@ah-oh/ao-workspaces-api-sdk 1.0.23 → 1.0.24

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 1.0.24 (2026-10-18)
+
+### 🚀 Features
+
+- **api-sdk:** cache sign-in tokens and harden requests ([ec22d4b](https://github.com/ah-oh/ao-workspaces/commit/ec22d4b))
+
+### ❤️ Thank You
+
+- Claude Opus 5.5
+- Jan Kessler
+
 ## 1.0.23 (2026-09-24)
 
 ### 🚀 Features

package/README.md

@@ -18,8 +18,9 @@ Admin fest. Fachliche Regeln: `docs/features/hardware-connector/` im Repository
 `ah-oh/ao-workspaces`.
 
 Der `PrintClient` wird vom `AuthModule` bereitgestellt (`forRoot` oder
-`forRootAsync`) und meldet sich pro Aufruf mit dem User-Token der App an
-(`tokenId`, `tokenKey`). `product` ist die aufrufende App, **nicht** `admin` –
+`forRootAsync`) und meldet sich mit dem User-Token der App an (`tokenId`,
+`tokenKey`). Das JWT wird pro Zugangsdaten zwischengespeichert (siehe
+`docs/api-sdk-authentifizierung.md`, Abschnitt Token-Cache). `product` ist die aufrufende App, **nicht** `admin` –
 nur so gilt der Aufruf als App und der Job trägt die App als Auslöser.
 
 ```ts
@@ -47,12 +48,12 @@ const current = await printClient.getJob({
 });
 ```
 
-| Methode              | Zweck                                                                                                                                                            |
-| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `print`              | Legt einen Job an und liefert ihn im Zustand `queued`. Optionen: `copies` (1–99), bei PDF `paperSize` und `color`, `idempotencyKey`, `expiresInSeconds`.         |
-| `getJob`             | Liefert den aktuellen Zustand eines Jobs inklusive `error`.                                                                                                      |
-| `waitForJob`         | Fragt den Job ab, bis er abgeschlossen ist (`completed`, `failed`, `expired`, `canceled`) oder `timeoutMs` (Standard 60 s) vergangen ist. Meldet sich einmal an. |
-| `isFinal` (statisch) | Prüft, ob ein Job sich nicht mehr ändert. `waitForJob` liefert nach Ablauf der Wartezeit den letzten, noch offenen Zustand.                                      |
+| Methode              | Zweck                                                                                                                                                                        |
+| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `print`              | Legt einen Job an und liefert ihn im Zustand `queued`. Optionen: `copies` (1–99), bei PDF `paperSize` und `color`, `idempotencyKey`, `expiresInSeconds`.                     |
+| `getJob`             | Liefert den aktuellen Zustand eines Jobs inklusive `error`.                                                                                                                  |
+| `waitForJob`         | Fragt den Job ab, bis er abgeschlossen ist (`completed`, `failed`, `expired`, `canceled`) oder `timeoutMs` (Standard 60 s) vergangen ist. Nutzt ein Token für alle Abfragen. |
+| `isFinal` (statisch) | Prüft, ob ein Job sich nicht mehr ändert. `waitForJob` liefert nach Ablauf der Wartezeit den letzten, noch offenen Zustand.                                                  |
 
 Hinweise:
 
@@ -70,19 +71,21 @@ Fehler der Hardware-API werden als `PrintClientError` geworfen (abgeleitet von
 Nests `HttpException`). `code` enthält den maschinenlesbaren Fehlercode,
 `getStatus()` den HTTP-Status:
 
-| `code`                  | Status | Bedeutung                                                 |
-| ----------------------- | ------ | --------------------------------------------------------- |
-| `target_not_found`      | 404    | Druckziel gibt es in der Company nicht                    |
-| `target_unassigned`     | 422    | Druckziel ist keinem Drucker zugeordnet                   |
-| `option_not_allowed`    | 422    | `paperSize` oder `color` bei ZPL                          |
-| `content_type_mismatch` | 422    | Drucker bzw. Druckziel akzeptiert diesen Inhaltstyp nicht |
-| `printer_disabled`      | 422    | Zugeordneter Drucker ist nicht freigegeben                |
-| `content_missing`       | 400    | Kein Inhalt übergeben                                     |
-| `content_invalid`       | 422    | Inhalt ist kein gültiges PDF                              |
-| `content_too_large`     | 413    | Inhalt größer als 50 MB                                   |
-| `job_not_found`         | 404    | Job-ID unbekannt                                          |
-
-Validierungsfehler (400) und Netzwerkfehler (502) haben keinen `code`.
