@apso/cli 0.5.0 → 0.7.0

package/dist/lib/apsorc-parser.js

@@ -34,12 +34,14 @@ const parseRc = () => {
     const version = apsoConfig.version || 1;
     const entities = apsoConfig.entities || [];
     const relationships = apsoConfig.relationships || [];
+    const auth = apsoConfig.auth;
     return {
         rootFolder,
         apiType,
         version,
         entities,
         relationships,
+        auth,
     };
 };
 const parseApsorc = () => {
@@ -57,6 +59,7 @@ const parseApsorc = () => {
                 const result = {
                     rootFolder: apsoConfig.rootFolder,
                     apiType: apsoConfig.apiType,
+                    auth: apsoConfig.auth,
                     ...(0, exports.parseApsorcV1)(apsoConfig),
                 };
                 if (debug) {
@@ -71,6 +74,7 @@ const parseApsorc = () => {
                 const result = {
                     rootFolder: apsoConfig.rootFolder,
                     apiType: apsoConfig.apiType,
+                    auth: apsoConfig.auth,
                     ...(() => {
                         const relStart = perf_hooks_1.performance.now();
                         const parsed = (0, exports.parseApsorcV2)(apsoConfig);
@@ -128,11 +132,12 @@ const loadConfig = (appName = "apso", defaults = {}) => {
     const configData = (0, rc_1.default)(appName, defaults);
     const rootFolder = configData.rootFolder || "src"; // Get rootFolder early
     // Check if rc found and loaded the config
-    // rc returns an object with default keys if nothing is found, 
+    // rc returns an object with default keys if nothing is found,
     // so check for more than just default keys or if configData.config exists
     const hasMeaningfulConfig = configData &&
-        Object.keys(configData).some(key => !Object.prototype.hasOwnProperty.call(defaults, key) && key !== '_') &&
-        configData.configs && configData.configs.length > 0;
+        Object.keys(configData).some((key) => !Object.prototype.hasOwnProperty.call(defaults, key) && key !== "_") &&
+        configData.configs &&
+        configData.configs.length > 0;
     if (!hasMeaningfulConfig) {
         // If rc didn't find it, try our manual search as a fallback
         const foundPath = (0, exports.findConfigPath)();
@@ -150,7 +155,7 @@ const loadConfig = (appName = "apso", defaults = {}) => {
         rootFolder: rootFolder,
         entities: configData.entities || [],
         apiType: configData.apiType || ApiType.Rest,
-        relationships: configData.relationships || []
+        relationships: configData.relationships || [],
     };
     if (version === 1) {
         // Pass the correctly structured object
@@ -167,7 +172,7 @@ const loadConfig = (appName = "apso", defaults = {}) => {
     if (!parsedData.entities || !Array.isArray(parsedData.entities)) {
         throw new Error("Invalid config: 'entities' array is missing or invalid after parsing.");
     }
-    if (!rootFolder || typeof rootFolder !== 'string') {
+    if (!rootFolder || typeof rootFolder !== "string") {
         throw new Error("Invalid config: 'rootFolder' string is missing or invalid.");
     }
     // Relationships are implicitly validated by parseRelationships/parseV1Relationships
@@ -177,7 +182,7 @@ const loadConfig = (appName = "apso", defaults = {}) => {
         // or adjust UnifiedConfig. For now, returning empty array as placeholder.
         // The relationshipMap is the primary output needed by downstream code.
         relationships: [],
-        rootFolder: rootFolder
+        rootFolder: rootFolder,
     };
 };
 exports.loadConfig = loadConfig;

package/dist/lib/controller.js

@@ -35,7 +35,9 @@ const createController = async (apiBaseDir, entity, relationshipMap) => {
     const startNested = perf_hooks_1.performance.now();
     const tmpDir = os_1.default.tmpdir();
     const nestedJoinsFile = path.join(tmpDir, `apso-nested-joins-${entityName}-${Date.now()}.eta`);
-    const nestedJoinsStream = fs_1.default.createWriteStream(nestedJoinsFile, { encoding: "utf8" });
+    const nestedJoinsStream = fs_1.default.createWriteStream(nestedJoinsFile, {
+        encoding: "utf8",
+    });
     let nestedCount = 0;
     nestedCount = await (0, parse_1.streamNestedRelationships)(entityName, relationshipMap, nestedJoinsStream);
     nestedJoinsStream.end();

