CertificateProvider

Class: CertificateProvider<T>

Defined in: packages/auth/src/certificate/certificate.service.ts:97

The certificate is verified by the HttpServer (clientCa) or by a trusted reverse proxy (clientCertHeader): this provider maps verified certificates to users. In login mode, each request carrying the certificate of a known user gets a stateless session with the provider "certificate" and the authentication method "mtls". In factor mode, it adds "mtls" only to an existing session for the same user on that request.

Exposes the operation Auth.Certificate.Link (POST auth/certificate/link) linking the presented certificate to the logged user.

Webda Modda

CertificateProvider

Extends

Service<T>

Type Parameters

T

T extends CertificateProviderParameters = CertificateProviderParameters

Implements

AuthProvider
CertificateResolver

Constructors

Constructor

new CertificateProvider<T>(name, params): CertificateProvider<T>

Defined in: packages/core/lib/services/service.d.ts:72

Service

Parameters

name

string

The name of the service

params

T

The parameters block define in the configuration file

Returns

CertificateProvider<T>

Inherited from

Service<T>.constructor

Properties

_compiledCapabilities

protected _compiledCapabilities: Record<string, any>

Defined in: packages/core/lib/services/iservice.d.ts:38

Capabilities detected at compile-time from @WebdaCapability-tagged interfaces.

Populated during Service.resolve by reading the service's entry in webda.module.json. Each key is a capability name (e.g., "request-filter"), and the value is an empty object {} by default. Override getCapabilities to provide capability-specific configuration or to conditionally disable capabilities.

See

getCapabilities

Implementation of

AuthProvider._compiledCapabilities

Inherited from

Service._compiledCapabilities

[WEBDA_EVENTS]

[WEBDA_EVENTS]: object

Defined in: packages/core/lib/services/service.d.ts:50

Set the Webda events here

Implementation of

AuthProvider.[WEBDA_EVENTS]

Inherited from

Service.[WEBDA_EVENTS]

cache

protected cache: Map<string, { expires: number; value: CertificateResolution; }>

Defined in: packages/auth/src/certificate/certificate.service.ts:111

Certificates resolved to a user, by ident uid

logger

protected logger: Logger

Defined in: packages/core/lib/services/service.d.ts:59

Logger with class context

Implementation of

AuthProvider.logger

Inherited from

Service.logger

metrics?

protected optional metrics?: object

Defined in: packages/core/lib/services/service.d.ts:63

Get metrics

Implementation of

AuthProvider.metrics

Inherited from

Service.metrics

name

readonly name: string

Defined in: packages/core/lib/services/iservice.d.ts:18

Implementation of

AuthProvider.name

Inherited from

Service.name

parameters

readonly parameters: T

Defined in: packages/core/lib/services/iservice.d.ts:19

Implementation of

AuthProvider.parameters

Inherited from

Service.parameters

providerName

readonly providerName: string = "certificate"

Defined in: packages/auth/src/certificate/certificate.service.ts:103

Unique provider name, used in ident keys ("email", "google")

Implementation of

AuthProvider.providerName

unsubscribers

protected unsubscribers: (() => void)[] = []

Defined in: packages/auth/src/certificate/certificate.service.ts:113

Listeners to remove on stop

Returns

void

createConfiguration?

static optional createConfiguration?: (params) => any

Defined in: packages/core/lib/services/iservice.d.ts:23

Create configuration set by the application on load

Parameters

params

any

Returns

any

Inherited from

Service.createConfiguration

filterConfiguration?

static optional filterConfiguration?: (params) => any

Defined in: packages/core/lib/services/iservice.d.ts:27

Create configuration set by the application on load

Parameters

params

any

Returns

any

Inherited from

Service.filterConfiguration

Parameters

static Parameters: typeof CertificateProviderParameters = CertificateProviderParameters

Defined in: packages/auth/src/certificate/certificate.service.ts:101

Service parameters

Overrides

Service.Parameters

Accessors

mode

Get Signature

get mode(): "login" | "factor"

Defined in: packages/auth/src/certificate/certificate.service.ts:106

Returns

"login" | "factor"

how certificate authentication contributes to a session

Implementation of

CertificateResolver.mode

Methods

__clean()

abstract __clean(): Promise<void>

Defined in: packages/core/lib/services/service.d.ts:215

Clean the service data, can only be used in test mode

Returns

Promise<void>

Implementation of

AuthProvider.__clean

Inherited from

Service.__clean

addListener()

addListener<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:80

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void | Promise<void>

the event listener

Returns

this

this for chaining

See

EventEmitter.addListener

Implementation of

AuthProvider.addListener

Inherited from

Service.addListener

addRoute()

protected addRoute(url, methods, executer, openapi?, override?): void

Defined in: packages/core/lib/services/service.d.ts:177

Add a route dynamicaly

Parameters

url

string

of the route can contains dynamic part like {uuid}

methods

HttpMethodType[]

the HTTP methods

executer

Function

Method to execute for this route

openapi?

