prime-sdk 3.0.7 → 3.0.9-beta.0

package/dist/lib/entraID/microsoft/microsoft.service.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MicrosoftService = void 0;
+const common_1 = require("@nestjs/common");
+const entraID_exception_1 = require("../customError/entraID.exception");
+const entraID_constants_1 = require("../entraID.constants");
+const GRAPH_BASE = 'https://graph.microsoft.com/v1.0';
+const FETCH_TIMEOUT_MS = 15_000;
+let MicrosoftService = class MicrosoftService {
+    constructor(config) {
+        this.config = config;
+    }
+    async exchangeCode(code) {
+        const body = new URLSearchParams({
+            client_id: this.config.clientID,
+            client_secret: this.config.clientSecret,
+            code,
+            redirect_uri: this.config.redirectUri,
+            grant_type: 'authorization_code',
+            scope: this.config.scope ??
+                'openid profile email User.Read GroupMember.Read.All',
+        });
+        const authorityUrl = this.config.authorityUrl ?? entraID_constants_1.MICROSOFT_AUTHORITY_URL;
+        const response = await fetch(`${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new entraID_exception_1.EntraIDException('CODE_EXCHANGE_FAILED');
+        const tokens = (await response.json());
+        if (!tokens.access_token || !tokens.id_token) {
+            throw new entraID_exception_1.EntraIDException('CODE_EXCHANGE_FAILED');
+        }
+        return tokens;
+    }
+    async refreshToken(refreshToken) {
+        const body = new URLSearchParams({
+            client_id: this.config.clientID,
+            client_secret: this.config.clientSecret,
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        });
+        const authorityUrl = this.config.authorityUrl ?? entraID_constants_1.MICROSOFT_AUTHORITY_URL;
+        const response = await fetch(`${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new entraID_exception_1.EntraIDException('REFRESH_TOKEN_FAILED');
+        const tokens = (await response.json());
+        if (!tokens.access_token)
+            throw new entraID_exception_1.EntraIDException('REFRESH_TOKEN_FAILED');
+        return tokens;
+    }
+    async revokeUserSessions(userId) {
+        const adminToken = await this.getClientCredentialsToken();
+        const response = await fetch(`${GRAPH_BASE}/users/${userId}/revokeSignInSessions`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${adminToken}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new entraID_exception_1.EntraIDException('REVOKE_SESSIONS_FAILED');
+    }
+    async getClientCredentialsToken() {
+        const authorityUrl = this.config.authorityUrl ?? entraID_constants_1.MICROSOFT_AUTHORITY_URL;
+        const body = new URLSearchParams({
+            client_id: this.config.clientID,
+            client_secret: this.config.clientSecret,
+            scope: 'https://graph.microsoft.com/.default',
+            grant_type: 'client_credentials',
+        });
+        const response = await fetch(`${authorityUrl}/${this.config.tenantID}/oauth2/v2.0/token`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new entraID_exception_1.EntraIDException('REVOKE_SESSIONS_FAILED');
+        const data = (await response.json());
+        return data.access_token;
+    }
+    async getMe(accessToken) {
+        const response = await fetch(`${GRAPH_BASE}/me?$select=id,displayName,mail,userPrincipalName,employeeId`, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            throw new entraID_exception_1.EntraIDException('GRAPH_FETCH_FAILED');
+        return (await response.json());
+    }
+    async getMemberOf(accessToken) {
+        const allGroups = [];
+        let url = `${GRAPH_BASE}/me/memberOf?$select=displayName&$top=100`;
+        while (url) {
+            const response = await fetch(url, {
+                headers: { Authorization: `Bearer ${accessToken}` },
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (!response.ok)
+                throw new entraID_exception_1.EntraIDException('GRAPH_FETCH_FAILED');
+            const data = (await response.json());
+            allGroups.push(...data.value);
+            url = data['@odata.nextLink'] ?? null;
+        }
+        return allGroups;
+    }
+};
+exports.MicrosoftService = MicrosoftService;
+exports.MicrosoftService = MicrosoftService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(entraID_constants_1.ENTRA_ID_CONFIG)),
+    __metadata("design:paramtypes", [Object])
+], MicrosoftService);
+//# sourceMappingURL=microsoft.service.js.map