package/dist/lib/dto.js

@@ -32,15 +32,15 @@ options) => {
     //   console.log('[DTO DEBUG] relationshipsTemplate:', relationshipsTemplate);
     // }
     // Add foreign key columns for ManyToOne relationships if not present
-    relationshipsTemplate.forEach(rel => {
+    relationshipsTemplate.forEach((rel) => {
         var _a;
-        if (rel.type === 'ManyToOne') {
-            const fkName = (0, casing_1.camelCase)(rel.referenceName || rel.name) + 'Id';
+        if (rel.type === "ManyToOne") {
+            const fkName = (0, casing_1.camelCase)(rel.referenceName || rel.name) + "Id";
             // Look up the referenced entity to determine the foreign key type
-            const referencedEntity = (_a = options === null || options === void 0 ? void 0 : options.allEntities) === null || _a === void 0 ? void 0 : _a.find(e => e.name === rel.name);
-            const referencedPrimaryKeyType = (referencedEntity === null || referencedEntity === void 0 ? void 0 : referencedEntity.primaryKeyType) || 'serial';
-            const fkDataType = referencedPrimaryKeyType === 'uuid' ? 'string' : 'number';
-            const fkType = referencedPrimaryKeyType === 'uuid' ? 'text' : 'integer';
+            const referencedEntity = (_a = options === null || options === void 0 ? void 0 : options.allEntities) === null || _a === void 0 ? void 0 : _a.find((e) => e.name === rel.name);
+            const referencedPrimaryKeyType = (referencedEntity === null || referencedEntity === void 0 ? void 0 : referencedEntity.primaryKeyType) || "serial";
+            const fkDataType = referencedPrimaryKeyType === "uuid" ? "string" : "number";
+            const fkType = referencedPrimaryKeyType === "uuid" ? "text" : "integer";
             // if (process.env.DEBUG) {
             //   console.log('[DTO DEBUG]', {
             //     relType: rel.type,
@@ -52,7 +52,7 @@ options) => {
             //     columns: columns.map(c => c.name)
             //   });
             // }
-            if (!columns.some(col => col.name === fkName)) {
+            if (!columns.some((col) => col.name === fkName)) {
                 columns.push({
                     name: fkName,
                     dataType: fkDataType,
@@ -65,7 +65,7 @@ options) => {
     const addDefaultPKProperty = primaryKeyColumns.length === 0;
     const createdAt = entity.created_at;
     const updatedAt = entity.updated_at;
-    const primaryKeyType = entity.primaryKeyType || 'serial'; // Default to 'serial' if not specified
+    const primaryKeyType = entity.primaryKeyType || "serial"; // Default to 'serial' if not specified
     // Filter columns: remove id, createdAt, updatedAt
     const dtoColumns = columns.filter((col) => !["id", "createdAt", "updatedAt"].includes(col.name));
     // Class names

package/dist/lib/entity.js

@@ -21,15 +21,14 @@ const Eta = tslib_1.__importStar(require("eta"));
  * @returns {Promise<void>} A promise that resolves when the entity file is created.
  */
 const createEntity = async (options) => {
-    const { apiBaseDir, entity, relationships: relationshipsNew, apiType, allEntities } = options;
+    const { apiBaseDir, entity, relationships: relationshipsNew, apiType, allEntities, } = options;
     const { name, fields = [], indexes, uniques } = entity;
     const File = path.join(apiBaseDir, `${name}.entity.ts`);
     const columns = (0, field_1.getFieldForTemplate)(fields, name);
-    const createPrimaryKey = columns.filter((column) => column.primary === true)
-        .length === 0;
+    const createPrimaryKey = columns.filter((column) => column.primary === true).length === 0;
     const createdAt = entity.created_at;
     const updatedAt = entity.updated_at;
-    const primaryKeyType = entity.primaryKeyType || 'serial'; // Default to 'serial' if not specified
+    const primaryKeyType = entity.primaryKeyType || "serial"; // Default to 'serial' if not specified
     const relationships = (0, relationships_1.getRelationshipForTemplate)(name, relationshipsNew, allEntities);
     const entitiesToImport = (0, relationships_1.getRelationshipsForImport)(name, relationships);
     const data = {
@@ -48,7 +47,9 @@ const createEntity = async (options) => {
         importEnums: (0, field_1.typeExistsInEntity)(entity, "enum") !== -1,
         apiType,
     };
-    const templatePath = apiType === "graphql" ? "./graphql/gql-entity-graphql" : "./entities/entity";
+    const templatePath = apiType === "graphql"
+        ? "./graphql/gql-entity-graphql"
+        : "./entities/entity";
     const content = await Eta.renderFileAsync(templatePath, (0, file_system_1.withGeneratedMeta)(data));
     await (0, file_system_1.createFile)(File, content);
 };

