@adatechnology/auth-keycloak 0.1.1 → 0.1.3

package/dist/index.js

@@ -4,6 +4,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -28,21 +29,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
 // ../shared/dist/types.js
 var require_types = __commonJS({
   "../shared/dist/types.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
   }
 });
 
@@ -50,15 +44,19 @@ var require_types = __commonJS({
 var require_utils = __commonJS({
   "../shared/dist/utils.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.noop = noop;
     exports2.prefixWith = prefixWith;
     function noop() {
       return void 0;
     }
+    __name(noop, "noop");
     function prefixWith(prefix, value) {
       return `${prefix}-${value}`;
     }
+    __name(prefixWith, "prefixWith");
   }
 });
 
@@ -66,23 +64,26 @@ var require_utils = __commonJS({
 var require_base_app_error = __commonJS({
   "../shared/dist/errors/base-app-error.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.BaseAppError = void 0;
-    var BaseAppError5 = class extends Error {
+    var _a;
+    var BaseAppError5 = (_a = class extends Error {
       code;
       status;
       context;
       constructor(params) {
-        var _a;
+        var _a2;
         super(params.message);
         this.name = new.target.name;
         this.status = params.status;
         this.code = params.code;
         this.context = params.context;
         const capturable = Error;
-        (_a = capturable.captureStackTrace) == null ? void 0 : _a.call(capturable, this, this.constructor);
+        (_a2 = capturable.captureStackTrace) == null ? void 0 : _a2.call(capturable, this, this.constructor);
       }
-    };
+    }, __name(_a, "BaseAppError"), _a);
     exports2.BaseAppError = BaseAppError5;
   }
 });
@@ -91,7 +92,9 @@ var require_base_app_error = __commonJS({
 var require_errors_constants = __commonJS({
   "../shared/dist/errors/errors.constants.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.SHARED_INTERNAL_FRAME_RE = exports2.SHARED_ERROR_MESSAGES = exports2.SHARED_ERRORS = void 0;
     exports2.SHARED_ERRORS = {
       DEFAULT_STATUS: 502,
@@ -117,19 +120,21 @@ var require_error_mapper_service = __commonJS({
       else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
       return c > 3 && r && Object.defineProperty(target, key, r), r;
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.ErrorMapperService = void 0;
     var common_1 = require("@nestjs/common");
     var base_app_error_1 = require_base_app_error();
     var errors_constants_1 = require_errors_constants();
-    var ErrorMapperService = class ErrorMapperService {
+    var _a;
+    var ErrorMapperService = (_a = class {
       /**
        * Map an upstream/internal error to a BaseAppError with normalized fields.
        * Keeps a small context to help tracing origin without leaking secrets.
        */
       mapUpstreamError(err) {
-        if (err instanceof base_app_error_1.BaseAppError)
-          return err;
+        if (err instanceof base_app_error_1.BaseAppError) return err;
         try {
           const obj = err ?? void 0;
           const context = {};
@@ -138,8 +143,7 @@ var require_error_mapper_service = __commonJS({
             if (frames.length) {
               context.stack = frames;
               const origin = frames.find((f) => !this.isInternalFrame(f.file));
-              if (origin)
-                context.origin = origin;
+              if (origin) context.origin = origin;
             }
           }
           if (obj && typeof obj.config === "object" && obj.config !== null) {
@@ -179,7 +183,9 @@ var require_error_mapper_service = __commonJS({
           return new base_app_error_1.BaseAppError({
             message: errors_constants_1.SHARED_ERROR_MESSAGES.MAPPING_FAILURE,
             status: errors_constants_1.SHARED_ERRORS.INTERNAL_STATUS,
-            context: { original: String(err) }
+            context: {
+              original: String(err)
+            }
           });
         }
       }
@@ -194,17 +200,21 @@ var require_error_mapper_service = __commonJS({
             const file = m[2];
             const lineNum = parseInt(m[3], 10);
             const colNum = parseInt(m[4], 10);
-            frames.push({ fn, file, line: lineNum, column: colNum });
+            frames.push({
+              fn,
+              file,
+              line: lineNum,
+              column: colNum
+            });
           }
         }
         return frames;
       }
       isInternalFrame(file) {
-        if (!file)
-          return false;
+        if (!file) return false;
         return errors_constants_1.SHARED_INTERNAL_FRAME_RE.test(file);
       }
-    };
+    }, __name(_a, "ErrorMapperService"), _a);
     exports2.ErrorMapperService = ErrorMapperService;
     exports2.ErrorMapperService = ErrorMapperService = __decorate([
       (0, common_1.Injectable)()
@@ -216,23 +226,28 @@ var require_error_mapper_service = __commonJS({
 var require_errors = __commonJS({
   "../shared/dist/errors/index.js"(exports2) {
     "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
+        desc = {
+          enumerable: true,
+          get: /* @__PURE__ */ __name(function() {
+            return m[k];
+          }, "get")
+        };
       }
       Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
+    } : function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       o[k2] = m[k];
-    }));
-    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    });
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports1) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports1, p)) __createBinding(exports1, m, p);
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     __exportStar(require_base_app_error(), exports2);
     __exportStar(require_error_mapper_service(), exports2);
   }
@@ -242,23 +257,28 @@ var require_errors = __commonJS({
 var require_dist = __commonJS({
   "../shared/dist/index.js"(exports2) {
     "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
+        desc = {
+          enumerable: true,
+          get: /* @__PURE__ */ __name(function() {
+            return m[k];
+          }, "get")
+        };
       }
       Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
+    } : function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       o[k2] = m[k];
-    }));
-    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    });
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports1) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports1, p)) __createBinding(exports1, m, p);
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     __exportStar(require_types(), exports2);
     __exportStar(require_utils(), exports2);
     __exportStar(require_errors(), exports2);
@@ -268,11 +288,15 @@ var require_dist = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AccessToken: () => AccessToken,
   ApiAuthGuard: () => ApiAuthGuard,
   AuthUser: () => AuthUser,
   B2BGuard: () => B2BGuard,
+  B2BRoles: () => B2BRoles,
   B2CGuard: () => B2CGuard,
+  B2CRoles: () => B2CRoles,
   BearerTokenGuard: () => BearerTokenGuard,
+  CallerToken: () => CallerToken,
   KEYCLOAK_CLIENT: () => KEYCLOAK_CLIENT,
   KEYCLOAK_CONFIG: () => KEYCLOAK_CONFIG,
   KEYCLOAK_HTTP_INTERCEPTOR: () => KEYCLOAK_HTTP_INTERCEPTOR,
@@ -280,17 +304,25 @@ __export(index_exports, {
   KeycloakError: () => KeycloakError,
   KeycloakModule: () => KeycloakModule,
   Roles: () => Roles,
-  RolesGuard: () => RolesGuard
+  RolesGuard: () => RolesGuard,
+  TokenRoles: () => TokenRoles
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/keycloak.module.ts
-var import_common6 = require("@nestjs/common");
+var import_common9 = require("@nestjs/common");
 var import_core2 = require("@nestjs/core");
 var import_http_client3 = require("@adatechnology/http-client");
 var import_logger3 = require("@adatechnology/logger");
 var import_cache3 = require("@adatechnology/cache");
 
+// src/api-auth.guard.ts
+var import_common4 = require("@nestjs/common");
+var import_shared3 = __toESM(require_dist());
+
+// src/b2b.guard.ts
+var import_common2 = require("@nestjs/common");
+
 // src/bearer-token.guard.ts
 var import_common = require("@nestjs/common");
 var import_logger = require("@adatechnology/logger");
@@ -306,7 +338,7 @@ var KEYCLOAK_PROVIDER = "KEYCLOAK_PROVIDER";
 // package.json
 var package_default = {
   name: "@adatechnology/auth-keycloak",
-  version: "0.1.1",
+  version: "0.1.3",
   publishConfig: {
     access: "public"
   },
@@ -334,6 +366,7 @@ var package_default = {
   devDependencies: {
     "@adatechnology/shared": "workspace:*",
     "@esbuild-plugins/tsconfig-paths": "^0.1.2",
+    "@swc/core": "^1.15.24",
     tsup: "^8.5.1",
     typescript: "^5.2.0"
   }
@@ -363,7 +396,26 @@ var ROLES_ERROR_CODE = {
 };
 
 // src/bearer-token.guard.ts
-var BearerTokenGuard = class {
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var _BearerTokenGuard = class _BearerTokenGuard {
+  keycloakClient;
+  logger;
   constructor(keycloakClient, logger) {
     this.keycloakClient = keycloakClient;
     this.logger = logger;
@@ -420,12 +472,16 @@ var BearerTokenGuard = class {
       isValid = await this.keycloakClient.validateToken(token);
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      this.log("error", `${method} - Token validation failed`, method, { detail });
+      this.log("error", `${method} - Token validation failed`, method, {
+        detail
+      });
       throw new import_shared.BaseAppError({
         message: "Token validation failed",
         status: HTTP_STATUS.UNAUTHORIZED,
         code: BEARER_ERROR_CODE.TOKEN_VALIDATION_FAILED,
-        context: { detail }
+        context: {
+          detail
+        }
       });
     }
     if (!isValid) {
@@ -441,23 +497,199 @@ var BearerTokenGuard = class {
     return true;
   }
 };
-BearerTokenGuard = __decorateClass([
+__name(_BearerTokenGuard, "BearerTokenGuard");
+var BearerTokenGuard = _BearerTokenGuard;
+BearerTokenGuard = _ts_decorate([
   (0, import_common.Injectable)(),
-  __decorateParam(0, (0, import_common.Optional)()),
-  __decorateParam(0, (0, import_common.Inject)(KEYCLOAK_CLIENT)),
-  __decorateParam(1, (0, import_common.Optional)()),
-  __decorateParam(1, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER))
+  _ts_param(0, (0, import_common.Optional)()),
+  _ts_param(0, (0, import_common.Inject)(KEYCLOAK_CLIENT)),
+  _ts_param(1, (0, import_common.Optional)()),
+  _ts_param(1, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof KeycloakClientInterface === "undefined" ? Object : KeycloakClientInterface,