OpenAPIWebdaDefinition

the OpenAPI specification

override?

boolean

whether to override existing

Returns

void

Implementation of

AuthProvider.addRoute

Inherited from

Service.addRoute

authorizeClientEvent()

authorizeClientEvent(_event, _context): boolean

Defined in: packages/core/lib/services/service.d.ts:153

Authorize a public event subscription

Parameters

_event

string

the event name

_context

OperationContext

the execution context

Returns

boolean

true if the condition is met

Implementation of

AuthProvider.authorizeClientEvent

Inherited from

Service.authorizeClientEvent

computeParameters()

computeParameters(): void

Defined in: packages/core/lib/services/service.d.ts:77

Used to compute or derivate input parameter to attribute

Returns

void

Deprecated

Implementation of

AuthProvider.computeParameters

Inherited from

Service.computeParameters

emit()

emit<Key>(event, data): Promise<void>

Defined in: packages/core/lib/services/service.d.ts:204

Emit the event with data and wait for Promise to finish if listener returned a Promise

Type Parameters

Key

Key extends never

Parameters

event

Key

the event name

data

object[Key]

the data to process

Returns

Promise<void>

Implementation of

AuthProvider.emit

Inherited from

Service.emit

findUser()

protected findUser(providerUid): Promise<CertificateResolution | undefined>

Defined in: packages/auth/src/certificate/certificate.service.ts:259

User owning a certificate ident, cached for cacheTtl

Parameters

providerUid

string

ident uid

Returns

Promise<CertificateResolution | undefined>

the user and ident ids, undefined when the certificate is not linked

getCapabilities()

getCapabilities(): Record<string, any>

Defined in: packages/core/lib/services/iservice.d.ts:60

Return the capabilities of this service.

By default returns capabilities detected at compile-time from

Returns

Record<string, any>

the result

Webda Capability-tagged

interfaces in webda.module.json.

Override to disable capabilities based on configuration:

getCapabilities() {
  const caps = super.getCapabilities();
  if (!this.parameters.enabled) delete caps["request-filter"];
  return caps;
}

Implementation of

AuthProvider.getCapabilities

Inherited from

Service.getCapabilities

getClientEvents()

getClientEvents(): string[]

Defined in: packages/core/lib/services/service.d.ts:144

Return the events that an external system can subscribe to

Returns

string[]

the list of results

Implementation of

AuthProvider.getClientEvents

Inherited from

Service.getClientEvents

getIdentity()

getIdentity(cert): ResolvedIdentity | undefined

Defined in: packages/auth/src/certificate/certificate.service.ts:184

Identity asserted by a certificate

Parameters

cert

ClientCertificate

client certificate

Returns

ResolvedIdentity | undefined

the identity, undefined when the certificate lacks the identity field

getMaxListeners()

getMaxListeners(): number

Defined in: packages/core/lib/events/asynceventemitter.d.ts:84

Returns

number

Implementation of

AuthProvider.getMaxListeners

Inherited from

Service.getMaxListeners

getMetric()

getMetric<T>(type, configuration): T

Defined in: packages/core/lib/services/service.d.ts:138

Add service name label

Type Parameters

T

T = Gauge<string> | Counter<string> | Histogram<string>

Parameters

type

CustomConstructor<T, [MetricConfiguration<T>]>

the type to look up

configuration

MetricConfiguration<T>

the configuration

Returns

T

the result

Implementation of

AuthProvider.getMetric

Inherited from

Service.getMetric

getName()

getName(): string

Defined in: packages/core/lib/services/service.d.ts:209

Get service name

Returns

string

the result string

Implementation of

AuthProvider.getName

Inherited from

Service.getName

getOpenApiReplacements()

getOpenApiReplacements(): any

Defined in: packages/core/lib/services/service.d.ts:182

Return variables for replacement in openapi

Returns

any

the result

Implementation of

AuthProvider.getOpenApiReplacements

Inherited from

Service.getOpenApiReplacements

getOperationId()

getOperationId(id): string | undefined

Defined in: packages/core/lib/services/service.d.ts:167

If undefined is returned it cancel the operation registration

Parameters

id

string

the identifier

Returns

string | undefined

the result

Implementation of

AuthProvider.getOperationId

Inherited from

Service.getOperationId

getParameters()

getParameters(): T

Defined in: packages/core/lib/services/service.d.ts:82

Get the service parameters

Returns

T

the result

Implementation of

AuthProvider.getParameters

Inherited from

Service.getParameters

getPublicInfo()

getPublicInfo(): ProviderInfo

Defined in: packages/auth/src/certificate/certificate.service.ts:152

Returns

ProviderInfo

what clients see in Auth.Providers

Implementation of

AuthProvider.getPublicInfo

getRoles()

getRoles(cert): string[] | undefined

Defined in: packages/auth/src/certificate/certificate.service.ts:224

Roles given by the roles parameter to a certificate

Parameters

cert

ClientCertificate

client certificate

Returns

string[] | undefined

the roles, undefined when none

getService()

getService<T>(name): ServicesMap[T]

