@apso/cli 0.43.4 → 0.45.0

package/dist/lib/templates/go/middleware/auth.eta

@@ -1,100 +1,340 @@
-<%~ includeFile('../../header.eta', it) %>
+<%~ includeFile('../header.eta', it) %>
 
 package middleware
 
+// AuthMiddleware authenticates every route registered on the /api group.
+// Routes registered outside that group (such as /health) stay public.
+<% if (it.jwt) { %>
+//
+// It verifies <%= it.jwt.provider %> JWTs from the Authorization: Bearer header against the
+// issuer's published keys (JWKS), checks issuer, expiry<% if (it.jwt.audience) { %>, audience<% } %> and algorithm,
+// and maps the token's claims into an AuthContext.
+// AUTH_JWT_ISSUER, AUTH_JWT_AUDIENCE and AUTH_JWKS_URI override the .apsorc values.
+<% } else { %>
+//
+// It reads an API key from the <%= it.apiKey.apiKeyHeader %> header and looks up the
+// <%= it.apiKey.apiKeyEntity %> row whose <%= it.apiKey.keyField %> is the key's hex SHA-256.
+<% } %>
+
 import (
+<% if (it.jwt) { %>
+	"context"
+	"encoding/json"
+<% } else { %>
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+<% } %>
 	"net/http"
+<% if (it.jwt) { %>
+	"os"
+	"strconv"
 	"strings"
+	"sync"
+<% } else if (it.apiKey.hasExpiresAt) { %>
+	"time"
+<% } %>
 
+<% if (it.jwt) { %>
+	"github.com/MicahParks/keyfunc/v3"
+<% } %>
 	"github.com/gin-gonic/gin"
+<% if (it.jwt) { %>
+	"github.com/golang-jwt/jwt/v5"
+<% } %>
+	"gorm.io/gorm"
+<% if (it.apiKey) { %>
+
+	"app/autogen/models"
+<% } %>
 )
 
-// AuthMiddleware provides authentication middleware for protected routes
-func AuthMiddleware() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-		if authHeader == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Authorization header required"})
-			return
-		}
+// AuthContext is the normalized identity of the caller.
+type AuthContext struct {
+	UserID         string                 `json:"userId,omitempty"`
+	Email          string                 `json:"email,omitempty"`
+	ServiceID      string                 `json:"serviceId,omitempty"`
+	WorkspaceID    string                 `json:"workspaceId,omitempty"`
+	OrganizationID string                 `json:"organizationId,omitempty"`
+	Roles          []string               `json:"roles"`
+	Claims         map[string]interface{} `json:"claims,omitempty"`
+}
 
-		parts := strings.SplitN(authHeader, " ", 2)
-		if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Invalid authorization header format"})
-			return
+// AuthContextKey is the gin context key holding *AuthContext.
+const AuthContextKey = "auth"
+
+// GetAuthContext returns the authenticated caller, if any.
+func GetAuthContext(c *gin.Context) (*AuthContext, bool) {
+	v, ok := c.Get(AuthContextKey)
+	if !ok {
+		return nil, false
+	}
+	a, ok := v.(*AuthContext)
+	return a, ok
+}
+
+func unauthorized(c *gin.Context, msg string) {
+	c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": msg})
+}
+<% if (it.jwt) { %>
+
+func splitList(s string) []string {
+	out := []string{}
+	for _, p := range strings.Split(s, ",") {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
 		}
+	}
+	return out
+}
 
-		token := parts[1]
+func env(name, fallback string) string {
+	if v := os.Getenv(name); v != "" {
+		return v
+	}
+	return fallback
+}
 