+    typeof LoggerProviderInterface === "undefined" ? Object : LoggerProviderInterface
+  ])
 ], BearerTokenGuard);
 
+// src/b2b.guard.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var _B2BGuard = class _B2BGuard {
+  bearerTokenGuard;
+  constructor(bearerTokenGuard) {
+    this.bearerTokenGuard = bearerTokenGuard;
+  }
+  canActivate(context) {
+    return Promise.resolve(this.bearerTokenGuard.canActivate(context));
+  }
+};
+__name(_B2BGuard, "B2BGuard");
+var B2BGuard = _B2BGuard;
+B2BGuard = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof BearerTokenGuard === "undefined" ? Object : BearerTokenGuard
+  ])
+], B2BGuard);
+
+// src/b2c.guard.ts
+var import_common3 = require("@nestjs/common");
+var import_shared2 = __toESM(require_dist());
+
+// src/keycloak.headers.ts
+var state = {
+  headers: {
+    b2cToken: parseEnvHeader("KEYCLOAK_B2C_TOKEN_HEADER", "x-access-token"),
+    b2bToken: parseEnvHeader("KEYCLOAK_B2B_TOKEN_HEADER", "authorization")
+  },
+  claims: {
+    userId: parseEnvClaims("KEYCLOAK_USER_ID_CLAIM", [
+      "sub"
+    ]),
+    callerId: parseEnvClaims("KEYCLOAK_CALLER_ID_CLAIM", [
+      "azp"
+    ])
+  }
+};
+function configureTokenHeaders(cfg) {
+  if (cfg.b2cToken) state.headers.b2cToken = cfg.b2cToken.toLowerCase();
+  if (cfg.b2bToken) state.headers.b2bToken = cfg.b2bToken.toLowerCase();
+}
+__name(configureTokenHeaders, "configureTokenHeaders");
+function configureTokenClaims(cfg) {
+  if (cfg.userId) state.claims.userId = normalizeClaims(cfg.userId);
+  if (cfg.callerId) state.claims.callerId = normalizeClaims(cfg.callerId);
+}
+__name(configureTokenClaims, "configureTokenClaims");
+function getB2CTokenHeader() {
+  return state.headers.b2cToken;
+}
+__name(getB2CTokenHeader, "getB2CTokenHeader");
+function getB2BTokenHeader() {
+  return state.headers.b2bToken;
+}
+__name(getB2BTokenHeader, "getB2BTokenHeader");
+function getUserIdClaims() {
+  return state.claims.userId;
+}
+__name(getUserIdClaims, "getUserIdClaims");
+function getCallerIdClaims() {
+  return state.claims.callerId;
+}
+__name(getCallerIdClaims, "getCallerIdClaims");
+function parseEnvHeader(key, fallback) {
+  return (process.env[key] ?? fallback).toLowerCase();
+}
+__name(parseEnvHeader, "parseEnvHeader");
+function parseEnvClaims(key, fallback) {
+  const raw = process.env[key];
+  if (!raw) return fallback;
+  return raw.split(",").map((c) => c.trim()).filter(Boolean);
+}
+__name(parseEnvClaims, "parseEnvClaims");
+function normalizeClaims(value) {
+  if (Array.isArray(value)) return value.filter(Boolean);
+  return value.split(",").map((c) => c.trim()).filter(Boolean);
+}
+__name(normalizeClaims, "normalizeClaims");
+
+// src/b2c.guard.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var _B2CGuard = class _B2CGuard {
+  canActivate(context) {
+    var _a;
+    const request = context.switchToHttp().getRequest();
+    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
+    if (accessToken) return true;
+    throw new import_shared2.BaseAppError({
+      message: "Missing X-Access-Token header. Route requires Kong-forwarded user authentication.",
+      status: HTTP_STATUS.UNAUTHORIZED,
+      code: BEARER_ERROR_CODE.MISSING_TOKEN,
+      context: {}
+    });
+  }
+};
+__name(_B2CGuard, "B2CGuard");
+var B2CGuard = _B2CGuard;
+B2CGuard = _ts_decorate3([
+  (0, import_common3.Injectable)()
+], B2CGuard);
+
+// src/api-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var _ApiAuthGuard = class _ApiAuthGuard {
+  b2bGuard;
+  b2cGuard;
+  constructor(b2bGuard, b2cGuard) {
+    this.b2bGuard = b2bGuard;
+    this.b2cGuard = b2cGuard;
+  }
+  async canActivate(context) {
+    var _a, _b;
+    const request = context.switchToHttp().getRequest();
+    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
+    if (accessToken) {
+      return this.b2cGuard.canActivate(context);
+    }
+    const authHeader = (_b = request.headers) == null ? void 0 : _b[getB2BTokenHeader()];
+    if (authHeader == null ? void 0 : authHeader.toLowerCase().startsWith("bearer ")) {
+      return this.b2bGuard.canActivate(context);
+    }
+    throw new import_shared3.BaseAppError({
+      message: "Unauthorized: missing X-Access-Token (Kong/B2C) or Authorization header (B2B)",
+      status: HTTP_STATUS.UNAUTHORIZED,
+      code: BEARER_ERROR_CODE.MISSING_TOKEN,
+      context: {}
+    });
+  }
+};
+__name(_ApiAuthGuard, "ApiAuthGuard");
+var ApiAuthGuard = _ApiAuthGuard;
+ApiAuthGuard = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof B2BGuard === "undefined" ? Object : B2BGuard,
+    typeof B2CGuard === "undefined" ? Object : B2CGuard
+  ])
+], ApiAuthGuard);
+
 // src/keycloak.client.ts
-var import_common2 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var import_http_client2 = require("@adatechnology/http-client");
 var import_logger2 = require("@adatechnology/logger");
 var import_cache = require("@adatechnology/cache");
 var import_cache2 = require("@adatechnology/cache");
 
 // src/errors/keycloak-error.ts
-var KeycloakError = class _KeycloakError extends Error {
+var _KeycloakError = class _KeycloakError extends Error {
   statusCode;
   details;
   keycloakError;
