@ahksolution/permissions-sdk 1.0.0 → 1.1.0

package/README.md

@@ -1,6 +1,9 @@
 # @ahksolution/permissions-sdk
 
-gRPC client SDK for the AHK Solution Permissions Microservice. Provides NestJS integration for inter-service permission checks with RBAC and ABAC support.
+gRPC client SDK for the AHK Solution Permissions Microservice. Provides NestJS integration for:
+
+- **JWT Authentication** - Validate tokens via gRPC (no JWT secret needed in consuming services)
+- **Permission Checks** - RBAC and ABAC support via gRPC
 
 ## Installation
 
@@ -61,105 +64,206 @@ import { PermissionsClientModule } from '@ahksolution/permissions-sdk';
 export class AppModule {}
 ```
 
-### 2. Use the Client Service
+### 2. Apply Guards Globally (Recommended)
 
-Inject `PermissionsGrpcClient` to check permissions programmatically:
+For full authentication and authorization, apply both guards globally:
 
 ```typescript
-import { Injectable } from '@nestjs/common';
-import { PermissionsGrpcClient } from '@ahksolution/permissions-sdk';
+// app.module.ts
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import {
+  PermissionsClientModule,
+  JwtAuthGuard,
+  PermissionsGuard,
+} from '@ahksolution/permissions-sdk';
 
-@Injectable()
-export class OrderService {
-  constructor(private readonly permissions: PermissionsGrpcClient) {}
+@Module({
+  imports: [PermissionsClientModule.register({ url: 'localhost:50051' })],
+  providers: [
+    // Order matters: authentication first, then authorization
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
+    { provide: APP_GUARD, useClass: PermissionsGuard },
+  ],
+})
+export class AppModule {}
+```
 
-  async createOrder(userId: string, orderData: CreateOrderDto) {
-    // Simple boolean check
-    const canCreate = await this.permissions.hasPermission(userId, 'orders:create');
-    if (!canCreate) {
-      throw new ForbiddenException('You do not have permission to create orders');
-    }
+### 3. Use Decorators in Controllers
 
-    // Continue with order creation...
+```typescript
+import { Controller, Get, Post, Body } from '@nestjs/common';
+import { Public, CurrentUser, RequirePermissions, JwtUserData } from '@ahksolution/permissions-sdk';
+
+@Controller('orders')
+export class OrdersController {
+  // Public route - bypasses JWT authentication
+  @Public()
+  @Get('health')
+  health() {
+    return { status: 'ok' };
   }
 
-  async deleteOrder(userId: string, orderId: string) {
-    // Check multiple permissions (user needs ANY of these)
-    const canDelete = await this.permissions.hasAnyPermission(userId, [
-      'orders:delete',
-      'orders:manage',
-      'admin:full',
-    ]);
+  // Authenticated route - no specific permission required
+  @Get('me')
+  getProfile(@CurrentUser() user: JwtUserData) {
+    return {
+      id: user.id,
+      email: user.email,
+      roles: user.roles,
+    };
+  }
 
-    if (!canDelete) {
-      throw new ForbiddenException('You do not have permission to delete orders');
-    }
+  // Authenticated + requires specific permission
+  @Post()
+  @RequirePermissions('orders:create')
+  createOrder(@CurrentUser() user: JwtUserData, @Body() dto: CreateOrderDto) {
+    return this.orderService.create(user.id, dto);
+  }
 
-    // Continue with deletion...
+  // Get specific user property
+  @Get('my-orders')
+  @RequirePermissions('orders:read')
+  getMyOrders(@CurrentUser('id') userId: string) {
+    return this.orderService.findByUser(userId);
   }
 }
 ```
 
-### 3. Use Guard and Decorator (Recommended)
+## JWT Authentication
+
+The SDK provides JWT authentication that validates tokens via gRPC call to the permissions service. **No JWT secret is required in consuming services** - all validation happens centrally.
+
+### How It Works
 
-For declarative permission checks on controller routes:
+1. `JwtAuthGuard` extracts the token from `Authorization: Bearer <token>` header
+2. Calls `ValidateToken` gRPC method on the permissions service
+3. Permissions service verifies the token and returns user data
+4. User data (with roles and permissions) is attached to `request.user`
+
+### JwtUserData Type
+
+```typescript
+interface JwtUserData {
+  id: string;
+  email: string | null;
+  phone: string | null;
+  userType: string;
+  status: string;
+  isProfileComplete: boolean;
+  roles: RoleInfo[]; // User's roles
+  permissions: string[]; // User's permission codes
+  hasAllAccess: boolean; // True if user has wildcard access
+}
+
+interface RoleInfo {
+  id: string;
+  code: string;
+  name: string;
+  isSystem: boolean;
+}
+```
+
+### Decorators
+
+| Decorator            | Description                                      |
+| -------------------- | ------------------------------------------------ |
+| `@Public()`          | Mark route as public (bypass JWT authentication) |
+| `@CurrentUser()`     | Get full user object from request                |
+| `@CurrentUser('id')` | Get specific property from user                  |
+
+## Permission Checking
+
+### Using Decorators (Recommended)
 