+| `code`                  | Status | Bedeutung                                                        |
+| ----------------------- | ------ | ---------------------------------------------------------------- |
+| `target_not_found`      | 404    | Druckziel gibt es in der Company nicht                           |
+| `target_unassigned`     | 422    | Druckziel ist keinem Drucker zugeordnet                          |
+| `option_not_allowed`    | 422    | `paperSize` oder `color` bei ZPL                                 |
+| `content_type_mismatch` | 422    | Drucker bzw. Druckziel akzeptiert diesen Inhaltstyp nicht        |
+| `printer_disabled`      | 422    | Zugeordneter Drucker ist nicht freigegeben                       |
+| `content_missing`       | 400    | Kein Inhalt übergeben                                            |
+| `content_invalid`       | 422    | Inhalt ist kein gültiges PDF                                     |
+| `content_too_large`     | 413    | Inhalt größer als 50 MB (prüft schon der Client, vor dem Upload) |
+| `job_not_found`         | 404    | Job-ID unbekannt                                                 |
+
+Validierungsfehler (400), Netzwerkfehler (502) und Zeitüberschreitungen (504)
+haben keinen `code`. Ungültige IDs (leer, `.` oder `..`) wirft der Client
+vorab als `BadRequestException`.
 
 ```ts
 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ah-oh/ao-workspaces-api-sdk",
-  "version": "1.0.23",
+  "version": "1.0.24",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",

package/src/lib/auth.module.js

@@ -12,39 +12,33 @@ var auth_constants_2 = require("./auth.constants");
 Object.defineProperty(exports, "AUTH_MODULE_OPTIONS", { enumerable: true, get: function () { return auth_constants_2.AUTH_MODULE_OPTIONS; } });
 Object.defineProperty(exports, "AUTH_TOKEN", { enumerable: true, get: function () { return auth_constants_2.AUTH_TOKEN; } });
 Object.defineProperty(exports, "AUTH_MODULE", { enumerable: true, get: function () { return auth_constants_2.AUTH_MODULE; } });
-const getAuthOptions = (options) => new customer_center_service_1.CustomerCenterService(options);
-const createAuthProvider = (options) => {
-    return {
-        provide: auth_constants_1.AUTH_TOKEN,
-        useValue: getAuthOptions(options),
-    };
+/**
+ * `AUTH_TOKEN` points to the same instance as `CustomerCenterService`, so the
+ * guards and the clients share one token and session cache.
+ */
+const authTokenProvider = {
+    provide: auth_constants_1.AUTH_TOKEN,
+    useExisting: customer_center_service_1.CustomerCenterService,
 };
+const services = [customer_center_service_1.CustomerCenterService, mail_settings_service_1.MailSettingsService, print_client_1.PrintClient];
 let AuthModule = AuthModule_1 = class AuthModule {
     static forRoot(options) {
-        const provider = createAuthProvider(options);
         return {
             module: AuthModule_1,
             providers: [
                 { provide: auth_constants_1.AUTH_MODULE_OPTIONS, useValue: options },
-                provider,
-                customer_center_service_1.CustomerCenterService,
-                mail_settings_service_1.MailSettingsService,
-                print_client_1.PrintClient,
+                authTokenProvider,
+                ...services,
             ],
-            exports: [provider, customer_center_service_1.CustomerCenterService, mail_settings_service_1.MailSettingsService, print_client_1.PrintClient],
+            exports: [auth_constants_1.AUTH_TOKEN, ...services],
         };
     }
     static forRootAsync(options) {
-        const provider = {
-            inject: [auth_constants_1.AUTH_MODULE_OPTIONS],
-            provide: auth_constants_1.AUTH_TOKEN,
-            useFactory: async (options) => getAuthOptions(options),
-        };
         return {
             module: AuthModule_1,
             imports: options.imports,
-            providers: [...this.createAsyncProviders(options), provider, customer_center_service_1.CustomerCenterService, mail_settings_service_1.MailSettingsService, print_client_1.PrintClient],
-            exports: [provider, customer_center_service_1.CustomerCenterService, mail_settings_service_1.MailSettingsService, print_client_1.PrintClient],
+            providers: [...this.createAsyncProviders(options), authTokenProvider, ...services],
+            exports: [auth_constants_1.AUTH_TOKEN, ...services],
         };
     }
     static createAsyncProviders(options) {
@@ -68,10 +62,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 inject: options.inject || [],
             };
         }
-        const inject = [
-            (options.useClass ||
-                options.useExisting),
-        ];
+        const inject = [(options.useClass || options.useExisting)];
         return {
             provide: auth_constants_1.AUTH_MODULE_OPTIONS,
             useFactory: async (optionsFactory) => await optionsFactory.createHttpModuleOptions(),

