@bearei/nest 0.0.0-stage → 2.0.0-dev.1

package/CHANGELOG.md

@@ -0,0 +1,76 @@
+# Changelog
+
+All notable changes to this project are documented in this file. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## 2.0.0-dev.1 — 2026-10-26
+
+Development snapshot published under the `next` dist-tag for early integration.
+Its contents match the 2.0.0 scope documented below; this entry is replaced by the
+final 2.0.0 release notes.
+
+Install it with `yarn add @bearei/nest@next` or pin `@bearei/nest@2.0.0-dev.1`.
+
+## 2.0.0 — unreleased
+
+First release under `@bearei/nest`. It supersedes `@bearei/service-common`, whose last release was `1.7.9`;
+that package replaced `@bearei/server-common` at `1.4.0`. The major version matches the studio-wide 2.0.0
+baseline; because the npm identity is new, the Breaking list below is also the migration guide from `1.7.9`.
+
+### Breaking
+
+-   Renamed the package to `@bearei/nest` (previously `@bearei/service-common`, originally `@bearei/server-common`). Update imports; the old names will not be published again.
+-   Raised the runtime baseline to Node.js >= 20, NestJS 11, TypeORM 1.x and `@nestjs/axios` 4. NestJS, TypeORM, validation, Axios, RxJS and `reflect-metadata` are peer dependencies, so the application owns exactly one copy of each.
+-   Removed `CommonEntity.entityStatus`, `EntityStatus` and `ENTITY_STATUS`. Soft deletion is expressed only by `deletedAt`; recovery clears `deletedAt`. The `@BeforeSoftRemove` / `@BeforeRecover` hooks are gone.
+-   Renamed `CommonEntity.primaryId` to `internalId` (column `internal_id`). `createdAt` / `updatedAt` / `deletedAt` are typed `Date | string` (`deletedAt` also `null`) so imported JSON values are preserved.
+-   `CommonEntity.beforeInsert` now keeps a caller-provided `id` and `createdAt` instead of overwriting them, which makes imports idempotent.
+-   Split `BaseService` options into `BaseServiceCreateOptions`, `BaseServiceDeleteOptions`, `BaseServiceUpdateOptions`, `BaseServiceFindOptions`, `BaseServiceCountOptions`, `BaseServiceFindOneOptions` and `BaseServiceUpdateAssociationOptions`. `BaseServiceOptions<T>` is no longer generic. The old `CreateOptions` / `DelOptions` / `UpdateOptions` / `FindOptions` / `CountOptions` / `FindOneOptions` / `UpdateAssociationOptions` types are removed.
+-   Renamed `BaseService.del` to `delete` and `BaseService.checkProhibited` to `assertNotProhibited`. `BaseService.throwError` now takes `{httpExceptionKind, ...}`.
+-   `BaseService.createSuccessActionLog` now takes the affected entity (or entities) plus `ActionLogOptions`. `ActionLogService.success` / `.failure` take the payload as the first argument.
+-   Renamed `ActionLogOptions.enabledLog` to `isLogEnabled`. `headers` is optional, and logging requires both `isLogEnabled` and `headers`.
+-   Replaced `throwHTTPException(options)(exception)` with `createHttpException(kind, options)` and `throwHttpException(kind, options)`. `HTTPException` / `HTTPExceptionCode` are renamed to `HttpExceptionKind` / `HttpExceptionCode`, and `ThrowHTTPExceptionOptions` to `ThrowHttpExceptionOptions`.
+-   `HTTP_EXCEPTION.GENERIC` now returns `{code, message, statusCode}` instead of `{code, message, status}`; every exception kind uses the same `statusCode` field.
+-   `VALIDATION_METHOD` values are now `AND` / `OR` instead of `and` / `or`. Update persisted or hard-coded values.
+-   Renamed the DTOs: `IndexDTO` → `ListQueryDto` (`size` → `pageSize`, `count` → `withTotal`, `order` → `sortOrder`, `createdAtRanges` → `createdAtRange`), `ByIdDTO` → `ByIdDto`, `ByEmailDTO` → `ByEmailDto`, `NotIdDTO` → `ExcludeIdDto` (`notId` → `excludeId`).
+-   Replaced the pagination result `FindResult` (string `limit` / `offset` / `total`) with `PaginatedResult` (`page`, `pageSize`, optional numeric `total`, `results`).
+-   Renamed the decorators: `PublicAccesses` → `AllowAccess`, `AuthenticationPermissions` → `RequirePermissions`, `AuthenticationSubscriptionFeatures` → `RequireSubscriptionFeatures`, `IsNanoid` → `IsNanoId`, `OmitEntityKey` → `OmitEntityKeys`. Their metadata keys changed as well.
+-   Removed `AccessGuard`, `AccessInterceptor`, `AuthenticationService`, `AuthenticationModule` and the `AppModule` / controller / service / `main.ts` bootstrap. This package is a library and no longer ships a runnable Nest application.
