@adatechnology/auth-keycloak 0.1.2 → 0.1.3

package/dist/index.js

@@ -4,6 +4,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __commonJS = (cb, mod) => function __require() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
@@ -28,21 +29,14 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
 // ../shared/dist/types.js
 var require_types = __commonJS({
   "../shared/dist/types.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
   }
 });
 
@@ -50,15 +44,19 @@ var require_types = __commonJS({
 var require_utils = __commonJS({
   "../shared/dist/utils.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.noop = noop;
     exports2.prefixWith = prefixWith;
     function noop() {
       return void 0;
     }
+    __name(noop, "noop");
     function prefixWith(prefix, value) {
       return `${prefix}-${value}`;
     }
+    __name(prefixWith, "prefixWith");
   }
 });
 
@@ -66,23 +64,26 @@ var require_utils = __commonJS({
 var require_base_app_error = __commonJS({
   "../shared/dist/errors/base-app-error.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.BaseAppError = void 0;
-    var BaseAppError5 = class extends Error {
+    var _a;
+    var BaseAppError5 = (_a = class extends Error {
       code;
       status;
       context;
       constructor(params) {
-        var _a;
+        var _a2;
         super(params.message);
         this.name = new.target.name;
         this.status = params.status;
         this.code = params.code;
         this.context = params.context;
         const capturable = Error;
-        (_a = capturable.captureStackTrace) == null ? void 0 : _a.call(capturable, this, this.constructor);
+        (_a2 = capturable.captureStackTrace) == null ? void 0 : _a2.call(capturable, this, this.constructor);
       }
-    };
+    }, __name(_a, "BaseAppError"), _a);
     exports2.BaseAppError = BaseAppError5;
   }
 });
@@ -91,7 +92,9 @@ var require_base_app_error = __commonJS({
 var require_errors_constants = __commonJS({
   "../shared/dist/errors/errors.constants.js"(exports2) {
     "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.SHARED_INTERNAL_FRAME_RE = exports2.SHARED_ERROR_MESSAGES = exports2.SHARED_ERRORS = void 0;
     exports2.SHARED_ERRORS = {
       DEFAULT_STATUS: 502,
@@ -117,19 +120,21 @@ var require_error_mapper_service = __commonJS({
       else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
       return c > 3 && r && Object.defineProperty(target, key, r), r;
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     exports2.ErrorMapperService = void 0;
     var common_1 = require("@nestjs/common");
     var base_app_error_1 = require_base_app_error();
     var errors_constants_1 = require_errors_constants();
-    var ErrorMapperService = class ErrorMapperService {
+    var _a;
+    var ErrorMapperService = (_a = class {
       /**
        * Map an upstream/internal error to a BaseAppError with normalized fields.
        * Keeps a small context to help tracing origin without leaking secrets.
        */
       mapUpstreamError(err) {
-        if (err instanceof base_app_error_1.BaseAppError)
-          return err;
+        if (err instanceof base_app_error_1.BaseAppError) return err;
         try {
           const obj = err ?? void 0;
           const context = {};
@@ -138,8 +143,7 @@ var require_error_mapper_service = __commonJS({
             if (frames.length) {
               context.stack = frames;
               const origin = frames.find((f) => !this.isInternalFrame(f.file));
-              if (origin)
-                context.origin = origin;
+              if (origin) context.origin = origin;
             }
           }
           if (obj && typeof obj.config === "object" && obj.config !== null) {
@@ -179,7 +183,9 @@ var require_error_mapper_service = __commonJS({
           return new base_app_error_1.BaseAppError({
             message: errors_constants_1.SHARED_ERROR_MESSAGES.MAPPING_FAILURE,
             status: errors_constants_1.SHARED_ERRORS.INTERNAL_STATUS,
-            context: { original: String(err) }
+            context: {
+              original: String(err)
+            }
           });
         }
       }
@@ -194,17 +200,21 @@ var require_error_mapper_service = __commonJS({
             const file = m[2];
             const lineNum = parseInt(m[3], 10);
             const colNum = parseInt(m[4], 10);
-            frames.push({ fn, file, line: lineNum, column: colNum });
+            frames.push({
+              fn,
+              file,
+              line: lineNum,
+              column: colNum
+            });
           }
         }
         return frames;
       }
       isInternalFrame(file) {
-        if (!file)
-          return false;
+        if (!file) return false;
         return errors_constants_1.SHARED_INTERNAL_FRAME_RE.test(file);
       }
-    };
+    }, __name(_a, "ErrorMapperService"), _a);
     exports2.ErrorMapperService = ErrorMapperService;
     exports2.ErrorMapperService = ErrorMapperService = __decorate([
       (0, common_1.Injectable)()
@@ -216,23 +226,28 @@ var require_error_mapper_service = __commonJS({
 var require_errors = __commonJS({
   "../shared/dist/errors/index.js"(exports2) {
     "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
+        desc = {
+          enumerable: true,
+          get: /* @__PURE__ */ __name(function() {
+            return m[k];
+          }, "get")
+        };
       }
       Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
+    } : function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       o[k2] = m[k];
-    }));
-    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    });
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports1) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports1, p)) __createBinding(exports1, m, p);
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     __exportStar(require_base_app_error(), exports2);
     __exportStar(require_error_mapper_service(), exports2);
   }
@@ -242,23 +257,28 @@ var require_errors = __commonJS({
 var require_dist = __commonJS({
   "../shared/dist/index.js"(exports2) {
     "use strict";
-    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       var desc = Object.getOwnPropertyDescriptor(m, k);
       if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
+        desc = {
+          enumerable: true,
+          get: /* @__PURE__ */ __name(function() {
+            return m[k];
+          }, "get")
+        };
       }
       Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
+    } : function(o, m, k, k2) {
       if (k2 === void 0) k2 = k;
       o[k2] = m[k];
-    }));
-    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
-      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    });
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports1) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports1, p)) __createBinding(exports1, m, p);
     };
-    Object.defineProperty(exports2, "__esModule", { value: true });
+    Object.defineProperty(exports2, "__esModule", {
+      value: true
+    });
     __exportStar(require_types(), exports2);
     __exportStar(require_utils(), exports2);
     __exportStar(require_errors(), exports2);
@@ -290,12 +310,19 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/keycloak.module.ts
-var import_common6 = require("@nestjs/common");
+var import_common9 = require("@nestjs/common");
 var import_core2 = require("@nestjs/core");
 var import_http_client3 = require("@adatechnology/http-client");
 var import_logger3 = require("@adatechnology/logger");
 var import_cache3 = require("@adatechnology/cache");
 