package/src/lib/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../../../libs/api-sdk/src/lib/auth.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAA+E;AAE/E,qDAAmE;AACnE,uEAAkE;AAClE,mEAA8D;AAC9D,iDAA6C;AAO7C,mDAAgF;AAAvE,qHAAA,mBAAmB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAAE,6GAAA,WAAW,OAAA;AAErD,MAAM,cAAc,GAAG,CAAC,OAA0B,EAAyB,EAAE,CACzE,IAAI,+CAAqB,CAAC,OAAO,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,CAAC,OAA0B,EAAY,EAAE;IAChE,OAAO;QACH,OAAO,EAAE,2BAAU;QACnB,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC;KACpC,CAAC;AACN,CAAC,CAAC;AAIK,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACZ,MAAM,CAAC,OAAO,CAAC,OAA0B;QAC5C,MAAM,QAAQ,GAAa,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO;YACH,MAAM,EAAE,YAAU;YAClB,SAAS,EAAE;gBACP,EAAE,OAAO,EAAE,oCAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnD,QAAQ;gBACR,+CAAqB;gBACrB,2CAAmB;gBACnB,0BAAW;aACd;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,+CAAqB,EAAE,2CAAmB,EAAE,0BAAW,CAAC;SAC/E,CAAC;IACN,CAAC;IAEM,MAAM,CAAC,YAAY,CAAC,OAA+B;QACtD,MAAM,QAAQ,GAAa;YACvB,MAAM,EAAE,CAAC,oCAAmB,CAAC;YAC7B,OAAO,EAAE,2BAAU;YACnB,UAAU,EAAE,KAAK,EAAE,OAA0B,EAAE,EAAE,CAC7C,cAAc,CAAC,OAAO,CAAC;SAC9B,CAAC;QAEF,OAAO;YACH,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,+CAAqB,EAAE,2CAAmB,EAAE,0BAAW,CAAC;YACrH,OAAO,EAAE,CAAC,QAAQ,EAAE,+CAAqB,EAAE,2CAAmB,EAAE,0BAAW,CAAC;SAC/E,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAC/B,OAA+B;QAE/B,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAmC,CAAC;QAE7D,OAAO;YACH,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACxC;gBACI,OAAO,EAAE,QAAQ;gBACjB,QAAQ;aACX;SACJ,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,0BAA0B,CACrC,OAA+B;QAE/B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO;gBACH,OAAO,EAAE,oCAAmB;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;aAC/B,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG;YACX,CAAC,OAAO,CAAC,QAAQ;gBACb,OAAO,CAAC,WAAW,CAA4B;SACtD,CAAC;QAEF,OAAO;YACH,OAAO,EAAE,oCAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,cAAiC,EAAE,EAAE,CACpD,MAAM,cAAc,CAAC,uBAAuB,EAAE;YAClD,MAAM;SACT,CAAC;IACN,CAAC;CACJ,CAAA;AAzEY,gCAAU;qBAAV,UAAU;IAFtB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAyEtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../../../libs/api-sdk/src/lib/auth.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAA+E;AAE/E,qDAAmE;AACnE,uEAAkE;AAClE,mEAA8D;AAC9D,iDAA6C;AAO7C,mDAAgF;AAAvE,qHAAA,mBAAmB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAAE,6GAAA,WAAW,OAAA;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAa;IAClC,OAAO,EAAE,2BAAU;IACnB,WAAW,EAAE,+CAAqB;CACnC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,+CAAqB,EAAE,2CAAmB,EAAE,0BAAW,CAAC,CAAC;AAIpE,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACd,MAAM,CAAC,OAAO,CAAC,OAA0B;QAC9C,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oCAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnD,iBAAiB;gBACjB,GAAG,QAAQ;aACZ;YACD,OAAO,EAAE,CAAC,2BAAU,EAAE,GAAG,QAAQ,CAAC;SACnC,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,YAAY,CAAC,OAA+B;QACxD,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,GAAG,QAAQ,CAAC;YAClF,OAAO,EAAE,CAAC,2BAAU,EAAE,GAAG,QAAQ,CAAC;SACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAAC,OAA+B;QACjE,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAmC,CAAC;QAE7D,OAAO;YACL,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC;YACxC;gBACE,OAAO,EAAE,QAAQ;gBACjB,QAAQ;aACT;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,0BAA0B,CAAC,OAA+B;QACvE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,oCAAmB;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;aAC7B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAA4B,CAAC,CAAC;QAEtF,OAAO;YACL,OAAO,EAAE,oCAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,cAAiC,EAAE,EAAE,CACtD,MAAM,cAAc,CAAC,uBAAuB,EAAE;YAChD,MAAM;SACP,CAAC;IACJ,CAAC;CACF,CAAA;AAxDY,gCAAU;qBAAV,UAAU;IAFtB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAwDtB"}

package/src/lib/customer-center.service.d.ts

@@ -1,25 +1,61 @@
 import { ApiKey, ApiKeyType } from './models/api-key.model';
 import { AuthModuleOptions } from './models/auth.options';
 import { Product, UserSession } from './models/user-session.model';
+export interface TokenSignInDto {
+    tokenId: string;
+    tokenKey: string;
+    product: Product;
+}
 export declare class CustomerCenterService {
     private readonly options;
-    private BASE_URL;
+    private readonly http;
+    /** Cache keys are HMACs, so the heap holds neither token keys nor tokens as keys. */
+    private readonly cacheKeySecret;
+    private readonly tokenCache;
+    private readonly sessionCache;
+    /** Until then `verifyInstanceToken` uses `GET /auth/verify/:token` directly. */
+    private legacyVerifyUntil;
     constructor(options: AuthModuleOptions);
+    /**
+     * Verifies a token and returns its session. The token travels in the
+     * `Authorization` header, not in the URL, so access logs do not record it.