package/dist/lib/guards.d.ts

@@ -1,4 +1,4 @@
-import { Entity } from "./types";
+import { Entity, AuthConfig } from "./types";
 /**
  * Represents a scope field configuration for template rendering
  */
@@ -36,11 +36,12 @@ export declare function getScopedEntities(entities: Entity[]): ScopedEntityConfi
 export declare function hasScopedEntities(entities: Entity[]): boolean;
 /**
  * Generates the guards module directory and files.
- * Creates scope.guard.ts, guards.module.ts, and index.ts in the guards directory.
+ * Creates auth.guard.ts, scope.guard.ts, guards.module.ts, and index.ts in the guards directory.
  *
  * @param rootPath The root path of the generated source (e.g., 'src').
  * @param entities All entities from the parsed .apsorc.
+ * @param auth Optional auth configuration from .apsorc.
  * @returns {Promise<void>} A promise that resolves when the guard files are created.
  */
-export declare const createGuards: (rootPath: string, entities: Entity[]) => Promise<void>;
+export declare const createGuards: (rootPath: string, entities: Entity[], auth?: AuthConfig) => Promise<void>;
 export {};

package/dist/lib/guards.js

@@ -6,13 +6,14 @@ const Eta = tslib_1.__importStar(require("eta"));
 const path = tslib_1.__importStar(require("path"));
 const fs = tslib_1.__importStar(require("fs"));
 const file_system_1 = require("./utils/file-system");
+const types_1 = require("./types");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 /**
  * Default scope options when not specified
  */
 const DEFAULT_SCOPE_OPTIONS = {
     injectOnCreate: true,
-    enforceOn: ['find', 'get', 'create', 'update', 'delete'],
+    enforceOn: ["find", "get", "create", "update", "delete"],
     bypassRoles: [],
 };
 /**
@@ -23,12 +24,12 @@ const DEFAULT_SCOPE_OPTIONS = {
  */
 function parseScopeBy(scopeBy) {
     const scopes = Array.isArray(scopeBy) ? scopeBy : [scopeBy];
-    return scopes.map(scope => {
-        const isDirect = !scope.includes('.');
-        const field = isDirect ? scope : scope.split('.')[0];
+    return scopes.map((scope) => {
+        const isDirect = !scope.includes(".");
+        const field = isDirect ? scope : scope.split(".")[0];
         // For direct fields, contextKey is the same as field
         // For nested paths like 'task.workspaceId', we extract 'workspaceId' as contextKey
-        const contextKey = isDirect ? scope : scope.split('.').pop();
+        const contextKey = isDirect ? scope : scope.split(".").pop();
         return {
             field,
             contextKey,
@@ -66,8 +67,8 @@ function toRepoName(entityName) {
  */
 function getScopedEntities(entities) {
     return entities
-        .filter(entity => entity.scopeBy)
-        .map(entity => {
+        .filter((entity) => entity.scopeBy)
+        .map((entity) => {
         const options = { ...DEFAULT_SCOPE_OPTIONS, ...entity.scopeOptions };
         return {
             name: entity.name,
@@ -88,24 +89,46 @@ exports.getScopedEntities = getScopedEntities;
  * @returns True if at least one entity has scopeBy defined.
  */
 function hasScopedEntities(entities) {
-    return entities.some(entity => entity.scopeBy);
+    return entities.some((entity) => entity.scopeBy);
 }
 exports.hasScopedEntities = hasScopedEntities;
+/**
+ * Normalizes auth config by applying defaults for DB session providers
+ * @param {AuthConfig | undefined} auth - The auth configuration to normalize
+ * @returns {DbSessionAuthConfig | undefined} The normalized auth config or undefined
+ */
+function normalizeAuthConfig(auth) {
+    if (!auth)
+        return undefined;
+    if ((0, types_1.isDbSessionAuth)(auth)) {
+        return {
+            ...types_1.DB_SESSION_AUTH_DEFAULTS,
+            ...auth,
+        };
+    }
+    // For now, only DB session providers are supported
+    // JWT providers will be added later
+    console.log(`[apso] Auth provider '${auth.provider}' is not yet supported, skipping auth guard generation`);
+    return undefined;
+}
 /**
  * Generates the guards module directory and files.
- * Creates scope.guard.ts, guards.module.ts, and index.ts in the guards directory.
