,OA8DP;AA5DX,iEAA6D;AA6D3D,8FA7DO,8BAAa,OA6DP;AA5Df,mDAAgD;AA6D9C,wFA7DO,iBAAO,OA6DP;AA5DT,kFAAsE;AA6DpE,yFA7DO,4BAAQ,OA6DP;AA3DV,4DAAwD;AA4DtD,4FA5DO,0BAAW,OA4DP;AA3Db,gDAA6C;AA4D3C,uFA5DO,eAAM,OA4DP;AA3DR,6EAAiE;AA4D/D,uFA5DO,wBAAM,OA4DP;AA1DR,2DAAuD;AA4DrD,4FA5DO,0BAAW,OA4DP;AA3Db,6CAA0C;AA4DxC,sFA5DO,aAAK,OA4DP;AA3DP,4EAAgE;AA4D9D,uFA5DO,wBAAM,OA4DP;AA1DR,8DAA0D;AA2DxD,6FA3DO,4BAAY,OA2DP;AA1Dd,gDAA6C;AA2D3C,uFA3DO,eAAM,OA2DP;AA1DR,+EAAmE;AA2DjE,wFA3DO,0BAAO,OA2DP;AAzDT,2DAAuD;AA0DrD,4FA1DO,0BAAW,OA0DP;AAzDb,6CAA0C;AA0DxC,sFA1DO,aAAK,OA0DP;AAzDP,4EAAgE;AA0D9D,uFA1DO,wBAAM,OA0DP;AAzDR,uEAAmE;AA0DjE,gGA1DO,kCAAe,OA0DP;AAzDjB,yDAAsD;AA0DpD,0FA1DO,qBAAS,OA0DP;AAzDX,wFAGwD;AAuDtD,yFAzDA,8BAAQ,OAyDA;AACR,0FAzDA,+BAAS,OAyDA;AAvDX,wEAK8C;AAqD5C,0FAvDA,yBAAS,OAuDA;AApDX,iEAA8E;AAsD5E,8FAtDO,8BAAa,OAsDP;AAEb,gGAxDsB,gCAAe,OAwDtB;AAtDjB,mEAA+D;AAuD7D,+FAvDO,gCAAc,OAuDP;AAtDhB,4EAAuE;AAuDrE,+FAvDO,iCAAc,OAuDP;AAtDhB,kEAA8D;AAuD5D,2FAvDO,wBAAU,OAuDP;AAtDZ,gGAA2F;AAuDzF,qGAvDO,6CAAoB,OAuDP;AAtDtB,4FAA8E;AAuD5E,4FAvDO,oCAAW,OAuDP;AAtDb,gFAAmE;AAuDjE,uFAvDO,yBAAM,OAuDP;AAtDR,8EAAiE;AAuD/D,sFAvDO,uBAAK,OAuDP;AAtDP,+CAA8D;AAuD5D,4FAvDO,mBAAW,OAuDP;AACX,2FAxDoB,kBAAU,OAwDpB;AAvDZ,8EAA0E;AAwDxE,gGAxDO,kCAAe,OAwDP;AAvDjB,mFAA+E;AAwD7E,iGAxDO,oCAAgB,OAwDP"}

package/dist/lib/entraID/customError/entraID.exception.d.ts

@@ -0,0 +1,5 @@
+export declare class EntraIDException extends Error {
+    readonly code: string;
+    readonly message: string;
+    constructor(code: string);
+}

