switching auth strategy to oidc

* adding optional auth to guard

* adding optional auth to guard

libs/modules/src/auth/auth.gaurd.ts

@@ -1,25 +1,14 @@
-import { CanActivate } from '@nestjs/common';
 import { ExecutionContext, Injectable } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
 import { AuthGuard as PassportAuthGuard } from '@nestjs/passport';
 import { Observable } from 'rxjs';
 
 @Injectable()
-export class AuthGuard extends PassportAuthGuard('azure-ad') implements CanActivate {
+export class AuthGuard extends PassportAuthGuard('oidc') {
-    constructor(private readonly reflector: Reflector) {
+    constructor() {
         super();
     }
 
     canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean> {
-        const isPublic = this.reflector.get<boolean>(
-            'isPublic',
-            context.getHandler()
-        );
-
-        if (isPublic) {
-            return true;
-        }
-
         return super.canActivate(context);
     }
 }

libs/modules/src/auth/auth.interface.ts

@@ -1,5 +1,10 @@
-export interface AuthOptions {
+export interface AuthModuleOptions {
-  tenantId: string;
+  authorizationUrl: string;
+  issuer: string;
+  callbackUrl: string;
   clientId: string;
   clientSecret: string;
+  scope: string;
+  tokenUrl: string;
+  userInfoUrl: string;
 }

libs/modules/src/auth/auth.module-definition.ts

@@ -0,0 +1,4 @@
+import { ConfigurableModuleBuilder } from '@nestjs/common';
+import { AuthModuleOptions } from './auth.interface';
+
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN } = new ConfigurableModuleBuilder<AuthModuleOptions>().build()

libs/modules/src/auth/auth.module.ts

@@ -1,26 +1,16 @@
-import { Module, DynamicModule } from '@nestjs/common';
+import { Module } from '@nestjs/common';
-import { AuthOptions } from './auth.interface';
-import { AUTH_OPTIONS } from './auth.constants';
 import { PassportModule } from '@nestjs/passport';
-import { AzureAdStrategy } from './auth.strategy';
+import { OidcStrategy } from './oidc.strategy';
+import { ConfigurableModuleClass } from './auth.module-definition';
 
-@Module({})
+@Module({
-export class AuthModule {
+  imports: [
-  static register(options: AuthOptions): DynamicModule {
+    PassportModule.register({
-    return {
+      defaultStrategy: 'oidc'
-      module: AuthModule,
+    })
-      imports: [
+  ],
-        PassportModule.register({
+  providers: [
-          defaultStrategy: 'azure-ad'
+    OidcStrategy
-        })
+  ]
-      ],
+})
-      providers: [
+export class AuthModule extends ConfigurableModuleClass {}
-        {
-          provide: AUTH_OPTIONS,
-          useValue: options
-        },
-        AzureAdStrategy
-      ]
-    };
-  }
-}

libs/modules/src/auth/auth.strategy.ts

@@ -1,25 +0,0 @@
-import { Inject, Injectable } from "@nestjs/common";
-import { PassportStrategy } from "@nestjs/passport";
-import { BearerStrategy } from 'passport-azure-ad';
-import { AuthOptions } from './auth.interface'
-import { AUTH_OPTIONS } from "./auth.constants";
-
-@Injectable()
-export class AzureAdStrategy extends PassportStrategy(
-    BearerStrategy,
-    'azure-ad'
-) {
-    constructor(@Inject(AUTH_OPTIONS) authOptions: AuthOptions) {
-        super({
-            identityMetadata: `https://login.microsoftonline.com/${authOptions.tenantId}/.well-known/openid-configuration`,
-            clientID: authOptions.clientId,
-            audience: `api://${authOptions.clientId}`,
-            loggingLevel: 'info',
-            loggingNoPII: false
-        })
-    }
-
-    async validate(data: any): Promise<any> {
-        return data;
-    }
-}

libs/modules/src/auth/oidc.strategy.ts

@@ -0,0 +1,31 @@
+import { PassportStrategy } from "@nestjs/passport";
+import { Strategy, Profile } from 'passport-openidconnect';
+import { MODULE_OPTIONS_TOKEN } from "./auth.module-definition";
+import { AuthModuleOptions } from "./auth.interface";
+import { Inject, Injectable } from "@nestjs/common";
+
+@Injectable()
+export class OidcStrategy extends PassportStrategy(Strategy, 'oidc') {
+  constructor(@Inject(MODULE_OPTIONS_TOKEN) authModuleOptions: AuthModuleOptions) {
+    super({
+      authorizationURL: authModuleOptions.authorizationUrl,
+      callbackURL: authModuleOptions.callbackUrl,
+      clientID: authModuleOptions.clientId,
+      clientSecret: authModuleOptions.clientSecret,
+      issuer: authModuleOptions.issuer,
+      scope: authModuleOptions.scope,
+      tokenURL: authModuleOptions.tokenUrl,
+      userInfoURL: authModuleOptions.userInfoUrl
+    })
+  }
+
+  async validate(profile: Profile, done: Function): Promise<any> {
+    const user = {
+      id: profile.id,
+      email: profile.emails,
+      name: profile.displayName
+    }
+
+    done(null, user)
+  }
+}