+-   Removed the `buildMobileNumber`, `generateRandomNumber` and `createSanitizeResponseEntity` utilities; the replacements are listed under Added.
+-   Changed permission values from `DOMAIN_DOMAIN_ACTION` to `resource:action` (for example `USER_USER_VIEW` → `user:read`). Persisted permission rows must be migrated.
+-   Reduced `SUBSCRIPTION_FEATURE` to `BEAREI_BOOKMARK_CLOUD_SYNC`; the previous bookmark/carton/tag flags are removed.
+-   Renamed JWT types `JWTPayloadOptions` → `JwtSignPayloadOptions` and `JWTPayload` → `JwtPayload`. `jti` and `nbf` are optional in the payload. Tokens are signed with RS256 from the JWK in `jwt.privateKey`.
+-   Renamed `RedisSetOptions.expireTime` to `ttlMilliseconds`.
+-   Renamed `ExternalService.authenticationUserPermissions` / `authenticationUserSubscriptionFeatures` to `findUserPermissions` / `findUserSubscriptionFeatures`.
+
+### Added
+
+-   `AuthenticationGuard`: verifies bearer tokens, resolves the request identity and accepts internal HMAC-signed calls.
+-   `AuthenticationContextInterceptor`: rejects client-supplied `x-bearei-*` identity headers, forwards trusted identity headers and sanitizes response bodies.
+-   `AuthorizationModule` / `AuthorizationService`: permission resolution behind `@RequirePermissions`.
+-   `BaseService.createMany`: batch insert that applies the same server-managed-key rules as `create`.
+-   Query options on `BaseServiceFindOptions`: `innerJoin`, `queryBuilderWhere`, `totalFindOptions` and `sortBy` for joined, filtered and counted lists.
+-   `CommonEntity`: nanoid public `id`, internal numeric id, optimistic-locking `version`, UTC timestamps and idempotent inserts.
+-   `ListQueryDto`, `ByIdDto`, `ByEmailDto`, `ExcludeIdDto`, plus `PaginatedResult`, `ReservedRequestHeaders`, `AuthenticatedRequest` and string-literal union types for the shared enums.
+-   `ApiErrorBody` and `ReservedRequestHeaderName`, re-exported from `@bearei/contracts`.
+-   `createResponseSanitizer` (replaces `createSanitizeResponseEntity`), `formatMobileNumber` (replaces `buildMobileNumber`) and `generateRandomNumberString` (replaces `generateRandomNumber`).
+-   `runWithDatabaseRetry` for transient database connection failures.
+-   `AllowAccess`, `RequirePermissions` and `RequireSubscriptionFeatures` decorators, alongside the existing validators.
+-   Unit tests for every module, root-export smoke test, `test/setup.ts`, and CI workflows for verification and tag-driven releases.
+
+### Changed
+
+-   `ActionLogService` is best-effort: unless logging is explicitly enabled and headers are forwarded, it skips the write and never fails the business operation.
+-   `JwtService.verifyAsync` normalizes verification failures to `UNAUTHORIZED` and logs the underlying reason.
+-   `extractBearerToken` now matches the `Bearer` scheme case-insensitively, accepts a configurable header name and returns `undefined` for malformed or non-string headers.
+-   `ExternalService.createActionLog` takes the request headers plus `{action, serviceName, data, ...}` instead of a single options object.
+-   `ListQueryDto` transforms accept empty query values, numeric strings and date arrays without producing `NaN` or invalid dates.
+-   `@bearei/contracts` now owns `HTTP_EXCEPTION_CODE`, `LANGUAGE`, `ORDER`, `ApiErrorBody`, `ReservedRequestHeaderName` and `PaginatedResult`. `@bearei/nest` re-exports the same names, and `PaginatedResult<T>` is no longer constrained to `CommonEntity`.
+
+### Removed
+
+-   Application scaffold: `AppModule`, `AppController`, `AppService`, `main.ts` and the e2e test harness.
+-   Fastify and Helmet platform dependencies; the library no longer chooses an HTTP adapter.
+-   The `crypto` runtime dependency; signing uses Node's built-in `crypto`.
+-   `ENTITY_STATUS`, `EntityStatus`, `entityStatus`, `beforeSoftRemove` and `beforeRecover`.
+-   The old `access/`, `app.*` and `authentication.service` modules.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Bearei
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,101 @@
-# Temporary Holding Version
+# @bearei/nest
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Shared foundation modules for Bearei NestJS services: base CRUD service, authentication and authorization guards, permission and subscription-feature checks, JWT, Redis, external HTTP calls, action logging, and common DTOs/entities.