-		// TODO: Validate the token
-		// This is a placeholder - implement your actual token validation logic
-		if token == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
-			return
+var (
+	issuer     = env("AUTH_JWT_ISSUER", <%~ JSON.stringify(it.jwt.issuer) %>)
+	audience   = env("AUTH_JWT_AUDIENCE", <%~ JSON.stringify(it.jwt.audience || '') %>)
+	jwksURI    = env("AUTH_JWKS_URI", <%~ JSON.stringify(it.jwt.jwksUri) %>)
+	algorithms = []string{<%~ it.jwt.algorithms.map((a) => JSON.stringify(a)).join(', ') %>}
+	// Origins allowed in the azp claim; empty allows any.
+	authorizedParties = splitList(env("AUTH_JWT_AUTHORIZED_PARTIES", <%~ JSON.stringify(it.jwt.authorizedParties.join(',')) %>))
+
+	jwksMu sync.Mutex
+	jwks   keyfunc.Keyfunc
+)
+
+// keys fetches the issuer's JWKS on first use, retrying on later requests if
+// the issuer was unreachable. keyfunc refreshes the set in the background.
+func keys() (keyfunc.Keyfunc, error) {
+	jwksMu.Lock()
+	defer jwksMu.Unlock()
+	if jwks != nil {
+		return jwks, nil
+	}
+	k, err := keyfunc.NewDefaultCtx(context.Background(), []string{jwksURI})
+	if err != nil {
+		return nil, err
+	}
+	jwks = k
+	return k, nil
+}
+
+// claim reads a claim by exact name (Auth0 namespaced URLs contain dots),
+// else by dotted path into nested objects.
+func claim(m map[string]interface{}, path string) interface{} {
+	if path == "" {
+		return nil
+	}
+	if v, ok := m[path]; ok {
+		return v
+	}
+	var cur interface{} = m
+	for _, part := range strings.Split(path, ".") {
+		obj, ok := cur.(map[string]interface{})
+		if !ok {
+			return nil
 		}
+		cur = obj[part]
+	}
+	return cur
+}
 
-		// Set user info in context if token is valid
-		// c.Set("user_id", userId)
-		// c.Set("user_roles", roles)
+func str(v interface{}) string {
+	switch t := v.(type) {
+	case string:
+		return t
+	case float64:
+		return strconv.FormatFloat(t, 'f', -1, 64)
+	case json.Number:
+		return t.String()
+	}
+	return ""
+}
 
-		c.Next()
+func contains(list []string, s string) bool {
+	for _, v := range list {
+		if v == s {
+			return true
+		}
+	}
+	return false
+}
+
+func roles(v interface{}) []string {
+	out := []string{}
+	switch t := v.(type) {
+	case []interface{}:
+		for _, r := range t {
+			if s := str(r); s != "" {
+				out = append(out, s)
+			}
+		}
+	case string:
+		if t != "" {
+			out = append(out, t)
+		}
 	}
+	return out
 }
 
-<% if (it.auth && it.auth.roles && it.auth.roles.length > 0) { %>
-// RoleMiddleware checks if the user has the required role
-func RoleMiddleware(allowedRoles ...string) gin.HandlerFunc {
+// AuthMiddleware verifies the caller's JWT. The database is unused for JWT auth.
+func AuthMiddleware(_ *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// Get user roles from context (set by AuthMiddleware)
-		userRoles, exists := c.Get("user_roles")
-		if !exists {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "No roles found"})
+		header := c.GetHeader("Authorization")
+		if !strings.HasPrefix(header, "Bearer ") {
+			unauthorized(c, "No bearer token provided")
+			return
+		}
+		k, err := keys()
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusServiceUnavailable, gin.H{"error": "Token signing keys unavailable"})
+			return
+		}
+		opts := []jwt.ParserOption{
+			jwt.WithIssuer(issuer),
+			jwt.WithValidMethods(algorithms),
+			jwt.WithExpirationRequired(),
+		}
+<% if (it.jwt.provider !== 'cognito') { %>
+		if audience != "" {
+			opts = append(opts, jwt.WithAudience(audience))
+		}
+<% } %>
+		mc := jwt.MapClaims{}
+		token, err := jwt.ParseWithClaims(strings.TrimPrefix(header, "Bearer "), mc, k.Keyfunc, opts...)
+		if err != nil || !token.Valid {
+			unauthorized(c, "Invalid token")
 			return
 		}
+		claims := map[string]interface{}(mc)
+<% if (it.jwt.provider === 'cognito') { %>
+		// Cognito ID tokens carry aud; access tokens carry client_id instead.
+		if audience != "" {
+			aud := claims["aud"]
+			if aud == nil {
+				aud = claims["client_id"]
+			}
+			if !containsAudience(aud, audience) {
+				unauthorized(c, "Invalid token")
+				return
+			}
+		}
+<% } %>
 
-		roles, ok := userRoles.([]string)
-		if !ok {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Invalid roles format"})
+		if azp, ok := claims["azp"].(string); ok && len(authorizedParties) > 0 && !contains(authorizedParties, azp) {
+			unauthorized(c, "Invalid token")
 			return
 		}
 