 ```typescript
-import { Controller, Post, Delete, Param, Body, UseGuards } from '@nestjs/common';
 import {
-  PermissionsGuard,
   RequirePermissions,
   RequireAnyPermission,
   RequireAllPermissions,
 } from '@ahksolution/permissions-sdk';
-import { JwtAuthGuard } from './your-auth-guard';
 
 @Controller('orders')
-@UseGuards(JwtAuthGuard, PermissionsGuard) // Auth guard must run first
 export class OrdersController {
   // Require a single permission
   @Post()
   @RequirePermissions('orders:create')
-  async createOrder(@Body() dto: CreateOrderDto) {
-    // Permission already verified by guard
-    return this.orderService.create(dto);
-  }
+  create() {}
 
-  // Require ALL permissions (AND logic)
+  // Require ALL permissions (AND logic) - default behavior
   @Post(':id/approve')
   @RequirePermissions(['orders:read', 'orders:approve'])
-  async approveOrder(@Param('id') id: string) {
-    return this.orderService.approve(id);
-  }
+  approve() {}
 
   // Require ANY of the permissions (OR logic)
   @Delete(':id')
   @RequirePermissions(['orders:delete', 'admin:full'], { mode: 'any' })
-  async deleteOrder(@Param('id') id: string) {
-    return this.orderService.delete(id);
-  }
+  delete() {}
 
   // Using alias decorators for clarity
   @Post(':id/export')
   @RequireAllPermissions(['orders:read', 'orders:export'])
-  async exportOrder(@Param('id') id: string) {
-    return this.orderService.export(id);
-  }
+  export() {}
 
   @Post(':id/cancel')
   @RequireAnyPermission(['orders:cancel', 'orders:manage'])
-  async cancelOrder(@Param('id') id: string) {
-    return this.orderService.cancel(id);
+  cancel() {}
+}
+```
+
+### Using the Client Service
+
+Inject `PermissionsGrpcClient` to check permissions programmatically:
+
+```typescript
+import { Injectable } from '@nestjs/common';
+import { PermissionsGrpcClient } from '@ahksolution/permissions-sdk';
+
+@Injectable()
+export class OrderService {
+  constructor(private readonly permissions: PermissionsGrpcClient) {}
+
+  async createOrder(userId: string, orderData: CreateOrderDto) {
+    // Simple boolean check
+    const canCreate = await this.permissions.hasPermission(userId, 'orders:create');
+    if (!canCreate) {
+      throw new ForbiddenException('You do not have permission to create orders');
+    }
+
+    // Continue with order creation...
+  }
+
+  async deleteOrder(userId: string, orderId: string) {
+    // Check multiple permissions (user needs ANY of these)
+    const canDelete = await this.permissions.hasAnyPermission(userId, [
+      'orders:delete',
+      'orders:manage',
+      'admin:full',
+    ]);
+
+    if (!canDelete) {
+      throw new ForbiddenException('You do not have permission to delete orders');
+    }
+
+    // Continue with deletion...
   }
 }
 ```
 
 ## API Reference
 
+### Guards
+
+| Guard              | Description                                                  |
+| ------------------ | ------------------------------------------------------------ |
+| `JwtAuthGuard`     | Validates JWT tokens via gRPC. Attaches user to request.     |
+| `PermissionsGuard` | Checks permissions based on `@RequirePermissions` decorator. |
+
 ### PermissionsGrpcClient
 
 | Method                                                    | Description                                         |
 | --------------------------------------------------------- | --------------------------------------------------- |
+| `validateToken(token)`                                    | Validates JWT and returns `ValidateTokenResult`     |
 | `hasPermission(userId, permissionCode)`                   | Returns `boolean` - does user have this permission? |
 | `hasAllPermissions(userId, permissionCodes)`              | Returns `boolean` - does user have ALL permissions? |
 | `hasAnyPermission(userId, permissionCodes)`               | Returns `boolean` - does user have ANY permission?  |
@@ -171,6 +275,9 @@ export class OrdersController {
 
 | Decorator                                    | Description                                  |
 | -------------------------------------------- | -------------------------------------------- |
+| `@Public()`                                  | Mark route as public (bypass JWT auth)       |
+| `@CurrentUser()`                             | Get authenticated user from request          |
+| `@CurrentUser('property')`                   | Get specific property from user              |
 | `@RequirePermissions(permissions, options?)` | Require permission(s) with configurable mode |
 | `@RequireAllPermissions(permissions)`        | Shorthand for mode: 'all'                    |
 | `@RequireAnyPermission(permissions)`         | Shorthand for mode: 'any'                    |
@@ -268,22 +375,92 @@ throw new ForbiddenException('Access denied. Required permission(s): orders:crea
 })
 ```
 