+
+English | [中文](./README.zh-CN.md)
+
+This package was previously published as `@bearei/service-common` (last release `1.7.9`). `@bearei/nest` starts at `2.0.0`, matching the studio-wide baseline; because the package name changed, it is a new install rather than an in-place upgrade. Migration notes are in the [CHANGELOG](./CHANGELOG.md).
+
+## Requirements
+
+-   Node.js >= 20
+-   NestJS 11
+-   TypeORM 1.x
+
+## Installation
+
+The package declares its NestJS, TypeORM, and validation dependencies as peer dependencies so your application owns exactly one copy of each.
+
+```bash
+yarn add @bearei/nest
+yarn add @nestjs/common @nestjs/core @nestjs/config @nestjs/axios @nestjs/jwt @nestjs/typeorm
+yarn add axios class-transformer class-validator reflect-metadata rxjs typeorm
+```
+
+Runtime dependencies installed automatically: `@bearei/contracts`, `bcrypt`, `dayjs`, `ioredis`, `nanoid`.
+
+Wire contracts shared with clients — error codes, the error body shape, pagination limits, language and sort values, and reserved request headers — live in `@bearei/contracts` and are re-exported from this package.
+
+## Modules
+
+| Module                           | Responsibility                                                                      |
+| -------------------------------- | ----------------------------------------------------------------------------------- |
+| `BaseServiceModule`              | Generic TypeORM CRUD service with pagination, relation handling, and action logging |
+| `DatabaseModule`                 | TypeORM connection helpers and retry support                                        |
+| `JwtModule`                      | RS256 signing and verification from a JWK configured under `jwt.*`                  |
+| `RedisModule`                    | Shared ioredis client and cache helpers                                             |
+| `ExternalModule`                 | Outbound HTTP requests through `@nestjs/axios`                                      |
+| `ActionLogModule`                | Pluggable action-log writer                                                         |
+| `AuthorizationModule`            | Permission resolution and guards                                                    |
+| `AuthenticationGuard`            | Bearer token resolution and authentication context                                  |
+| `SubscriptionFeatureInterceptor` | Subscription-feature enforcement                                                    |
+| `Common DTOs / entities / enums` | Pagination, response envelopes, shared entity columns, and shared enums             |
+
+Decorators include `@AllowAccess`, `@RequirePermissions`, `@RequireSubscriptionFeatures`, `@IsNanoId`, `@IsPassword`, `@IsVersion`, `@IsCaptcha`, and `@OmitEntityKeys`.
+
+## Quick start
+
+```ts
+import {Module} from '@nestjs/common'
+import {ConfigModule} from '@nestjs/config'
+import {DatabaseModule, JwtModule, RedisModule} from '@bearei/nest'
+
+@Module({
+	imports: [ConfigModule.forRoot({isGlobal: true}), DatabaseModule, JwtModule, RedisModule]
+})
+export class AppModule {}
+```
+
+Extend the base service for CRUD endpoints:
+
+```ts
+import {Injectable} from '@nestjs/common'
+import {InjectRepository} from '@nestjs/typeorm'
+import {BaseService} from '@bearei/nest'
+import {Repository} from 'typeorm'
+
+import {User} from './user.entity'
+
+@Injectable()
+export class UserService extends BaseService<User> {
+	constructor(@InjectRepository(User) repository: Repository<User>) {
+		super(repository)
+	}
+}
+```
+
+JWT configuration is read from `jwt.privateKey` (a JWK object or JSON string), `jwt.expiresIn`, and an optional `jwt.publicKey`.
+
+## Development
+
+```bash
+yarn install
+yarn lint        # ESLint, no fixes
+yarn typecheck   # tsc --noEmit
+yarn test        # Jest with coverage thresholds
+yarn build       # compile to dist/
+yarn verify      # lint + typecheck + test + build
+```
+
+Packaging:
+
+```bash
+yarn pack --dry-run   # inspect the published file list
+yarn pack             # produce the tarball
+```
+
+Releases are published from CI on version tags. Update `version` in `package.json`, push the matching `v<version>` tag, and the release workflow publishes the package.
+
+## License
+
+MIT