+     * Concurrent calls with the same token share one request; with
+     * `sessionCacheTtlMs` the session is cached.
+     */
     verifyInstanceToken(token: string): Promise<UserSession>;
     sendCompanyRefreshTokenMail(id: string, expiresIn: number): Promise<{
         done: boolean;
     }>;
-    tokenSignIn(dto: {
-        tokenId: string;
-        tokenKey: string;
-        product: Product;
-    }): Promise<{
+    /**
+     * Exchanges a user token for a JWT. Unless `tokenCache` is `false`, the JWT
+     * is reused for the same credentials until shortly before it expires.
+     */
+    tokenSignIn(dto: TokenSignInDto): Promise<{
         token: string;
     }>;
+    /**
+     * Runs `call` with `Bearer <jwt>` for the credentials. If the server rejects
+     * a cached token with 401, the token is dropped and `call` runs once more
+     * with a new one.
+     */
+    withToken<T>(dto: TokenSignInDto, call: (authorization: string) => Promise<T>): Promise<T>;
+    /** Drops all cached tokens and sessions. */
+    clearCache(): void;
     getApiKey(args: {
         company: string;
         type: ApiKeyType;
         ip: string;
         authorization: string;
     }): Promise<ApiKey>;
+    private signIn;
+    /**
+     * Servers before `POST /auth/verify` answer it with 404; for them the token
+     * goes into the path as before.
+     */
+    private fetchSession;
+    private tokenTtl;
+    private sessionTtl;
+    private tokenCacheKey;
+    private cacheKey;
+    private request;
 }

package/src/lib/customer-center.service.js

@@ -3,75 +3,163 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CustomerCenterService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
-const axios_1 = require("axios");
+const node_crypto_1 = require("node:crypto");
 const auth_constants_1 = require("./auth.constants");
 const axios_error_handler_1 = require("./utils/axios-error.handler");
+const http_client_1 = require("./utils/http-client");
+const jwt_util_1 = require("./utils/jwt.util");
+const ttl_cache_1 = require("./utils/ttl-cache");
+const url_path_1 = require("./utils/url-path");
+/** Cached tokens are renewed this long before they expire. */
+const TOKEN_REFRESH_MARGIN_MS = 5 * 60_000;
+/** Upper bound for caching a token, so a revoked user token stops working soon. */
+const TOKEN_MAX_CACHE_MS = 60 * 60_000;
+const TOKEN_CACHE_SIZE = 1_000;
+const SESSION_CACHE_SIZE = 10_000;
+/** How long to use the legacy verify endpoint after the server lacked `POST /auth/verify`. */
+const LEGACY_VERIFY_RECHECK_MS = 10 * 60_000;
+/** Visible ASCII only: the token goes into a header and, on old servers, into the path. */
+const TOKEN_PATTERN = /^[\x21-\x7e]+$/;
 let CustomerCenterService = class CustomerCenterService {
     options;
-    BASE_URL = 'https://admin.ah-oh.com';
+    http;
+    /** Cache keys are HMACs, so the heap holds neither token keys nor tokens as keys. */
+    cacheKeySecret = (0, node_crypto_1.randomBytes)(32);
+    tokenCache = new ttl_cache_1.TtlCache(TOKEN_CACHE_SIZE);
+    sessionCache = new ttl_cache_1.TtlCache(SESSION_CACHE_SIZE);
+    /** Until then `verifyInstanceToken` uses `GET /auth/verify/:token` directly. */
+    legacyVerifyUntil = 0;
     constructor(options) {
         this.options = options;
-        this.BASE_URL = this.options.baseUrl;
+        this.http = (0, http_client_1.createHttpClient)(options);
     }
+    /**
+     * Verifies a token and returns its session. The token travels in the
+     * `Authorization` header, not in the URL, so access logs do not record it.