libs/modules/src/auth/public.decorator.ts

@@ -1,3 +1,4 @@
 import { SetMetadata } from "@nestjs/common";
 
-export const Public = () => SetMetadata('isPublic', true);
+export const IS_PUBLIC_KEY = 'isPublic'
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

libs/modules/src/azAppConfig/az-app-config.constants.ts

@@ -1 +0,0 @@
-export const APP_CONFIG_OPTIONS = 'APP_CONFIG_OPTIONS';

libs/modules/src/azAppConfig/az-app-config.module.ts

@@ -1,21 +0,0 @@
-import { Module, DynamicModule } from '@nestjs/common';
-import { AppConfigService } from './az-app-config.service';
-import { AppConfigOptions } from './az-app-config.interface';
-import { APP_CONFIG_OPTIONS } from './az-app-config.constants';
-
-@Module({})
-export class AppConfigModule {
-  static register(options: AppConfigOptions): DynamicModule {
-    return {
-      module: AppConfigModule,
-      providers: [
-        {
-          provide: APP_CONFIG_OPTIONS,
-          useValue: options
-        },
-        AppConfigService
-      ],
-      exports: [AppConfigService]
-    };
-  }
-}

libs/modules/src/azAppConfig/az-app-config.service.ts

@@ -1,38 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { AppConfigOptions } from './az-app-config.interface';
-import { APP_CONFIG_OPTIONS } from './az-app-config.constants';
-import axios, { AxiosResponse } from 'axios';
-import { AppConfigurationClient, ConfigurationSetting, FeatureFlagValue, GetConfigurationSettingResponse, featureFlagPrefix, isFeatureFlag, parseFeatureFlag } from '@azure/app-configuration';
-import { ClientSecretCredential } from '@azure/identity';
-
-@Injectable()
-export class AppConfigService {
-  constructor(
-    @Inject(APP_CONFIG_OPTIONS)
-    private appConfigOptions: AppConfigOptions
-  ) { }
-
-  async getFeatureFlags(keys: string[], label: string): Promise<{ key: string, enabled: boolean }[]> {
-    const credential: ClientSecretCredential = new ClientSecretCredential(this.appConfigOptions.tenantId, this.appConfigOptions.clientId, this.appConfigOptions.clientSecret);
-    const client: AppConfigurationClient = new AppConfigurationClient(this.appConfigOptions.url, credential);
-    const featureFlags: { key: string, enabled: boolean }[] = await Promise.all(
-      keys.map(async (key: string) => {
-        const configSetting: GetConfigurationSettingResponse = await client.getConfigurationSetting({
-          key: `${featureFlagPrefix}${key}`,
-          label: label
-        });
-
-        if (isFeatureFlag(configSetting)) {
-          const parsedFeatureFlag: ConfigurationSetting<FeatureFlagValue> = parseFeatureFlag(configSetting);
-
-          return {
-            key: parsedFeatureFlag.value.id,
-            enabled: parsedFeatureFlag.value.enabled
-          }
-        }
-      })
-    );
-
-    return featureFlags;
-  }
-}

libs/modules/src/azTable/az-table.constants.ts

@@ -1 +0,0 @@
-export const TABLE_OPTIONS = 'TABLE_OPTIONS';

libs/modules/src/azTable/az-table.interface.ts

@@ -1,4 +0,0 @@
-export interface TableOptions {
-  accountName: string;
-  accountKey: string;
-}

libs/modules/src/azTable/az-table.module.ts

@@ -1,21 +0,0 @@
-import { Module, DynamicModule } from '@nestjs/common';
-import { TableService } from './az-table.service';
-import { TableOptions } from './az-table.interface';
-import { TABLE_OPTIONS } from './az-table.constants';
-
-@Module({})
-export class TableModule {
-  static register(options: TableOptions): DynamicModule {
-    return {
-      module: TableModule,
-      providers: [
-        {
-          provide: TABLE_OPTIONS,
-          useValue: options
-        },
-        TableService
-      ],
-      exports: [TableService]
-    }
-  }
-}

