@5minds/processcube_engine
Version:
The ProcessCube Engine. Stores and executes BPMNs.
126 lines • 5.8 kB
JavaScript
"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.IamService = void 0;
const inversify_1 = require("inversify");
const processcube_engine_sdk_1 = require("@5minds/processcube_engine_sdk");
const Configurator_1 = __importDefault(require("../Configurator"));
// No logs will be created for any of the claims listed in here.
const optionalclaims = [processcube_engine_sdk_1.claims.canManageProcessInstances, processcube_engine_sdk_1.claims.canObserveEngine];
const defaultRootAccessToken = 'ZHVtbXlfdG9rZW4=';
const internalToken = 'QXRsYXNFbmdpbmVJbnRlcm5hbFVzZXI=';
let IamService = class IamService {
claimChecksDisabled = false;
rootAccessTokenAllowed = false;
config;
logger;
constructor() {
this.claimChecksDisabled = process.env.DISABLE_CLAIM_CHECKS == 'true';
this.logger = new processcube_engine_sdk_1.Logger('iam:iam_service');
}
initialize() {
this.config = Configurator_1.default.iam();
// This can be a string value, because parameters provided through the console are always interpreted as strings.
this.rootAccessTokenAllowed = this.config?.allowAnonymousRootAccess == 'true' || this.config?.allowAnonymousRootAccess == true;
}
getAuthorityAddress() {
return this.config.baseUrl;
}
ensureHasClaim(identity, claimName, claimValue = true) {
const identityHasclaim = this.checkIfIdentityHasClaim(identity, claimName, claimValue);
if (!identityHasclaim) {
const error = new processcube_engine_sdk_1.ForbiddenError('Identity does not have the requested claim!');
error.additionalInformation = {
identity: identity,
claim: claimName,
requiredClaimValue: claimValue,
actualClaimValue: identity.claims[claimName],
};
const isRequiredClaim = !optionalclaims.some((claim) => claim === claimName);
if (isRequiredClaim) {
this.logger.error('Claim check failed!', {
err: error,
});
}
throw error;
}
}
checkIfIdentityHasClaim(identity, claimName, claimValue = true) {
if (this.claimChecksDisabled) {
return true;
}
const isInternalToken = this.checkIfTokenIsInternalToken(identity.token);
if (isInternalToken) {
return true;
}
const isRootAccessToken = this.checkIfTokenIsRootAccessToken(identity.token);
if (isRootAccessToken && this.rootAccessTokenAllowed) {
return true;
}
if (!identity) {
throw new processcube_engine_sdk_1.BadRequestError('No valid identity given!');
}
if (!claimName || claimName === '') {
throw new processcube_engine_sdk_1.BadRequestError('No valid claimName given!');
}
if (isRootAccessToken && !this.rootAccessTokenAllowed) {
this.logger.error('Illegal use of root access token.', {
claimName: claimName,
identity: identity,
});
const error = new processcube_engine_sdk_1.ForbiddenError('Identity does not have the requested claim!');
error.additionalInformation = {
claimName: claimName,
identity: identity,
reason: 'Use of root access token is not allowed.',
};
throw error;
}
const userHasClaim = this.checkIfUserHasClaim(identity, claimName, claimValue);
return userHasClaim;
}
checkIfUserIsObserver(identity) {
return this.checkIfUserHasClaim(identity, processcube_engine_sdk_1.claims.canObserveEngine, true);
}
checkIfUserIsSuperAdmin(identity) {
return this.checkIfUserHasClaim(identity, processcube_engine_sdk_1.claims.canManageProcessInstances, true);
}
checkIfTokenIsInternalToken(token) {
return token === internalToken;
}
checkIfTokenIsRootAccessToken(token) {
return this.config?.rootAccessToken ? token === this.config.rootAccessToken : token === defaultRootAccessToken;
}
checkIfUserHasClaim(identity, claimName, claimValue = true) {
if (!identity?.claims) {
return false;
}
if (claimValue) {
return identity.claims[claimName] == claimValue;
}
return Object.keys(identity.claims).includes(claimName);
}
};
exports.IamService = IamService;
__decorate([
(0, inversify_1.postConstruct)(),
__metadata("design:type", Function),
__metadata("design:paramtypes", []),
__metadata("design:returntype", void 0)
], IamService.prototype, "initialize", null);
exports.IamService = IamService = __decorate([
(0, inversify_1.injectable)(),
__metadata("design:paramtypes", [])
], IamService);
//# sourceMappingURL=IamService.js.map