+     * Concurrent calls with the same token share one request; with
+     * `sessionCacheTtlMs` the session is cached.
+     */
     async verifyInstanceToken(token) {
-        const options = {
-            method: 'GET',
-            baseURL: this.BASE_URL,
-            url: `/auth-api/auth/verify/${token}`,
-            headers: { accept: 'application/json' },
-        };
-        try {
-            const res = await axios_1.default.request(options);
-            return res.data;
-        }
-        catch (error) {
-            (0, axios_error_handler_1.handleAxiosError)(error);
+        if (typeof token !== 'string' || !TOKEN_PATTERN.test(token) || !(0, url_path_1.isValidPathSegment)(token)) {
+            throw new common_1.UnauthorizedException('Invalid authentication token');
         }
+        const { value } = await this.sessionCache.getOrLoad(this.cacheKey('session', token), async () => ({
+            value: await this.fetchSession(token),
+            ttlMs: this.sessionTtl(token),
+        }));
+        // Callers get their own copy, so changing one request's session leaves the others alone.
+        return structuredClone(value);
     }
     async sendCompanyRefreshTokenMail(id, expiresIn) {
-        const options = {
+        return this.request({
             method: 'GET',
-            baseURL: this.BASE_URL,
-            url: `/public/companies/${id}/${expiresIn}/mail`,
-            headers: { accept: 'application/json' },
-        };
-        try {
-            const res = await axios_1.default.request(options);
-            return res.data;
-        }
-        catch (error) {
-            (0, axios_error_handler_1.handleAxiosError)(error);
-        }
+            url: (0, url_path_1.urlPath) `/public/companies/${id}/${expiresIn}/mail`,
+        });
     }
+    /**
+     * Exchanges a user token for a JWT. Unless `tokenCache` is `false`, the JWT
+     * is reused for the same credentials until shortly before it expires.
+     */
     async tokenSignIn(dto) {
-        const options = {
-            method: 'POST',
-            baseURL: this.BASE_URL,
-            url: `/auth-api/token/auth/sign-in`,
-            headers: { accept: 'application/json' },
-            data: dto,
-        };
+        const { token } = await this.signIn(dto);
+        return { token };
+    }
+    /**
+     * Runs `call` with `Bearer <jwt>` for the credentials. If the server rejects
+     * a cached token with 401, the token is dropped and `call` runs once more
+     * with a new one.
+     */
+    async withToken(dto, call) {
+        const { token, fromCache } = await this.signIn(dto);
         try {
-            const res = await axios_1.default.request(options);
-            return res.data;
+            return await call(`Bearer ${token}`);
         }
         catch (error) {
-            (0, axios_error_handler_1.handleAxiosError)(error);
+            if (!fromCache || !(0, axios_error_handler_1.isUnauthorizedError)(error))
+                throw error;
+            this.tokenCache.delete(this.tokenCacheKey(dto), token);
+            const renewed = await this.signIn(dto);
+            return call(`Bearer ${renewed.token}`);
         }
     }
+    /** Drops all cached tokens and sessions. */
+    clearCache() {
+        this.tokenCache.clear();
+        this.sessionCache.clear();
+    }
     async getApiKey(args) {
-        const options = {
+        return this.request({
             method: 'GET',
-            baseURL: this.BASE_URL,
-            url: `/api-keys/${args.company}/${args.type}/with-key`,
+            url: (0, url_path_1.urlPath) `/api-keys/${args.company}/${args.type}/with-key`,
             headers: {
-                accept: 'application/json',
                 'x-real-ip': args.ip,
                 authorization: args.authorization,
             },
+        });
+    }
+    async signIn(dto) {
+        const load = async () => {
+            const { token } = await this.request({
+                method: 'POST',
+                url: '/auth-api/token/auth/sign-in',
+                data: { tokenId: dto.tokenId, tokenKey: dto.tokenKey, product: dto.product },
+            });
+            return { value: token, ttlMs: this.tokenTtl(token) };
         };
+        if (this.options.tokenCache === false) {
+            return { token: (await load()).value, fromCache: false };
+        }
+        const { value, fromCache } = await this.tokenCache.getOrLoad(this.tokenCacheKey(dto), load);
+        return { token: value, fromCache };
+    }
+    /**
+     * Servers before `POST /auth/verify` answer it with 404; for them the token
+     * goes into the path as before.