+// src/api-auth.guard.ts
+var import_common4 = require("@nestjs/common");
+var import_shared3 = __toESM(require_dist());
+
+// src/b2b.guard.ts
+var import_common2 = require("@nestjs/common");
+
 // src/bearer-token.guard.ts
 var import_common = require("@nestjs/common");
 var import_logger = require("@adatechnology/logger");
@@ -311,7 +338,7 @@ var KEYCLOAK_PROVIDER = "KEYCLOAK_PROVIDER";
 // package.json
 var package_default = {
   name: "@adatechnology/auth-keycloak",
-  version: "0.1.2",
+  version: "0.1.3",
   publishConfig: {
     access: "public"
   },
@@ -339,6 +366,7 @@ var package_default = {
   devDependencies: {
     "@adatechnology/shared": "workspace:*",
     "@esbuild-plugins/tsconfig-paths": "^0.1.2",
+    "@swc/core": "^1.15.24",
     tsup: "^8.5.1",
     typescript: "^5.2.0"
   }
@@ -368,7 +396,26 @@ var ROLES_ERROR_CODE = {
 };
 
 // src/bearer-token.guard.ts
-var BearerTokenGuard = class {
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var _BearerTokenGuard = class _BearerTokenGuard {
+  keycloakClient;
+  logger;
   constructor(keycloakClient, logger) {
     this.keycloakClient = keycloakClient;
     this.logger = logger;
@@ -425,12 +472,16 @@ var BearerTokenGuard = class {
       isValid = await this.keycloakClient.validateToken(token);
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      this.log("error", `${method} - Token validation failed`, method, { detail });
+      this.log("error", `${method} - Token validation failed`, method, {
+        detail
+      });
       throw new import_shared.BaseAppError({
         message: "Token validation failed",
         status: HTTP_STATUS.UNAUTHORIZED,
         code: BEARER_ERROR_CODE.TOKEN_VALIDATION_FAILED,
-        context: { detail }
+        context: {
+          detail
+        }
       });
     }
     if (!isValid) {
@@ -446,23 +497,199 @@ var BearerTokenGuard = class {
     return true;
   }
 };
-BearerTokenGuard = __decorateClass([
+__name(_BearerTokenGuard, "BearerTokenGuard");
+var BearerTokenGuard = _BearerTokenGuard;
+BearerTokenGuard = _ts_decorate([
   (0, import_common.Injectable)(),
-  __decorateParam(0, (0, import_common.Optional)()),
-  __decorateParam(0, (0, import_common.Inject)(KEYCLOAK_CLIENT)),
-  __decorateParam(1, (0, import_common.Optional)()),
-  __decorateParam(1, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER))
+  _ts_param(0, (0, import_common.Optional)()),
+  _ts_param(0, (0, import_common.Inject)(KEYCLOAK_CLIENT)),
+  _ts_param(1, (0, import_common.Optional)()),
+  _ts_param(1, (0, import_common.Inject)(import_logger.LOGGER_PROVIDER)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof KeycloakClientInterface === "undefined" ? Object : KeycloakClientInterface,
+    typeof LoggerProviderInterface === "undefined" ? Object : LoggerProviderInterface
+  ])
 ], BearerTokenGuard);
 