+ * Creates auth.guard.ts, scope.guard.ts, guards.module.ts, and index.ts in the guards directory.
  *
  * @param rootPath The root path of the generated source (e.g., 'src').
  * @param entities All entities from the parsed .apsorc.
+ * @param auth Optional auth configuration from .apsorc.
  * @returns {Promise<void>} A promise that resolves when the guard files are created.
  */
-const createGuards = async (rootPath, entities) => {
-    // Only generate guards if there are scoped entities
-    if (!hasScopedEntities(entities)) {
-        console.log('[apso] No scopeBy configurations found, skipping guards generation');
+const createGuards = async (rootPath, entities, auth) => {
+    const hasScopes = hasScopedEntities(entities);
+    const normalizedAuth = normalizeAuthConfig(auth);
+    // Only generate guards if there are scoped entities OR auth config
+    if (!hasScopes && !normalizedAuth) {
+        console.log("[apso] No scopeBy or auth configurations found, skipping guards generation");
         return;
     }
-    const guardsDir = path.join(rootPath, 'guards');
+    const guardsDir = path.join(rootPath, "autogen", "guards");
     // Ensure guards directory exists
     if (!fs.existsSync(guardsDir)) {
         fs.mkdirSync(guardsDir, { recursive: true });
@@ -114,24 +137,40 @@ const createGuards = async (rootPath, entities) => {
     // Common template data
     const templateData = {
         scopedEntities,
+        authConfig: normalizedAuth,
         generatedAt: new Date().toISOString(),
-        generatedBy: 'Apso CLI',
+        generatedBy: "Apso CLI",
     };
-    // Generate scope.guard.ts
-    const scopeGuardPath = path.join(guardsDir, 'scope.guard.ts');
-    const scopeGuardContent = await Eta.renderFileAsync('./guards/scope.guard', templateData);
-    await (0, file_system_1.createFile)(scopeGuardPath, scopeGuardContent);
-    console.log(`[apso] Generated ${scopeGuardPath}`);
+    // Generate auth.guard.ts if auth is configured
+    if (normalizedAuth) {
+        const authGuardPath = path.join(guardsDir, "auth.guard.ts");
+        const authGuardContent = await Eta.renderFileAsync("./guards/auth.guard.eta", templateData);
+        await (0, file_system_1.createFile)(authGuardPath, authGuardContent);
+        console.log(`[apso] Generated ${authGuardPath}`);
+    }
+    // Generate scope.guard.ts if there are scoped entities
+    if (hasScopes) {
+        const scopeGuardPath = path.join(guardsDir, "scope.guard.ts");
+        const scopeGuardContent = await Eta.renderFileAsync("./guards/scope.guard.eta", templateData);
+        await (0, file_system_1.createFile)(scopeGuardPath, scopeGuardContent);
+        console.log(`[apso] Generated ${scopeGuardPath}`);
+    }
     // Generate guards.module.ts
-    const guardsModulePath = path.join(guardsDir, 'guards.module.ts');
-    const guardsModuleContent = await Eta.renderFileAsync('./guards/guards.module', templateData);
+    const guardsModulePath = path.join(guardsDir, "guards.module.ts");
+    const guardsModuleContent = await Eta.renderFileAsync("./guards/guards.module.eta", templateData);
     await (0, file_system_1.createFile)(guardsModulePath, guardsModuleContent);
     console.log(`[apso] Generated ${guardsModulePath}`);
     // Generate index.ts
-    const indexPath = path.join(guardsDir, 'index.ts');
-    const indexContent = await Eta.renderFileAsync('./guards/index', templateData);
+    const indexPath = path.join(guardsDir, "index.ts");
+    const indexContent = await Eta.renderFileAsync("./guards/index.eta", templateData);
     await (0, file_system_1.createFile)(indexPath, indexContent);
     console.log(`[apso] Generated ${indexPath}`);
-    console.log(`[apso] Generated guards for ${scopedEntities.length} scoped entities`);
+    // Summary
+    const parts = [];
+    if (normalizedAuth)
+        parts.push(`auth (${normalizedAuth.provider})`);
+    if (scopedEntities.length > 0)
+        parts.push(`${scopedEntities.length} scoped entities`);
+    console.log(`[apso] Generated guards for ${parts.join(" + ")}`);
 };
 exports.createGuards = createGuards;