@@ -470,8 +702,27 @@ var KeycloakError = class _KeycloakError extends Error {
     Object.setPrototypeOf(this, _KeycloakError.prototype);
   }
 };
+__name(_KeycloakError, "KeycloakError");
+var KeycloakError = _KeycloakError;
 
 // src/keycloak.client.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 function extractErrorInfo(err) {
   var _a, _b, _c, _d, _e;
   const statusCode = (err == null ? void 0 : err.status) ?? ((_a = err == null ? void 0 : err.response) == null ? void 0 : _a.status);
@@ -496,15 +747,19 @@ function extractErrorInfo(err) {
     keycloakError: keycloakError ?? (errorCode ? `NETWORK_ERROR_${String(errorCode)}` : void 0)
   };
 }
-var KeycloakClient = class {
+__name(extractErrorInfo, "extractErrorInfo");
+var _KeycloakClient = class _KeycloakClient {
+  config;
+  httpProvider;
+  logger;
+  cacheProvider;
+  tokenPromise = null;
   constructor(config, httpProvider, logger, cacheProvider) {
     this.config = config;
     this.httpProvider = httpProvider;
     this.logger = logger;
     this.cacheProvider = cacheProvider ?? new import_cache.InMemoryCacheProvider(logger);
   }
-  cacheProvider;
-  tokenPromise = null;
   log(level, message, libMethod, meta) {
     if (!this.logger) return;
     const loggerCtx = (0, import_logger2.getContext)();
@@ -566,21 +821,29 @@ var KeycloakClient = class {
     if (this.config.credentials.clientSecret) {
       body.append("client_secret", this.config.credentials.clientSecret);
     }
-    body.append("scope", KeycloakClient.scopesToString(this.config.scopes));
+    body.append("scope", _KeycloakClient.scopesToString(this.config.scopes));
     try {
       const response = await this.httpProvider.post({
         url: tokenUrl,
         data: body,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("info", `${method} - Success for user: ${username}`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed for user: ${username}`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed for user: ${username}`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to obtain token with credentials", {
         statusCode,
         details,
@@ -602,7 +865,7 @@ var KeycloakClient = class {
       if (this.config.credentials.username && this.config.credentials.password) {
         data.append("username", this.config.credentials.username);
         data.append("password", this.config.credentials.password);
-        data.append("scope", KeycloakClient.scopesToString(this.config.scopes));
+        data.append("scope", _KeycloakClient.scopesToString(this.config.scopes));
       }
     }
     try {
@@ -610,15 +873,23 @@ var KeycloakClient = class {
         url: tokenUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("debug", `${method} - Success`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to request token", {
         statusCode,
         details,
@@ -642,8 +913,13 @@ var KeycloakClient = class {
         url: tokenUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       const ttlSeconds = this.config.tokenCacheTtl ? Math.floor(this.config.tokenCacheTtl / 1e3) : response.data.expires_in - 60;
@@ -652,7 +928,10 @@ var KeycloakClient = class {
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to refresh token", {
         statusCode,
         details,
@@ -676,8 +955,13 @@ var KeycloakClient = class {
         url: introspectUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       const active = ((_a = response.data) == null ? void 0 : _a.active) === true;
@@ -685,7 +969,10 @@ var KeycloakClient = class {
       return active;
     } catch (error) {
       const { statusCode, details, keycloakError } = extractErrorInfo(error);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Token introspection failed", {
         statusCode,
         details,
@@ -701,15 +988,23 @@ var KeycloakClient = class {
       const response = await this.httpProvider.get({
         url: userInfoUrl,
         config: {
-          headers: { Authorization: `Bearer ${token}` },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            Authorization: `Bearer ${token}`
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("debug", `${method} - Success`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to retrieve userinfo", {
         statusCode,
         details,
@@ -725,18 +1020,38 @@ var KeycloakClient = class {
     return Array.isArray(scopes) ? scopes.join(" ") : String(scopes);
   }
 };
-KeycloakClient = __decorateClass([
-  (0, import_common2.Injectable)(),
-  __decorateParam(1, (0, import_common2.Inject)(import_http_client2.HTTP_PROVIDER)),
-  __decorateParam(2, (0, import_common2.Optional)()),
-  __decorateParam(2, (0, import_common2.Inject)(import_logger2.LOGGER_PROVIDER)),
-  __decorateParam(3, (0, import_common2.Optional)()),
-  __decorateParam(3, (0, import_common2.Inject)(import_cache2.CACHE_PROVIDER))
+__name(_KeycloakClient, "KeycloakClient");
+var KeycloakClient = _KeycloakClient;
+KeycloakClient = _ts_decorate5([
+  (0, import_common5.Injectable)(),
+  _ts_param2(1, (0, import_common5.Inject)(import_http_client2.HTTP_PROVIDER)),
+  _ts_param2(2, (0, import_common5.Optional)()),
+  _ts_param2(2, (0, import_common5.Inject)(import_logger2.LOGGER_PROVIDER)),
+  _ts_param2(3, (0, import_common5.Optional)()),