+// src/b2b.guard.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+var _B2BGuard = class _B2BGuard {
+  bearerTokenGuard;
+  constructor(bearerTokenGuard) {
+    this.bearerTokenGuard = bearerTokenGuard;
+  }
+  canActivate(context) {
+    return Promise.resolve(this.bearerTokenGuard.canActivate(context));
+  }
+};
+__name(_B2BGuard, "B2BGuard");
+var B2BGuard = _B2BGuard;
+B2BGuard = _ts_decorate2([
+  (0, import_common2.Injectable)(),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof BearerTokenGuard === "undefined" ? Object : BearerTokenGuard
+  ])
+], B2BGuard);
+
+// src/b2c.guard.ts
+var import_common3 = require("@nestjs/common");
+var import_shared2 = __toESM(require_dist());
+
+// src/keycloak.headers.ts
+var state = {
+  headers: {
+    b2cToken: parseEnvHeader("KEYCLOAK_B2C_TOKEN_HEADER", "x-access-token"),
+    b2bToken: parseEnvHeader("KEYCLOAK_B2B_TOKEN_HEADER", "authorization")
+  },
+  claims: {
+    userId: parseEnvClaims("KEYCLOAK_USER_ID_CLAIM", [
+      "sub"
+    ]),
+    callerId: parseEnvClaims("KEYCLOAK_CALLER_ID_CLAIM", [
+      "azp"
+    ])
+  }
+};
+function configureTokenHeaders(cfg) {
+  if (cfg.b2cToken) state.headers.b2cToken = cfg.b2cToken.toLowerCase();
+  if (cfg.b2bToken) state.headers.b2bToken = cfg.b2bToken.toLowerCase();
+}
+__name(configureTokenHeaders, "configureTokenHeaders");
+function configureTokenClaims(cfg) {
+  if (cfg.userId) state.claims.userId = normalizeClaims(cfg.userId);
+  if (cfg.callerId) state.claims.callerId = normalizeClaims(cfg.callerId);
+}
+__name(configureTokenClaims, "configureTokenClaims");
+function getB2CTokenHeader() {
+  return state.headers.b2cToken;
+}
+__name(getB2CTokenHeader, "getB2CTokenHeader");
+function getB2BTokenHeader() {
+  return state.headers.b2bToken;
+}
+__name(getB2BTokenHeader, "getB2BTokenHeader");
+function getUserIdClaims() {
+  return state.claims.userId;
+}
+__name(getUserIdClaims, "getUserIdClaims");
+function getCallerIdClaims() {
+  return state.claims.callerId;
+}
+__name(getCallerIdClaims, "getCallerIdClaims");
+function parseEnvHeader(key, fallback) {
+  return (process.env[key] ?? fallback).toLowerCase();
+}
+__name(parseEnvHeader, "parseEnvHeader");
+function parseEnvClaims(key, fallback) {
+  const raw = process.env[key];
+  if (!raw) return fallback;
+  return raw.split(",").map((c) => c.trim()).filter(Boolean);
+}
+__name(parseEnvClaims, "parseEnvClaims");
+function normalizeClaims(value) {
+  if (Array.isArray(value)) return value.filter(Boolean);
+  return value.split(",").map((c) => c.trim()).filter(Boolean);
+}
+__name(normalizeClaims, "normalizeClaims");
+
+// src/b2c.guard.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var _B2CGuard = class _B2CGuard {
+  canActivate(context) {
+    var _a;
+    const request = context.switchToHttp().getRequest();
+    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
+    if (accessToken) return true;
+    throw new import_shared2.BaseAppError({
+      message: "Missing X-Access-Token header. Route requires Kong-forwarded user authentication.",
+      status: HTTP_STATUS.UNAUTHORIZED,
+      code: BEARER_ERROR_CODE.MISSING_TOKEN,
+      context: {}
+    });
+  }
+};
+__name(_B2CGuard, "B2CGuard");
+var B2CGuard = _B2CGuard;
+B2CGuard = _ts_decorate3([
+  (0, import_common3.Injectable)()
+], B2CGuard);
+
+// src/api-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var _ApiAuthGuard = class _ApiAuthGuard {
+  b2bGuard;
+  b2cGuard;
+  constructor(b2bGuard, b2cGuard) {
+    this.b2bGuard = b2bGuard;
+    this.b2cGuard = b2cGuard;
+  }
+  async canActivate(context) {
+    var _a, _b;
+    const request = context.switchToHttp().getRequest();
+    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
+    if (accessToken) {
+      return this.b2cGuard.canActivate(context);
+    }
+    const authHeader = (_b = request.headers) == null ? void 0 : _b[getB2BTokenHeader()];
+    if (authHeader == null ? void 0 : authHeader.toLowerCase().startsWith("bearer ")) {
+      return this.b2bGuard.canActivate(context);
+    }
+    throw new import_shared3.BaseAppError({
+      message: "Unauthorized: missing X-Access-Token (Kong/B2C) or Authorization header (B2B)",
+      status: HTTP_STATUS.UNAUTHORIZED,
+      code: BEARER_ERROR_CODE.MISSING_TOKEN,
+      context: {}
+    });
+  }
+};
+__name(_ApiAuthGuard, "ApiAuthGuard");
+var ApiAuthGuard = _ApiAuthGuard;
+ApiAuthGuard = _ts_decorate4([
+  (0, import_common4.Injectable)(),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof B2BGuard === "undefined" ? Object : B2BGuard,
+    typeof B2CGuard === "undefined" ? Object : B2CGuard
+  ])
+], ApiAuthGuard);
+
 // src/keycloak.client.ts
-var import_common2 = require("@nestjs/common");
+var import_common5 = require("@nestjs/common");
 var import_http_client2 = require("@adatechnology/http-client");
 var import_logger2 = require("@adatechnology/logger");
 var import_cache = require("@adatechnology/cache");
 var import_cache2 = require("@adatechnology/cache");
 
 // src/errors/keycloak-error.ts
-var KeycloakError = class _KeycloakError extends Error {
+var _KeycloakError = class _KeycloakError extends Error {
   statusCode;
   details;
   keycloakError;
@@ -475,8 +702,27 @@ var KeycloakError = class _KeycloakError extends Error {
     Object.setPrototypeOf(this, _KeycloakError.prototype);
   }
 };
+__name(_KeycloakError, "KeycloakError");
+var KeycloakError = _KeycloakError;
 