package/README.zh-CN.md

@@ -0,0 +1,103 @@
+# @bearei/nest
+
+Bearei NestJS 服务的共享基础模块：通用 CRUD 基础服务、认证与授权守卫、权限与订阅特性校验、JWT、Redis、外部 HTTP 调用、操作日志，以及通用 DTO 与实体。
+
+[English](./README.md) | 中文
+
+本包此前以 `@bearei/service-common` 发布（最后版本 `1.7.9`）。`@bearei/nest` 从 `2.0.0` 开始，与工作室整体版本基线对齐；包名已变更，属于重新安装而非原地升级。迁移说明见 [CHANGELOG](./CHANGELOG.md)。
+
+## 环境要求
+
+-   Node.js >= 20
+-   NestJS 11
+-   TypeORM 1.x
+
+## 安装
+
+本包将 NestJS、TypeORM 及校验相关依赖声明为 peer dependencies，确保应用中每个依赖只存在一个实例。
+
+```bash
+yarn add @bearei/nest
+yarn add @nestjs/common @nestjs/core @nestjs/config @nestjs/axios @nestjs/jwt @nestjs/typeorm
+yarn add axios class-transformer class-validator reflect-metadata rxjs typeorm
+```
+
+随包自动安装的运行时依赖：`@bearei/contracts`、`bcrypt`、`dayjs`、`ioredis`、`nanoid`。
+
+与客户端共享的传输契约——错误码、错误体结构、分页上限、语言与排序值、保留请求头——定义在 `@bearei/contracts`，并由本包转出。
+
+## 模块
+
+| 模块                             | 职责                                                 |
+| -------------------------------- | ---------------------------------------------------- |
+| `BaseServiceModule`              | 通用 TypeORM CRUD 服务，包含分页、关联处理与操作日志 |
+| `DatabaseModule`                 | TypeORM 连接辅助与重试支持                           |
+| `JwtModule`                      | 基于 `jwt.*` 配置中的 JWK 进行 RS256 签名与验签      |
+| `RedisModule`                    | 共享 ioredis 客户端与缓存辅助方法                    |
+| `ExternalModule`                 | 通过 `@nestjs/axios` 发起外部 HTTP 请求              |
+| `ActionLogModule`                | 可插拔的操作日志写入能力                             |
+| `AuthorizationModule`            | 权限解析与守卫                                       |
+| `AuthenticationGuard`            | Bearer Token 解析与认证上下文                        |
+| `SubscriptionFeatureInterceptor` | 订阅特性校验                                         |
+| `通用 DTO / 实体 / 枚举`         | 分页、响应包装、共享实体列与通用枚举                 |
+
+装饰器包括 `@AllowAccess`、`@RequirePermissions`、`@RequireSubscriptionFeatures`、`@IsNanoId`、`@IsPassword`、`@IsVersion`、`@IsCaptcha` 与 `@OmitEntityKeys`。
+
+## 快速开始
+
+```ts
+import {Module} from '@nestjs/common'
+import {ConfigModule} from '@nestjs/config'
+import {DatabaseModule, JwtModule, RedisModule} from '@bearei/nest'
+
+@Module({
+	imports: [ConfigModule.forRoot({isGlobal: true}), DatabaseModule, JwtModule, RedisModule]
+})
+export class AppModule {}
+```
+
+通过继承基础服务实现 CRUD 接口：
+
+```ts
+import {Injectable} from '@nestjs/common'
+import {InjectRepository} from '@nestjs/typeorm'
+import {BaseService} from '@bearei/nest'
+import {Repository} from 'typeorm'
+
+import {User} from './user.entity'
+
+@Injectable()
+export class UserService extends BaseService<User> {
+	constructor(@InjectRepository(User) repository: Repository<User>) {
+		super(repository)
+	}
+}
+```
+
+JWT 相关配置读取自 `jwt.privateKey`（JWK 对象或 JSON 字符串）、`jwt.expiresIn`，以及可选的 `jwt.publicKey`。
+
+## 开发
+
+```bash
+yarn install
+yarn lint        # ESLint，不自动修复
+yarn typecheck   # tsc --noEmit
+yarn test        # Jest，含覆盖率门槛
+yarn build       # 编译到 dist/
+yarn verify      # lint + typecheck + test + build
+```
+
+打包：
+
+```bash
+yarn pack --dry-run   # 查看将要发布的文件清单
+yarn pack             # 生成 tarball
+```
+
+## 发布
+
+发布由 CI 在版本 tag 上执行。修改 `package.json` 中的 `version`，推送同版本的 `v<version>` tag，发布工作流会自动校验 tag 与版本一致并发布到 npm。
+
+## 许可证
+
+MIT