-## Request Requirements
-
-The `PermissionsGuard` expects the request to have a `user` object with an `id` property (typically set by your JWT auth guard):
+## Complete Example
 
 ```typescript
-interface Request {
-  user: {
-    id: string; // Required - the user ID to check permissions for
-    // ... other properties
-  };
+// app.module.ts
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import {
+  PermissionsClientModule,
+  JwtAuthGuard,
+  PermissionsGuard,
+} from '@ahksolution/permissions-sdk';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot(),
+    PermissionsClientModule.registerAsync({
+      imports: [ConfigModule],
+      useFactory: (config: ConfigService) => ({
+        url: config.get('PERMISSIONS_SERVICE_URL', 'localhost:50051'),
+      }),
+      inject: [ConfigService],
+    }),
+  ],
+  providers: [
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
+    { provide: APP_GUARD, useClass: PermissionsGuard },
+  ],
+})
+export class AppModule {}
+
+// users.controller.ts
+import { Controller, Get, Post, Body, Param } from '@nestjs/common';
+import {
+  Public,
+  CurrentUser,
+  RequirePermissions,
+  RequireAnyPermission,
+  JwtUserData,
+} from '@ahksolution/permissions-sdk';
+
+@Controller('users')
+export class UsersController {
+  // Public endpoint - no auth required
+  @Public()
+  @Get('health')
+  health() {
+    return { status: 'ok' };
+  }
+
+  // Auth required, no specific permission
+  @Get('profile')
+  getProfile(@CurrentUser() user: JwtUserData) {
+    return user;
+  }
+
+  // Auth + specific permission required
+  @Get()
+  @RequirePermissions('users:list')
+  findAll() {
+    return this.userService.findAll();
+  }
+
+  @Post()
+  @RequirePermissions('users:create')
+  create(@Body() dto: CreateUserDto, @CurrentUser('id') createdBy: string) {
+    return this.userService.create(dto, createdBy);
+  }
+
+  @Get(':id')
+  @RequireAnyPermission(['users:read', 'users:manage'])
+  findOne(@Param('id') id: string) {
+    return this.userService.findOne(id);
+  }
 }
 ```
 
-## Important Note
+## Important Notes
+
+1. **No JWT Secret Required**: The SDK validates tokens via gRPC call to the permissions service. You don't need to configure JWT secrets in consuming services.
+
+2. **Guard Order Matters**: When using both guards globally, `JwtAuthGuard` must run before `PermissionsGuard` (authentication before authorization).
+
+3. **Permissions Service Required**: This SDK is a client for the AHK Solution Permissions Microservice. It will not function without a running instance exposing a gRPC endpoint.
 
-This SDK is a client for the AHK Solution Permissions Microservice. It will not function without a running instance of the permissions service exposing a gRPC endpoint. The SDK only provides the client-side integration.
+4. **Same-Pod Deployment**: For optimal performance, deploy consuming services in the same pod/network as the permissions service to minimize gRPC latency.
 
 ## License
 

package/dist/client/permissions-grpc.client.d.ts

@@ -1,6 +1,6 @@
 import { OnModuleInit } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
-import type { BulkPermissionResultRecord, EffectivePermissions, EvaluationResult, RequestContext, ResourceContext } from '../types';
+import type { BulkPermissionResultRecord, EffectivePermissions, EvaluationResult, RequestContext, ResourceContext, ValidateTokenResult } from '../types';
 /**
  * gRPC client for the Permissions Service
  * Provides methods to check permissions via gRPC calls to the permissions microservice
@@ -41,5 +41,14 @@ export declare class PermissionsGrpcClient implements OnModuleInit {
      * Check if user has ANY of the specified permissions
      */
     hasAnyPermission(userId: string, permissionCodes: string[]): Promise<boolean>;
+    /**
+     * Validate a JWT token via gRPC and return user data
+     * Used by JwtAuthGuard to authenticate requests
+     */
+    validateToken(token: string): Promise<ValidateTokenResult>;
+    /**
+     * Maps gRPC user data to JwtUserData type
+     */
+    private mapToJwtUserData;
 }
 //# sourceMappingURL=permissions-grpc.client.d.ts.map

package/dist/client/permissions-grpc.client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-grpc.client.d.ts","sourceRoot":"","sources":["../../src/client/permissions-grpc.client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAInD,OAAO,KAAK,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EAChB,MAAM,UAAU,CAAC;AAkGlB;;;GAGG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,kBAAkB,CAA0B;gBAIjC,MAAM,EAAE,UAAU;IAGrC,YAAY,IAAI,IAAI;IAMpB;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B,GACA,OAAO,CAAC,gBAAgB,CAAC;IAY5B;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC;IAmBtC;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB5E;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7E;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpF;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAMpF"}
+{"version":3,"file":"permissions-grpc.client.d.ts","sourceRoot":"","sources":["../../src/client/permissions-grpc.client.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAInD,OAAO,KAAK,EACV,0BAA0B,EAC1B,oBAAoB,EACpB,gBAAgB,EAGhB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,UAAU,CAAC;AAmGlB;;;GAGG;AACH,qBACa,qBAAsB,YAAW,YAAY;IAMtD,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,kBAAkB,CAA0B;gBAIjC,MAAM,EAAE,UAAU;IAGrC,YAAY,IAAI,IAAI;IAMpB;;OAEG;IACG,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B,GACA,OAAO,CAAC,gBAAgB,CAAC;IAY5B;;OAEG;IACG,oBAAoB,CACxB,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzB,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B,GACA,OAAO,CAAC,0BAA0B,CAAC;IAmBtC;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiB5E;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO7E;;OAEG;IACG,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpF;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOnF;;;OAGG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAiBhE;;OAEG;IACH,OAAO,CAAC,gBAAgB;CAsBzB"}