package/dist/lib/entraID/customError/entraID.exception.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraIDException = void 0;
+const entraIDErrorMessages = {
+    INVALID_CONFIG: 'Configuração inválida do módulo EntraID',
+    TENANT_NOT_FOUND: 'Tenant não encontrado na configuração do EntraID',
+    INVALID_SECRET: 'Em Produção é necessário um secret válido',
+    STATE_MISMATCH: 'State OAuth inválido ou expirado',
+    TOKEN_INVALID_HEADER: 'Header da chave publica inválido',
+    PAYLOAD_ID_TOKEN_INVALID: 'Payload decodificado é inválido',
+    INVALID_NONCE: 'Nonce retornado é diferente do esperado',
+    CODE_EXCHANGE_FAILED: 'Falha ao trocar o código de autorização pelo token',
+    TOKEN_EXPIRED: 'Token de acesso expirado',
+    TOKEN_INVALID: 'Token de acesso inválido',
+    RESERVED_CLAIM_OVERRIDE: 'enrichTokenPayload tentou sobrescrever um claim reservado (sub/iss/aud/exp/iat/nbf/jti/groups)',
+    TOKEN_AUDIENCE_INVALID: 'Audience do token não corresponde ao esperado',
+    JWKS_FETCH_FAILED: 'Falha ao buscar chaves públicas do Azure',
+    JWKS_KEY_NOT_FOUND: 'Chave pública não encontrada no JWKS',
+    GRAPH_FETCH_FAILED: 'Falha ao buscar dados do usuário no Microsoft Graph',
+    GRAPH_USER_NOT_FOUND: 'Usuário não encontrado no Microsoft Entra ID',
+    SECURITY_PATH_TRAVERSAL: 'Tentativa de path traversal detectada',
+    SECURITY_NULL_BYTE: 'Caractere nulo detectado na entrada',
+    SECURITY_INVALID_CHARS: 'Caracteres inválidos ou perigosos na entrada',
+    SECURITY_OPEN_REDIRECT: 'Redirecionamento para URL não autorizada',
+    SECURITY_INVALID_URL: 'URL inválida',
+    OAUTH_PROVIDER_ERROR: 'Erro retornado pelo provedor OAuth',
+    OAUTH_MISSING_PARAMS: 'Parâmetros obrigatórios ausentes no callback OAuth',
+    REFRESH_TOKEN_FAILED: 'Falha ao renovar o token de acesso',
+    REVOKE_SESSIONS_FAILED: 'Falha ao revogar sessões do usuário no Microsoft Entra ID',
+    UNKNOWN_ERROR: 'Erro desconhecido',
+};
+class EntraIDException extends Error {
+    constructor(code) {
+        const message = entraIDErrorMessages[code] ?? entraIDErrorMessages['UNKNOWN_ERROR'];
+        super(message);
+        this.code = code;
+        this.message = message;
+        this.name = 'EntraIDException';
+        Object.setPrototypeOf(this, EntraIDException.prototype);
+    }
+}
+exports.EntraIDException = EntraIDException;
+//# sourceMappingURL=entraID.exception.js.map

package/dist/lib/entraID/customError/entraID.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID.exception.js","sourceRoot":"","sources":["../../../../src/lib/entraID/customError/entraID.exception.ts"],"names":[],"mappings":";;;AAAA,MAAM,oBAAoB,GAA2B;IACnD,cAAc,EAAE,yCAAyC;IACzD,gBAAgB,EAAE,kDAAkD;IACpE,cAAc,EAAE,2CAA2C;IAC3D,cAAc,EAAE,kCAAkC;IAClD,oBAAoB,EAAE,kCAAkC;IACxD,wBAAwB,EAAE,iCAAiC;IAC3D,aAAa,EAAE,yCAAyC;IACxD,oBAAoB,EAAE,oDAAoD;IAC1E,aAAa,EAAE,0BAA0B;IACzC,aAAa,EAAE,0BAA0B;IACzC,uBAAuB,EACrB,gGAAgG;IAClG,sBAAsB,EAAE,+CAA+C;IACvE,iBAAiB,EAAE,0CAA0C;IAC7D,kBAAkB,EAAE,sCAAsC;IAC1D,kBAAkB,EAAE,qDAAqD;IACzE,oBAAoB,EAAE,8CAA8C;IACpE,uBAAuB,EAAE,uCAAuC;IAChE,kBAAkB,EAAE,qCAAqC;IACzD,sBAAsB,EAAE,8CAA8C;IACtE,sBAAsB,EAAE,0CAA0C;IAClE,oBAAoB,EAAE,cAAc;IACpC,oBAAoB,EAAE,oCAAoC;IAC1D,oBAAoB,EAAE,oDAAoD;IAC1E,oBAAoB,EAAE,oCAAoC;IAC1D,sBAAsB,EACpB,2DAA2D;IAC7D,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAa,gBAAiB,SAAQ,KAAK;IAGzC,YAA4B,IAAY;QACtC,MAAM,OAAO,GACX,oBAAoB,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,eAAe,CAAC,CAAC;QACtE,KAAK,CAAC,OAAO,CAAC,CAAC;QAHW,SAAI,GAAJ,IAAI,CAAQ;QAItC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;CACF;AAXD,4CAWC"}

package/dist/lib/entraID/decorators/current-user.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentUser: <T = Record<string, unknown>>(...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/lib/entraID/decorators/current-user.decorator.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+exports.CurrentUser = (0, common_1.createParamDecorator)((_data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/lib/entraID/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../../src/lib/entraID/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAE3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAA8B,KAAc,EAAE,GAAqB,EAAK,EAAE;IACxE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,OAAO,OAAO,CAAC,IAAS,CAAC;AAC3B,CAAC,CACF,CAAC"}