libs/modules/src/azTable/az-table.service.ts

@@ -1,19 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { TableOptions } from './az-table.interface';
-import { TABLE_OPTIONS } from './az-table.constants';
-import { TableClient, AzureNamedKeyCredential } from '@azure/data-tables';
-
-@Injectable()
-export class TableService {
-  constructor(
-    @Inject(TABLE_OPTIONS)
-    private tablesOptions: TableOptions
-  ) {}
-
-  async getTableClient(tableName: string): Promise<TableClient> {
-    const credential: AzureNamedKeyCredential = new AzureNamedKeyCredential(this.tablesOptions.accountName, this.tablesOptions.accountKey);
-    const tableClient: TableClient = new TableClient(`https://${this.tablesOptions.accountName}.table.core.windows.net`, tableName, credential);
-
-    return tableClient;
-  }
-}

libs/modules/src/index.ts

@@ -1,22 +1,14 @@
-// Azure App Configuration
-
-export * from './azAppConfig/az-app-config.module';
-export * from './azAppConfig/az-app-config.service';
-
-// Azure Data Tables
-
-export * from './azTable/az-table.module';
-export * from './azTable/az-table.service';
-export { TableClient } from '@azure/data-tables';
-
 // Auth
 
 export * from './auth/auth.module';
 export * from './auth/auth.gaurd';
 export * from './auth/public.decorator';
 
-// MS Graph
+// Custom Error
 
-export * from './msGraph/ms-graph.module';
+export * from './util/customError';
-export * from './msGraph/ms-graph.service';
+
-export { Client as MsGraphClient } from '@microsoft/microsoft-graph-client';
+// User
+
+export * from './user/user.module';
+export * from './user/user.service';

libs/modules/src/msGraph/ms-graph.constants.ts

@@ -1 +0,0 @@
-export const MS_GRAPH_OPTIONS = 'MS_GRAPH_OPTIONS';

libs/modules/src/msGraph/ms-graph.interface.ts

@@ -1,5 +0,0 @@
-export interface MsGraphOptions {
-    tenantId: string;
-    clientId: string;
-    clientSecret: string;
-  }

libs/modules/src/msGraph/ms-graph.module.ts

@@ -1,21 +0,0 @@
-import { Module, DynamicModule } from '@nestjs/common';
-import { MsGraphService } from './ms-graph.service';
-import { MsGraphOptions } from './ms-graph.interface';
-import { MS_GRAPH_OPTIONS } from './ms-graph.constants';
-
-@Module({})
-export class MsGraphModule {
-    static register(options: MsGraphOptions): DynamicModule {
-        return {
-            module: MsGraphModule,
-            providers: [
-                {
-                    provide: MS_GRAPH_OPTIONS,
-                    useValue: options
-                },
-                MsGraphService
-            ],
-            exports: [MsGraphService]
-        }
-    }
-}

libs/modules/src/msGraph/ms-graph.service.ts

@@ -1,41 +0,0 @@
-import { Inject, Injectable } from '@nestjs/common';
-import { MsGraphOptions } from './ms-graph.interface';
-import { MS_GRAPH_OPTIONS } from './ms-graph.constants';
-import { Client } from '@microsoft/microsoft-graph-client';
-import { AuthenticationResult, ConfidentialClientApplication, OnBehalfOfRequest } from '@azure/msal-node';
-
-@Injectable()
-export class MsGraphService {
-    constructor(@Inject(MS_GRAPH_OPTIONS) private msGraphOptions: MsGraphOptions) {}
-
-    async getMsGraphAuth(accessToken: string, scopes: string[]): Promise<string> {
-        try {
-            const oboRequest: OnBehalfOfRequest = {
-                oboAssertion: accessToken,
-                scopes: scopes
-            }
-            const cca = new ConfidentialClientApplication({
-                auth: {
-                    clientId: this.msGraphOptions.clientId,
-                    clientSecret: this.msGraphOptions.clientSecret,
-                    authority: `https://login.microsoftonline.com/${this.msGraphOptions.tenantId}`
-                }
-            });
-            const authenticationResult: AuthenticationResult = await cca.acquireTokenOnBehalfOf(oboRequest);
-
-            return authenticationResult.accessToken
-        } catch (error) {
-            return error
-        }  
-    }
-
-    async getMsGraphClientDelegated(accessToken): Promise<Client> {
-        const client = await Client.init({
-            authProvider: (done) => {
-                done(null, accessToken);
-            }
-        });
-
-        return client;
-    }
-}

libs/modules/src/user/user.constants.ts

@@ -0,0 +1 @@
+export const USER_MODULE_OPTIONS = 'USER_MODULE_OPTIONS'