package/dist/client/permissions-grpc.client.js

@@ -172,6 +172,48 @@ let PermissionsGrpcClient = PermissionsGrpcClient_1 = class PermissionsGrpcClien
         const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.hasAnyPermission({ userId, permissionCodes }));
         return response.hasPermission;
     }
+    /**
+     * Validate a JWT token via gRPC and return user data
+     * Used by JwtAuthGuard to authenticate requests
+     */
+    async validateToken(token) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.validateToken({ token }));
+        if (!response.valid) {
+            return {
+                valid: false,
+                errorCode: response.errorCode,
+                errorMessage: response.errorMessage,
+            };
+        }
+        return {
+            valid: true,
+            user: this.mapToJwtUserData(response.user),
+        };
+    }
+    /**
+     * Maps gRPC user data to JwtUserData type
+     */
+    mapToJwtUserData(userData) {
+        if (userData === undefined) {
+            return undefined;
+        }
+        return {
+            id: userData.id,
+            email: userData.email !== '' ? userData.email : null,
+            phone: userData.phone !== '' ? userData.phone : null,
+            userType: userData.userType,
+            status: userData.status,
+            isProfileComplete: userData.isProfileComplete,
+            roles: userData.roles.map((role) => ({
+                id: role.id,
+                code: role.code,
+                name: role.name,
+                isSystem: role.isSystem,
+            })),
+            permissions: userData.permissions,
+            hasAllAccess: userData.hasAllAccess,
+        };
+    }
 };
 exports.PermissionsGrpcClient = PermissionsGrpcClient;
 exports.PermissionsGrpcClient = PermissionsGrpcClient = PermissionsGrpcClient_1 = __decorate([

package/dist/client/permissions-grpc.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-grpc.client.js","sourceRoot":"","sources":["../../src/client/permissions-grpc.client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA0E;AAE1E,+BAAsC;AAEtC,4CAAiF;AAgBjF;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAA4B;IACvD,MAAM,SAAS,GAAmD;QAChE,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE,QAAQ;KACZ,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAiC;IAC3D,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAyB;IAStD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI;QACJ,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAwB;IASpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,SAAS;QACT,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAMb;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,CAA0B;IAEpD,YAEmB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,kBAAkB;YACrB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAyB,oCAAwB,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,cAAsB,EACtB,OAGC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC;YACtC,MAAM;YACN,cAAc;YACd,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,eAAyB,EACzB,OAGC;QAED,MAAM,QAAQ,GAAiC,MAAM,IAAA,qBAAc,EACjE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC;YAC3C,MAAM;YACN,eAAe;YACf,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAC5D,CAAC;QACF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,cAAsB;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,eAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACvE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,eAAyB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACtE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;CACF,CAAA;AAnHY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GALvB,qBAAqB,CAmHjC"}
+{"version":3,"file":"permissions-grpc.client.js","sourceRoot":"","sources":["../../src/client/permissions-grpc.client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA0E;AAE1E,+BAAsC;AAEtC,4CAAiF;AAmBjF;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAA4B;IACvD,MAAM,SAAS,GAAmD;QAChE,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE,QAAQ;KACZ,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAiC;IAC3D,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAyB;IAStD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI;QACJ,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAwB;IASpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,SAAS;QACT,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAMb;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,CAA0B;IAEpD,YAEmB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,kBAAkB;YACrB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAyB,oCAAwB,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,cAAsB,EACtB,OAGC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC;YACtC,MAAM;YACN,cAAc;YACd,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,eAAyB,EACzB,OAGC;QAED,MAAM,QAAQ,GAAiC,MAAM,IAAA,qBAAc,EACjE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC;YAC3C,MAAM;YACN,eAAe;YACf,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAC5D,CAAC;QACF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,cAAsB;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,eAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACvE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,eAAyB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACtE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EAAC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAExF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;SAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,QAAuB;QAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;YACpD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;SACpC,CAAC;IACJ,CAAC;CACF,CAAA;AAlKY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GALvB,qBAAqB,CAkKjC"}

package/dist/decorators/current-user.decorator.d.ts

@@ -0,0 +1,24 @@
+import type { JwtUserData } from '../types/jwt.types';
+/**
+ * Get the current authenticated user from the request
+ *
+ * @example
+ * ```typescript
+ * // Get full user object
+ * @Get('profile')
+ * getProfile(@CurrentUser() user: JwtUserData) {
+ *   return user;
+ * }
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Get specific property
+ * @Get('my-id')
+ * getMyId(@CurrentUser('id') userId: string) {
+ *   return { userId };
+ * }
+ * ```
+ */
+export declare const CurrentUser: (...dataOrPipes: (keyof JwtUserData | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
+//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/decorators/current-user.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/current-user.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,WAAW,gNAMvB,CAAC"}