package/dist/lib/entraID/decorators/public.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/lib/entraID/decorators/public.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.IS_PUBLIC_KEY = 'isPublic';
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;
+//# sourceMappingURL=public.decorator.js.map

package/dist/lib/entraID/decorators/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../../src/lib/entraID/decorators/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,aAAa,GAAG,UAAU,CAAC;AAEjC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,qBAAa,EAAE,IAAI,CAAC,CAAC;AAAhD,QAAA,MAAM,UAA0C"}

package/dist/lib/entraID/decorators/roles.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const ROLES_KEY = "roles";
+export declare const Roles: (...roles: string[]) => import("@nestjs/common").CustomDecorator<string>;

package/dist/lib/entraID/decorators/roles.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Roles = exports.ROLES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.ROLES_KEY = 'roles';
+const Roles = (...roles) => (0, common_1.SetMetadata)(exports.ROLES_KEY, roles);
+exports.Roles = Roles;
+//# sourceMappingURL=roles.decorator.js.map

package/dist/lib/entraID/decorators/roles.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.decorator.js","sourceRoot":"","sources":["../../../../src/lib/entraID/decorators/roles.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,SAAS,GAAG,OAAO,CAAC;AAE1B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,iBAAS,EAAE,KAAK,CAAC,CAAC;AAA9D,QAAA,KAAK,SAAyD"}

package/dist/lib/entraID/entraID.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const ENTRA_ID_CONFIG = "ENTRA_ID_CONFIG";
+export declare const MICROSOFT_AUTHORITY_URL = "https://login.microsoftonline.com";

package/dist/lib/entraID/entraID.constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_AUTHORITY_URL = exports.ENTRA_ID_CONFIG = void 0;
+exports.ENTRA_ID_CONFIG = 'ENTRA_ID_CONFIG';
+exports.MICROSOFT_AUTHORITY_URL = 'https://login.microsoftonline.com';
+//# sourceMappingURL=entraID.constants.js.map

package/dist/lib/entraID/entraID.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID.constants.js","sourceRoot":"","sources":["../../../src/lib/entraID/entraID.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG,iBAAiB,CAAC;AACpC,QAAA,uBAAuB,GAAG,mCAAmC,CAAC"}

package/dist/lib/entraID/entraID.module.d.ts

@@ -0,0 +1,14 @@
+import { DynamicModule, ModuleMetadata, Type } from '@nestjs/common';
+import { InternalTokenService } from './internal-token/internal-token.service';
+import { ENTRA_ID_CONFIG } from './entraID.constants';
+import { EntraIDAsyncOptions, EntraIDSetup } from './types/entraID-module-init.types';
+export { ENTRA_ID_CONFIG };
+export type EntraIDModuleOptions = {
+    internalTokenService?: Type<InternalTokenService>;
+    imports?: ModuleMetadata['imports'];
+};
+export declare class EntraIDModule {
+    private static buildModule;
+    static forRoot(params: EntraIDSetup, options?: EntraIDModuleOptions): DynamicModule;
+    static forRootAsync(paramsAsync: EntraIDAsyncOptions, options?: EntraIDModuleOptions): DynamicModule;
+}

package/dist/lib/entraID/entraID.module.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var EntraIDModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntraIDModule = exports.ENTRA_ID_CONFIG = void 0;
+const common_1 = require("@nestjs/common");
+const entraID_service_1 = require("./entraID.service");
+const entra_auth_guard_1 = require("./guards/entra-auth.guard");
+const internal_token_service_1 = require("./internal-token/internal-token.service");
+const microsoft_module_1 = require("./microsoft/microsoft.module");
+const security_module_1 = require("./security/security.module");
+const entraID_constants_1 = require("./entraID.constants");
+Object.defineProperty(exports, "ENTRA_ID_CONFIG", { enumerable: true, get: function () { return entraID_constants_1.ENTRA_ID_CONFIG; } });
+let EntraIDModule = EntraIDModule_1 = class EntraIDModule {
+    static buildModule(configProvider, imports = [], options = {}) {
+        const tokenServiceClass = options.internalTokenService ?? internal_token_service_1.InternalTokenService;
+        return {
+            global: true,
+            module: EntraIDModule_1,
+            imports: [...imports, ...(options.imports ?? []), microsoft_module_1.MicrosoftModule, security_module_1.SecurityModule],
+            providers: [
+                configProvider,
+                tokenServiceClass,
+                { provide: internal_token_service_1.InternalTokenService, useExisting: tokenServiceClass },
+                entraID_service_1.EntraIDService,
+                entra_auth_guard_1.EntraAuthGuard,
+            ],
+            exports: [
+                entraID_constants_1.ENTRA_ID_CONFIG,
+                internal_token_service_1.InternalTokenService,
+                entraID_service_1.EntraIDService,
+                entra_auth_guard_1.EntraAuthGuard,
+            ],
+        };
+    }
+    static forRoot(params, options) {
+        return this.buildModule({ provide: entraID_constants_1.ENTRA_ID_CONFIG, useValue: params }, [], options);
+    }
+    static forRootAsync(paramsAsync, options) {
+        return this.buildModule({
+            provide: entraID_constants_1.ENTRA_ID_CONFIG,
+            useFactory: paramsAsync.useFactory,
+            inject: paramsAsync.inject ?? [],
+        }, paramsAsync.imports ?? [], options);
+    }
+};
+exports.EntraIDModule = EntraIDModule;
+exports.EntraIDModule = EntraIDModule = EntraIDModule_1 = __decorate([
+    (0, common_1.Module)({})
+], EntraIDModule);
+//# sourceMappingURL=entraID.module.js.map