Defined in: packages/core/lib/services/service.d.ts:131

Get a service by name

Type Parameters

T

T extends keyof ServicesMap

Parameters

name

T

the name to use

Returns

ServicesMap[T]

the result map

Deprecated

Use useService, might reconsider

Implementation of

AuthProvider.getService

Inherited from

Service.getService

getState()

getState(): ServiceStates

Defined in: packages/core/lib/services/service.d.ts:55

Get the current state

Returns

ServiceStates

the result

Implementation of

AuthProvider.getState

Inherited from

Service.getState

getUrl()

getUrl(url, _methods): string

Defined in: packages/core/lib/services/service.d.ts:161

Return the full path url based on parameters

Parameters

url

string

relative url to service

_methods

HttpMethodType[]

in case we need filtering (like Store)

Returns

string

absolute url or undefined if need to skip the Route

Implementation of

AuthProvider.getUrl

Inherited from

Service.getUrl

init()

init(): Promise<CertificateProvider<T>>

Defined in: packages/auth/src/certificate/certificate.service.ts:123

Returns

Promise<CertificateProvider<T>>

Implementation of

AuthProvider.init

Overrides

Service.init

initMetrics()

initMetrics(): void

Defined in: packages/core/lib/services/service.d.ts:124

Init the metrics

Returns

void

Implementation of

AuthProvider.initMetrics

Inherited from

Service.initMetrics

initOperations()

initOperations(): void

Defined in: packages/core/lib/services/service.d.ts:186

Init the operations from

Returns

void

Operation

decorators on this service

Implementation of

AuthProvider.initOperations

Inherited from

Service.initOperations

isAccepted()

isAccepted(cert): boolean

Defined in: packages/auth/src/certificate/certificate.service.ts:161

Whether a certificate is accepted: valid now, from an allowed issuer, with an allowed subject

Parameters

cert

ClientCertificate

client certificate

Returns

boolean

true when accepted

link()

link(): Promise<AuthResult | { status: "linked"; }>

Defined in: packages/auth/src/certificate/certificate.service.ts:331

Link the client certificate of the request to the logged user

Returns

Promise<AuthResult | { status: "linked"; }>

the auth result

Throws

WebdaError.Unauthorized when no user is logged

Throws

WebdaError.Forbidden when the request has no verified, accepted certificate with the identity field

listeners()

listeners(eventName): Function[]

Defined in: packages/core/lib/events/asynceventemitter.d.ts:139

Get all listeners for an event

Parameters

eventName

never

the event name

Returns

Function[]

the list of results

Implementation of

AuthProvider.listeners

Inherited from

Service.listeners

loadCapabilities()

protected loadCapabilities(): void

Defined in: packages/core/lib/services/service.d.ts:120

Load capabilities from webda.module.json metadata into _compiledCapabilities.

Called during resolve after dependency injection. Reads the service's type name from parameters, looks it up in the application's module metadata (moddas or beans section), and populates _compiledCapabilities with an empty object for each declared capability name.

Fails silently if the application is not available (e.g., in unit tests where services are instantiated without a full application context).

Returns

void

Example

// If webda.module.json contains:
// { "moddas": { "MyApp/HawkService": { "capabilities": ["request-filter", "cors-filter"] } } }
// Then after resolve(), this.getCapabilities() returns:
// { "request-filter": {}, "cors-filter": {} }

See

getCapabilities

Implementation of

AuthProvider.loadCapabilities

Inherited from

Service.loadCapabilities

log()

log(level, ...args): void

Defined in: packages/core/lib/services/service.d.ts:226

Parameters

level

WorkerLogLevel

to log

args

...any[]

additional arguments

Returns

void

Implementation of

AuthProvider.log

Inherited from

Service.log

off()

off<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:116

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.off

Implementation of

AuthProvider.off

Inherited from

Service.off

on()

on<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:102

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.once

Implementation of

AuthProvider.on

Inherited from

Service.on

once()

once<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:95

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.once

Implementation of

AuthProvider.once

Inherited from

Service.once

register()

protected register(identity, context): Promise<CertificateResolution | undefined>

Defined in: packages/auth/src/certificate/certificate.service.ts:299

Register the user of an unknown certificate through Authentication.complete() (linking and registration policies apply), when autoRegister is set

Parameters

identity

ResolvedIdentity

identity of the certificate

context

Context

context of the request

Returns

Promise<CertificateResolution | undefined>

the new user and ident ids, undefined when not registered

remember()

protected remember(providerUid, value): void

Defined in: packages/auth/src/certificate/certificate.service.ts:282

Parameters

providerUid

string

ident uid

value

CertificateResolution

resolution to cache

Returns

void

removeAllListeners()

removeAllListeners<Key>(eventName?): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:122

Type Parameters

Key

Key extends never

Parameters

eventName?