package/dist/lib/module.js

@@ -31,7 +31,9 @@ const createModule = async (apiBaseDir, entity, options) => {
         entityName,
     };
     // Determine template based on API type
-    const templatePath = (options === null || options === void 0 ? void 0 : options.apiType) === "graphql" ? "./graphql/gql-module-graphql" : "./rest/module-rest";
+    const templatePath = (options === null || options === void 0 ? void 0 : options.apiType) === "graphql"
+        ? "./graphql/gql-module-graphql"
+        : "./rest/module-rest";
     // Render the template
     const content = await Eta.renderFileAsync(templatePath, data);
     // Create the module file

package/dist/lib/templates/guards/auth.guard.eta

@@ -0,0 +1,228 @@
+/**
+ * AuthGuard - Authentication guard for <%= it.authConfig.provider %> provider
+ *
+ * Auto-generated by Apso CLI from .apsorc auth configuration
+ * Generated at: <%= it.generatedAt %>
+ *
+ * This guard:
+ * - Validates session tokens from cookies/headers
+ * - Loads user and organization context
+ * - Attaches normalized AuthContext to requests
+ *
+ * DO NOT EDIT - Changes will be overwritten on next scaffold
+ */
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+
+// Entity imports (from sibling autogen folders)
+import { <%= it.authConfig.sessionEntity %> } from '../<%= it.authConfig.sessionEntity %>/<%= it.authConfig.sessionEntity %>.entity';
+import { <%= it.authConfig.userEntity %> } from '../<%= it.authConfig.userEntity %>/<%= it.authConfig.userEntity %>.entity';
+<% if (it.authConfig.accountUserEntity) { %>
+import { <%= it.authConfig.accountUserEntity %> } from '../<%= it.authConfig.accountUserEntity %>/<%= it.authConfig.accountUserEntity %>.entity';
+<% } %>
+
+/**
+ * Metadata key for marking routes as public (no auth required)
+ */
+export const IS_PUBLIC_KEY = 'isPublic';
+
+/**
+ * Decorator to mark a route as public (skips authentication)
+ * Usage: @Public()
+ */
+export const Public =
+  () => (target: any, key?: string, descriptor?: PropertyDescriptor) => {
+    Reflect.defineMetadata(IS_PUBLIC_KEY, true, descriptor?.value || target);
+  };
+
+/**
+ * Normalized auth context attached to authenticated requests.
+ * This is what scopeBy and RBAC consume.
+ */
+export interface AuthContext {
+  userId?: string;
+  email?: string;
+  workspaceId?: string;
+  organizationId?: string;
+  roles: string[];
+  user?: <%= it.authConfig.userEntity %>;
+  session?: <%= it.authConfig.sessionEntity %>;
+}
+
+/**
+ * Extended request type with auth context
+ */
+export interface AuthenticatedRequest extends Request {
+  auth: AuthContext;
+  user: <%= it.authConfig.userEntity %>;
+  session: <%= it.authConfig.sessionEntity %>;
+  // Legacy compatibility aliases
+  accountId?: string;
+  accountRole?: string;
+  organizationId?: string;
+}
+
+@Injectable()
+export class AuthGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    @InjectRepository(<%= it.authConfig.sessionEntity %>)
+    private sessionRepository: Repository<<%= it.authConfig.sessionEntity %>>,
+    @InjectRepository(<%= it.authConfig.userEntity %>)
+    private userRepository: Repository<<%= it.authConfig.userEntity %>>,
+<% if (it.authConfig.accountUserEntity) { %>
+    @InjectRepository(<%= it.authConfig.accountUserEntity %>)
+    private accountUserRepository: Repository<<%= it.authConfig.accountUserEntity %>>,
+<% } %>
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Check if route is marked as public
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No session token provided');
+    }
+
+    try {
+      // Find session by token
+      const sessionRecord = await this.sessionRepository.findOne({
+        where: { token },
+      });
+
+      if (!sessionRecord) {
