fix npm run build
This commit is contained in:
Rayyan
Vendored
+209
@@ -0,0 +1,209 @@
|
||||
"use strict";
|
||||
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
|
||||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||||
};
|
||||
var __metadata = (this && this.__metadata) || function (k, v) {
|
||||
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
|
||||
};
|
||||
var __param = (this && this.__param) || function (paramIndex, decorator) {
|
||||
return function (target, key) { decorator(target, key, paramIndex); }
|
||||
};
|
||||
Object.defineProperty(exports, "__esModule", { value: true });
|
||||
exports.AuthService = void 0;
|
||||
const common_1 = require("@nestjs/common");
|
||||
const config_1 = require("@nestjs/config");
|
||||
const jwt_1 = require("@nestjs/jwt");
|
||||
const sync_identity_handler_1 = require("../identity/application/handlers/user/sync-identity.handler");
|
||||
const user_interface_1 = require("../identity/domain/repositories/user.interface");
|
||||
const prisma_service_1 = require("../../shared/prisma.service");
|
||||
const redis_pkce_store_1 = require("./pkce/redis-pkce.store");
|
||||
const inmemory_refresh_store_1 = require("./refresh/inmemory-refresh.store");
|
||||
const openidClient = require('openid-client');
|
||||
let AuthService = class AuthService {
|
||||
config;
|
||||
jwtService;
|
||||
prisma;
|
||||
userRepository;
|
||||
syncIdentityHandler;
|
||||
pkceStore;
|
||||
refreshStore;
|
||||
constructor(config, jwtService, prisma, userRepository, syncIdentityHandler, pkceStore, refreshStore) {
|
||||
this.config = config;
|
||||
this.jwtService = jwtService;
|
||||
this.prisma = prisma;
|
||||
this.userRepository = userRepository;
|
||||
this.syncIdentityHandler = syncIdentityHandler;
|
||||
this.pkceStore = pkceStore;
|
||||
this.refreshStore = refreshStore;
|
||||
}
|
||||
issuer = null;
|
||||
client = null;
|
||||
async getIssuer() {
|
||||
if (this.issuer)
|
||||
return this.issuer;
|
||||
const issuerUrl = this.config.get('AUTHENTIK_ISSUER');
|
||||
if (!issuerUrl)
|
||||
throw new Error('AUTHENTIK_ISSUER not configured');
|
||||
this.issuer = await openidClient.Issuer.discover(issuerUrl);
|
||||
return this.issuer;
|
||||
}
|
||||
async getClient() {
|
||||
if (this.client)
|
||||
return this.client;
|
||||
const issuer = await this.getIssuer();
|
||||
const clientId = this.config.get('AUTHENTIK_CLIENT_ID');
|
||||
const clientSecret = this.config.get('AUTHENTIK_CLIENT_SECRET');
|
||||
if (!clientId)
|
||||
throw new Error('AUTHENTIK_CLIENT_ID not configured');
|
||||
this.client = new issuer.Client({ client_id: clientId, client_secret: clientSecret });
|
||||
return this.client;
|
||||
}
|
||||
async createAuthorizationRedirect(returnTo) {
|
||||
const client = await this.getClient();
|
||||
const redirectUri = this.config.get('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
|
||||
const state = require('crypto').randomUUID();
|
||||
const code_verifier = openidClient.generators.codeVerifier();
|
||||
const code_challenge = await openidClient.generators.codeChallenge(code_verifier);
|
||||
const nonce = openidClient.generators.nonce();
|
||||
await this.pkceStore.save(state, { code_verifier, nonce, returnTo }, 300);
|
||||
const url = client.authorizationUrl({
|
||||
redirect_uri: redirectUri,
|
||||
scope: this.config.get('AUTHENTIK_DEFAULT_SCOPE') || 'openid email profile',
|
||||
response_type: 'code',
|
||||
code_challenge,
|
||||
code_challenge_method: 'S256',
|
||||
state,
|
||||
nonce,
|
||||
});
|
||||
return url;
|
||||
}
|
||||
async handleCallback(code, state) {
|
||||
const client = await this.getClient();
|
||||
const pkce = await this.pkceStore.get(state);
|
||||
if (!pkce)
|
||||
throw new common_1.UnauthorizedException('Invalid or expired state');
|
||||
// remove one-time state
|
||||
await this.pkceStore.remove(state);
|
||||
const redirectUri = this.config.get('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
|
||||
// exchange code
|
||||
const tokenSet = await client.callback(redirectUri, { code, state }, { code_verifier: pkce.code_verifier, nonce: pkce.nonce });
|
||||
// verify id_token and get claims
|
||||
const claims = tokenSet.claims();
|
||||
// fetch userinfo if available
|
||||
let userInfo = null;
|
||||
try {
|
||||
if (tokenSet.access_token && client.userinfo) {
|
||||
userInfo = await client.userinfo(tokenSet.access_token);
|
||||
}
|
||||
}
|
||||
catch (e) {
|
||||
// ignore
|
||||
}
|
||||
const identity = {
|
||||
sub: userInfo?.sub || claims.sub || null,