package/dist/action-log/action-log.interface.d.ts

@@ -0,0 +1,12 @@
+import type { Action, ActionResult, RequestHeaders } from '../common.interface';
+export interface ActionLogOptions {
+    action: Action;
+    headers?: RequestHeaders;
+    isLogEnabled?: boolean;
+    message?: string;
+    raw: Record<string, unknown>;
+    serviceName: string;
+}
+export interface CreateActionLogOptions extends ActionLogOptions {
+    result: ActionResult;
+}

package/dist/action-log/action-log.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/action-log/action-log.module.d.ts

@@ -0,0 +1,2 @@
+export declare class ActionLogModule {
+}

package/dist/action-log/action-log.module.js

@@ -0,0 +1,22 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionLogModule = void 0;
+const common_1 = require("@nestjs/common");
+const external_1 = require("../external");
+const action_log_service_1 = require("./action-log.service");
+let ActionLogModule = class ActionLogModule {
+};
+exports.ActionLogModule = ActionLogModule;
+exports.ActionLogModule = ActionLogModule = __decorate([
+    (0, common_1.Module)({
+        exports: [action_log_service_1.ActionLogService],
+        imports: [external_1.ExternalModule],
+        providers: [action_log_service_1.ActionLogService]
+    })
+], ActionLogModule);

package/dist/action-log/action-log.service.d.ts

@@ -0,0 +1,10 @@
+import type { ActionLogOptions, CreateActionLogOptions } from './action-log.interface';
+import { ExternalService } from '../external';
+export declare class ActionLogService {
+    private readonly externalService;
+    private readonly logger;
+    constructor(externalService: ExternalService);
+    success(data: Record<string, unknown>, options: ActionLogOptions): Promise<void>;
+    failure(data: Record<string, unknown>, options: ActionLogOptions): Promise<void>;
+    create(data: Record<string, unknown>, { headers, isLogEnabled, ...restOptions }: CreateActionLogOptions): Promise<void>;
+}