package/dist/lib/entraID/microsoft/microsoft.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.service.js","sourceRoot":"","sources":["../../../../src/lib/entraID/microsoft/microsoft.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wEAAoE;AAGpE,4DAAgF;AAEhF,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAGzB,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAAsD,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAE9E,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,KAAK,EACH,IAAI,CAAC,MAAM,CAAC,KAAK;gBACjB,qDAAqD;SACxD,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,2CAAuB,CAAC;QAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,oBAAoB,EAC3D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACrC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,eAAe;SAC5B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,2CAAuB,CAAC;QAEzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,oBAAoB,EAC3D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QAErE,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,YAAY;YACtB,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QAErD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGD,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,UAAU,UAAU,MAAM,uBAAuB,EACpD;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAgB,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,2CAAuB,CAAC;QAEzE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;YACvC,KAAK,EAAE,sCAAsC;YAC7C,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,oBAAoB,EAC3D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAgB,CAAC,wBAAwB,CAAC,CAAC;QAEvE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;QACjE,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,WAAmB;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,UAAU,8DAA8D,EAC3E;YACE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,oCAAgB,CAAC,oBAAoB,CAAC,CAAC;QAEnE,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAc,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB;QACnC,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,IAAI,GAAG,GACL,GAAG,UAAU,2CAA2C,CAAC;QAE3D,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;gBACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,IAAI,oCAAgB,CAAC,oBAAoB,CAAC,CAAC;YAEnE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YAEF,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;QACxC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAnJY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,mCAAe,CAAC,CAAA;;GADzB,gBAAgB,CAmJ5B"}

package/dist/lib/entraID/security/security.module.d.ts

@@ -0,0 +1,2 @@
+export declare class SecurityModule {
+}

package/dist/lib/entraID/security/security.module.js

@@ -0,0 +1,21 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityModule = void 0;
+const common_1 = require("@nestjs/common");
+const security_service_1 = require("./security.service");
+let SecurityModule = class SecurityModule {
+};
+exports.SecurityModule = SecurityModule;
+exports.SecurityModule = SecurityModule = __decorate([
+    (0, common_1.Module)({
+        providers: [security_service_1.SecurityService],
+        exports: [security_service_1.SecurityService],
+    })
+], SecurityModule);
+//# sourceMappingURL=security.module.js.map

package/dist/lib/entraID/security/security.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.module.js","sourceRoot":"","sources":["../../../../src/lib/entraID/security/security.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,yDAAqD;AAM9C,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAJ1B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,kCAAe,CAAC;QAC5B,OAAO,EAAE,CAAC,kCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}

package/dist/lib/entraID/security/security.service.d.ts

@@ -0,0 +1,9 @@
+export declare class SecurityService {
+    validateInput(value: string, field?: string): string;
+    validateRedirectUri(uri: string, allowedUri: string): void;
+    validateCallbackParams(params: {
+        code?: string;
+        state?: string;
+        error?: string;
+    }): void;
+}

package/dist/lib/entraID/security/security.service.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityService = void 0;
+const common_1 = require("@nestjs/common");
+const entraID_exception_1 = require("../customError/entraID.exception");
+const PATH_TRAVERSAL_PATTERNS = [
+    /\.\.[/\\]/,
+    /\.\.[/\\].*\.\.[/\\]/,
+    /%2e%2e[/\\]/i,
+    /%2e%2e%2f/i,
+    /%2e%2e%5c/i,
+];
+const NULL_BYTE_PATTERN = /\0|%00/;
+const DANGEROUS_CHARS = /<|>|"|'|`|\$\{|javascript:/i;
+let SecurityService = class SecurityService {
+    validateInput(value, field = 'input') {
+        if (NULL_BYTE_PATTERN.test(value)) {
+            throw new entraID_exception_1.EntraIDException('SECURITY_NULL_BYTE');
+        }
+        if (PATH_TRAVERSAL_PATTERNS.some((p) => p.test(value))) {
+            throw new entraID_exception_1.EntraIDException('SECURITY_PATH_TRAVERSAL');
+        }
+        if (DANGEROUS_CHARS.test(value)) {
+            throw new entraID_exception_1.EntraIDException('SECURITY_INVALID_CHARS');
+        }
+        void field;
+        return value.trim();
+    }
+    validateRedirectUri(uri, allowedUri) {
+        try {
+            const parsed = new URL(uri);
+            const allowed = new URL(allowedUri);
+            if (parsed.hostname !== allowed.hostname ||
+                parsed.protocol !== allowed.protocol) {
+                throw new entraID_exception_1.EntraIDException('SECURITY_OPEN_REDIRECT');
+            }
+        }
+        catch (err) {
+            if (err instanceof entraID_exception_1.EntraIDException)
+                throw err;
+            throw new entraID_exception_1.EntraIDException('SECURITY_INVALID_URL');
+        }
+    }
+    validateCallbackParams(params) {
+        if (params.error) {
+            throw new entraID_exception_1.EntraIDException('OAUTH_PROVIDER_ERROR');
+        }
+        if (!params.code || !params.state) {
+            throw new entraID_exception_1.EntraIDException('OAUTH_MISSING_PARAMS');
+        }
+        this.validateInput(params.code, 'code');
+        this.validateInput(params.state, 'state');
+    }
+};
+exports.SecurityService = SecurityService;
+exports.SecurityService = SecurityService = __decorate([
+    (0, common_1.Injectable)()
+], SecurityService);
+//# sourceMappingURL=security.service.js.map