|
||||
preferred_username: userInfo?.preferred_username || userInfo?.username || userInfo?.email || claims.preferred_username || claims.email,
|
||||
email: userInfo?.email || claims.email,
|
||||
raw: { tokenSet, userInfo, claims },
|
||||
};
|
||||
// Sync identity to local user (create if needed)
|
||||
const domainUser = await this.syncIdentityHandler.execute(identity);
|
||||
// ensure active/not deleted
|
||||
if (!domainUser.isActive)
|
||||
throw new common_1.UnauthorizedException('User is not active');
|
||||
if (domainUser.deletedAt)
|
||||
throw new common_1.UnauthorizedException('User is deleted');
|
||||
// create internal JWT
|
||||
const jwtPayload = {
|
||||
sub: domainUser.id,
|
||||
preferred_username: domainUser.username,
|
||||
email: domainUser.email,
|
||||
};
|
||||
const expiresIn = Number(this.config.get('RAYLAB_JWT_EXPIRES_IN') || 3600);
|
||||
const access = this.jwtService.sign(jwtPayload, { expiresIn });
|
||||
// create internal refresh token
|
||||
const refreshToken = require('crypto').randomUUID();
|
||||
const refreshTtl = Number(this.config.get('RAYLAB_REFRESH_EXPIRES_IN') || 30 * 24 * 3600); // default 30 days
|
||||
await this.refreshStore.set(refreshToken, { userId: domainUser.id }, refreshTtl);
|
||||
return {
|
||||
accessToken: access,
|
||||
refreshToken,
|
||||
expiresIn,
|
||||
refreshTtl,
|
||||
user: {
|
||||
id: domainUser.id,
|
||||
username: domainUser.username,
|
||||
email: domainUser.email,
|
||||
roles: domainUser.roles || [],
|
||||
},
|
||||
returnTo: pkce.returnTo,
|
||||
};
|
||||
}
|
||||
async refresh(refreshToken) {
|
||||
if (!refreshToken)
|
||||
throw new common_1.UnauthorizedException('Missing refresh token');
|
||||
const data = await this.refreshStore.get(refreshToken);
|
||||
if (!data)
|
||||
throw new common_1.UnauthorizedException('Invalid refresh token');
|
||||
const userId = data.userId;
|
||||
// load user
|
||||
const domainUser = await this.userRepository.getById(userId);
|
||||
if (!domainUser)
|
||||
throw new common_1.UnauthorizedException('User not found');
|
||||
if (!domainUser.isActive)
|
||||
throw new common_1.UnauthorizedException('User is not active');
|
||||
// rotate refresh token
|
||||
await this.refreshStore.del(refreshToken);
|
||||
const newRefresh = require('crypto').randomUUID();
|
||||
const refreshTtl = Number(this.config.get('RAYLAB_REFRESH_EXPIRES_IN') || 30 * 24 * 3600);
|
||||
await this.refreshStore.set(newRefresh, { userId }, refreshTtl);
|
||||
const expiresIn = Number(this.config.get('RAYLAB_JWT_EXPIRES_IN') || 3600);
|
||||
const access = this.jwtService.sign({ sub: domainUser.id, preferred_username: domainUser.username, email: domainUser.email }, { expiresIn });
|
||||
return { accessToken: access, refreshToken: newRefresh, expiresIn, refreshTtl };
|
||||
}
|
||||
async logout(refreshToken) {
|
||||
if (refreshToken) {
|
||||
await this.refreshStore.del(refreshToken);
|
||||
}
|
||||
const issuer = await this.getIssuer();
|
||||
const endSession = issuer.metadata.end_session_endpoint;
|
||||
const postLogout = this.config.get('APP_URL') || '/';
|
||||
if (endSession) {
|
||||
// Redirect to identity provider logout
|
||||
const url = new URL(endSession);
|
||||
if (postLogout)
|
||||
url.searchParams.set('post_logout_redirect_uri', postLogout);
|
||||
return url.toString();
|
||||
}
|
||||
return postLogout;
|
||||
}
|
||||
async me(token) {
|
||||
if (!token)
|
||||
throw new common_1.UnauthorizedException('Missing token');
|
||||
try {
|
||||
const payload = this.jwtService.verify(token);
|
||||
const user = await this.userRepository.getById(payload.sub);
|
||||
if (!user)
|
||||
throw new common_1.UnauthorizedException('User not found');
|
||||
return { id: user.id, username: user.username, email: user.email, roles: user.roles || [] };
|
||||
}
|
||||
catch (e) {
|
||||
throw new common_1.UnauthorizedException('Invalid token');
|
||||
}
|
||||
}
|
||||
};
|
||||
exports.AuthService = AuthService;
|
||||
exports.AuthService = AuthService = __decorate([
|
||||
(0, common_1.Injectable)(),
|
||||
__param(3, (0, common_1.Inject)(user_interface_1.IUser)),
|
||||
__metadata("design:paramtypes", [config_1.ConfigService,
|
||||
jwt_1.JwtService,
|
||||
prisma_service_1.PrismaService,
|
||||
user_interface_1.IUser,
|
||||
sync_identity_handler_1.SyncIdentityHandler,
|
||||
redis_pkce_store_1.RedisPkceStore,
|
||||
inmemory_refresh_store_1.InMemoryRefreshStore])
|
||||
], AuthService);
|
||||
//# sourceMappingURL=auth.service.js.map
|
||||
Reference in New Issue
Block a user