-		// Check if user has any of the allowed roles
-		for _, userRole := range roles {
-			for _, allowedRole := range allowedRoles {
-				if userRole == allowedRole {
-					c.Next()
-					return
-				}
+		userID := str(claim(claims, <%~ JSON.stringify(it.jwt.claims.userId) %>))
+		if userID == "" {
+			unauthorized(c, "Token has no user id")
+			return
+		}
+		tenant := str(claim(claims, <%~ JSON.stringify(it.jwt.claims.workspaceId || '') %>))
+		if tenant == "" {
+			tenant = str(claim(claims, <%~ JSON.stringify(it.jwt.claims.organizationId || '') %>))
+		}
+		c.Set(AuthContextKey, &AuthContext{
+			UserID:         userID,
+			Email:          str(claim(claims, <%~ JSON.stringify(it.jwt.claims.email || '') %>)),
+			WorkspaceID:    tenant,
+			OrganizationID: tenant,
+			Roles:          roles(claim(claims, <%~ JSON.stringify(it.jwt.claims.roles || '') %>)),
+			Claims:         claims,
+		})
+		c.Next()
+	}
+}
+<% if (it.jwt.provider === 'cognito') { %>
+
+func containsAudience(aud interface{}, want string) bool {
+	switch t := aud.(type) {
+	case string:
+		return t == want
+	case []interface{}:
+		for _, a := range t {
+			if str(a) == want {
+				return true
 			}
 		}
+	}
+	return false
+}
+<% } %>
+<% } else { %>
 
-		c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
+<% if (it.apiKey.hasExpiresAt) { %>
+// before reports whether an expiresAt value read from the database is still
+// in the future. A value it cannot read counts as expired.
+func before(v interface{}, now time.Time) bool {
+	switch t := v.(type) {
+	case time.Time:
+		return now.Before(t)
+	case *time.Time:
+		return t == nil || now.Before(*t)
+	case string:
+		for _, layout := range []string{time.RFC3339Nano, "2006-01-02 15:04:05", "2006-01-02"} {
+			if p, err := time.Parse(layout, t); err == nil {
+				return now.Before(p)
+			}
+		}
+	case []byte:
+		return before(string(t), now)
 	}
+	return false
 }
 
-// Role constants
-const (
-<% it.auth.roles.forEach((role) => { %>
-	Role<%= role.charAt(0).toUpperCase() + role.slice(1) %> = "<%= role %>"
-<% }) %>
-)
 <% } %>
-
-<% if (it.auth && it.auth.multiTenant) { %>
-// TenantMiddleware extracts and validates tenant from requests
-func TenantMiddleware() gin.HandlerFunc {
+// AuthMiddleware authenticates the caller's API key against <%= it.apiKey.apiKeyEntity %>.
+func AuthMiddleware(db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		tenantID := c.GetHeader("X-Tenant-ID")
-		if tenantID == "" {
-			tenantID = c.Query("tenantId")
+		key := c.GetHeader(<%~ JSON.stringify(it.apiKey.apiKeyHeader) %>)
+		if key == "" {
+			unauthorized(c, "No API key provided")
+			return
 		}
-
-		if tenantID == "" {
-			c.AbortWithStatusJSON(http.StatusBadRequest, gin.H{"error": "Tenant ID required"})
+		sum := sha256.Sum256([]byte(key))
+		row := map[string]interface{}{}
+		err := db.Model(&models.<%= it.apiKey.goModel %>{}).
+			Where(<%~ JSON.stringify(it.apiKey.keyColumn + ' = ?') %>, hex.EncodeToString(sum[:])).
+			Take(&row).Error
+		if err != nil {
+			unauthorized(c, "Invalid API key")
 			return
 		}
-
-		c.Set("tenant_id", tenantID)
+<% if (it.apiKey.hasStatus) { %>
+		if fmt.Sprint(row["status"]) != "active" {
+			unauthorized(c, "API key is not active")
+			return
+		}
+<% } %>
+<% if (it.apiKey.hasExpiresAt) { %>
+		if v := row[<%~ JSON.stringify(it.apiKey.expiresColumn) %>]; v != nil && !before(v, time.Now()) {
+			unauthorized(c, "API key has expired")
+			return
+		}
+<% } %>
+		tenant := ""
+		if v := row[<%~ JSON.stringify(it.apiKey.workspaceColumn) %>]; v != nil {
+			tenant = fmt.Sprint(v)
+		}
+		roles := []string{}
+<% if (it.apiKey.roleField) { %>
+		if v := row[<%~ JSON.stringify(it.apiKey.roleColumn) %>]; v != nil {
+			roles = append(roles, fmt.Sprint(v))
+		}
+<% } %>
+		c.Set(AuthContextKey, &AuthContext{
+			ServiceID:      fmt.Sprint(row["id"]),
+			WorkspaceID:    tenant,
+			OrganizationID: tenant,
+			Roles:          roles,
+		})
 		c.Next()
 	}
 }