package/dist/decorators/current-user.decorator.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Get the current authenticated user from the request
+ *
+ * @example
+ * ```typescript
+ * // Get full user object
+ * @Get('profile')
+ * getProfile(@CurrentUser() user: JwtUserData) {
+ *   return user;
+ * }
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Get specific property
+ * @Get('my-id')
+ * getMyId(@CurrentUser('id') userId: string) {
+ *   return { userId };
+ * }
+ * ```
+ */
+exports.CurrentUser = (0, common_1.createParamDecorator)((data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    const { user } = request;
+    return data !== undefined ? user?.[data] : user;
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../src/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6E;AAI7E;;;;;;;;;;;;;;;;;;;;GAoBG;AACU,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,IAAmC,EAAE,GAAqB,EAAE,EAAE;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAA0B,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC,CACF,CAAC"}

package/dist/decorators/index.d.ts

@@ -1,2 +1,4 @@
+export * from './current-user.decorator';
+export * from './public.decorator';
 export * from './require-permissions.decorator';
 //# sourceMappingURL=index.d.ts.map

package/dist/decorators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iCAAiC,CAAC"}

package/dist/decorators/index.js

@@ -14,5 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./current-user.decorator"), exports);
+__exportStar(require("./public.decorator"), exports);
 __exportStar(require("./require-permissions.decorator"), exports);
 //# sourceMappingURL=index.js.map

package/dist/decorators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kEAAgD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,qDAAmC;AACnC,kEAAgD"}

package/dist/decorators/public.decorator.d.ts

@@ -0,0 +1,22 @@
+import { SetMetadata } from '@nestjs/common';
+/**
+ * Metadata key for public routes
+ */
+export declare const IS_PUBLIC_KEY = "permissions-sdk:isPublic";
+/**
+ * Mark a route as public (bypass JWT authentication)
+ *
+ * @example
+ * ```typescript
+ * @Controller('health')
+ * export class HealthController {
+ *   @Public()
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
+ * ```
+ */
+export declare const Public: () => ReturnType<typeof SetMetadata>;
+//# sourceMappingURL=public.decorator.d.ts.map

package/dist/decorators/public.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/public.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,aAAa,6BAA6B,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,QAAO,UAAU,CAAC,OAAO,WAAW,CAAqC,CAAC"}

package/dist/decorators/public.decorator.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Metadata key for public routes
+ */
+exports.IS_PUBLIC_KEY = 'permissions-sdk:isPublic';
+/**
+ * Mark a route as public (bypass JWT authentication)
+ *
+ * @example
+ * ```typescript
+ * @Controller('health')
+ * export class HealthController {
+ *   @Public()
+ *   @Get()
+ *   check() {
+ *     return { status: 'ok' };
+ *   }
+ * }
+ * ```
+ */
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;
+//# sourceMappingURL=public.decorator.js.map

package/dist/decorators/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../src/decorators/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C;;GAEG;AACU,QAAA,aAAa,GAAG,0BAA0B,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACI,MAAM,MAAM,GAAG,GAAmC,EAAE,CAAC,IAAA,oBAAW,EAAC,qBAAa,EAAE,IAAI,CAAC,CAAC;AAAhF,QAAA,MAAM,UAA0E"}

package/dist/guards/index.d.ts

@@ -1,2 +1,3 @@
+export * from './jwt-auth.guard';
 export * from './permissions.guard';
 //# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/dist/guards/index.js

@@ -14,5 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jwt-auth.guard"), exports);
 __exportStar(require("./permissions.guard"), exports);
 //# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,sDAAoC"}

package/dist/guards/jwt-auth.guard.d.ts

@@ -0,0 +1,39 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PermissionsGrpcClient } from '../client/permissions-grpc.client';
+/**
+ * JWT Authentication Guard
+ *
+ * Validates JWT tokens via gRPC call to the permissions service.
+ * This guard extracts the token from the Authorization header,
+ * validates it via gRPC, and attaches the user data to the request.
+ *
+ * @example
+ * ```typescript
+ * // Apply globally in app.module.ts
+ * @Module({
+ *   imports: [PermissionsClientModule.register({ url: 'localhost:50051' })],
+ *   providers: [
+ *     { provide: APP_GUARD, useClass: JwtAuthGuard },
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Or apply to specific routes
+ * @Controller('orders')
+ * @UseGuards(JwtAuthGuard)
+ * export class OrdersController {}
+ * ```
+ */
+export declare class JwtAuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly permissionsClient;
+    private readonly logger;
+    constructor(reflector: Reflector, permissionsClient: PermissionsGrpcClient);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private extractTokenFromHeader;
+}
+//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/guards/jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../src/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAG1E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,YAAa,YAAW,WAAW;IAI5C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;gBAGrC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,qBAAqB;IAGrD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmC9D,OAAO,CAAC,sBAAsB;CAW/B"}