+     */
+    async fetchSession(token) {
+        if (Date.now() >= this.legacyVerifyUntil) {
+            try {
+                return await this.request({
+                    method: 'POST',
+                    url: '/auth-api/auth/verify',
+                    headers: { authorization: `Bearer ${token}` },
+                });
+            }
+            catch (error) {
+                if (!isMissingEndpoint(error))
+                    throw error;
+                this.legacyVerifyUntil = Date.now() + LEGACY_VERIFY_RECHECK_MS;
+            }
+        }
+        return this.request({
+            method: 'GET',
+            url: (0, url_path_1.urlPath) `/auth-api/auth/verify/${token}`,
+        });
+    }
+    tokenTtl(token) {
+        const expiresAt = (0, jwt_util_1.getJwtExpiresAt)(token);
+        if (expiresAt === undefined)
+            return 0;
+        return Math.min(expiresAt - Date.now() - TOKEN_REFRESH_MARGIN_MS, TOKEN_MAX_CACHE_MS);
+    }
+    sessionTtl(token) {
+        const ttl = this.options.sessionCacheTtlMs ?? 0;
+        if (ttl <= 0)
+            return 0;
+        const expiresAt = (0, jwt_util_1.getJwtExpiresAt)(token);
+        return expiresAt === undefined ? ttl : Math.min(ttl, expiresAt - Date.now());
+    }
+    tokenCacheKey(dto) {
+        return this.cacheKey('token', dto.tokenId, dto.tokenKey, dto.product);
+    }
+    cacheKey(...parts) {
+        return (0, node_crypto_1.createHmac)('sha256', this.cacheKeySecret)
+            .update(JSON.stringify(parts))
+            .digest('base64url');
+    }
+    async request(config) {
         try {
-            const res = await axios_1.default.request(options);
+            const res = await this.http.request(config);
             return res.data;
         }
         catch (error) {
@@ -85,4 +173,10 @@ exports.CustomerCenterService = CustomerCenterService = tslib_1.__decorate([
     tslib_1.__param(0, (0, common_1.Inject)(auth_constants_1.AUTH_MODULE_OPTIONS)),
     tslib_1.__metadata("design:paramtypes", [Object])
 ], CustomerCenterService);
+function isMissingEndpoint(error) {
+    if (!(error instanceof common_1.HttpException))
+        return false;
+    const status = error.getStatus();
+    return status === common_1.HttpStatus.NOT_FOUND || status === common_1.HttpStatus.METHOD_NOT_ALLOWED;
+}
 //# sourceMappingURL=customer-center.service.js.map

package/src/lib/customer-center.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"customer-center.service.js","sourceRoot":"","sources":["../../../../../libs/api-sdk/src/lib/customer-center.service.ts"],"names":[],"mappings":";;;;AAAA,2CAAoD;AACpD,iCAAkD;AAElD,qDAAuD;AAIvD,qEAA+D;AAGxD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAKb;IAJX,QAAQ,GAAG,yBAAyB,CAAC;IAE7C,YAEmB,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;QAE3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,EAAE,yBAAyB,KAAK,EAAE;YACrC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAK,CAAC,OAAO,CAAc,OAAO,CAAC,CAAC;YACtD,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sCAAgB,EAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,2BAA2B,CACtC,EAAU,EACV,SAAiB;QAEjB,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,EAAE,qBAAqB,EAAE,IAAI,SAAS,OAAO;YAChD,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAK,CAAC,OAAO,CAAoB,OAAO,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sCAAgB,EAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,GAIxB;QACC,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,EAAE,8BAA8B;YACnC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,IAAI,EAAE,GAAG;SACV,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAK,CAAC,OAAO,CAAoB,OAAO,CAAC,CAAC;YAC5D,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sCAAgB,EAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,IAKtB;QACC,MAAM,OAAO,GAAuB;YAClC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,GAAG,EAAE,aAAa,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,WAAW;YACtD,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,eAAK,CAAC,OAAO,CAAS,OAAO,CAAC,CAAC;YACjD,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sCAAgB,EAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF,CAAA;AAtFY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,mBAAA,IAAA,eAAM,EAAC,oCAAmB,CAAC,CAAA;;GAJnB,qBAAqB,CAsFjC"}
+{"version":3,"file":"customer-center.service.js","sourceRoot":"","sources":["../../../../../libs/api-sdk/src/lib/customer-center.service.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AAExB,6CAAsD;AAEtD,qDAAuD;AAIvD,qEAAoF;AACpF,qDAAuD;AACvD,+CAAmD;AACnD,iDAA6C;AAC7C,+CAA+D;AAQ/D,8DAA8D;AAC9D,MAAM,uBAAuB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC3C,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AAC7C,2FAA2F;AAC3F,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAGhC,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAWb;IAVF,IAAI,CAAgB;IACrC,qFAAqF;IACpE,cAAc,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IACjC,UAAU,GAAG,IAAI,oBAAQ,CAAS,gBAAgB,CAAC,CAAC;IACpD,YAAY,GAAG,IAAI,oBAAQ,CAAc,kBAAkB,CAAC,CAAC;IAC9E,gFAAgF;IACxE,iBAAiB,GAAG,CAAC,CAAC;IAE9B,YAEmB,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;QAE3C,IAAI,CAAC,IAAI,GAAG,IAAA,8BAAgB,EAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAA,6BAAkB,EAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,EAC/B,KAAK