 // src/keycloak.client.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
 function extractErrorInfo(err) {
   var _a, _b, _c, _d, _e;
   const statusCode = (err == null ? void 0 : err.status) ?? ((_a = err == null ? void 0 : err.response) == null ? void 0 : _a.status);
@@ -501,15 +747,19 @@ function extractErrorInfo(err) {
     keycloakError: keycloakError ?? (errorCode ? `NETWORK_ERROR_${String(errorCode)}` : void 0)
   };
 }
-var KeycloakClient = class {
+__name(extractErrorInfo, "extractErrorInfo");
+var _KeycloakClient = class _KeycloakClient {
+  config;
+  httpProvider;
+  logger;
+  cacheProvider;
+  tokenPromise = null;
   constructor(config, httpProvider, logger, cacheProvider) {
     this.config = config;
     this.httpProvider = httpProvider;
     this.logger = logger;
     this.cacheProvider = cacheProvider ?? new import_cache.InMemoryCacheProvider(logger);
   }
-  cacheProvider;
-  tokenPromise = null;
   log(level, message, libMethod, meta) {
     if (!this.logger) return;
     const loggerCtx = (0, import_logger2.getContext)();
@@ -571,21 +821,29 @@ var KeycloakClient = class {
     if (this.config.credentials.clientSecret) {
       body.append("client_secret", this.config.credentials.clientSecret);
     }
-    body.append("scope", KeycloakClient.scopesToString(this.config.scopes));
+    body.append("scope", _KeycloakClient.scopesToString(this.config.scopes));
     try {
       const response = await this.httpProvider.post({
         url: tokenUrl,
         data: body,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("info", `${method} - Success for user: ${username}`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed for user: ${username}`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed for user: ${username}`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to obtain token with credentials", {
         statusCode,
         details,
@@ -607,7 +865,7 @@ var KeycloakClient = class {
       if (this.config.credentials.username && this.config.credentials.password) {
         data.append("username", this.config.credentials.username);
         data.append("password", this.config.credentials.password);
-        data.append("scope", KeycloakClient.scopesToString(this.config.scopes));
+        data.append("scope", _KeycloakClient.scopesToString(this.config.scopes));
       }
     }
     try {
@@ -615,15 +873,23 @@ var KeycloakClient = class {
         url: tokenUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("debug", `${method} - Success`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to request token", {
         statusCode,
         details,
@@ -647,8 +913,13 @@ var KeycloakClient = class {
         url: tokenUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       const ttlSeconds = this.config.tokenCacheTtl ? Math.floor(this.config.tokenCacheTtl / 1e3) : response.data.expires_in - 60;
@@ -657,7 +928,10 @@ var KeycloakClient = class {
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to refresh token", {
         statusCode,
         details,
@@ -681,8 +955,13 @@ var KeycloakClient = class {
         url: introspectUrl,
         data,
         config: {
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded"
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       const active = ((_a = response.data) == null ? void 0 : _a.active) === true;
@@ -690,7 +969,10 @@ var KeycloakClient = class {
       return active;
     } catch (error) {
       const { statusCode, details, keycloakError } = extractErrorInfo(error);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Token introspection failed", {
         statusCode,
         details,
@@ -706,15 +988,23 @@ var KeycloakClient = class {
       const response = await this.httpProvider.get({
         url: userInfoUrl,
         config: {
-          headers: { Authorization: `Bearer ${token}` },
-          logContext: { className: LOG_CONTEXT.KEYCLOAK_CLIENT, methodName: method }
+          headers: {
+            Authorization: `Bearer ${token}`
+          },
+          logContext: {
+            className: LOG_CONTEXT.KEYCLOAK_CLIENT,
+            methodName: method
+          }
         }
       });
       this.log("debug", `${method} - Success`, method);
       return response.data;
     } catch (err) {
       const { statusCode, details, keycloakError } = extractErrorInfo(err);
-      this.log("error", `${method} - Failed`, method, { statusCode, keycloakError });
+      this.log("error", `${method} - Failed`, method, {
+        statusCode,
+        keycloakError
+      });
       throw new KeycloakError("Failed to retrieve userinfo", {
         statusCode,
         details,
@@ -730,18 +1020,38 @@ var KeycloakClient = class {
     return Array.isArray(scopes) ? scopes.join(" ") : String(scopes);
   }
 };
-KeycloakClient = __decorateClass([
-  (0, import_common2.Injectable)(),
-  __decorateParam(1, (0, import_common2.Inject)(import_http_client2.HTTP_PROVIDER)),
-  __decorateParam(2, (0, import_common2.Optional)()),
-  __decorateParam(2, (0, import_common2.Inject)(import_logger2.LOGGER_PROVIDER)),
-  __decorateParam(3, (0, import_common2.Optional)()),
-  __decorateParam(3, (0, import_common2.Inject)(import_cache2.CACHE_PROVIDER))
+__name(_KeycloakClient, "KeycloakClient");
+var KeycloakClient = _KeycloakClient;
+KeycloakClient = _ts_decorate5([
+  (0, import_common5.Injectable)(),
+  _ts_param2(1, (0, import_common5.Inject)(import_http_client2.HTTP_PROVIDER)),
+  _ts_param2(2, (0, import_common5.Optional)()),
+  _ts_param2(2, (0, import_common5.Inject)(import_logger2.LOGGER_PROVIDER)),
+  _ts_param2(3, (0, import_common5.Optional)()),
+  _ts_param2(3, (0, import_common5.Inject)(import_cache2.CACHE_PROVIDER)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof KeycloakConfig === "undefined" ? Object : KeycloakConfig,
+    typeof HttpProviderInterface === "undefined" ? Object : HttpProviderInterface,
+    typeof import_logger2.LoggerProviderInterface === "undefined" ? Object : import_logger2.LoggerProviderInterface,
+    typeof CacheProviderInterface === "undefined" ? Object : CacheProviderInterface
+  ])
 ], KeycloakClient);
 
