Rayyan Syahbani Hermanto
+96
-14
@@ -1,38 +1,120 @@
|
||||
"use strict";
|
||||
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
var desc = Object.getOwnPropertyDescriptor(m, k);
|
||||
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
||||
desc = { enumerable: true, get: function() { return m[k]; } };
|
||||
}
|
||||
Object.defineProperty(o, k2, desc);
|
||||
}) : (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
o[k2] = m[k];
|
||||
}));
|
||||
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
||||
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
||||
}) : function(o, v) {
|
||||
o["default"] = v;
|
||||
});
|
||||
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
||||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||||
};
|
||||
var __importStar = (this && this.__importStar) || (function () {
|
||||
var ownKeys = function(o) {
|
||||
ownKeys = Object.getOwnPropertyNames || function (o) {
|
||||
var ar = [];
|
||||
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
||||
return ar;
|
||||
};
|
||||
return ownKeys(o);
|
||||
};
|
||||
return function (mod) {
|
||||
if (mod && mod.__esModule) return mod;
|
||||
var result = {};
|
||||
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
||||
__setModuleDefault(result, mod);
|
||||
return result;
|
||||
};
|
||||
})();
|
||||
var __metadata = (this && this.__metadata) || function (k, v) {
|
||||
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.JwtAuthGuard = void 0;
|
||||
const common_1 = require("@nestjs/common");
|
||||
const jwt_1 = require("@nestjs/jwt");
|
||||
const jose_1 = require("jose");
|
||||
const identity_data_1 = require("../interfaces/identity-data");
|
||||
const jwt = __importStar(require("jsonwebtoken"));
|
||||
/**
|
||||
* JwtAuthGuard verifies JWTs issued by the external Identity Provider (Authentik)
|
||||
* using JWKS (RS256). It also accepts internal RayLab JWTs signed with a local secret.
|
||||
*/
|
||||
let JwtAuthGuard = class JwtAuthGuard {
|
||||
jwtService;
|
||||
constructor(jwtService) {
|
||||
this.jwtService = jwtService;
|
||||
}
|
||||
jwks = null;
|
||||
logger = new common_1.Logger('JwtAuthGuard');
|
||||
constructor() { }
|
||||
async canActivate(context) {
|
||||
const request = context.switchToHttp().getRequest();
|
||||
let token;
|
||||
const authHeader = request.headers.authorization;
|
||||
if (!authHeader) {
|
||||
throw new common_1.UnauthorizedException('Authorization header is missing.');
|
||||
if (authHeader) {
|
||||
const [type, t] = authHeader.split(' ');
|
||||
if (type === 'Bearer' && t)
|
||||
token = t;
|
||||
}
|
||||
const [type, token] = authHeader.split(' ');
|
||||
if (type !== 'Bearer' || !token) {
|
||||
throw new common_1.UnauthorizedException('Invalid authorization header.');
|
||||
// fallback to cookie if no Authorization header
|
||||
if (!token) {
|
||||
token = request.cookies?.raylab_jwt;
|
||||
this.logger.debug(`No Authorization header. Trying cookie. cookiePresent=${!!request.cookies} tokenFromCookie=${!!token}`);
|
||||
}
|
||||
else {
|
||||
this.logger.debug('Authorization header found. Using Bearer token.');
|
||||
}
|
||||
if (!token) {
|
||||
this.logger.debug('No token found in Authorization header or cookie.');
|
||||
throw new common_1.UnauthorizedException('Authorization token is missing.');
|
||||
}
|
||||
const jwksUri = process.env.AUTHENTIK_JWKS_URI;
|
||||
// First try verifying with external JWKS (Authentik)
|
||||
if (jwksUri) {
|
||||
try {
|
||||
if (!this.jwks)
|
||||
this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
|
||||
const { payload } = await (0, jose_1.jwtVerify)(token, this.jwks, {
|
||||
issuer: process.env.AUTHENTIK_ISSUER,
|
||||
audience: process.env.AUTHENTIK_AUDIENCE,
|
||||
});
|
||||
const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
|
||||
request.identity = identity;
|
||||