package/dist/lib/entraID/entraID.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID.module.js","sourceRoot":"","sources":["../../../src/lib/entraID/entraID.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAMwB;AACxB,uDAAmD;AACnD,gEAA2D;AAC3D,oFAA+E;AAC/E,mEAA+D;AAC/D,gEAA4D;AAC5D,2DAAsD;AAM7C,gGANA,mCAAe,OAMA;AAQjB,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAChB,MAAM,CAAC,WAAW,CACxB,cAAwB,EACxB,UAAqC,EAAE,EACvC,UAAgC,EAAE;QAElC,MAAM,iBAAiB,GACrB,OAAO,CAAC,oBAAoB,IAAI,6CAAoB,CAAC;QAEvD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,eAAa;YACrB,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,kCAAe,EAAE,gCAAc,CAAC;YAClF,SAAS,EAAE;gBACT,cAAc;gBACd,iBAAiB;gBACjB,EAAE,OAAO,EAAE,6CAAoB,EAAE,WAAW,EAAE,iBAAiB,EAAE;gBACjE,gCAAc;gBACd,iCAAc;aACf;YACD,OAAO,EAAE;gBACP,mCAAe;gBACf,6CAAoB;gBACpB,gCAAc;gBACd,iCAAc;aACf;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,MAAoB,EAAE,OAA8B;QACjE,OAAO,IAAI,CAAC,WAAW,CACrB,EAAE,OAAO,EAAE,mCAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,EAC9C,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,WAAgC,EAChC,OAA8B;QAE9B,OAAO,IAAI,CAAC,WAAW,CACrB;YACE,OAAO,EAAE,mCAAe;YACxB,UAAU,EAAE,WAAW,CAAC,UAAU;YAClC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,EAAE;SACjC,EACD,WAAW,CAAC,OAAO,IAAI,EAAE,EACzB,OAAO,CACR,CAAC;IACJ,CAAC;CACF,CAAA;AAnDY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAmDzB"}

package/dist/lib/entraID/entraID.service.d.ts

@@ -0,0 +1,25 @@
+import { OnModuleInit } from '@nestjs/common';
+import { InternalTokenService } from './internal-token/internal-token.service';
+import { MicrosoftService } from './microsoft/microsoft.service';
+import { SecurityService } from './security/security.service';
+import { AuthResult, CallbackParams, CreateStateNonce, EntraUser, IdTokenPayload, UrlRedirectSso } from './types/entraID.type';
+import { EntraIDSetup } from './types/entraID-module-init.types';
+import { IEntraIDService } from './interfaces/entraID-service.interface';
+export declare class EntraIDService implements OnModuleInit, IEntraIDService {
+    protected readonly config: EntraIDSetup;
+    protected readonly microsoftService: MicrosoftService;
+    protected readonly securityService: SecurityService;
+    protected readonly internalTokenService: InternalTokenService;
+    private jwksClientRsa;
+    constructor(config: EntraIDSetup, microsoftService: MicrosoftService, securityService: SecurityService, internalTokenService: InternalTokenService);
+    onModuleInit(): void;
+    handleCallback(params: CallbackParams): Promise<AuthResult>;
+    refresh(refreshToken: string): Promise<AuthResult>;
+    logout(userId: string): Promise<void>;
+    initiateLogin(): Promise<UrlRedirectSso>;
+    decodeLocalToken(token: string): EntraUser;
+    protected verifyIdToken(idToken: string, nonce: string): Promise<IdTokenPayload>;
+    protected buildUserJwt(accessToken: string, email: string, name: string): Promise<AuthResult>;
+    protected createSignedState(): CreateStateNonce;
+    protected verifyStateAndReturnNonce(state: string): string;
+}