package/dist/lib/entraID/security/security.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.service.js","sourceRoot":"","sources":["../../../../src/lib/entraID/security/security.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAC5C,wEAAoE;AAEpE,MAAM,uBAAuB,GAAG;IAC9B,WAAW;IACX,sBAAsB;IACtB,cAAc;IACd,YAAY;IACZ,YAAY;CACb,CAAC;AAEF,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAG/C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,aAAa,CAAC,KAAa,EAAE,KAAK,GAAG,OAAO;QAC1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,oCAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,oCAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,oCAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,KAAK,CAAC;QACX,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,mBAAmB,CAAC,GAAW,EAAE,UAAkB;QACjD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAEpC,IACE,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;gBACpC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EACpC,CAAC;gBACD,MAAM,IAAI,oCAAgB,CAAC,wBAAwB,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oCAAgB;gBAAE,MAAM,GAAG,CAAC;YAC/C,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,sBAAsB,CAAC,MAItB;QACC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,oCAAgB,CAAC,sBAAsB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAnDY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CAmD3B"}

package/dist/lib/entraID/types/entraID-module-init.types.d.ts

@@ -0,0 +1,18 @@
+import { InjectionToken, ModuleMetadata, OptionalFactoryDependency } from '@nestjs/common';
+export type EntraIDSetup = {
+    tenantID: string;
+    clientID: string;
+    clientSecret: string;
+    stateSecret: string;
+    scope?: string;
+    prompt?: string;
+    authorityUrl?: string;
+    redirectUri: string;
+    jwtSecret: string;
+    jwtExpiresIn?: string | number;
+};
+export type EntraIDAsyncOptions = {
+    imports?: ModuleMetadata['imports'];
+    inject?: Array<InjectionToken | OptionalFactoryDependency>;
+    useFactory: (...args: any[]) => EntraIDSetup | Promise<EntraIDSetup>;
+};

package/dist/lib/entraID/types/entraID-module-init.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entraID-module-init.types.js.map

package/dist/lib/entraID/types/entraID-module-init.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID-module-init.types.js","sourceRoot":"","sources":["../../../../src/lib/entraID/types/entraID-module-init.types.ts"],"names":[],"mappings":""}

package/dist/lib/entraID/types/entraID.type.d.ts

@@ -0,0 +1,55 @@
+export type CreateStateNonce = {
+    nonce: string;
+    state: string;
+};
+export type UrlRedirectSso = string;
+export type CallbackParams = {
+    code?: string;
+    state?: string;
+    error?: string;
+    error_description?: string;
+};
+export type AzureTokenResponse = {
+    access_token: string;
+    id_token: string;
+    refresh_token?: string;
+    token_type: string;
+    expires_in: number;
+};
+export type IdTokenPayload = {
+    sub: string;
+    name: string;
+    preferred_username?: string;
+    email?: string;
+    upn?: string;
+    nonce: string;
+    aud: string;
+    iss: string;
+    exp: number;
+};
+export type TokenEnrichmentContext = {
+    user: EntraUser;
+    accessToken: string;
+};
+export type GraphUser = {
+    id: string;
+    displayName: string;
+    mail: string | null;
+    userPrincipalName: string;
+    employeeId?: string | null;
+};
+export type EntraUser = {
+    entraId: string;
+    email: string;
+    name: string;
+    tenantId: string;
+    matricula?: string | null;
+} & Record<string, unknown>;
+export type AuthResult = {
+    token: string;
+    user: EntraUser;
+    refreshToken?: string;
+};
+export type CookieDomainOptions = {
+    domain?: string;
+};

package/dist/lib/entraID/types/entraID.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entraID.type.js.map

package/dist/lib/entraID/types/entraID.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entraID.type.js","sourceRoot":"","sources":["../../../../src/lib/entraID/types/entraID.type.ts"],"names":[],"mappings":""}

