@astram/guard 0.1.0 → 0.2.0

package/dist/module/shield.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AACnF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAExE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAkBhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CA8BtE"}
+{"version":3,"file":"shield.module.d.ts","sourceRoot":"","sources":["../../src/module/shield.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAiB,MAAM,gBAAgB,CAAC;AAMnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AASxE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAE7E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,IAAI,EAAE,SAAS,OAAO,EAAE,KACxB,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;IACxD,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAEa,YAAY;IACvB,6DAA6D;IAC7D,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;IAgDhE;;;;;;;;;OASG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,wBAAwB,GAAG,aAAa;CAwDtE"}

package/dist/module/shield.module.js

@@ -14,6 +14,13 @@ const enforcement_module_js_1 = require("../enforcement/enforcement.module.js");
 const boot_module_js_1 = require("../boot/boot.module.js");
 const config_module_js_1 = require("../config/config.module.js");
 const app_config_js_1 = require("../config/app-config.js");
+// Static import is SAFE: auth.module.ts top-level-imports @astram/core as TYPES
+// only (it loads core's ESM factory VALUES lazily inside its async provider
+// factories — see auth.module.ts loadCore()). So pulling AuthModule here does NOT
+// trigger a runtime `require('@astram/core')`; the opt-in gate below still ensures
+// the enforcement-only path never INSTANTIATES it (no live pool/Redis, no HMAC
+// gate, no core load).
+const auth_module_js_1 = require("../auth/auth.module.js");
 /**
  * DI token for the Core decision authority (the ADR-0001 single decision
  * authority) that the enforcement guard consults. The consumer supplies the real
@@ -50,11 +57,33 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
     /** Register Shield with static options (the common path). */
     static forRoot(options = {}) {
         const config = options.config ?? (0, app_config_js_1.loadAppConfig)();
+        // Build the opt-in AuthModule ONCE so the SAME DynamicModule instance is both
+        // imported (composes) and re-exported (propagates its exported engine tokens
+        // app-wide through the @Global ShieldModule). Re-exporting the two Symbols
+        // directly is NOT valid Nest — a module may only re-export a whole imported
+        // module (or a token IT provides), so we export the AuthModule dynamic module.
+        // When auth is opted in, thread the consumer's optional credentialResolver into
+        // AuthModule (it binds the supplied instance under SHIELD_CREDENTIAL_RESOLVER;
+        // omitted → the default MariaDb store, unchanged). Without auth the resolver is
+        // irrelevant (no AuthModule composes) — a documented no-op.
+        const authModule = options.auth
+            ? auth_module_js_1.AuthModule.forRoot(
+            // Only pass the property when the consumer supplied one — under
+            // `exactOptionalPropertyTypes`, an explicit `undefined` is not assignable
+            // to the optional `credentialResolver`; a spread keeps it truly absent so
+            // AuthModule falls back to the default MariaDb binding.
+            options.credentialResolver
+                ? { credentialResolver: options.credentialResolver }
+                : {})
+            : undefined;
         return {
             module: ShieldModule_1,
             // Compose the framework modules — EnforcementModule holds the ONE APP_GUARD
             // binding; BootModule holds the boot-sequence hook. No re-declaration here.
-            imports: [enforcement_module_js_1.EnforcementModule, boot_module_js_1.BootModule],
+            // AuthModule is OPT-IN (options.auth === true): only then does the app open a
+            // live pool/Redis + fire the fail-closed HMAC gate. Absent/false → the
+            // enforcement-only no-`.env` boot survives untouched.
+            imports: [enforcement_module_js_1.EnforcementModule, boot_module_js_1.BootModule, ...(authModule ? [authModule] : [])],
             providers: [
                 { provide: config_module_js_1.APP_CONFIG, useValue: config },
                 {
@@ -62,7 +91,14 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
                     useValue: options.decisionAuthority ?? core_seam_js_1.stubDecisionAuthority,
                 },
             ],
-            exports: [config_module_js_1.APP_CONFIG, exports.SHIELD_DECISION_AUTHORITY],
+            // Re-export the composed AuthModule app-wide ONLY when auth is opted in — its
+            // own `exports` (SHIELD_AUTHENTICATOR / SHIELD_SESSION_AUTHORITY) then become
+            // visible to a consumer's controllers/services via the @Global seam.
+            exports: [
+                config_module_js_1.APP_CONFIG,
+                exports.SHIELD_DECISION_AUTHORITY,
+                ...(authModule ? [authModule] : []),
+            ],
         };
     }
     /**
@@ -92,12 +128,37 @@ let ShieldModule = ShieldModule_1 = class ShieldModule {
             useFactory: (opts) => opts.decisionAuthority ?? core_seam_js_1.stubDecisionAuthority,
             inject: [optionsToken],
         };
+        // Same one-instance opt-in AuthModule as forRoot (imported + re-exported).
+        // `credentialResolver` is STATIC on the async options (like `auth`) — a
+        // registration-time collaborator, threaded straight through here.
+        const authModule = options.auth
+            ? auth_module_js_1.AuthModule.forRoot(
+            // Only pass the property when the consumer supplied one — under
+            // `exactOptionalPropertyTypes`, an explicit `undefined` is not assignable
+            // to the optional `credentialResolver`; a spread keeps it truly absent so
+            // AuthModule falls back to the default MariaDb binding.
+            options.credentialResolver
+                ? { credentialResolver: options.credentialResolver }
+                : {})
+            : undefined;
         return {
             module: ShieldModule_1,
             // Same single-path composition as forRoot (+ the caller's option imports).
-            imports: [enforcement_module_js_1.EnforcementModule, boot_module_js_1.BootModule, ...(options.imports ?? [])],
+            // AuthModule is OPT-IN via the STATIC `options.auth` flag (see the interface
+            // doc — the imports list is composed statically, so auth cannot be gated on
+            // the async-resolved options).
+            imports: [
+                enforcement_module_js_1.EnforcementModule,
+                boot_module_js_1.BootModule,
+                ...(authModule ? [authModule] : []),
+                ...(options.imports ?? []),
+            ],
             providers: [asyncOptionsProvider, configProvider, authorityProvider],
-            exports: [config_module_js_1.APP_CONFIG, exports.SHIELD_DECISION_AUTHORITY],
+            exports: [
+                config_module_js_1.APP_CONFIG,
+                exports.SHIELD_DECISION_AUTHORITY,
+                ...(authModule ? [authModule] : []),
+            ],
         };
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/guard",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "description": "Astram framework — the enforcement guard + real-world adapters (the 'hands'). One global deny-by-default gate every request passes through (ADR-0002), classification decorators, boot-pool assertion (ADR-0018), the forRoot() registration seam, and the DB/Redis/crypto adapters that connect the sealed core to a real backend. Depends on @astram/core (ADR-0003, ADR-0023).",
   "type": "commonjs",
@@ -19,16 +19,11 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "test": "vitest run"
-  },
   "dependencies": {
-    "@astram/core": "workspace:*",
     "argon2": "^0.41.1",
     "ioredis": "^5.4.1",
-    "mariadb": "^3.4.0"
+    "mariadb": "^3.4.0",
+    "@astram/core": "0.1.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -48,5 +43,10 @@
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "vitest run"
   }
-}
+}