@5minds/processcube_engine
Version:
The ProcessCube Engine. Stores and executes BPMNs.
239 lines • 10.5 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __importStar = (this && this.__importStar) || (function () {
var ownKeys = function(o) {
ownKeys = Object.getOwnPropertyNames || function (o) {
var ar = [];
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
return ar;
};
return ownKeys(o);
};
return function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
__setModuleDefault(result, mod);
return result;
};
})();
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.IdentityService = void 0;
const inversify_1 = require("inversify");
const jose = __importStar(require("jose"));
const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
const processcube_engine_sdk_1 = require("@5minds/processcube_engine_sdk");
const Configurator_1 = __importDefault(require("../Configurator"));
const Internals_1 = require("./Internals");
const defaultRootAccessToken = 'ZHVtbXlfdG9rZW4=';
const internalToken = 'QXRsYXNFbmdpbmVJbnRlcm5hbFVzZXI=';
let IdentityService = class IdentityService {
config;
jsonWebToken;
iamFetchClient;
mock;
logger = new processcube_engine_sdk_1.Logger('iam:identity_service');
minimumRefreshTimeInMs = 1000;
maximumRefreshTimeInMs = 2 ** 31 - 1;
initialize(jsonWebToken, mock = false) {
this.config = Configurator_1.default.get('iam');
this.jsonWebToken = jsonWebToken ? jsonWebToken : jsonwebtoken_1.default;
this.mock = mock;
this.iamFetchClient = new Internals_1.IAMFetchClient();
}
getRootAccessTokenAllowed() {
// This can be a string value, because parameters provided through the console are always interpreted as strings.
return this.config?.allowAnonymousRootAccess == 'true' || this.config?.allowAnonymousRootAccess == true;
}
async getIdentity(params) {
if (!params.token) {
this.logger.error('No auth token provided!');
throw new processcube_engine_sdk_1.BadRequestError('Must provide a token by which to create an identity!');
}
if (this.isInternalToken(params.token)) {
return {
token: params.token,
claims: this.getClaimsForInternalIdentity(),
userId: 'AtlasEngineInternalUser',
};
}
if (this.isRootAccessToken(params.token)) {
return {
token: params.token,
claims: this.getClaimsForInternalIdentity(),
userId: 'dummy_token',
};
}
try {
const decodedToken = await this.decodeToken(params.token, params.skipValidation, params.ignoreTokenExpired);
this.validateDecodedToken(decodedToken);
const originUserId = params.userId || decodedToken.sub || decodedToken.client_id;
return {
token: params.token,
claims: await this.getClaims(params.token),
originUserId: originUserId,
userId: params.sessionId || originUserId,
userEmail: decodedToken.email,
userName: decodedToken.name,
};
}
catch (error) {
this.logger.error(`Failed to resolve identity: ${error.message}`, {
additionalInformation: {
err: error,
},
});
const errorToThrow = new processcube_engine_sdk_1.BadRequestError(error.message);
errorToThrow.additionalInformation = {
originalError: error,
};
throw errorToThrow;
}
}
async getIdentityForExtensionAdapters(identity) {
if (!identity) {
return this.getInternalIdentity();
}
const mappedIdentity = await this.getIdentity({ token: identity.token, userId: identity.userId });
return mappedIdentity;
}
getAvailableLaneClaims(identity) {
const allowedLanes = Object.entries(identity.claims)
.filter(([claim, value]) => value !== false)
.map(([claim]) => claim)
.concat(['', null]);
return allowedLanes;
}
getRootAccessIdentity() {
return {
token: this.config.rootAccessToken ?? defaultRootAccessToken,
claims: this.getClaimsForInternalIdentity(),
userId: 'dummy_token',
};
}
getInternalIdentity() {
return {
token: internalToken,
claims: this.getClaimsForInternalIdentity(),
userId: 'AtlasEngineInternalUser',
};
}
isInternalToken(token) {
return token === internalToken;
}
isRootAccessToken(token) {
return this.config?.rootAccessToken ? token === this.config.rootAccessToken : token === defaultRootAccessToken;
}
async getClaims(token) {
const decodedToken = this.jsonWebToken.decode(token);
if (!decodedToken) {
return {};
}
const nonClaimKeys = ['nbf', 'exp', 'iss', 'client_id', 'sub', 'auth_time', 'idp', 'sid', 'iat', 'scope', 'amr', 'jti', 'aud', 'nonce', 'azp', 'acr', 'at_hash', 'c_hash'];
for (const nonClaim of nonClaimKeys) {
delete decodedToken[nonClaim];
}
return decodedToken ?? {};
}
async decodeToken(token, skipValidation = false, ignoreTokenExpired = false) {
if (skipValidation || this.config.baseUrl == undefined) {
return this.jsonWebToken.decode(token);
}
const getKey = (header, callback) => {
if (this.mock) {
callback(null, 'public-key');
return;
}
this.iamFetchClient.getJwks().then(async (jwks) => {
const key = jwks.keys.find((key) => key.kid === header.kid);
if (!key) {
callback(new Error('The given auth token is invalid.'));
}
const keyLike = await jose.importJWK(key);
const pemKey = await jose.exportSPKI(keyLike);
callback(null, pemKey);
});
};
return new Promise((resolve, reject) => {
this.jsonWebToken.verify(token, getKey.bind(this), { ignoreExpiration: ignoreTokenExpired }, (error, verifiedToken) => {
if (error) {
const errorToThrow = new processcube_engine_sdk_1.BadRequestError('The given auth token is invalid.');
errorToThrow.additionalInformation = {
error: error,
};
return reject(error);
}
resolve(verifiedToken);
});
});
}
validateDecodedToken(decodedToken) {
if (!decodedToken) {
throw new processcube_engine_sdk_1.BadRequestError('The given auth token is invalid.');
}
const tokenHasNoId = !(decodedToken.sub || decodedToken.client_id);
if (tokenHasNoId) {
throw new processcube_engine_sdk_1.BadRequestError('The given auth token contains neither sub, nor client_id. At least one of them is required for identification.');
}
}
calculateMinimumTokenLifetime(tokenLifetime) {
if (!tokenLifetime || tokenLifetime <= 0) {
return 0;
}
return Math.floor(tokenLifetime / 10);
}
limitNumberWithinRange(number, min, max) {
return Math.min(Math.max(number, min), max);
}
getClaimsForInternalIdentity() {
return {
[processcube_engine_sdk_1.claims.canDeleteProcessModel]: true,
[processcube_engine_sdk_1.claims.canWriteProcessModel]: true,
[processcube_engine_sdk_1.claims.canAccessExternalTasks]: true,
[processcube_engine_sdk_1.claims.canSubscribeToEvents]: true,
[processcube_engine_sdk_1.claims.canTerminateProcess]: true,
[processcube_engine_sdk_1.claims.canTriggerMessages]: true,
[processcube_engine_sdk_1.claims.canTriggerSignals]: true,
[processcube_engine_sdk_1.claims.canRetryProcessInstance]: true,
[processcube_engine_sdk_1.claims.canManageProcessInstances]: true,
};
}
};
exports.IdentityService = IdentityService;
__decorate([
(0, inversify_1.postConstruct)(),
__metadata("design:type", Function),
__metadata("design:paramtypes", [Object, Object]),
__metadata("design:returntype", void 0)
], IdentityService.prototype, "initialize", null);
exports.IdentityService = IdentityService = __decorate([
(0, inversify_1.injectable)()
], IdentityService);
//# sourceMappingURL=IdentityService.js.map