package/dist/lib/entraID/utils/cookie.utils.d.ts

@@ -0,0 +1,8 @@
+import { Response } from 'express';
+import { CookieDomainOptions, EntraUser } from '../types/entraID.type';
+export declare class CookieUtils {
+    private static buildBaseCookieOptions;
+    static setAuthCookie(res: Response, token: string, refreshToken?: string, options?: CookieDomainOptions): void;
+    static setUserDataCookie(res: Response, user: EntraUser, options?: CookieDomainOptions): void;
+    static clearAuthCookies(res: Response, options?: CookieDomainOptions): void;
+}

package/dist/lib/entraID/utils/cookie.utils.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CookieUtils = void 0;
+const IS_PRODUCTION = process.env.NODE_ENV === 'production';
+const REFRESH_TOKEN_MAX_AGE = 30 * 24 * 60 * 60 * 1000;
+class CookieUtils {
+    static buildBaseCookieOptions(options) {
+        return {
+            httpOnly: true,
+            secure: IS_PRODUCTION,
+            sameSite: (IS_PRODUCTION ? 'none' : 'lax'),
+            path: '/',
+            ...(options?.domain ? { domain: options.domain } : {}),
+        };
+    }
+    static setAuthCookie(res, token, refreshToken, options) {
+        const baseCookieOptions = CookieUtils.buildBaseCookieOptions(options);
+        res.cookie('auth_token', token, {
+            ...baseCookieOptions,
+            maxAge: 24 * 60 * 60 * 1000,
+        });
+        if (refreshToken) {
+            res.cookie('refresh_token', refreshToken, {
+                ...baseCookieOptions,
+                maxAge: REFRESH_TOKEN_MAX_AGE,
+            });
+        }
+    }
+    static setUserDataCookie(res, user, options) {
+        res.cookie('user_data', JSON.stringify(user), {
+            ...CookieUtils.buildBaseCookieOptions(options),
+            maxAge: 60 * 1000,
+        });
+    }
+    static clearAuthCookies(res, options) {
+        const clearOptions = {
+            ...CookieUtils.buildBaseCookieOptions(options),
+            maxAge: 0,
+        };
+        res.clearCookie('auth_token', clearOptions);
+        res.clearCookie('user_data', clearOptions);
+        res.clearCookie('refresh_token', clearOptions);
+    }
+}
+exports.CookieUtils = CookieUtils;
+//# sourceMappingURL=cookie.utils.js.map

package/dist/lib/entraID/utils/cookie.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.utils.js","sourceRoot":"","sources":["../../../../src/lib/entraID/utils/cookie.utils.ts"],"names":[],"mappings":";;;AAGA,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAE5D,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,MAAa,WAAW;IACd,MAAM,CAAC,sBAAsB,CAAC,OAA6B;QACjE,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAmB;YAC5D,IAAI,EAAE,GAAG;YACT,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,aAAa,CAClB,GAAa,EACb,KAAa,EACb,YAAqB,EACrB,OAA6B;QAE7B,MAAM,iBAAiB,GAAG,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEtE,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE;YAC9B,GAAG,iBAAiB;YACpB,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,EAAE;gBACxC,GAAG,iBAAiB;gBACpB,MAAM,EAAE,qBAAqB;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,CAAC,iBAAiB,CACtB,GAAa,EACb,IAAe,EACf,OAA6B;QAE7B,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;YAC5C,GAAG,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC9C,MAAM,EAAE,EAAE,GAAG,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,GAAa,EAAE,OAA6B;QAClE,MAAM,YAAY,GAAG;YACnB,GAAG,WAAW,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC9C,MAAM,EAAE,CAAC;SACV,CAAC;QACF,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5C,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3C,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;CACF;AApDD,kCAoDC"}

package/dist/lib/entraID/utils/crypto.utils.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import crypto from 'crypto';
+import jwksClient from 'jwks-rsa';
+export declare class CryptoUtils {
+    static createSignedPayloadWithHMAC(payload: string, secret: string): string;
+    static generateHash(length?: number): string;
+    static verifyPayloadWithHMAC(parts: string[], secret: string): void;
+    static getPublicKeyRsa(kid: string, jwksClientInstance: ReturnType<typeof jwksClient>): Promise<crypto.KeyObject>;
+}