+  _ts_param2(3, (0, import_common5.Inject)(import_cache2.CACHE_PROVIDER)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof KeycloakConfig === "undefined" ? Object : KeycloakConfig,
+    typeof HttpProviderInterface === "undefined" ? Object : HttpProviderInterface,
+    typeof import_logger2.LoggerProviderInterface === "undefined" ? Object : import_logger2.LoggerProviderInterface,
+    typeof CacheProviderInterface === "undefined" ? Object : CacheProviderInterface
+  ])
 ], KeycloakClient);
 
 // src/keycloak.http.interceptor.ts
-var import_common3 = require("@nestjs/common");
-var KeycloakHttpInterceptor = class {
+var import_common6 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var _KeycloakHttpInterceptor = class _KeycloakHttpInterceptor {
   constructor() {
   }
   intercept(context, next) {
@@ -746,141 +1061,259 @@ var KeycloakHttpInterceptor = class {
     return next.handle();
   }
 };
-KeycloakHttpInterceptor = __decorateClass([
-  (0, import_common3.Injectable)()
+__name(_KeycloakHttpInterceptor, "KeycloakHttpInterceptor");
+var KeycloakHttpInterceptor = _KeycloakHttpInterceptor;
+KeycloakHttpInterceptor = _ts_decorate6([
+  (0, import_common6.Injectable)(),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [])
 ], KeycloakHttpInterceptor);
 
 // src/roles.guard.ts
-var import_common5 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
 // src/roles.decorator.ts
-var import_common4 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var ROLES_META_KEY = "roles";
+var B2C_ROLES_META_KEY = "roles:b2c";
+var B2B_ROLES_META_KEY = "roles:b2b";
+var TOKEN_ROLES_META_KEY = "roles:token";
 function Roles(...args) {
+  return (0, import_common7.SetMetadata)(ROLES_META_KEY, normalizeRolesOptions(args));
+}
+__name(Roles, "Roles");
+function B2CRoles(...args) {
+  return (0, import_common7.SetMetadata)(B2C_ROLES_META_KEY, normalizeRolesOptions(args));
+}
+__name(B2CRoles, "B2CRoles");
+function B2BRoles(...args) {
+  return (0, import_common7.SetMetadata)(B2B_ROLES_META_KEY, normalizeRolesOptions(args));
+}
+__name(B2BRoles, "B2BRoles");
+function normalizeRolesOptions(args) {
   let payload;
   if (args.length === 1 && typeof args[0] === "object" && !Array.isArray(args[0])) {
     payload = args[0];
   } else {
-    const roles = [].concat(
-      ...args.map((a) => Array.isArray(a) ? a : String(a))
-    );
-    payload = { roles };
+    const roles = [].concat(...args.map((a) => Array.isArray(a) ? a : String(a)));
+    payload = {
+      roles
+    };
   }
   payload.mode = payload.mode ?? "any";
   payload.type = payload.type ?? "both";
-  return (0, import_common4.SetMetadata)(ROLES_META_KEY, payload);
+  return payload;
+}
+__name(normalizeRolesOptions, "normalizeRolesOptions");
+function TokenRoles(options) {
+  const normalized = {
+    ...options,
+    header: options.header.toLowerCase(),
+    mode: options.mode ?? "any",
+    // auto-detect bearer stripping: true when header is 'authorization'
+    bearer: options.bearer ?? options.header.toLowerCase() === "authorization"
+  };
+  return (0, import_common7.SetMetadata)(TOKEN_ROLES_META_KEY, [
+    normalized
+  ]);
 }
+__name(TokenRoles, "TokenRoles");
 
 // src/roles.guard.ts
-var import_shared2 = __toESM(require_dist());
-var RolesGuard = class {
+var import_shared4 = __toESM(require_dist());
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var _RolesGuard = class _RolesGuard {
+  reflector;
+  config;
   constructor(reflector, config) {
     this.reflector = reflector;
     this.config = config;
   }
   canActivate(context) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
-    const meta = this.reflector.get(ROLES_META_KEY, context.getHandler()) || this.reflector.get(ROLES_META_KEY, context.getClass());
-    if (!meta || !meta.roles || meta.roles.length === 0) return true;
+    var _a, _b, _c, _d, _e, _f;
     const req = context.switchToHttp().getRequest();
-    const required = meta.roles;
-    const availableRoles = /* @__PURE__ */ new Set();
-    const kongRolesHeader = ((_a = req.headers) == null ? void 0 : _a["x-user-roles"]) || ((_b = req.headers) == null ? void 0 : _b["X-User-Roles"]);
-    if (kongRolesHeader) {
-      kongRolesHeader.split(",").map((r) => r.trim()).filter(Boolean).forEach((r) => availableRoles.add(r));
-    } else {
-      const authHeader = ((_c = req.headers) == null ? void 0 : _c.authorization) || ((_d = req.headers) == null ? void 0 : _d.Authorization);
-      const token = authHeader ? String(authHeader).split(" ")[1] : (_e = req.query) == null ? void 0 : _e.token;
-      if (!token) {
-        throw new import_shared2.BaseAppError({
-          message: "Authorization token not provided",
-          status: HTTP_STATUS.FORBIDDEN,
-          code: ROLES_ERROR_CODE.MISSING_TOKEN,
-          context: {}
-        });
-      }
-      const payload = this.decodeJwtPayload(token);
-      if (((_f = payload == null ? void 0 : payload.realm_access) == null ? void 0 : _f.roles) && Array.isArray(payload.realm_access.roles)) {
-        payload.realm_access.roles.forEach((r) => availableRoles.add(r));
-      }
-      const clientId = (_h = (_g = this.config) == null ? void 0 : _g.credentials) == null ? void 0 : _h.clientId;
-      if (clientId && ((_j = (_i = payload == null ? void 0 : payload.resource_access) == null ? void 0 : _i[clientId]) == null ? void 0 : _j.roles)) {
