-
Notifications
You must be signed in to change notification settings - Fork 262
/
jwt-helper.service.ts
219 lines (197 loc) · 6.39 KB
/
jwt-helper.service.ts
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
/*!
* @license
* Copyright © 2005-2024 Hyland Software, Inc. and its affiliates. All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import { Injectable } from '@angular/core';
import { StorageService } from '../../common/services/storage.service';
@Injectable({
providedIn: 'root'
})
export class JwtHelperService {
static USER_NAME = 'name';
static FAMILY_NAME = 'family_name';
static GIVEN_NAME = 'given_name';
static USER_EMAIL = 'email';
static USER_ACCESS_TOKEN = 'access_token';
static USER_ID_TOKEN = 'id_token';
static REALM_ACCESS = 'realm_access';
static RESOURCE_ACCESS = 'resource_access';
static USER_PREFERRED_USERNAME = 'preferred_username';
static HXP_AUTHORIZATION = 'hxp_authorization';
constructor(private storageService: StorageService) {
}
/**
* Decodes a JSON web token into a JS object.
*
* @param token Token in encoded form
* @returns Decoded token data object
*/
decodeToken(token): any {
const parts = token.split('.');
if (parts.length !== 3) {
throw new Error('JWT must have 3 parts');
}
const decoded = this.urlBase64Decode(parts[1]);
if (!decoded) {
throw new Error('Cannot decode the token');
}
return JSON.parse(decoded);
}
private urlBase64Decode(token): string {
let output = token.replace(/-/g, '+').replace(/_/g, '/');
switch (output.length % 4) {
case 0: {
break;
}
case 2: {
output += '==';
break;
}
case 3: {
output += '=';
break;
}
default: {
throw new Error('Illegal base64url string!');
}
}
return decodeURIComponent(escape(window.atob(output)));
}
/**
* Gets a named value from the user access or id token.
*
* @param key Key name of the field to retrieve
* @returns Value from the token
*/
getValueFromLocalToken<T>(key: string): T {
return this.getValueFromToken(this.getAccessToken(), key) || this.getValueFromToken(this.getIdToken(), key);
}
/**
* Gets a named value from the user access token.
*
* @param key Key name of the field to retrieve
* @returns Value from the token
*/
getValueFromLocalAccessToken<T>(key: string): T {
return this.getValueFromToken(this.getAccessToken(), key);
}
/**
* Gets access token
*
* @returns access token
*/
getAccessToken(): string {
return this.storageService.getItem(JwtHelperService.USER_ACCESS_TOKEN);
}
/**
* Gets a named value from the user id token.
*
* @param key Key name of the field to retrieve
* @returns Value from the token
*/
getValueFromLocalIdToken<T>(key: string): T {
return this.getValueFromToken(this.getIdToken(), key);
}
/**
* Gets id token
*
* @returns id token
*/
getIdToken(): string {
return this.storageService.getItem(JwtHelperService.USER_ID_TOKEN);
}
/**
* Gets a named value from the user access token.
*
* @param token your SSO access token where the value is encode
* @param key Key name of the field to retrieve
* @returns Value from the token
*/
getValueFromToken<T>(token: string, key: string): T {
let value: T;
if (token) {
const tokenPayload = this.decodeToken(token);
value = tokenPayload[key];
}
return value;
}
/**
* Gets realm roles.
*
* @returns Array of realm roles
*/
getRealmRoles(): string[] {
const access = this.getValueFromLocalAccessToken<any>(JwtHelperService.REALM_ACCESS);
return access ? access['roles'] : [];
}
/**
* Gets Client roles.
*
* @param clientName client name
* @returns Array of client roles
*/
getClientRoles(clientName: string): string[] {
const clientRole = this.getValueFromLocalAccessToken<any>(JwtHelperService.RESOURCE_ACCESS)[clientName];
return clientRole ? clientRole['roles'] : [];
}
/**
* Checks for single realm role.
*
* @param role Role name to check
* @returns True if it contains given role, false otherwise
*/
hasRealmRole(role: string): boolean {
let hasRole = false;
if (this.getAccessToken()) {
const realmRoles = this.getRealmRoles();
hasRole = realmRoles.some((currentRole) => currentRole === role);
}
return hasRole;
}
/**
* Checks for realm roles.
*
* @param rolesToCheck List of role names to check
* @returns True if it contains at least one of the given roles, false otherwise
*/
hasRealmRoles(rolesToCheck: string []): boolean {
return rolesToCheck.some((currentRole) => this.hasRealmRole(currentRole));
}
/**
* Checks for client roles.
*
* @param clientName Targeted client name
* @param rolesToCheck List of role names to check
* @returns True if it contains at least one of the given roles, false otherwise
*/
hasRealmRolesForClientRole(clientName: string, rolesToCheck: string []): boolean {
return rolesToCheck.some((currentRole) => this.hasClientRole(clientName, currentRole));
}
/**
* Checks for client role.
*
* @param clientName Targeted client name
* @param role Role name to check
* @returns True if it contains given role, false otherwise
*/
hasClientRole(clientName: string, role: string): boolean {
let hasRole = false;
if (this.getAccessToken()) {
const clientRoles = this.getClientRoles(clientName);
hasRole = clientRoles.some((currentRole) => currentRole === role);
}
return hasRole;
}
}