package/dist/lib/entraID/utils/crypto.utils.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoUtils = void 0;
+const crypto_1 = __importDefault(require("crypto"));
+const entraID_exception_1 = require("../customError/entraID.exception");
+class CryptoUtils {
+    static createSignedPayloadWithHMAC(payload, secret) {
+        const hash = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(payload)
+            .digest('base64url');
+        return `${payload}.${hash}`;
+    }
+    static generateHash(length = 32) {
+        return crypto_1.default.randomBytes(length).toString('hex');
+    }
+    static verifyPayloadWithHMAC(parts, secret) {
+        if (parts.length !== 2) {
+            throw new entraID_exception_1.EntraIDException('STATE_MISMATCH');
+        }
+        const [payload, receivedSig] = parts;
+        const expectedSig = crypto_1.default
+            .createHmac('sha256', secret)
+            .update(payload)
+            .digest('base64url');
+        const sigBuf = new Uint8Array(Buffer.from(receivedSig));
+        const expectedBuf = new Uint8Array(Buffer.from(expectedSig));
+        if (sigBuf.length !== expectedBuf.length ||
+            !crypto_1.default.timingSafeEqual(sigBuf, expectedBuf)) {
+            throw new entraID_exception_1.EntraIDException('STATE_MISMATCH');
+        }
+    }
+    static async getPublicKeyRsa(kid, jwksClientInstance) {
+        try {
+            const key = await jwksClientInstance.getSigningKey(kid);
+            return crypto_1.default.createPublicKey(key.getPublicKey());
+        }
+        catch {
+            throw new entraID_exception_1.EntraIDException('JWKS_KEY_NOT_FOUND');
+        }
+    }
+}
+exports.CryptoUtils = CryptoUtils;
+//# sourceMappingURL=crypto.utils.js.map

package/dist/lib/entraID/utils/crypto.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.utils.js","sourceRoot":"","sources":["../../../../src/lib/entraID/utils/crypto.utils.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAC5B,wEAAoE;AAGpE,MAAa,WAAW;IACtB,MAAM,CAAC,2BAA2B,CAAC,OAAe,EAAE,MAAc;QAChE,MAAM,IAAI,GAAG,gBAAM;aAChB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,OAAO,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE;QACrC,OAAO,gBAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,qBAAqB,CAAC,KAAe,EAAE,MAAc;QAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,oCAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC;QAErC,MAAM,WAAW,GAAG,gBAAM;aACvB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAE7D,IACE,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YACpC,CAAC,gBAAM,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,EAC5C,CAAC;YACD,MAAM,IAAI,oCAAgB,CAAC,gBAAgB,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,GAAW,EACX,kBAAiD;QAEjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,gBAAM,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,oCAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF;AAhDD,kCAgDC"}

package/dist/lib/entraID/utils/index.d.ts

@@ -0,0 +1,2 @@
+export { CookieUtils } from './cookie.utils';
+export { TokenUtils } from './token.utils';

package/dist/lib/entraID/utils/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenUtils = exports.CookieUtils = void 0;
+var cookie_utils_1 = require("./cookie.utils");
+Object.defineProperty(exports, "CookieUtils", { enumerable: true, get: function () { return cookie_utils_1.CookieUtils; } });
+var token_utils_1 = require("./token.utils");
+Object.defineProperty(exports, "TokenUtils", { enumerable: true, get: function () { return token_utils_1.TokenUtils; } });
+//# sourceMappingURL=index.js.map

package/dist/lib/entraID/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/entraID/utils/index.ts"],"names":[],"mappings":";;;AAAA,+CAA6C;AAApC,2GAAA,WAAW,OAAA;AACpB,6CAA2C;AAAlC,yGAAA,UAAU,OAAA"}

package/dist/lib/entraID/utils/token.utils.d.ts

@@ -0,0 +1,6 @@
+import { Request } from 'express';
+import { EntraUser } from '../types/entraID.type';
+export declare class TokenUtils {
+    static extractFromRequest(req: Request): string | undefined;
+    static extractUserDataFromCookie(req: Request): EntraUser | null;
+}

package/dist/lib/entraID/utils/token.utils.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenUtils = void 0;
+class TokenUtils {
+    static extractFromRequest(req) {
+        const auth = req.headers.authorization;
+        if (auth?.startsWith('Bearer '))
+            return auth.slice(7);
+        return req.cookies?.auth_token;
+    }
+    static extractUserDataFromCookie(req) {
+        const raw = req.cookies?.user_data;
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.TokenUtils = TokenUtils;
+//# sourceMappingURL=token.utils.js.map

package/dist/lib/entraID/utils/token.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.utils.js","sourceRoot":"","sources":["../../../../src/lib/entraID/utils/token.utils.ts"],"names":[],"mappings":";;;AAGA,MAAa,UAAU;IACrB,MAAM,CAAC,kBAAkB,CAAC,GAAY;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACvC,IAAI,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,CAAC,OAAO,EAAE,UAAgC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,yBAAyB,CAAC,GAAY;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,SAA+B,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAhBD,gCAgBC"}