Bot

dist/modules/identity/application/handlers/token.handler.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenHandler = void 0;
+const common_1 = require("@nestjs/common");
+const bcrypt = __importStar(require("bcrypt"));
+const jwt_1 = require("@nestjs/jwt");
+const service_account_repository_interface_1 = require("../../domain/repositories/service-account.repository.interface");
+let TokenHandler = class TokenHandler {
+    serviceAccountRepository;
+    jwtService;
+    constructor(serviceAccountRepository, jwtService) {
+        this.serviceAccountRepository = serviceAccountRepository;
+        this.jwtService = jwtService;
+    }
+    async execute(body) {
+        const { client_id, client_secret, grant_type } = body;
+        if (grant_type !== 'client_credentials') {
+            throw new common_1.BadRequestException('Invalid grant_type.');
+        }
+        const unauthorizedMsg = 'Invalid client credentials.';
+        if (!client_id || !client_secret) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const serviceAccount = await this.serviceAccountRepository.findByClientId(client_id);
+        if (!serviceAccount) {
+            // generic error
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        // check status
+        if (serviceAccount.status !== 'ACTIVE') {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const match = await bcrypt.compare(client_secret, serviceAccount.clientSecretHash);
+        if (!match) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const payload = {
+            sub: serviceAccount.id,
+            client_id: serviceAccount.clientId,
+            // existing JwtPayload expects email; provide empty string to remain compatible
+            email: '',
+            role: serviceAccount.role,
+            permissions: serviceAccount.permissions ?? [],
+        };
+        const accessToken = await this.jwtService.signAsync(payload, {
+            expiresIn: '1h',
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600,
+        };
+    }
+};
+exports.TokenHandler = TokenHandler;
+exports.TokenHandler = TokenHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [service_account_repository_interface_1.ServiceAccountRepository,
+        jwt_1.JwtService])
+], TokenHandler);
+//# sourceMappingURL=token.handler.js.map