package/dist/lib/templates/guards/api-key-auth.guard.eta

@@ -0,0 +1,146 @@
+/**
+ * AuthGuard - application API keys stored as SHA-256 hashes on <%= it.apiKey.apiKeyEntity %>
+ *
+ * Auto-generated by Apso CLI from .apsorc auth configuration
+ * Generated at: <%= it.generatedAt %>
+ *
+ * This guard:
+ * - Reads the key from the <%= it.apiKey.apiKeyHeader %> header
+ * - Looks up the <%= it.apiKey.apiKeyEntity %> row whose <%= it.apiKey.keyField %> is the key's hex SHA-256
+<% if (it.apiKey.hasStatus) { %>
+ * - Rejects keys whose status is not "active"
+<% } %>
+<% if (it.apiKey.hasExpiresAt) { %>
+ * - Rejects keys past expiresAt
+<% } %>
+ * - Attaches a normalized AuthContext to request.auth
+ *
+ * DO NOT EDIT - Changes will be overwritten on next scaffold
+ */
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { createHash } from 'crypto';
+
+import { <%= it.apiKey.apiKeyEntity %> } from '../<%= it.apiKey.apiKeyEntity %>/<%= it.apiKey.apiKeyEntity %>.entity';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+
+/**
+ * Decorator to mark a route as public (skips authentication)
+ * Usage: @Public()
+ */
+export const Public =
+  () => (target: any, key?: string, descriptor?: PropertyDescriptor) => {
+    Reflect.defineMetadata(IS_PUBLIC_KEY, true, descriptor?.value || target);
+  };
+
+/**
+ * Normalized auth context attached to authenticated requests.
+ * This is what scopeBy and RBAC consume.
+ */
+export interface AuthContext {
+  userId?: string;
+  serviceId: string;
+  workspaceId?: string;
+  organizationId?: string;
+  roles: string[];
+}
+
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    @InjectRepository(<%= it.apiKey.apiKeyEntity %>)
+    private apiKeyRepository: Repository<<%= it.apiKey.apiKeyEntity %>>,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) {
+      return true;
+    }
+
+    // The template's health check stays public for load balancer probes.
+    const req = context.switchToHttp().getRequest();
+    if (req.method === 'GET' && /^\/health\/?$/.test(req.path)) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const key = request.headers['<%= it.apiKey.apiKeyHeader %>'];
+    if (typeof key !== 'string' || !key) {
+      throw new UnauthorizedException('No API key provided');
+    }
+
+    const hash = createHash('sha256').update(key).digest('hex');
+    const record: any = await this.apiKeyRepository.findOne({
+      where: { <%= it.apiKey.keyField %>: hash } as any,
+    });
+    if (!record) {
+      throw new UnauthorizedException('Invalid API key');
+    }
+<% if (it.apiKey.hasStatus) { %>
+    if (record.status !== 'active') {
+      throw new UnauthorizedException('API key is not active');
+    }
+<% } %>
+<% if (it.apiKey.hasExpiresAt) { %>
+    if (record.expiresAt && new Date(record.expiresAt) <= new Date()) {
+      throw new UnauthorizedException('API key has expired');
+    }
+<% } %>
+
+    const tenant =
+      record.<%= it.apiKey.workspaceField %> != null
+        ? String(record.<%= it.apiKey.workspaceField %>)
+        : undefined;
+<% if (it.apiKey.roleField) { %>
+    const role = record.<%= it.apiKey.roleField %>;
+    const roles = Array.isArray(role) ? role.map(String) : role ? [String(role)] : [];
+<% } else { %>
+    const roles: string[] = [];
+<% } %>
+    const auth: AuthContext = {
+      serviceId: String(record.id),
+      workspaceId: tenant,
+      organizationId: tenant,
+      roles,
+    };
+
+    request.auth = auth;
+    request.user = { id: auth.serviceId, ...auth };
+    // Read by ScopeGuard's scope lookup.
+    request.workspaceId = tenant;
+    request.organizationId = tenant;
+    return true;
+  }
+}
+
+/**
+ * Helper function to get AuthContext from request
+ * Use this in controllers/services to access the authenticated context
+ */
+export function getAuthContext(request: any): AuthContext | undefined {
+  return request?.auth;
+}
+
+/**
+ * Helper function to require AuthContext (throws if not present)
+ */
+export function requireAuthContext(request: any): AuthContext {
+  const ctx = getAuthContext(request);
+  if (!ctx) {
+    throw new UnauthorizedException('Authentication required');
+  }
+  return ctx;
+}

package/dist/lib/templates/guards/auth.guard.eta

@@ -94,6 +94,12 @@ export class AuthGuard implements CanActivate {
       return true;
     }
 