,IAAI,EAAE,CAAC,CAAC;YACX,KAAK,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;SAC9B,CAAC,CACH,CAAC;QACF,yFAAyF;QACzF,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,2BAA2B,CACtC,EAAU,EACV,SAAiB;QAEjB,OAAO,IAAI,CAAC,OAAO,CAAoB;YACrC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAA,kBAAO,EAAA,qBAAqB,EAAE,IAAI,SAAS,OAAO;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,WAAW,CAAC,GAAmB;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,SAAS,CACpB,GAAmB,EACnB,IAA2C;QAE3C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,IAAI,CAAC,IAAA,yCAAmB,EAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC,UAAU,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4CAA4C;IACrC,UAAU;QACf,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,IAKtB;QACC,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAA,kBAAO,EAAA,aAAa,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,WAAW;YAC7D,OAAO,EAAE;gBACP,WAAW,EAAE,IAAI,CAAC,EAAE;gBACpB,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAmB;QACtC,MAAM,IAAI,GAAG,KAAK,IAA+C,EAAE;YACjE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB;gBACtD,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,8BAA8B;gBACnC,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;aAC7E,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,CAAC,CAAC;QAEF,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,KAAa;QACtC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAc;oBACrC,MAAM,EAAE,MAAM;oBACd,GAAG,EAAE,uBAAuB;oBAC5B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3C,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAc;YAC/B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,IAAA,kBAAO,EAAA,yBAAyB,KAAK,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,MAAM,SAAS,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IACxF,CAAC;IAEO,UAAU,CAAC,KAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAChD,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACzC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAEO,aAAa,CAAC,GAAmB;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACxE,CAAC;IAEO,QAAQ,CAAC,GAAG,KAAe;QACjC,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC;aAC7C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;aAC7B,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAA0B;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAI,MAAM,CAAC,CAAC;YAC/C,OAAO,GAAG,CAAC,IAAI,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,sCAAgB,EAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF,CAAA;AAzKY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAWR,mBAAA,IAAA,eAAM,EAAC,oCAAmB,CAAC,CAAA;;GAVnB,qBAAqB,CAyKjC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,CAAC,KAAK,YAAY,sBAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACjC,OAAO,MAAM,KAAK,mBAAU,CAAC,SAAS,IAAI,MAAM,KAAK,mBAAU,CAAC,kBAAkB,CAAC;AACrF,CAAC"}

package/src/lib/guards/auth.guard.js

@@ -12,10 +12,9 @@ let AuthGuard = class AuthGuard {
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
-        let token = request.headers.dev ??
-            request.cookies['jwt'] ??
-            request.headers.authorization;
-        token = token?.replace('Bearer ', '');
+        // `cookies` only exists with the cookie-parser middleware.
+        const raw = request.headers.dev ?? request.cookies?.['jwt'] ?? request.headers.authorization;
+        const token = typeof raw === 'string' ? raw.replace(/^Bearer\s+/i, '').trim() : undefined;
         if (!token?.length) {
             throw new common_1.UnauthorizedException('No authentication token provided');
         }

package/src/lib/guards/auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AAExB,gDAA4C;AAC5C,wEAAmE;AAG5D,IAAM,SAAS,GAAf,MAAM,SAAS;IAGG;IAFrB,YAEqB,qBAA4C;QAA5C,0BAAqB,GAArB,qBAAqB,CAAuB;IAC9D,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,IAAI,KAAK,GACL,OAAO,CAAC,OAAO,CAAC,GAAG;YACnB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YACtB,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAElC,KAAK,GAAG,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAEtC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAClE,KAAK,CACR,CAAC;QAEF,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA1BY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGJ,mBAAA,IAAA,eAAM,EAAC,wBAAU,CAAC,CAAA;6CACqB,+CAAqB;GAHxD,SAAS,CA0BrB"}
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AAExB,gDAA4C;AAC5C,wEAAmE;AAG5D,IAAM,SAAS,GAAf,MAAM,SAAS;IAGD;IAFnB,YAEmB,qBAA4C;QAA5C,0BAAqB,GAArB,qBAAqB,CAAuB;IAC5D,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,2DAA2D;QAC3D,MAAM,GAAG,GACP,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACnF,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1F,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE9E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAtBY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGR,mBAAA,IAAA,eAAM,EAAC,wBAAU,CAAC,CAAA;6CACqB,+CAAqB;GAHpD,SAAS,CAsBrB"}

package/src/lib/guards/company.guard.js

@@ -9,6 +9,9 @@ let CompanyGuard = class CompanyGuard {
         const request = context.switchToHttp().getRequest();
         const companyId = request.params.companyId;
         const session = request.session;
+        if (!session) {
+            throw new common_1.UnauthorizedException('No session; use AuthGuard first');
+        }