 // src/keycloak.http.interceptor.ts
-var import_common3 = require("@nestjs/common");
-var KeycloakHttpInterceptor = class {
+var import_common6 = require("@nestjs/common");
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var _KeycloakHttpInterceptor = class _KeycloakHttpInterceptor {
   constructor() {
   }
   intercept(context, next) {
@@ -751,43 +1061,51 @@ var KeycloakHttpInterceptor = class {
     return next.handle();
   }
 };
-KeycloakHttpInterceptor = __decorateClass([
-  (0, import_common3.Injectable)()
+__name(_KeycloakHttpInterceptor, "KeycloakHttpInterceptor");
+var KeycloakHttpInterceptor = _KeycloakHttpInterceptor;
+KeycloakHttpInterceptor = _ts_decorate6([
+  (0, import_common6.Injectable)(),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [])
 ], KeycloakHttpInterceptor);
 
 // src/roles.guard.ts
-var import_common5 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var import_core = require("@nestjs/core");
 
 // src/roles.decorator.ts
-var import_common4 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var ROLES_META_KEY = "roles";
 var B2C_ROLES_META_KEY = "roles:b2c";
 var B2B_ROLES_META_KEY = "roles:b2b";
 var TOKEN_ROLES_META_KEY = "roles:token";
 function Roles(...args) {
-  return (0, import_common4.SetMetadata)(ROLES_META_KEY, normalizeRolesOptions(args));
+  return (0, import_common7.SetMetadata)(ROLES_META_KEY, normalizeRolesOptions(args));
 }
+__name(Roles, "Roles");
 function B2CRoles(...args) {
-  return (0, import_common4.SetMetadata)(B2C_ROLES_META_KEY, normalizeRolesOptions(args));
+  return (0, import_common7.SetMetadata)(B2C_ROLES_META_KEY, normalizeRolesOptions(args));
 }
+__name(B2CRoles, "B2CRoles");
 function B2BRoles(...args) {
-  return (0, import_common4.SetMetadata)(B2B_ROLES_META_KEY, normalizeRolesOptions(args));
+  return (0, import_common7.SetMetadata)(B2B_ROLES_META_KEY, normalizeRolesOptions(args));
 }
+__name(B2BRoles, "B2BRoles");
 function normalizeRolesOptions(args) {
   let payload;
   if (args.length === 1 && typeof args[0] === "object" && !Array.isArray(args[0])) {
     payload = args[0];
   } else {
-    const roles = [].concat(
-      ...args.map((a) => Array.isArray(a) ? a : String(a))
-    );
-    payload = { roles };
+    const roles = [].concat(...args.map((a) => Array.isArray(a) ? a : String(a)));
+    payload = {
+      roles
+    };
   }
   payload.mode = payload.mode ?? "any";
   payload.type = payload.type ?? "both";
   return payload;
 }
+__name(normalizeRolesOptions, "normalizeRolesOptions");
 function TokenRoles(options) {
   const normalized = {
     ...options,
@@ -796,58 +1114,34 @@ function TokenRoles(options) {
     // auto-detect bearer stripping: true when header is 'authorization'
     bearer: options.bearer ?? options.header.toLowerCase() === "authorization"
   };
-  return (0, import_common4.SetMetadata)(TOKEN_ROLES_META_KEY, [normalized]);
+  return (0, import_common7.SetMetadata)(TOKEN_ROLES_META_KEY, [
+    normalized
+  ]);
 }
+__name(TokenRoles, "TokenRoles");
 