+    // The template's health check stays public for load balancer probes.
+    const req = context.switchToHttp().getRequest();
+    if (req.method === 'GET' && /^\/health\/?$/.test(req.path)) {
+      return true;
+    }
+
     const request = context.switchToHttp().getRequest();
     const token = this.extractToken(request);
 

package/dist/lib/templates/guards/guards.module.eta

@@ -7,7 +7,7 @@ import { APP_GUARD } from '@nestjs/core';
 <% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
 import { ScopeGuard } from './scope.guard';
 <% } %>
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
 import { AuthGuard } from './auth.guard';
 <% } %>
 
@@ -20,13 +20,11 @@ import { <%= entity.name %> } from '../<%= entity.name %>/<%= entity.name %>.ent
 <% } %>
 
 <% /* Import entities for AuthGuard (from sibling autogen folders) */ %>
-<% if (it.authConfig) { %>
+<% if (it.authEntities.length > 0) { %>
 // Entities for AuthGuard
-import { <%= it.authConfig.sessionEntity %> } from '../<%= it.authConfig.sessionEntity %>/<%= it.authConfig.sessionEntity %>.entity';
-import { <%= it.authConfig.userEntity %> } from '../<%= it.authConfig.userEntity %>/<%= it.authConfig.userEntity %>.entity';
-<% if (it.authConfig.accountUserEntity) { %>
-import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.accountUserEntity %>/<%= it.authConfig.accountUserEntity %>.entity';
-<% } %>
+<% it.authEntities.forEach((entity) => { %>
+import { <%= entity %> } from '../<%= entity %>/<%= entity %>.entity';
+<% }) %>
 <% } %>
 
 /**
@@ -43,12 +41,10 @@ import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.acc
  * 3. Services with no auth model generate no guards and rely on the API Gateway
  *    API key at the edge.
  *
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
  * AuthGuard:
- * - Validates session tokens from cookies/headers
- * - Loads user and organization context
+ * - Authenticates every request (<%= it.authProvider %>)
  * - Attaches normalized AuthContext to request.auth
- * - Provider: <%= it.authConfig.provider %>
  *
 <% } %>
 <% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
@@ -72,11 +68,7 @@ import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.acc
 <% /* Collect all unique entities */ %>
 <% const allEntities = new Set(); %>
 <% if (it.scopedEntities) { it.scopedEntities.forEach(e => allEntities.add(e.name)); } %>
-<% if (it.authConfig) { %>
-<%   allEntities.add(it.authConfig.sessionEntity); %>
-<%   allEntities.add(it.authConfig.userEntity); %>
-<%   if (it.authConfig.accountUserEntity) { allEntities.add(it.authConfig.accountUserEntity); } %>
-<% } %>
+<% it.authEntities.forEach(e => allEntities.add(e)); %>
 <% const entityArray = Array.from(allEntities); %>
 <% entityArray.forEach((entity, index) => { %>
       <%= entity %><%= index < entityArray.length - 1 ? ',' : '' %>
@@ -84,7 +76,7 @@ import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.acc
     ]),
   ],
   providers: [
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
     AuthGuard,
 <% } %>
 <% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
@@ -95,7 +87,7 @@ import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.acc
     // config generate no guards at all and are protected at the edge by the
     // API Gateway API key — so this does not conflict with that setup. Use the
     // @Public() decorator to opt an individual route out of authentication.
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
     {
       provide: APP_GUARD,
       useClass: AuthGuard,
@@ -109,7 +101,7 @@ import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.acc
 <% } %>
   ],
   exports: [
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
     AuthGuard,
 <% } %>
 <% if (it.scopedEntities && it.scopedEntities.length > 0) { %>

package/dist/lib/templates/guards/index.eta

@@ -1,10 +1,10 @@
 <%~ includeFile('../header.eta') %>
 
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
 export * from './auth.guard';
 <% } %>
 <% if (it.scopedEntities && it.scopedEntities.length > 0) { %>
-<% if (it.authConfig) { %>
+<% if (it.hasAuth) { %>
 // When auth is configured, only export scope-specific items from scope.guard
 // to avoid duplicate exports (Public, IS_PUBLIC_KEY come from auth.guard)
 export {