         if (user_session_model_1.AllAccessRoles.includes(session.role) ||
             (companyId && session.enabledCompanies?.includes(companyId))) {
             return true;

package/src/lib/guards/company.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"company.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/company.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AAExB,qEAA2E;AAGpE,IAAM,YAAY,GAAlB,MAAM,YAAY;IACrB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3C,MAAM,OAAO,GAAgB,OAAO,CAAC,OAAO,CAAC;QAC7C,IACI,mCAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YACrC,CAAC,SAAS,IAAI,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;YACC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;CACJ,CAAA;AAfY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAexB"}
+{"version":3,"file":"company.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/company.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAOwB;AAExB,qEAA2E;AAGpE,IAAM,YAAY,GAAlB,MAAM,YAAY;IACvB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC3C,MAAM,OAAO,GAA4B,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,IACE,mCAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YACrC,CAAC,SAAS,IAAI,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;CACF,CAAA;AAlBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAkBxB"}

package/src/lib/guards/sethub-permissions.guard.js

@@ -16,11 +16,14 @@ let SetHubPermissionsGuard = class SetHubPermissionsGuard {
             return true;
         }
         const request = context.switchToHttp().getRequest();
+        if (!request.session) {
+            throw new common_1.UnauthorizedException('No session; use AuthGuard first');
+        }
         const { setHubPermission, product, role } = request.session;
         if (user_session_model_1.AllAccessRoles.includes(role) ||
             (setHubPermission &&
                 product === user_session_model_1.Product.SETHUB &&
-                permissions.every((p) => setHubPermission[p] === true))) {
+                permissions.every(p => setHubPermission[p] === true))) {
             return true;
         }
         throw new common_1.HttpException('Missing permission', common_1.HttpStatus.UNAUTHORIZED);

package/src/lib/guards/sethub-permissions.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"sethub-permissions.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/sethub-permissions.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AACxB,uCAAyC;AAGzC,qEAAuE;AAGhE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACX;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,WAAW,CAAC,OAAyB;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAClC,aAAa,EACb,OAAO,CAAC,UAAU,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAE5D,IACI,mCAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,CAAC,gBAAgB;gBACb,OAAO,KAAK,4BAAO,CAAC,MAAM;gBAC1B,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAC7D,CAAC;YACC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;CACJ,CAAA;AAzBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;6CAEsB,gBAAS;GAD/B,sBAAsB,CAyBlC"}
+{"version":3,"file":"sethub-permissions.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/sethub-permissions.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAOwB;AACxB,uCAAyC;AAGzC,qEAAuE;AAGhE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACb;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqB,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QAE5D,IACE,mCAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;YAC7B,CAAC,gBAAgB;gBACf,OAAO,KAAK,4BAAO,CAAC,MAAM;gBAC1B,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EACvD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AAzBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;6CAEoB,gBAAS;GAD7B,sBAAsB,CAyBlC"}

package/src/lib/guards/super-admin.guard.js

@@ -8,6 +8,9 @@ let SuperAdminGuard = class SuperAdminGuard {
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
         const session = request.session;
+        if (!session) {
+            throw new common_1.UnauthorizedException('No session; use AuthGuard first');
+        }
         if (user_session_model_1.AllAccessRoles.includes(session.role)) {
             return true;
         }

package/src/lib/guards/super-admin.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"super-admin.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/super-admin.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAMwB;AAExB,qEAA2E;AAGpE,IAAM,eAAe,GAArB,MAAM,eAAe;IACxB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACvC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,OAAO,GAAgB,OAAO,CAAC,OAAO,CAAC;QAC7C,IAAI,mCAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;CACJ,CAAA;AAXY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CAW3B"}
+{"version":3,"file":"super-admin.guard.js","sourceRoot":"","sources":["../../../../../../libs/api-sdk/src/lib/guards/super-admin.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAOwB;AAExB,qEAA2E;AAGpE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,OAAO,GAA4B,OAAO,CAAC,OAAO,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,mCAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,sBAAa,CAAC,oBAAoB,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;CACF,CAAA;AAdY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CAc3B"}