 // src/roles.guard.ts
-var import_shared2 = __toESM(require_dist());
-
-// src/keycloak.headers.ts
-var state = {
-  headers: {
-    b2cToken: parseEnvHeader("KEYCLOAK_B2C_TOKEN_HEADER", "x-access-token"),
-    b2bToken: parseEnvHeader("KEYCLOAK_B2B_TOKEN_HEADER", "authorization")
-  },
-  claims: {
-    userId: parseEnvClaims("KEYCLOAK_USER_ID_CLAIM", ["sub"]),
-    callerId: parseEnvClaims("KEYCLOAK_CALLER_ID_CLAIM", ["azp"])
-  }
-};
-function configureTokenHeaders(cfg) {
-  if (cfg.b2cToken) state.headers.b2cToken = cfg.b2cToken.toLowerCase();
-  if (cfg.b2bToken) state.headers.b2bToken = cfg.b2bToken.toLowerCase();
-}
-function configureTokenClaims(cfg) {
-  if (cfg.userId) state.claims.userId = normalizeClaims(cfg.userId);
-  if (cfg.callerId) state.claims.callerId = normalizeClaims(cfg.callerId);
-}
-function getB2CTokenHeader() {
-  return state.headers.b2cToken;
-}
-function getB2BTokenHeader() {
-  return state.headers.b2bToken;
-}
-function getUserIdClaims() {
-  return state.claims.userId;
-}
-function getCallerIdClaims() {
-  return state.claims.callerId;
-}
-function parseEnvHeader(key, fallback) {
-  return (process.env[key] ?? fallback).toLowerCase();
+var import_shared4 = __toESM(require_dist());
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-function parseEnvClaims(key, fallback) {
-  const raw = process.env[key];
-  if (!raw) return fallback;
-  return raw.split(",").map((c) => c.trim()).filter(Boolean);
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-function normalizeClaims(value) {
-  if (Array.isArray(value)) return value.filter(Boolean);
-  return value.split(",").map((c) => c.trim()).filter(Boolean);
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
 }
-
-// src/roles.guard.ts
-var RolesGuard = class {
+__name(_ts_param3, "_ts_param");
+var _RolesGuard = class _RolesGuard {
+  reflector;
+  config;
   constructor(reflector, config) {
     this.reflector = reflector;
     this.config = config;
@@ -858,10 +1152,10 @@ var RolesGuard = class {
     const b2cMeta = this.getMeta(B2C_ROLES_META_KEY, context);
     const b2bMeta = this.getMeta(B2B_ROLES_META_KEY, context);
     const genericMeta = this.getMeta(ROLES_META_KEY, context);
-    const tokenRules = this.reflector.getAllAndMerge(
-      TOKEN_ROLES_META_KEY,
-      [context.getHandler(), context.getClass()]
-    ) ?? [];
+    const tokenRules = this.reflector.getAllAndMerge(TOKEN_ROLES_META_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]) ?? [];
     if (!b2cMeta && !b2bMeta && !genericMeta && tokenRules.length === 0) return true;
     if (b2cMeta) {
       const token = (_a = req.headers) == null ? void 0 : _a[getB2CTokenHeader()];
@@ -883,7 +1177,7 @@ var RolesGuard = class {
         const raw = (_d = req.headers) == null ? void 0 : _d[getB2BTokenHeader()];
         const token = (raw == null ? void 0 : raw.split(" ")[1]) ?? ((_e = req.query) == null ? void 0 : _e.token);
         if (!token) {
-          throw new import_shared2.BaseAppError({
+          throw new import_shared4.BaseAppError({
             message: "Authorization token not provided",
             status: HTTP_STATUS.FORBIDDEN,
             code: ROLES_ERROR_CODE.MISSING_TOKEN,
@@ -898,7 +1192,10 @@ var RolesGuard = class {
       const raw = (_f = req.headers) == null ? void 0 : _f[rule.header];
       const token = rule.bearer ? raw == null ? void 0 : raw.split(" ")[1] : raw;
       const roles = token ? this.extractRoles(token, "b2c") : /* @__PURE__ */ new Set();
-      this.assertRoles(roles, { roles: rule.roles, mode: rule.mode ?? "any" }, `header:${rule.header}`);
+      this.assertRoles(roles, {
+        roles: rule.roles,
+        mode: rule.mode ?? "any"
+      }, `header:${rule.header}`);
     }
     return true;
   }
@@ -925,11 +1222,14 @@ var RolesGuard = class {
     const hasMatch = meta.roles.map((r) => available.has(r));
     const passed = meta.mode === "all" ? hasMatch.every(Boolean) : hasMatch.some(Boolean);
     if (!passed) {
-      throw new import_shared2.BaseAppError({
+      throw new import_shared4.BaseAppError({
         message: `Insufficient roles for ${label} token`,
         status: HTTP_STATUS.FORBIDDEN,
         code: ROLES_ERROR_CODE.INSUFFICIENT_ROLES,
-        context: { required: meta.roles, source: label }
+        context: {
+          required: meta.roles,
+          source: label
+        }
       });
     }
   }
@@ -946,45 +1246,74 @@ var RolesGuard = class {
     }
   }
 };
-RolesGuard = __decorateClass([
-  (0, import_common5.Injectable)(),
-  __decorateParam(0, (0, import_common5.Inject)(import_core.Reflector)),
-  __decorateParam(1, (0, import_common5.Optional)()),
-  __decorateParam(1, (0, import_common5.Inject)(KEYCLOAK_CONFIG))
+__name(_RolesGuard, "RolesGuard");
+var RolesGuard = _RolesGuard;
+RolesGuard = _ts_decorate7([
+  (0, import_common8.Injectable)(),
+  _ts_param3(0, (0, import_common8.Inject)(import_core.Reflector)),
+  _ts_param3(1, (0, import_common8.Optional)()),
+  _ts_param3(1, (0, import_common8.Inject)(KEYCLOAK_CONFIG)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof KeycloakConfig === "undefined" ? Object : KeycloakConfig
+  ])
 ], RolesGuard);
 