-        payload.resource_access[clientId].roles.forEach(
-          (r) => availableRoles.add(r)
-        );
+    const b2cMeta = this.getMeta(B2C_ROLES_META_KEY, context);
+    const b2bMeta = this.getMeta(B2B_ROLES_META_KEY, context);
+    const genericMeta = this.getMeta(ROLES_META_KEY, context);
+    const tokenRules = this.reflector.getAllAndMerge(TOKEN_ROLES_META_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]) ?? [];
+    if (!b2cMeta && !b2bMeta && !genericMeta && tokenRules.length === 0) return true;
+    if (b2cMeta) {
+      const token = (_a = req.headers) == null ? void 0 : _a[getB2CTokenHeader()];
+      const roles = token ? this.extractRoles(token, "b2c") : /* @__PURE__ */ new Set();
+      this.assertRoles(roles, b2cMeta, "B2C (user)");
+    }
+    if (b2bMeta) {
+      const raw = (_b = req.headers) == null ? void 0 : _b[getB2BTokenHeader()];
+      const token = raw == null ? void 0 : raw.split(" ")[1];
+      const roles = token ? this.extractRoles(token, "b2b") : /* @__PURE__ */ new Set();
+      this.assertRoles(roles, b2bMeta, "B2B (service)");
+    }
+    if (genericMeta) {
+      const accessToken = (_c = req.headers) == null ? void 0 : _c[getB2CTokenHeader()];
+      if (accessToken) {
+        const roles = this.extractRoles(accessToken, "b2c");
+        this.assertRoles(roles, genericMeta, "B2C (user)");
+      } else {
+        const raw = (_d = req.headers) == null ? void 0 : _d[getB2BTokenHeader()];
+        const token = (raw == null ? void 0 : raw.split(" ")[1]) ?? ((_e = req.query) == null ? void 0 : _e.token);
+        if (!token) {
+          throw new import_shared4.BaseAppError({
+            message: "Authorization token not provided",
+            status: HTTP_STATUS.FORBIDDEN,
+            code: ROLES_ERROR_CODE.MISSING_TOKEN,
+            context: {}
+          });
+        }
+        const roles = this.extractRoles(token, "b2b");
+        this.assertRoles(roles, genericMeta, "B2B (service)");
       }
-      if (meta.type === "both" && (payload == null ? void 0 : payload.resource_access)) {
-        Object.values(payload.resource_access).forEach((entry) => {
-          if ((entry == null ? void 0 : entry.roles) && Array.isArray(entry.roles)) {
-            entry.roles.forEach((r) => availableRoles.add(r));
-          }
-        });
+    }
+    for (const rule of tokenRules) {
+      const raw = (_f = req.headers) == null ? void 0 : _f[rule.header];
+      const token = rule.bearer ? raw == null ? void 0 : raw.split(" ")[1] : raw;
+      const roles = token ? this.extractRoles(token, "b2c") : /* @__PURE__ */ new Set();
+      this.assertRoles(roles, {
+        roles: rule.roles,
+        mode: rule.mode ?? "any"
+      }, `header:${rule.header}`);
+    }
+    return true;
+  }
+  // ── Helpers ───────────────────────────────────────────────────────────────
+  getMeta(key, ctx) {
+    return this.reflector.get(key, ctx.getHandler()) || this.reflector.get(key, ctx.getClass()) || void 0;
+  }
+  extractRoles(token, source) {
+    var _a, _b, _c, _d;
+    const payload = this.decodeJwtPayload(token);
+    const roles = /* @__PURE__ */ new Set();
+    if (((_a = payload == null ? void 0 : payload.realm_access) == null ? void 0 : _a.roles) && Array.isArray(payload.realm_access.roles)) {
+      payload.realm_access.roles.forEach((r) => roles.add(r));
+    }
+    if (source === "b2b" && (payload == null ? void 0 : payload.resource_access)) {
+      const clientId = (_c = (_b = this.config) == null ? void 0 : _b.credentials) == null ? void 0 : _c.clientId;
+      if (clientId && ((_d = payload.resource_access[clientId]) == null ? void 0 : _d.roles)) {
+        payload.resource_access[clientId].roles.forEach((r) => roles.add(r));
       }
     }
-    const hasMatch = required.map((r) => availableRoles.has(r));
-    const result = meta.mode === "all" ? hasMatch.every(Boolean) : hasMatch.some(Boolean);
-    if (!result) {
-      throw new import_shared2.BaseAppError({
-        message: "Insufficient roles",
+    return roles;
+  }
+  assertRoles(available, meta, label) {
+    const hasMatch = meta.roles.map((r) => available.has(r));
+    const passed = meta.mode === "all" ? hasMatch.every(Boolean) : hasMatch.some(Boolean);
+    if (!passed) {
+      throw new import_shared4.BaseAppError({
+        message: `Insufficient roles for ${label} token`,
         status: HTTP_STATUS.FORBIDDEN,
         code: ROLES_ERROR_CODE.INSUFFICIENT_ROLES,
-        context: { required }
+        context: {
+          required: meta.roles,
+          source: label
+        }
       });
     }
-    return true;
   }
   decodeJwtPayload(token) {
     try {
       const parts = token.split(".");
       if (parts.length < 2) return {};
-      const payload = parts[1];
+      const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
       const BufferCtor = globalThis.Buffer;
       if (!BufferCtor) return {};
-      const decoded = BufferCtor.from(payload, "base64").toString("utf8");
-      return JSON.parse(decoded);
+      return JSON.parse(BufferCtor.from(padded, "base64").toString("utf8"));
     } catch {
       return {};
     }
   }
 };
-RolesGuard = __decorateClass([
