fix npm run build

2026-08-02 20:01:29 +07:00
parent 306c145f91
commit eb6031282a
236 changed files with 5557 additions and 47 deletions
@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jose_1 = require("jose");
+const identity_data_1 = require("../interfaces/identity-data");
+const jwt = __importStar(require("jsonwebtoken"));
+/**
+ * JwtAuthGuard verifies JWTs issued by the external Identity Provider (Authentik)
+ * using JWKS (RS256). It also accepts internal RayLab JWTs signed with a local secret.
+ */
+let JwtAuthGuard = class JwtAuthGuard {
+    jwks = null;
+    constructor() { }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            throw new common_1.UnauthorizedException('Authorization header is missing.');
+        }
+        const [type, token] = authHeader.split(' ');
+        if (type !== 'Bearer' || !token) {
+            throw new common_1.UnauthorizedException('Invalid authorization header.');
+        }
+        const jwksUri = process.env.AUTHENTIK_JWKS_URI;
+        // First try verifying with external JWKS (Authentik)
+        if (jwksUri) {
+            try {
+                if (!this.jwks)
+                    this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
+                const { payload } = await (0, jose_1.jwtVerify)(token, this.jwks, {
+                    issuer: process.env.AUTHENTIK_ISSUER,
+                    audience: process.env.AUTHENTIK_AUDIENCE,
+                });
+                const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+                request.identity = identity;
+                return true;
+            }
+            catch (err) {
+                // ignore and try internal verification
+            }
+        }
+        // Fallback: verify with internal symmetric secret
+        const secret = process.env.RAYLAB_JWT_SECRET;
+        if (!secret) {
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+        try {
+            const payload = jwt.verify(token, secret);
+            const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+            request.identity = identity;
+            return true;
+        }
+        catch (err) {
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map