 // src/keycloak.module.ts
-var KeycloakModule = class {
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+var _KeycloakModule = class _KeycloakModule {
   static forRoot(config, httpConfig) {
     if (config.headers) configureTokenHeaders(config.headers);
     if (config.claims) configureTokenClaims(config.claims);
     return {
-      module: KeycloakModule,
+      module: _KeycloakModule,
       global: true,
       imports: [
-        import_http_client3.HttpModule.forRoot(
-          httpConfig || { baseURL: config.baseUrl, timeout: 5e3 },
-          {
-            logging: {
-              enabled: true,
-              includeBody: true,
-              context: "KeycloakHttpClient",
-              environments: ["development", "test"]
-            }
+        import_http_client3.HttpModule.forRoot(httpConfig || {
+          baseURL: config.baseUrl,
+          timeout: 5e3
+        }, {
+          logging: {
+            enabled: true,
+            includeBody: true,
+            context: "KeycloakHttpClient",
+            environments: [
+              "development",
+              "test"
+            ]
           }
-        )
+        })
       ],
       providers: [
-        { provide: import_core2.Reflector, useClass: import_core2.Reflector },
-        { provide: KEYCLOAK_CONFIG, useValue: config },
+        {
+          provide: import_core2.Reflector,
+          useClass: import_core2.Reflector
+        },
+        {
+          provide: KEYCLOAK_CONFIG,
+          useValue: config
+        },
         {
           provide: KEYCLOAK_CLIENT,
-          useFactory: (cfg, httpProvider, logger, cacheProvider) => new KeycloakClient(cfg, httpProvider, logger, cacheProvider),
+          useFactory: /* @__PURE__ */ __name((cfg, httpProvider, logger, cacheProvider) => new KeycloakClient(cfg, httpProvider, logger, cacheProvider), "useFactory"),
           inject: [
             KEYCLOAK_CONFIG,
             import_http_client3.HTTP_PROVIDER,
-            { token: import_logger3.LOGGER_PROVIDER, optional: true },
-            { token: import_cache3.CACHE_PROVIDER, optional: true }
+            {
+              token: import_logger3.LOGGER_PROVIDER,
+              optional: true
+            },
+            {
+              token: import_cache3.CACHE_PROVIDER,
+              optional: true
+            }
           ]
         },
         {
@@ -993,10 +1322,13 @@ var KeycloakModule = class {
         },
         {
           provide: KEYCLOAK_HTTP_INTERCEPTOR,
-          useFactory: () => new KeycloakHttpInterceptor()
+          useFactory: /* @__PURE__ */ __name(() => new KeycloakHttpInterceptor(), "useFactory")
         },
         RolesGuard,
-        BearerTokenGuard
+        BearerTokenGuard,
+        B2CGuard,
+        B2BGuard,
+        ApiAuthGuard
       ],
       exports: [
         import_core2.Reflector,
@@ -1005,150 +1337,108 @@ var KeycloakModule = class {
         KEYCLOAK_HTTP_INTERCEPTOR,
         KEYCLOAK_CONFIG,
         RolesGuard,
-        BearerTokenGuard
+        BearerTokenGuard,
+        B2CGuard,
+        B2BGuard,
+        ApiAuthGuard
       ]
     };
   }
 };
-KeycloakModule = __decorateClass([
-  (0, import_common6.Module)({})
+__name(_KeycloakModule, "KeycloakModule");
+var KeycloakModule = _KeycloakModule;
+KeycloakModule = _ts_decorate8([
+  (0, import_common9.Module)({})
 ], KeycloakModule);
 