-  (0, import_common5.Injectable)(),
-  __decorateParam(0, (0, import_common5.Inject)(import_core.Reflector)),
-  __decorateParam(1, (0, import_common5.Optional)()),
-  __decorateParam(1, (0, import_common5.Inject)(KEYCLOAK_CONFIG))
+__name(_RolesGuard, "RolesGuard");
+var RolesGuard = _RolesGuard;
+RolesGuard = _ts_decorate7([
+  (0, import_common8.Injectable)(),
+  _ts_param3(0, (0, import_common8.Inject)(import_core.Reflector)),
+  _ts_param3(1, (0, import_common8.Optional)()),
+  _ts_param3(1, (0, import_common8.Inject)(KEYCLOAK_CONFIG)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof KeycloakConfig === "undefined" ? Object : KeycloakConfig
+  ])
 ], RolesGuard);
 
 // src/keycloak.module.ts
-var KeycloakModule = class {
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+var _KeycloakModule = class _KeycloakModule {
   static forRoot(config, httpConfig) {
+    if (config.headers) configureTokenHeaders(config.headers);
+    if (config.claims) configureTokenClaims(config.claims);
     return {
-      module: KeycloakModule,
+      module: _KeycloakModule,
       global: true,
       imports: [
-        import_http_client3.HttpModule.forRoot(
-          httpConfig || { baseURL: config.baseUrl, timeout: 5e3 },
-          {
-            logging: {
-              enabled: true,
-              includeBody: true,
-              context: "KeycloakHttpClient",
-              environments: ["development", "test"]
-            }
+        import_http_client3.HttpModule.forRoot(httpConfig || {
+          baseURL: config.baseUrl,
+          timeout: 5e3
+        }, {
+          logging: {
+            enabled: true,
+            includeBody: true,
+            context: "KeycloakHttpClient",
+            environments: [
+              "development",
+              "test"
+            ]
           }
-        )
+        })
       ],
       providers: [
-        { provide: import_core2.Reflector, useClass: import_core2.Reflector },
-        { provide: KEYCLOAK_CONFIG, useValue: config },
+        {
+          provide: import_core2.Reflector,
+          useClass: import_core2.Reflector
+        },
+        {
+          provide: KEYCLOAK_CONFIG,
+          useValue: config
+        },
         {
           provide: KEYCLOAK_CLIENT,
-          useFactory: (cfg, httpProvider, logger, cacheProvider) => new KeycloakClient(cfg, httpProvider, logger, cacheProvider),
+          useFactory: /* @__PURE__ */ __name((cfg, httpProvider, logger, cacheProvider) => new KeycloakClient(cfg, httpProvider, logger, cacheProvider), "useFactory"),
           inject: [
             KEYCLOAK_CONFIG,
             import_http_client3.HTTP_PROVIDER,
-            { token: import_logger3.LOGGER_PROVIDER, optional: true },
-            { token: import_cache3.CACHE_PROVIDER, optional: true }
+            {
+              token: import_logger3.LOGGER_PROVIDER,
+              optional: true
+            },
+            {
+              token: import_cache3.CACHE_PROVIDER,
+              optional: true
+            }
           ]
         },
         {
@@ -889,10 +1322,13 @@ var KeycloakModule = class {
         },
         {
           provide: KEYCLOAK_HTTP_INTERCEPTOR,
-          useFactory: () => new KeycloakHttpInterceptor()
+          useFactory: /* @__PURE__ */ __name(() => new KeycloakHttpInterceptor(), "useFactory")
         },
         RolesGuard,
-        BearerTokenGuard
+        BearerTokenGuard,
+        B2CGuard,
+        B2BGuard,
+        ApiAuthGuard
       ],
       exports: [
         import_core2.Reflector,
@@ -901,98 +1337,137 @@ var KeycloakModule = class {
         KEYCLOAK_HTTP_INTERCEPTOR,
         KEYCLOAK_CONFIG,
         RolesGuard,
-        BearerTokenGuard
+        BearerTokenGuard,
+        B2CGuard,
+        B2BGuard,
+        ApiAuthGuard
       ]
     };
   }
 };
-KeycloakModule = __decorateClass([
-  (0, import_common6.Module)({})
+__name(_KeycloakModule, "KeycloakModule");
+var KeycloakModule = _KeycloakModule;
+KeycloakModule = _ts_decorate8([
+  (0, import_common9.Module)({})
 ], KeycloakModule);
 
-// src/b2b.guard.ts
-var import_common7 = require("@nestjs/common");
-var B2BGuard = class {
-  constructor(bearerTokenGuard) {
-    this.bearerTokenGuard = bearerTokenGuard;
+// src/auth-user.decorator.ts
+var import_common10 = require("@nestjs/common");
+var AuthUser = (0, import_common10.createParamDecorator)((param, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const { header, claims } = resolveB2CParam(param);
+  const raw = (_a = request.headers) == null ? void 0 : _a[header];
+  const token = Array.isArray(raw) ? raw[0] : raw;
+  if (!token) return "";
+  return decodeJwtClaims(String(token), claims) ?? "";
+});
+var CallerToken = (0, import_common10.createParamDecorator)((param, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const { header, claims } = resolveB2BParam(param);
+  const raw = (_a = request.headers) == null ? void 0 : _a[header];
+  const token = raw == null ? void 0 : raw.split(" ")[1];
+  if (!token) return "";
+  return decodeJwtClaims(token, claims) ?? "";
+});
+var AccessToken = (0, import_common10.createParamDecorator)((header, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const h = (header == null ? void 0 : header.toLowerCase()) ?? getB2CTokenHeader();