package/dist/guards/jwt-auth.guard.js

@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var JwtAuthGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const permissions_grpc_client_1 = require("../client/permissions-grpc.client");
+const public_decorator_1 = require("../decorators/public.decorator");
+/**
+ * JWT Authentication Guard
+ *
+ * Validates JWT tokens via gRPC call to the permissions service.
+ * This guard extracts the token from the Authorization header,
+ * validates it via gRPC, and attaches the user data to the request.
+ *
+ * @example
+ * ```typescript
+ * // Apply globally in app.module.ts
+ * @Module({
+ *   imports: [PermissionsClientModule.register({ url: 'localhost:50051' })],
+ *   providers: [
+ *     { provide: APP_GUARD, useClass: JwtAuthGuard },
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Or apply to specific routes
+ * @Controller('orders')
+ * @UseGuards(JwtAuthGuard)
+ * export class OrdersController {}
+ * ```
+ */
+let JwtAuthGuard = JwtAuthGuard_1 = class JwtAuthGuard {
+    reflector;
+    permissionsClient;
+    logger = new common_1.Logger(JwtAuthGuard_1.name);
+    constructor(reflector, permissionsClient) {
+        this.reflector = reflector;
+        this.permissionsClient = permissionsClient;
+    }
+    async canActivate(context) {
+        // Check if route is marked as public
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractTokenFromHeader(request);
+        if (token === undefined) {
+            throw new common_1.UnauthorizedException('No token provided');
+        }
+        // Validate token via gRPC call to permissions service
+        const result = await this.permissionsClient.validateToken(token);
+        if (!result.valid) {
+            this.logger.debug(`Token validation failed: ${result.errorCode ?? 'UNKNOWN'}`);
+            throw new common_1.UnauthorizedException(result.errorMessage ?? 'Invalid token');
+        }
+        // Attach user to request
+        request.user = result.user;
+        return true;
+    }
+    extractTokenFromHeader(request) {
+        const authHeader = request.headers.authorization;
+        if (authHeader === undefined) {
+            return undefined;
+        }
+        const [type, token] = authHeader.split(' ');
+        return type === 'Bearer' ? token : undefined;
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = JwtAuthGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        permissions_grpc_client_1.PermissionsGrpcClient])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../src/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AAEzC,+EAA0E;AAC1E,qEAA+D;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIJ;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,YACmB,SAAoB,EACpB,iBAAwC;QADxC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAuB;IACxD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,qCAAqC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAG7C,CAAC;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,sDAAsD;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,8BAAqB,CAAC,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC;QAC1E,CAAC;QAED,yBAAyB;QACzB,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAE3B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,OAE9B;QACC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAtDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAKmB,gBAAS;QACD,+CAAqB;GALhD,YAAY,CAsDxB"}

package/dist/guards/permissions.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.guard.d.ts","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AA0B1E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gBAAiB,YAAW,WAAW;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,qBAAqB;IAGrD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C9D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAO9B;;OAEG;YACW,mBAAmB;IAuBjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAO7B"}
+{"version":3,"file":"permissions.guard.d.ts","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AA0B1E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gBAAiB,YAAW,WAAW;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,qBAAqB;IAGrD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C9D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAO9B;;OAEG;YACW,mBAAmB;IAuBjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAQ7B"}

package/dist/guards/permissions.guard.js

@@ -95,7 +95,7 @@ let PermissionsGuard = PermissionsGuard_1 = class PermissionsGuard {
         const requestContext = this.buildRequestContext(request);
         const resourceContext = includeResourceContext ? this.buildResourceContext(request) : undefined;
         if (permissions.length === 1) {
-            const [firstPermission] = permissions;
+            const [firstPermission = ''] = permissions;
             const result = await this.permissionsClient.checkPermission(userId, firstPermission, {
                 request: requestContext,
                 resource: resourceContext,
@@ -124,7 +124,8 @@ let PermissionsGuard = PermissionsGuard_1 = class PermissionsGuard {
      */
     buildResourceContext(request) {
         return {
-            id: request.params?.id,
+            // eslint-disable-next-line @typescript-eslint/dot-notation
+            id: request.params?.['id'],
             ...request.params,
             ...request.query,
         };