libs/modules/src/user/user.controller.ts

@@ -0,0 +1,76 @@
+import {
+  Controller,
+  Get,
+  Headers,
+  Query,
+  StreamableFile,
+  UseGuards,
+} from '@nestjs/common';
+import { UserService } from './user.service';
+import { Client as MsGraphClient } from '@microsoft/microsoft-graph-client';
+import { AuthGuard } from '../auth/auth.gaurd';
+
+@Controller('user')
+export class UserController {
+  constructor(
+    private readonly userService: UserService
+  ) {}
+
+  @Get('photo')
+  @UseGuards(AuthGuard)
+  async getProfilePhoto(@Headers() headers: any): Promise<StreamableFile> {
+    try {
+      const graphToken: string = await this.userService.getMsGraphAuth(
+        headers.authorization.replace('Bearer ', ''),
+        ['user.read']
+      );
+      const client: MsGraphClient =
+        await this.userService.getMsGraphClientDelegated(graphToken);
+      const blob: Blob = await client.api(`me/photos('48x48')/$value`).get();
+      const arrayBuffer: ArrayBuffer = await blob.arrayBuffer();
+      const buffer: Buffer = Buffer.from(arrayBuffer);
+
+      return new StreamableFile(buffer, {
+        type: 'application/json',
+        disposition: `attachment; filename="user_photo.png"`
+      });
+    } catch (error) {
+      return error;
+    }
+  }
+
+  @Get('profile')
+  @UseGuards(AuthGuard)
+  async getUserProfile(@Headers() headers: any): Promise<any> {
+    try {
+      const graphToken: string = await this.userService.getMsGraphAuth(
+        headers.authorization.replace('Bearer ', ''),
+        ['user.read']
+      );
+      const client: MsGraphClient =
+        await this.userService.getMsGraphClientDelegated(graphToken);
+      const userProfile = await client.api(`me`).get();
+
+      return userProfile;
+    } catch (error) {
+      return error;
+    }
+  }
+
+  @Get('search')
+  @UseGuards(AuthGuard)
+  async searchUsers(
+    @Headers() headers: any,
+    @Query('search') search: any
+  ): Promise<any> {
+    try {
+      const accessToken: string = headers.authorization.replace('Bearer ', '');
+      const personSearchResults: any[] =
+        await this.userService.searchUsers(accessToken, search);
+
+      return personSearchResults;
+    } catch (error) {
+      return error;
+    }
+  }
+}

libs/modules/src/user/user.interface.ts

@@ -1,6 +1,5 @@
-export interface AppConfigOptions {
+export interface UserModuleOptions {
-  url: string;
   tenantId: string;
   clientId: string;
   clientSecret: string;
-}
+}

libs/modules/src/user/user.module-definition.ts

@@ -0,0 +1,4 @@
+import { ConfigurableModuleBuilder } from '@nestjs/common';
+import { UserModuleOptions } from './user.interface';
+
+export const { ConfigurableModuleClass, ASYNC_OPTIONS_TYPE, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } = new ConfigurableModuleBuilder<UserModuleOptions>().build()

libs/modules/src/user/user.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { UserService } from './user.service';
+import { ConfigurableModuleClass } from './user.module-definition';
+import { UserController } from './user.controller';
+
+@Module({
+  controllers: [UserController],
+  providers: [UserService],
+  exports: [UserService]
+})
+export class UserModule extends ConfigurableModuleClass {}