Key

the event name

Returns

this

this for chaining

See

EventEmitter.removeAllListeners

Implementation of

AuthProvider.removeAllListeners

Inherited from

Service.removeAllListeners

removeListener()

removeListener<Key>(eventName, listener): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:109

Type Parameters

Key

Key extends never

Parameters

eventName

Key

the event name

listener

(event) => void

the event listener

Returns

this

this for chaining

See

EventEmitter.removeListener

Implementation of

AuthProvider.removeListener

Inherited from

Service.removeListener

resolve()

resolve(): this

Defined in: packages/auth/src/certificate/certificate.service.ts:116

Returns

this

Implementation of

AuthProvider.resolve

Overrides

Service.resolve

resolveCertificate()

resolveCertificate(cert, context): Promise<CertificateResolution | undefined>

Defined in: packages/auth/src/certificate/certificate.service.ts:242

Resolve a verified certificate into a user, registering one when autoRegister is set

Parameters

cert

ClientCertificate

verified client certificate

context

Context

context of the request, its session is not loaded yet

Returns

Promise<CertificateResolution | undefined>

the user, undefined when the certificate is refused or unknown

Implementation of

CertificateResolver.resolveCertificate

setMaxListeners()

setMaxListeners(n): this

Defined in: packages/core/lib/events/asynceventemitter.d.ts:88

Parameters

n

number

Returns

this

Implementation of

AuthProvider.setMaxListeners

Inherited from

Service.setMaxListeners

stop()

stop(): Promise<void>

Defined in: packages/auth/src/certificate/certificate.service.ts:140

Returns

Promise<void>

Implementation of

AuthProvider.stop

Overrides

Service.stop

toJSON()

toJSON(): string

Defined in: packages/core/lib/services/service.d.ts:191

Prevent service to be serialized

Returns

string

the result

Implementation of

AuthProvider.toJSON

Inherited from

Service.toJSON

toString()

toString(): string

Defined in: packages/core/lib/services/service.d.ts:91

Return service representation

Returns

string

the result

Implementation of

AuthProvider.toString

Inherited from

Service.toString

Class: CertificateProvider<T>

Webda Modda​

Extends​

Type Parameters​

T​

Implements​

Constructors​

Constructor​

Parameters​

name​

params​

Returns​

Inherited from​

Properties​

_compiledCapabilities​

See​

Implementation of​

Inherited from​

[WEBDA_EVENTS]​

Implementation of​

Inherited from​

cache​

logger​

Implementation of​

Inherited from​

metrics?​

Implementation of​

Inherited from​

name​

Implementation of​

Inherited from​

parameters​

Implementation of​

Inherited from​

providerName​

Implementation of​

unsubscribers​

Returns​

createConfiguration?​

Parameters​

params​

Returns​

Inherited from​

filterConfiguration?​

Parameters​

params​

Returns​

Inherited from​

Parameters​

Overrides​

Accessors​

mode​

Get Signature​

Returns​

Implementation of​

Methods​

__clean()​

Returns​

Implementation of​

Inherited from​

addListener()​

Type Parameters​

Key​

Parameters​

eventName​

listener​

Returns​

See​

Implementation of​

Inherited from​

addRoute()​

Parameters​

url​

methods​

executer​

openapi?​

override?​

Returns​

Implementation of​

Inherited from​

Webda Modda

Extends

Type Parameters

T

Implements

Constructors

Constructor

Parameters

name

params

Returns

Inherited from

Properties

_compiledCapabilities

See

Implementation of

Inherited from

[WEBDA_EVENTS]

Implementation of

Inherited from

cache

logger

Implementation of

Inherited from

metrics?

Implementation of

Inherited from

name

Implementation of

Inherited from

parameters

Implementation of

Inherited from

providerName

Implementation of

unsubscribers

Returns

createConfiguration?

Parameters

params

Returns

Inherited from

filterConfiguration?

Parameters

params

Returns

Inherited from

Parameters

Overrides

Accessors

mode

Get Signature

Returns

Implementation of

Methods

__clean()

Returns

Implementation of

Inherited from

addListener()

Type Parameters

Key

Parameters

eventName

listener

Returns

See

Implementation of

Inherited from

addRoute()

Parameters

url

methods

executer

openapi?

override?

Returns

Implementation of

Inherited from

authorizeClientEvent()