// mark as external (verified by Authentik JWKS)
|
||||
request.identitySource = 'external';
|
||||
this.logger.debug(`Verified token using external JWKS. sub=${payload.sub}`);
|
||||
return true;
|
||||
}
|
||||
catch (err) {
|
||||
this.logger.debug(`External JWKS verification failed: ${err.message}`);
|
||||
// ignore and try internal verification
|
||||
}
|
||||
}
|
||||
// Fallback: verify with internal symmetric secret
|
||||
const secret = process.env.RAYLAB_JWT_SECRET;
|
||||
if (!secret) {
|
||||
this.logger.error('RAYLAB_JWT_SECRET is not configured.');
|
||||
throw new common_1.UnauthorizedException('Invalid or expired token.');
|
||||
}
|
||||
try {
|
||||
const payload = await this.jwtService.verifyAsync(token);
|
||||
request['user'] = payload;
|
||||
const payload = jwt.verify(token, secret);
|
||||
const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
|
||||
request.identity = identity;
|
||||
// mark as internal (verified by RayLab internal secret)
|
||||
request.identitySource = 'internal';
|
||||
this.logger.debug(`Verified token using internal secret. sub=${payload.sub}`);
|
||||
return true;
|
||||
}
|
||||
catch {
|
||||
catch (err) {
|
||||
this.logger.debug(`Internal token verification failed: ${err.message}`);
|
||||
throw new common_1.UnauthorizedException('Invalid or expired token.');
|
||||
}
|
||||
}
|
||||
@@ -40,6 +122,6 @@ let JwtAuthGuard = class JwtAuthGuard {
|
||||
exports.JwtAuthGuard = JwtAuthGuard;
|
||||
exports.JwtAuthGuard = JwtAuthGuard = __decorate([
|
||||
(0, common_1.Injectable)(),
|
||||
__metadata("design:paramtypes", [jwt_1.JwtService])
|
||||
__metadata("design:paramtypes", [])
|
||||
], JwtAuthGuard);
|
||||
//# sourceMappingURL=jwt-auth.guard.js.map
|
||||
+1
-1
@@ -1 +1 @@
|
||||
{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/core/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAyC;AAIlC,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEJ;IADnB,YACmB,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAE7D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAEzD,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;YAE1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AA9BY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAGoB,gBAAU;GAF9B,YAAY,CA8BxB"}
|
||||
{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/core/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAMwB;AAExB,+BAAqD;AACrD,+DAA2D;AAC3D,kDAAoC;AAEpC;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACf,IAAI,GAAiD,IAAI,CAAC;IACjD,MAAM,GAAG,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC;IAErD,gBAAe,CAAC;IAEhB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAyC,CAAC;QAEvF,IAAI,KAAyB,CAAC;QAElC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAI,OAAe,CAAC,OAAO,EAAE,UAAU,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAE,OAAe,CAAC,OAAO,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtI,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE3C,qDAAqD;QACzD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;oBACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;iBACzC,CAAC,CAAC;gBAEK,MAAM,QAAQ,GAAG,IAAI,4BAAY,CACvC,OAAO,CAAC,GAAa,EACpB,OAAe,CAAC,kBAAwC,EACxD,OAAe,CAAC,KAA2B,EAC5C,OAA8B,CAC/B,CAAC;gBAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC5B,gDAAgD;gBAC/C,OAAe,CAAC,cAAc,GAAG,UAAU,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,kDAAkD;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACG,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAQ,CAAC;YAEvD,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACrB,OAAO,CAAC,kBAAwC,EAChD,OAAO,CAAC,KAA2B,EACnC,OAA8B,CAC/B,CAAC;YAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,wDAAwD;YACvD,OAAe,CAAC,cAAc,GAAG,UAAU,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AAvFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CAuFxB"}
|
||||
Reference in New Issue
Block a user