@@ -5,18 +5,20 @@ import {
55 UnauthorizedException ,
66 ForbiddenException ,
77 } from '@nestjs/common' ;
8- import jwt , { JwtHeader , SigningKeyCallback } from 'jsonwebtoken' ;
8+ import * as jwt from 'jsonwebtoken' ;
9+ import { JwtHeader , SigningKeyCallback } from 'jsonwebtoken' ;
910 import { JwksClient } from 'jwks-rsa' ;
1011 import { ENV_CONFIG } from 'src/config' ;
11-
12+
1213 // Use the new, validated config variable
1314 const mockAzureAdValidation = ENV_CONFIG . MOCK_AZURE_AD_VALIDATION ;
14- if ( mockAzureAdValidation ) console . warn ( 'Mock Azure AD validation enabled 🚀' ) ;
15-
15+ if ( mockAzureAdValidation )
16+ console . warn ( 'Mock Azure AD validation enabled 🚀' ) ;
17+
1618 const multiTenantClient = new JwksClient ( {
1719 jwksUri : `https://login.microsoftonline.com/common/discovery/v2.0/keys` ,
1820 } ) ;
19-
21+
2022 const getSigningKey = ( header : JwtHeader , callback : SigningKeyCallback ) => {
2123 if ( ! header . kid ) {
2224 return callback ( new Error ( 'JWT header is missing "kid" property.' ) ) ;
@@ -29,24 +31,24 @@ import {
2931 callback ( null , signingKey ) ;
3032 } ) ;
3133 } ;
32-
34+
3335 @Injectable ( )
3436 export class AzureAdGuard implements CanActivate {
3537 async canActivate ( context : ExecutionContext ) : Promise < boolean > {
3638 const request = context . switchToHttp ( ) . getRequest ( ) ;
3739 const authHeader = request . headers . authorization ;
38-
40+
3941 if ( ! authHeader || ! authHeader . startsWith ( 'Bearer ' ) ) {
4042 throw new UnauthorizedException ( 'No token provided.' ) ;
4143 }
42-
44+
4345 const token = authHeader . substring ( 7 ) ;
44-
46+
4547 if ( mockAzureAdValidation ) {
4648 request . user = { oid : token } ;
4749 return true ;
4850 }
49-
51+
5052 try {
5153 const payload = await this . verifyToken ( token ) ;
5254 request . user = payload ;
@@ -55,14 +57,14 @@ import {
5557 throw error ;
5658 }
5759 }
58-
60+
5961 private verifyToken ( token : string ) : Promise < jwt . JwtPayload > {
6062 return new Promise ( ( resolve , reject ) => {
6163 jwt . verify (
6264 token ,
6365 getSigningKey ,
6466 {
65- audience : ENV_CONFIG . AZURE_AD_AUDIENCE , // Corrected reference
67+ audience : ENV_CONFIG . AZURE_AD_AUDIENCE ,
6668 algorithms : [ 'RS256' ] ,
6769 } ,
6870 ( err , decoded ) => {
@@ -71,9 +73,9 @@ import {
7173 new UnauthorizedException ( 'Invalid token.' , err . message ) ,
7274 ) ;
7375 }
74-
76+
7577 const payload = decoded as jwt . JwtPayload ;
76-
78+
7779 if (
7880 ENV_CONFIG . IS_SAME_AZURE_AD_TENANT && // Corrected reference
7981 payload . tid !== ENV_CONFIG . AZURE_AD_TENANT_ID // Corrected reference
@@ -82,7 +84,7 @@ import {
8284 new ForbiddenException ( 'User is not from the correct tenant.' ) ,
8385 ) ;
8486 }
85-
87+
8688 resolve ( payload ) ;
8789 } ,
8890 ) ;
0 commit comments