fix npm run build
This commit is contained in:
Rayyan
+106
@@ -0,0 +1,106 @@
|
||||
"use strict";
|
||||
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
var desc = Object.getOwnPropertyDescriptor(m, k);
|
||||
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
||||
desc = { enumerable: true, get: function() { return m[k]; } };
|
||||
}
|
||||
Object.defineProperty(o, k2, desc);
|
||||
}) : (function(o, m, k, k2) {
|
||||
if (k2 === undefined) k2 = k;
|
||||
o[k2] = m[k];
|
||||
}));
|
||||
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
||||
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
||||
}) : function(o, v) {
|
||||
o["default"] = v;
|
||||
});
|
||||
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
||||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||||
};
|
||||
var __importStar = (this && this.__importStar) || (function () {
|
||||
var ownKeys = function(o) {
|
||||
ownKeys = Object.getOwnPropertyNames || function (o) {
|
||||
var ar = [];
|
||||
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
||||
return ar;
|
||||
};
|
||||
return ownKeys(o);
|
||||
};
|
||||
return function (mod) {
|
||||
if (mod && mod.__esModule) return mod;
|
||||
var result = {};
|
||||
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
||||
__setModuleDefault(result, mod);
|
||||
return result;
|
||||
};
|
||||
})();
|
||||
var __metadata = (this && this.__metadata) || function (k, v) {
|
||||
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.JwtAuthGuard = void 0;
|
||||
const common_1 = require("@nestjs/common");
|
||||
const jose_1 = require("jose");
|
||||
const identity_data_1 = require("../interfaces/identity-data");
|
||||
const jwt = __importStar(require("jsonwebtoken"));
|
||||
/**
|
||||
* JwtAuthGuard verifies JWTs issued by the external Identity Provider (Authentik)
|
||||
* using JWKS (RS256). It also accepts internal RayLab JWTs signed with a local secret.
|
||||
*/
|
||||
let JwtAuthGuard = class JwtAuthGuard {
|
||||
jwks = null;
|
||||
constructor() { }
|
||||
async canActivate(context) {
|
||||
const request = context.switchToHttp().getRequest();
|
||||
const authHeader = request.headers.authorization;
|
||||
if (!authHeader) {
|
||||
throw new common_1.UnauthorizedException('Authorization header is missing.');
|
||||
}
|
||||
const [type, token] = authHeader.split(' ');
|
||||
if (type !== 'Bearer' || !token) {
|
||||
throw new common_1.UnauthorizedException('Invalid authorization header.');
|
||||
}
|
||||
const jwksUri = process.env.AUTHENTIK_JWKS_URI;
|
||||
// First try verifying with external JWKS (Authentik)
|
||||
if (jwksUri) {
|
||||
try {
|
||||
if (!this.jwks)
|
||||
this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
|
||||
const { payload } = await (0, jose_1.jwtVerify)(token, this.jwks, {
|
||||
issuer: process.env.AUTHENTIK_ISSUER,
|
||||
audience: process.env.AUTHENTIK_AUDIENCE,
|
||||
});
|
||||
const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
|
||||
request.identity = identity;
|
||||
return true;
|
||||
}
|
||||
catch (err) {
|
||||
// ignore and try internal verification
|
||||
}
|
||||
}
|
||||
// Fallback: verify with internal symmetric secret
|
||||
const secret = process.env.RAYLAB_JWT_SECRET;
|
||||
if (!secret) {
|
||||
throw new common_1.UnauthorizedException('Invalid or expired token.');
|
||||
}
|
||||
try {
|
||||
const payload = jwt.verify(token, secret);
|
||||
const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
|
||||
request.identity = identity;
|
||||
return true;
|
||||
}
|
||||
catch (err) {
|
||||
throw new common_1.UnauthorizedException('Invalid or expired token.');
|
||||
}
|
||||
}
|
||||
};
|
||||
exports.JwtAuthGuard = JwtAuthGuard;
|
||||
exports.JwtAuthGuard = JwtAuthGuard = __decorate([
|
||||
(0, common_1.Injectable)(),
|
||||
__metadata("design:paramtypes", [])
|
||||
], JwtAuthGuard);
|
||||
//# sourceMappingURL=jwt-auth.guard.js.map
|
||||
+1
@@ -0,0 +1 @@
|
||||
{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/core/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAKwB;AAExB,+BAAqD;AACrD,+DAA2D;AAC3D,kDAAoC;AAEpC;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACf,IAAI,GAAiD,IAAI,CAAC;IAElE,gBAAe,CAAC;IAEhB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAyC,CAAC;QAE3F,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE/C,qDAAqD;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;oBACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;iBACzC,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACpB,OAAe,CAAC,kBAAwC,EACxD,OAAe,CAAC,KAA2B,EAC5C,OAA8B,CAC/B,CAAC;gBAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAQ,CAAC;YAEjD,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACrB,OAAO,CAAC,kBAAwC,EAChD,OAAO,CAAC,KAA2B,EACnC,OAA8B,CAC/B,CAAC;YAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AApEY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CAoExB"}
|
||||
Reference in New Issue
Block a user