+  const raw = (_a = request.headers) == null ? void 0 : _a[h];
+  return Array.isArray(raw) ? raw[0] : raw ?? "";
+});
+function resolveB2CParam(param) {
+  var _a;
+  if (!param) {
+    return {
+      header: getB2CTokenHeader(),
+      claims: getUserIdClaims()
+    };
   }
-  canActivate(context) {
-    return Promise.resolve(this.bearerTokenGuard.canActivate(context));
+  if (typeof param === "string") {
+    return {
+      header: getB2CTokenHeader(),
+      claims: [
+        param
+      ]
+    };
   }
-};
-B2BGuard = __decorateClass([
-  (0, import_common7.Injectable)()
-], B2BGuard);
-
-// src/b2c.guard.ts
-var import_common8 = require("@nestjs/common");
-var import_shared3 = __toESM(require_dist());
-var B2CGuard = class {
-  canActivate(context) {
-    var _a, _b;
-    const request = context.switchToHttp().getRequest();
-    const userId = ((_a = request.headers) == null ? void 0 : _a["x-user-id"]) ?? ((_b = request.headers) == null ? void 0 : _b["X-User-Id"]);
-    if (userId) return true;
-    throw new import_shared3.BaseAppError({
-      message: "Missing Kong identity headers (X-User-Id). Route requires user authentication via Kong.",
-      status: HTTP_STATUS.UNAUTHORIZED,
-      code: BEARER_ERROR_CODE.MISSING_TOKEN,
-      context: {}
-    });
+  if (Array.isArray(param)) {
+    return {
+      header: getB2CTokenHeader(),
+      claims: param
+    };
   }
-};
-B2CGuard = __decorateClass([
-  (0, import_common8.Injectable)()
-], B2CGuard);
-
-// src/api-auth.guard.ts
-var import_common9 = require("@nestjs/common");
-var import_shared4 = __toESM(require_dist());
-var ApiAuthGuard = class {
-  constructor(b2bGuard, b2cGuard) {
-    this.b2bGuard = b2bGuard;
-    this.b2cGuard = b2cGuard;
+  return {
+    header: ((_a = param.header) == null ? void 0 : _a.toLowerCase()) ?? getB2CTokenHeader(),
+    claims: param.claim ? normalizeClaims2(param.claim) : getUserIdClaims()
+  };
+}
+__name(resolveB2CParam, "resolveB2CParam");
+function resolveB2BParam(param) {
+  var _a;
+  if (!param) {
+    return {
+      header: getB2BTokenHeader(),
+      claims: getCallerIdClaims()
+    };
   }
-  async canActivate(context) {
-    var _a, _b, _c, _d;
-    const request = context.switchToHttp().getRequest();
-    const authHeader = ((_a = request.headers) == null ? void 0 : _a.authorization) ?? ((_b = request.headers) == null ? void 0 : _b.Authorization);
-    if (authHeader == null ? void 0 : authHeader.toLowerCase().startsWith("bearer ")) {
-      return this.b2bGuard.canActivate(context);
-    }
-    const userId = ((_c = request.headers) == null ? void 0 : _c["x-user-id"]) ?? ((_d = request.headers) == null ? void 0 : _d["X-User-Id"]);
-    if (userId) {
-      return this.b2cGuard.canActivate(context);
-    }
-    throw new import_shared4.BaseAppError({
-      message: "Unauthorized: missing Authorization header (B2B) or Kong identity headers (B2C)",
-      status: HTTP_STATUS.UNAUTHORIZED,
-      code: BEARER_ERROR_CODE.MISSING_TOKEN,
-      context: {}
-    });
+  if (typeof param === "string") {
+    return {
+      header: getB2BTokenHeader(),
+      claims: [
+        param
+      ]
+    };
   }
-};
-ApiAuthGuard = __decorateClass([
-  (0, import_common9.Injectable)()
-], ApiAuthGuard);
-
-// src/auth-user.decorator.ts
-var import_common10 = require("@nestjs/common");
-var AuthUser = (0, import_common10.createParamDecorator)(
-  (_data, ctx) => {
-    var _a, _b;
-    const request = ctx.switchToHttp().getRequest();
-    const raw = ((_a = request.headers) == null ? void 0 : _a["x-user-id"]) ?? ((_b = request.headers) == null ? void 0 : _b["X-User-Id"]);
-    return Array.isArray(raw) ? raw[0] : raw ?? "";
+  if (Array.isArray(param)) {
+    return {
+      header: getB2BTokenHeader(),
+      claims: param
+    };
   }
-);
+  return {
+    header: ((_a = param.header) == null ? void 0 : _a.toLowerCase()) ?? getB2BTokenHeader(),
+    claims: param.claim ? normalizeClaims2(param.claim) : getCallerIdClaims()
+  };
+}
+__name(resolveB2BParam, "resolveB2BParam");
+function normalizeClaims2(value) {
+  if (Array.isArray(value)) return value.filter(Boolean);
+  return value.split(",").map((c) => c.trim()).filter(Boolean);
+}
+__name(normalizeClaims2, "normalizeClaims");
+function decodeJwtClaims(token, claims) {
+  try {
+    const parts = token.split(".");
+    if (parts.length < 2) return void 0;
+    const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const BufferCtor = globalThis.Buffer;
+    if (!BufferCtor) return void 0;
+    const payload = JSON.parse(BufferCtor.from(padded, "base64").toString("utf8"));
+    for (const claim of claims) {
+      const value = payload[claim];
+      if (typeof value === "string" && value.length > 0) return value;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(decodeJwtClaims, "decodeJwtClaims");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AccessToken,
   ApiAuthGuard,
   AuthUser,
   B2BGuard,
+  B2BRoles,
   B2CGuard,
+  B2CRoles,
   BearerTokenGuard,
+  CallerToken,
   KEYCLOAK_CLIENT,
   KEYCLOAK_CONFIG,
   KEYCLOAK_HTTP_INTERCEPTOR,
@@ -1000,5 +1475,6 @@ var AuthUser = (0, import_common10.createParamDecorator)(
   KeycloakError,
   KeycloakModule,
   Roles,
-  RolesGuard
+  RolesGuard,
+  TokenRoles
 });