package/dist/guards/permissions.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AAEzC,+EAA0E;AAE1E,oCAAoD;AAwBpD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIR;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YACmB,SAAoB,EACpB,iBAAwC;QADxC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAuB;IACxD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QACrE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACzE,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAClD,IAAI,CAAC,EAAE,EACP,CAAC,GAAG,WAAW,CAAC,EAChB,IAAI,EACJ,OAAO,EACP,OAAO,CAAC,sBAAsB,IAAI,KAAK,CACxC,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;oBACpB,0CAA0C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CACnF,CAAC;gBACF,MAAM,IAAI,2BAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oCAAoC,IAAI,CAAC,EAAE,EAAE,EAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACrD,CAAC;YACF,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,OAAyB;QACtD,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACrC,gCAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,WAAqB,EACrB,IAAmB,EACnB,OAAwB,EACxB,sBAA+B;QAE/B,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE;gBACnF,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,eAAe;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAwB;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,OAAwB;QACnD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YACtB,GAAG,OAAO,CAAC,MAAM;YACjB,GAAG,OAAO,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;CACF,CAAA;AA9GY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAKmB,gBAAS;QACD,+CAAqB;GALhD,gBAAgB,CA8G5B"}
+{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AAEzC,+EAA0E;AAE1E,oCAAoD;AAwBpD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIR;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YACmB,SAAoB,EACpB,iBAAwC;QADxC,cAAS,GAAT,SAAS,CAAW;QACpB,sBAAiB,GAAjB,iBAAiB,CAAuB;IACxD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QACrE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;YACzE,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAClD,IAAI,CAAC,EAAE,EACP,CAAC,GAAG,WAAW,CAAC,EAChB,IAAI,EACJ,OAAO,EACP,OAAO,CAAC,sBAAsB,IAAI,KAAK,CACxC,CAAC;YACF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;oBACpB,0CAA0C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8BAA8B,IAAI,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CACnF,CAAC;gBACF,MAAM,IAAI,2BAAkB,CAAC,YAAY,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAAkB,EAAE,CAAC;gBACxC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,oCAAoC,IAAI,CAAC,EAAE,EAAE,EAC7C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACrD,CAAC;YACF,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB,CAAC,OAAyB;QACtD,OAAO,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACrC,gCAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,WAAqB,EACrB,IAAmB,EACnB,OAAwB,EACxB,sBAA+B;QAE/B,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,MAAM,EAAE,eAAe,EAAE;gBACnF,OAAO,EAAE,cAAc;gBACvB,QAAQ,EAAE,eAAe;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,OAAwB;QAClD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,OAAwB;QACnD,OAAO;YACL,2DAA2D;YAC3D,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;YAC1B,GAAG,OAAO,CAAC,MAAM;YACjB,GAAG,OAAO,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;CACF,CAAA;AA/GY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAKmB,gBAAS;QACD,+CAAqB;GALhD,gBAAgB,CA+G5B"}

package/dist/proto/permissions.proto

@@ -37,6 +37,12 @@ service PermissionsService {
    * Check if user has ANY of the specified permissions
    */
   rpc HasAnyPermission(HasMultiplePermissionsRequest) returns (HasPermissionResponse);
+
+  /**
+   * Validate a JWT token and return user data with roles and permissions
+   * Used by consuming services to authenticate requests via gRPC
+   */
+  rpc ValidateToken(ValidateTokenRequest) returns (ValidateTokenResponse);
 }
 
 // ============================================================================
@@ -148,3 +154,44 @@ message RequestContext {
   optional string path = 4;
   map<string, string> attributes = 5;
 }
+
+// ============================================================================
+// JWT Token Validation Messages
+// ============================================================================
+
+message ValidateTokenRequest {
+  string token = 1;
+}
+
+message ValidateTokenResponse {
+  bool valid = 1;
+  string error_code = 2;       // "EXPIRED", "INVALID", "USER_INACTIVE", "USER_NOT_FOUND"
+  string error_message = 3;
+  UserData user = 4;           // Only populated if valid=true
+}
+
+/**
+ * User data returned from token validation
+ * Contains user info with roles and permissions
+ */
+message UserData {
+  string id = 1;
+  string email = 2;
+  string phone = 3;
+  string user_type = 4;
+  string status = 5;
+  bool is_profile_complete = 6;
+  repeated UserRoleInfo roles = 7;
+  repeated string permissions = 8;
+  bool has_all_access = 9;
+}
+
+/**
+ * Role info for user data (simplified version of RoleInfo)
+ */
+message UserRoleInfo {
+  string id = 1;
+  string code = 2;
+  string name = 3;
+  bool is_system = 4;
+}

package/dist/types/grpc.types.d.ts

@@ -82,6 +82,32 @@ export interface GetEffectivePermissionsResponse {
 export interface HasPermissionResponse {
     hasPermission: boolean;
 }
+export interface ValidateTokenRequest {
+    token: string;
+}
+export interface GrpcUserRoleInfo {
+    id: string;
+    code: string;
+    name: string;
+    isSystem: boolean;
+}
+export interface GrpcUserData {
+    id: string;
+    email: string;
+    phone: string;
+    userType: string;
+    status: string;
+    isProfileComplete: boolean;
+    roles: GrpcUserRoleInfo[];
+    permissions: string[];
+    hasAllAccess: boolean;
+}
+export interface ValidateTokenResponse {
+    valid: boolean;
+    errorCode: string;
+    errorMessage: string;
+    user?: GrpcUserData;
+}
 /**
  * gRPC Permissions Service client interface
  * This interface is used by NestJS microservices to define the client methods
@@ -93,5 +119,6 @@ export interface PermissionsGrpcService {
     hasPermission: (request: HasPermissionRequest) => Observable<HasPermissionResponse>;
     hasAllPermissions: (request: HasMultiplePermissionsRequest) => Observable<HasPermissionResponse>;
     hasAnyPermission: (request: HasMultiplePermissionsRequest) => Observable<HasPermissionResponse>;
+    validateToken: (request: ValidateTokenRequest) => Observable<ValidateTokenResponse>;
 }
 //# sourceMappingURL=grpc.types.d.ts.map