-// src/b2b.guard.ts
-var import_common7 = require("@nestjs/common");
-var B2BGuard = class {
-  constructor(bearerTokenGuard) {
-    this.bearerTokenGuard = bearerTokenGuard;
-  }
-  canActivate(context) {
-    return Promise.resolve(this.bearerTokenGuard.canActivate(context));
-  }
-};
-B2BGuard = __decorateClass([
-  (0, import_common7.Injectable)()
-], B2BGuard);
-
-// src/b2c.guard.ts
-var import_common8 = require("@nestjs/common");
-var import_shared3 = __toESM(require_dist());
-var B2CGuard = class {
-  canActivate(context) {
-    var _a;
-    const request = context.switchToHttp().getRequest();
-    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
-    if (accessToken) return true;
-    throw new import_shared3.BaseAppError({
-      message: "Missing X-Access-Token header. Route requires Kong-forwarded user authentication.",
-      status: HTTP_STATUS.UNAUTHORIZED,
-      code: BEARER_ERROR_CODE.MISSING_TOKEN,
-      context: {}
-    });
-  }
-};
-B2CGuard = __decorateClass([
-  (0, import_common8.Injectable)()
-], B2CGuard);
-
-// src/api-auth.guard.ts
-var import_common9 = require("@nestjs/common");
-var import_shared4 = __toESM(require_dist());
-var ApiAuthGuard = class {
-  constructor(b2bGuard, b2cGuard) {
-    this.b2bGuard = b2bGuard;
-    this.b2cGuard = b2cGuard;
-  }
-  async canActivate(context) {
-    var _a, _b;
-    const request = context.switchToHttp().getRequest();
-    const accessToken = (_a = request.headers) == null ? void 0 : _a[getB2CTokenHeader()];
-    if (accessToken) {
-      return this.b2cGuard.canActivate(context);
-    }
-    const authHeader = (_b = request.headers) == null ? void 0 : _b[getB2BTokenHeader()];
-    if (authHeader == null ? void 0 : authHeader.toLowerCase().startsWith("bearer ")) {
-      return this.b2bGuard.canActivate(context);
-    }
-    throw new import_shared4.BaseAppError({
-      message: "Unauthorized: missing X-Access-Token (Kong/B2C) or Authorization header (B2B)",
-      status: HTTP_STATUS.UNAUTHORIZED,
-      code: BEARER_ERROR_CODE.MISSING_TOKEN,
-      context: {}
-    });
-  }
-};
-ApiAuthGuard = __decorateClass([
-  (0, import_common9.Injectable)()
-], ApiAuthGuard);
-
 // src/auth-user.decorator.ts
 var import_common10 = require("@nestjs/common");
-var AuthUser = (0, import_common10.createParamDecorator)(
-  (param, ctx) => {
-    var _a;
-    const request = ctx.switchToHttp().getRequest();
-    const { header, claims } = resolveB2CParam(param);
-    const raw = (_a = request.headers) == null ? void 0 : _a[header];
-    const token = Array.isArray(raw) ? raw[0] : raw;
-    if (!token) return "";
-    return decodeJwtClaims(String(token), claims) ?? "";
-  }
-);
-var CallerToken = (0, import_common10.createParamDecorator)(
-  (param, ctx) => {
-    var _a;
-    const request = ctx.switchToHttp().getRequest();
-    const { header, claims } = resolveB2BParam(param);
-    const raw = (_a = request.headers) == null ? void 0 : _a[header];
-    const token = raw == null ? void 0 : raw.split(" ")[1];
-    if (!token) return "";
-    return decodeJwtClaims(token, claims) ?? "";
-  }
-);
-var AccessToken = (0, import_common10.createParamDecorator)(
-  (header, ctx) => {
-    var _a;
-    const request = ctx.switchToHttp().getRequest();
-    const h = (header == null ? void 0 : header.toLowerCase()) ?? getB2CTokenHeader();
-    const raw = (_a = request.headers) == null ? void 0 : _a[h];
-    return Array.isArray(raw) ? raw[0] : raw ?? "";
-  }
-);
+var AuthUser = (0, import_common10.createParamDecorator)((param, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const { header, claims } = resolveB2CParam(param);
+  const raw = (_a = request.headers) == null ? void 0 : _a[header];
+  const token = Array.isArray(raw) ? raw[0] : raw;
+  if (!token) return "";
+  return decodeJwtClaims(String(token), claims) ?? "";
+});
+var CallerToken = (0, import_common10.createParamDecorator)((param, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const { header, claims } = resolveB2BParam(param);
+  const raw = (_a = request.headers) == null ? void 0 : _a[header];
+  const token = raw == null ? void 0 : raw.split(" ")[1];
+  if (!token) return "";
+  return decodeJwtClaims(token, claims) ?? "";
+});
+var AccessToken = (0, import_common10.createParamDecorator)((header, ctx) => {
+  var _a;
+  const request = ctx.switchToHttp().getRequest();
+  const h = (header == null ? void 0 : header.toLowerCase()) ?? getB2CTokenHeader();
+  const raw = (_a = request.headers) == null ? void 0 : _a[h];
+  return Array.isArray(raw) ? raw[0] : raw ?? "";
+});
 function resolveB2CParam(param) {
   var _a;
   if (!param) {
-    return { header: getB2CTokenHeader(), claims: getUserIdClaims() };
+    return {
+      header: getB2CTokenHeader(),
+      claims: getUserIdClaims()
+    };
   }
   if (typeof param === "string") {
-    return { header: getB2CTokenHeader(), claims: [param] };
+    return {
+      header: getB2CTokenHeader(),
+      claims: [
+        param
+      ]
+    };
   }
   if (Array.isArray(param)) {
-    return { header: getB2CTokenHeader(), claims: param };
+    return {
+      header: getB2CTokenHeader(),
+      claims: param
+    };
   }
   return {
     header: ((_a = param.header) == null ? void 0 : _a.toLowerCase()) ?? getB2CTokenHeader(),
     claims: param.claim ? normalizeClaims2(param.claim) : getUserIdClaims()
   };
 }
+__name(resolveB2CParam, "resolveB2CParam");
 function resolveB2BParam(param) {
   var _a;
   if (!param) {
-    return { header: getB2BTokenHeader(), claims: getCallerIdClaims() };
+    return {
+      header: getB2BTokenHeader(),
+      claims: getCallerIdClaims()
+    };
   }
   if (typeof param === "string") {
-    return { header: getB2BTokenHeader(), claims: [param] };
+    return {
+      header: getB2BTokenHeader(),
+      claims: [
+        param
+      ]
+    };
   }
   if (Array.isArray(param)) {
-    return { header: getB2BTokenHeader(), claims: param };
+    return {
+      header: getB2BTokenHeader(),
+      claims: param
+    };
   }
   return {
     header: ((_a = param.header) == null ? void 0 : _a.toLowerCase()) ?? getB2BTokenHeader(),
     claims: param.claim ? normalizeClaims2(param.claim) : getCallerIdClaims()
   };
 }
+__name(resolveB2BParam, "resolveB2BParam");
 function normalizeClaims2(value) {
   if (Array.isArray(value)) return value.filter(Boolean);
   return value.split(",").map((c) => c.trim()).filter(Boolean);
 }
+__name(normalizeClaims2, "normalizeClaims");
 function decodeJwtClaims(token, claims) {
   try {
     const parts = token.split(".");
@@ -1156,9 +1446,7 @@ function decodeJwtClaims(token, claims) {
     const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
     const BufferCtor = globalThis.Buffer;
     if (!BufferCtor) return void 0;
-    const payload = JSON.parse(
-      BufferCtor.from(padded, "base64").toString("utf8")
-    );
+    const payload = JSON.parse(BufferCtor.from(padded, "base64").toString("utf8"));
     for (const claim of claims) {
       const value = payload[claim];
       if (typeof value === "string" && value.length > 0) return value;
@@ -1168,6 +1456,7 @@ function decodeJwtClaims(token, claims) {
     return void 0;
   }
 }
+__name(decodeJwtClaims, "decodeJwtClaims");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AccessToken,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adatechnology/auth-keycloak",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "publishConfig": {
     "access": "public"
   },
@@ -12,8 +12,8 @@
   ],
   "dependencies": {
     "@adatechnology/cache": "0.0.8",
-    "@adatechnology/http-client": "0.0.9",
-    "@adatechnology/logger": "0.0.7"
+    "@adatechnology/logger": "0.0.7",
+    "@adatechnology/http-client": "0.0.9"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.16",
@@ -21,6 +21,7 @@
   },
   "devDependencies": {
     "@esbuild-plugins/tsconfig-paths": "^0.1.2",
+    "@swc/core": "^1.15.24",
     "tsup": "^8.5.1",
     "typescript": "^5.2.0",
     "@adatechnology/shared": "0.0.2"