libs/modules/src/user/user.service.ts

@@ -0,0 +1,96 @@
+import { Inject, Injectable, StreamableFile } from '@nestjs/common';
+import { UserModuleOptions } from './user.interface';
+import { Client } from '@microsoft/microsoft-graph-client';
+import { AuthenticationResult, ConfidentialClientApplication, OnBehalfOfRequest } from '@azure/msal-node';
+import { MODULE_OPTIONS_TOKEN } from './user.module-definition';
+
+@Injectable()
+export class UserService {
+    constructor(@Inject(MODULE_OPTIONS_TOKEN) private userModuleOptions: UserModuleOptions) {}
+
+    async getMsGraphAuth(accessToken: string, scopes: string[]): Promise<string> {
+        try {
+            const oboRequest: OnBehalfOfRequest = {
+                oboAssertion: accessToken,
+                scopes: scopes
+            }
+            const cca = new ConfidentialClientApplication({
+                auth: {
+                    clientId: this.userModuleOptions.clientId,
+                    clientSecret: this.userModuleOptions.clientSecret,
+                    authority: `https://login.microsoftonline.com/${this.userModuleOptions.tenantId}`
+                }
+            });
+            const authenticationResult: AuthenticationResult = await cca.acquireTokenOnBehalfOf(oboRequest);
+
+            return authenticationResult.accessToken
+        } catch (error) {
+            return error
+        }  
+    }
+
+    async getMsGraphClientDelegated(accessToken): Promise<Client> {
+        const client = await Client.init({
+            authProvider: (done) => {
+                done(null, accessToken);
+            }
+        });
+
+        return client;
+    }
+
+    async getProfilePhoto(accessToken: string, scopes: string[]): Promise<Buffer> {
+        try {
+            const graphToken: string = await this.getMsGraphAuth(accessToken, scopes);
+            const client: Client = await this.getMsGraphClientDelegated(graphToken);
+            const blob: Blob = await client.api(`me/photos('48x48)/$value`).get();
+            const arrayBuffer: ArrayBuffer = await blob.arrayBuffer();
+            const buffer: Buffer = Buffer.from(arrayBuffer);
+
+            return buffer;
+        } catch (error) {
+            return error;
+        }
+    }
+
+    async getUserProfile(accessToken): Promise<any> {
+        try {
+            const graphToken: string = await this.getMsGraphAuth(accessToken, ['user.read']);
+            const client: Client = await this.getMsGraphClientDelegated(graphToken);
+            const userProfile = await client.api(`me`).get();
+
+            return userProfile
+        } catch (error) {
+            return error;
+        }
+    }
+
+    async searchUsers(accessToken, searchText: string): Promise<any> {
+        try {
+            const graphToken: string = await this.getMsGraphAuth(accessToken, ['user.read']);
+            const client: Client = await this.getMsGraphClientDelegated(graphToken);
+            const results: any = await client
+                .api('users')
+                .header('ConsistencyLevel', 'eventual')
+                .search(`"displayName:${searchText}"`)
+                .orderby('displayName')
+                .select(['displayName', 'userPrincipalName'])
+                .get();
+            let personResults: any[];
+
+            if (results.value) {
+                personResults = results.value.filter((result: any) => {
+                    if (result.userPrincipalName !== null) {
+                        return result;
+                    }
+                });
+            } else {
+                personResults = []
+            }
+
+            return personResults;
+        } catch (error) {
+            throw new Error(error);
+        }
+    }
+}

libs/modules/src/util/customError.ts

@@ -0,0 +1,9 @@
+export class CustomError extends Error {
+  statusCode: number;
+
+  constructor(message, name, statusCode) {
+    super(message);
+    this.name = name;
+    this.statusCode = statusCode;
+  }
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noahspan/noahspan-modules",
-  "version": "0.3.9",
+  "version": "1.2.0",
   "description": "",
   "author": "",
   "license": "UNLICENSED",
@@ -24,28 +24,29 @@
     "test:e2e": "jest --config ./test/jest-e2e.json"
   },
   "dependencies": {
-    "@azure/app-configuration": "^1.6.0",
-    "@azure/data-tables": "^13.2.2",
     "@azure/identity": "^4.2.0",
     "@azure/msal-node": "^2.9.2",
     "@microsoft/microsoft-graph-client": "^3.0.7",
-    "@nestjs/common": "^10.0.0",
+    "@nestjs/common": "^11.0.11",
-    "@nestjs/core": "^10.0.0",
+    "@nestjs/core": "^11.0.11",
-    "@nestjs/passport": "^10.0.3",
+    "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^10.0.0",
+    "@nestjs/platform-express": "^11.0.11",
     "axios": "^1.7.2",
-    "passport-azure-ad": "^4.3.5",
+    "passport": "^0.7.0",
-    "reflect-metadata": "^0.2.0",
+    "passport-jwt": "^4.0.1",
+    "passport-openidconnect": "^0.1.2",
+    "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1"
   },
   "devDependencies": {
     "@microsoft/microsoft-graph-types": "^2.40.0",
-    "@nestjs/cli": "^10.0.0",
+    "@nestjs/cli": "^11.0.5",
-    "@nestjs/schematics": "^10.0.0",
+    "@nestjs/schematics": "^11.0.2",
-    "@nestjs/testing": "^10.0.0",
+    "@nestjs/testing": "^11.0.11",
     "@types/express": "^4.17.17",
     "@types/jest": "^29.5.2",
     "@types/node": "^20.3.1",
+    "@types/passport-openidconnect": "^0.1.3",
     "@types/supertest": "^6.0.0",
     "@typescript-eslint/eslint-plugin": "^6.0.0",
     "@typescript-eslint/parser": "^6.0.0",