package/dist/types/grpc.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grpc.types.d.ts","sourceRoot":"","sources":["../../src/types/grpc.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B,IAAI;IACjC,sBAAsB,IAAI;IAC1B,sBAAsB,IAAI;IAC1B,6BAA6B,IAAI;IACjC,wBAAwB,IAAI;CAC7B;AAMD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAMD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAC;CACxB;AAMD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC1F,oBAAoB,EAAE,CACpB,OAAO,EAAE,2BAA2B,KACjC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAC9C,uBAAuB,EAAE,CACvB,OAAO,EAAE,8BAA8B,KACpC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IACjD,aAAa,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACpF,iBAAiB,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;CACjG"}
+{"version":3,"file":"grpc.types.d.ts","sourceRoot":"","sources":["../../src/types/grpc.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,oBAAY,oBAAoB;IAC9B,6BAA6B,IAAI;IACjC,sBAAsB,IAAI;IAC1B,sBAAsB,IAAI;IAC1B,6BAA6B,IAAI;IACjC,wBAAwB,IAAI;CAC7B;AAMD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAMD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAC;CACxB;AAMD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,eAAe,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,UAAU,CAAC,uBAAuB,CAAC,CAAC;IAC1F,oBAAoB,EAAE,CACpB,OAAO,EAAE,2BAA2B,KACjC,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAC9C,uBAAuB,EAAE,CACvB,OAAO,EAAE,8BAA8B,KACpC,UAAU,CAAC,+BAA+B,CAAC,CAAC;IACjD,aAAa,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACpF,iBAAiB,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACjG,gBAAgB,EAAE,CAAC,OAAO,EAAE,6BAA6B,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAChG,aAAa,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,UAAU,CAAC,qBAAqB,CAAC,CAAC;CACrF"}

package/dist/types/index.d.ts

@@ -1,4 +1,5 @@
 export * from './evaluation.types';
 export * from './grpc.types';
+export type * from './jwt.types';
 export * from './permission.types';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,mBAAmB,aAAa,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+CAA6B;AAC7B,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,+CAA6B;AAE7B,qDAAmC"}

package/dist/types/jwt.types.d.ts

@@ -0,0 +1,26 @@
+import type { RoleInfo } from './permission.types';
+/**
+ * User data returned from JWT validation via gRPC
+ * Contains full user information with roles and permissions
+ */
+export interface JwtUserData {
+    readonly id: string;
+    readonly email: string | null;
+    readonly phone: string | null;
+    readonly userType: string;
+    readonly status: string;
+    readonly isProfileComplete: boolean;
+    readonly roles: readonly RoleInfo[];
+    readonly permissions: readonly string[];
+    readonly hasAllAccess: boolean;
+}
+/**
+ * Result of token validation from gRPC
+ */
+export interface ValidateTokenResult {
+    readonly valid: boolean;
+    readonly errorCode?: string;
+    readonly errorMessage?: string;
+    readonly user?: JwtUserData;
+}
+//# sourceMappingURL=jwt.types.d.ts.map

package/dist/types/jwt.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.types.d.ts","sourceRoot":"","sources":["../../src/types/jwt.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;CAC7B"}

package/dist/types/jwt.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=jwt.types.js.map

package/dist/types/jwt.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.types.js","sourceRoot":"","sources":["../../src/types/jwt.types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahksolution/permissions-sdk",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "gRPC client SDK for AHK Solution Permissions Microservice - provides NestJS guard, decorators, and client for inter-service permission checks",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/proto/permissions.proto

@@ -37,6 +37,12 @@ service PermissionsService {
    * Check if user has ANY of the specified permissions
    */
   rpc HasAnyPermission(HasMultiplePermissionsRequest) returns (HasPermissionResponse);
+
+  /**
+   * Validate a JWT token and return user data with roles and permissions
+   * Used by consuming services to authenticate requests via gRPC
+   */
+  rpc ValidateToken(ValidateTokenRequest) returns (ValidateTokenResponse);
 }
 
 // ============================================================================
@@ -148,3 +154,44 @@ message RequestContext {
   optional string path = 4;
   map<string, string> attributes = 5;
 }
+
+// ============================================================================
+// JWT Token Validation Messages
+// ============================================================================
+
+message ValidateTokenRequest {
+  string token = 1;
+}
+
+message ValidateTokenResponse {
+  bool valid = 1;
+  string error_code = 2;       // "EXPIRED", "INVALID", "USER_INACTIVE", "USER_NOT_FOUND"
+  string error_message = 3;
+  UserData user = 4;           // Only populated if valid=true
+}
+
+/**
+ * User data returned from token validation
+ * Contains user info with roles and permissions
+ */
+message UserData {
+  string id = 1;
+  string email = 2;
+  string phone = 3;
+  string user_type = 4;
+  string status = 5;
+  bool is_profile_complete = 6;
+  repeated UserRoleInfo roles = 7;
+  repeated string permissions = 8;
+  bool has_all_access = 9;
+}
+
+/**
+ * Role info for user data (simplified version of RoleInfo)
+ */
+message UserRoleInfo {
+  string id = 1;
+  string code = 2;
+  string name = 3;
+  bool is_system = 4;
+}