+        throw new UnauthorizedException('Invalid session token');
+      }
+
+      // Check if session is expired
+      if (new Date(sessionRecord.expiresAt) < new Date()) {
+        throw new UnauthorizedException('Session expired');
+      }
+
+      // Get user from session
+      const user = await this.userRepository.findOne({
+        where: { id: sessionRecord.userId },
+      });
+
+      if (!user) {
+        throw new UnauthorizedException('User not found');
+      }
+
+<% if (it.authConfig.accountUserEntity) { %>
+      // Get user's organization through <%= it.authConfig.accountUserEntity %> junction
+      const accountUser = await this.accountUserRepository.findOne({
+        where: { userId: user.id },
+      });
+
+      if (!accountUser) {
+        throw new UnauthorizedException('User not associated with any organization');
+      }
+
+      const organizationId = accountUser.<%= it.authConfig.organizationField %>;
+      const role = accountUser.<%= it.authConfig.roleField %> || 'member';
+<% } else { %>
+      // No account user entity configured - using user-level organization
+      const organizationId = (user as any).<%= it.authConfig.organizationField %> || undefined;
+      const role = (user as any).<%= it.authConfig.roleField %> || 'member';
+<% } %>
+
+      // Build normalized AuthContext
+      const authContext: AuthContext = {
+        userId: user.id,
+        email: user.email,
+        workspaceId: organizationId,
+        organizationId: organizationId,
+        roles: [role],
+        user: user,
+        session: sessionRecord,
+      };
+
+      // Attach to request
+      (request as any).auth = authContext;
+      (request as any).user = user;
+      (request as any).session = sessionRecord;
+
+      // Legacy compatibility - attach directly to request root
+      (request as any).accountId = organizationId;
+      (request as any).accountRole = role;
+      (request as any).organizationId = organizationId;
+
+      return true;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      console.error('Auth guard error:', error);
+      throw new UnauthorizedException('Authentication failed');
+    }
+  }
+
+  /**
+   * Extract session token from request
+   * Checks: Authorization header (Bearer), cookies, X-Session-Token header
+   */
+  private extractToken(request: any): string | undefined {
+    // Check Authorization header first (Bearer token)
+    const authHeader = request.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      return authHeader.substring(7);
+    }
+
+    // Check for session token in cookies
+    const cookies = request.cookies || {};
+<% if (it.authConfig.cookiePrefix) { %>
+    const cookieName = '<%= it.authConfig.cookiePrefix %>.session_token';
+    const sessionToken =
+      cookies[cookieName] ||
+      cookies['better-auth.session_token'] ||
+      cookies['session_token'];
+<% } else { %>
+    const sessionToken =
+      cookies['better-auth.session_token'] ||
+      cookies['session_token'];
+<% } %>
+
+    if (sessionToken) {
+      return sessionToken;
+    }
+
+    // Check X-Session-Token header
+    return request.headers['x-session-token'];
+  }
+}
+
+/**
+ * Helper function to get AuthContext from request
+ * Use this in controllers/services to access the authenticated context
+ */
+export function getAuthContext(request: any): AuthContext | undefined {
+  return request?.auth;
+}
+
+/**
+ * Helper function to require AuthContext (throws if not present)
+ */
+export function requireAuthContext(request: any): AuthContext {
+  const ctx = getAuthContext(request);
+  if (!ctx) {
+    throw new UnauthorizedException('Authentication required');
+  }
+  return ctx;
+}