nest-azure-ad-jwt-validator
Version:
Nest Azure Active Directory JWT Token Validator
78 lines • 4.02 kB
JavaScript
;
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var AzureActiveDirectoryGuard_1;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AzureActiveDirectoryGuard = void 0;
const common_1 = require("@nestjs/common");
const azure_token_validation_1 = require("../azure-token-validation");
const module_config_1 = require("../module-config");
const core_1 = require("@nestjs/core");
let AzureActiveDirectoryGuard = AzureActiveDirectoryGuard_1 = class AzureActiveDirectoryGuard {
constructor(reflector, tokenValidationService, options) {
this.reflector = reflector;
this.tokenValidationService = tokenValidationService;
this.options = options;
this.logger = new common_1.Logger(AzureActiveDirectoryGuard_1.name);
}
canActivate(context) {
return __awaiter(this, void 0, void 0, function* () {
const accessToken = this.parseTokenFromContext(context);
const [isTokenValid, user, isServiceToken] = yield this.tokenValidationService.isTokenValid(accessToken);
if (!isTokenValid) {
return false;
}
if (isServiceToken) {
return true;
}
const roles = this.reflector.get('roles', context.getHandler());
if (!roles) {
return true;
}
return this.matchRoles(roles, user.roles);
});
}
parseTokenFromContext(context) {
var _a;
const request = context.switchToHttp().getRequest();
const header = (_a = this.options.tokenHeader) !== null && _a !== void 0 ? _a : 'authtoken';
const token = request.headers[header];
return (!!token ? token.toString() : '').trim().split(' ').pop();
}
matchRoles(roles, usersRoles) {
const userRolesLower = usersRoles.map((key) => key.toLowerCase());
for (const role of roles) {
if (userRolesLower.includes(role.toLowerCase())) {
return true;
}
}
if (this.options.enableDebugLogs) {
this.logger.warn('403 Permission Denied: User not in routes role.');
}
return false;
}
};
AzureActiveDirectoryGuard = AzureActiveDirectoryGuard_1 = __decorate([
(0, common_1.Injectable)(),
__metadata("design:paramtypes", [core_1.Reflector,
azure_token_validation_1.AzureTokenValidationService,
module_config_1.NestAzureAdJwtValidatorModuleOptions])
], AzureActiveDirectoryGuard);
exports.AzureActiveDirectoryGuard = AzureActiveDirectoryGuard;
//# sourceMappingURL=azure-active-directory.guard.js.map