package/dist/action-log/action-log.service.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ActionLogService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActionLogService = void 0;
+const common_1 = require("@nestjs/common");
+const common_enum_1 = require("../common.enum");
+const external_1 = require("../external");
+let ActionLogService = ActionLogService_1 = class ActionLogService {
+    externalService;
+    logger = new common_1.Logger(ActionLogService_1.name);
+    constructor(externalService) {
+        this.externalService = externalService;
+    }
+    success(data, options) {
+        return this.create(data, { ...options, result: common_enum_1.ACTION_RESULT.SUCCESS });
+    }
+    failure(data, options) {
+        return this.create(data, { ...options, result: common_enum_1.ACTION_RESULT.FAILURE });
+    }
+    async create(data, { headers, isLogEnabled = false, ...restOptions }) {
+        if (!isLogEnabled || !headers) {
+            return;
+        }
+        await this.externalService
+            .createActionLog(headers, { ...restOptions, data })
+            .catch(error => this.logger.warn('Operation log enqueue failed.', String(error)));
+    }
+};
+exports.ActionLogService = ActionLogService;
+exports.ActionLogService = ActionLogService = ActionLogService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [external_1.ExternalService])
+], ActionLogService);

package/dist/action-log/index.d.ts

@@ -0,0 +1,3 @@
+export * from './action-log.interface';
+export * from './action-log.module';
+export * from './action-log.service';

package/dist/action-log/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./action-log.interface"), exports);
+__exportStar(require("./action-log.module"), exports);
+__exportStar(require("./action-log.service"), exports);

package/dist/authentication/authentication-context.interceptor.d.ts

@@ -0,0 +1,7 @@
+import type { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class AuthenticationContextInterceptor implements NestInterceptor {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    intercept(context: ExecutionContext, next: CallHandler): import("rxjs").Observable<any>;
+}

package/dist/authentication/authentication-context.interceptor.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationContextInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const rxjs_1 = require("rxjs");
+const decorators_1 = require("../decorators");
+const exception_1 = require("../exception");
+const utils_1 = require("../utils");
+const DEFAULT_OMIT_ENTITY_KEYS = ['deletedAt', 'internalId', 'version'];
+let AuthenticationContextInterceptor = class AuthenticationContextInterceptor {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    intercept(context, next) {
+        const requiredOmitEntityKeys = this.reflector.getAllAndOverride(decorators_1.OMIT_ENTITY_KEYS, [
+            context.getClass(),
+            context.getHandler()
+        ]);
+        const request = context.switchToHttp().getRequest();
+        const sanitizeResponseData = (0, utils_1.createResponseSanitizer)([
+            ...(requiredOmitEntityKeys ?? []),
+            ...DEFAULT_OMIT_ENTITY_KEYS
+        ]);
+        if (request.isInternalAccess) {
+            return next
+                .handle()
+                .pipe((0, rxjs_1.map)(data => (data && typeof data === 'object' ? sanitizeResponseData(data) : data)));
+        }
+        const reservedHeaderValues = [
+            request.headers['x-bearei-client'],
+            request.headers['x-bearei-domain-id'],
+            request.headers['x-bearei-ip'],
+            request.headers['x-bearei-subject']
+        ];
+        if (!request.isSubscriptionEvaluated) {
+            reservedHeaderValues.push(request.headers['x-bearei-subscription']);
+        }
+        if (reservedHeaderValues.some(Boolean)) {
+            (0, exception_1.throwHttpException)(exception_1.HTTP_EXCEPTION.BAD_REQUEST, {
+                code: exception_1.HTTP_EXCEPTION_CODE.CONTAINS_INVALID_REQUEST_HEADERS,
+                message: 'Contains invalid request headers.'
+            });
+        }
+        const forwardedFor = request.headers['x-forwarded-for'];
+        const clientIp = typeof forwardedFor === 'string' ? forwardedFor.split(',')[0].trim()
+            : Array.isArray(forwardedFor) ? forwardedFor[0]
+                : undefined;
+        request.headers['x-bearei-client'] = request.audience;
+        request.headers['x-bearei-domain-id'] = request.issuer;
+        request.headers['x-bearei-ip'] = clientIp ?? request.headers['x-real-ip'];
+        request.headers['x-bearei-subject'] = request.subject;
+        return next.handle().pipe((0, rxjs_1.map)(data => (data && typeof data === 'object' ? sanitizeResponseData(data) : data)));
+    }
+};
+exports.AuthenticationContextInterceptor = AuthenticationContextInterceptor;
+exports.AuthenticationContextInterceptor = AuthenticationContextInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], AuthenticationContextInterceptor);

package/dist/authentication/authentication.enum.d.ts

@@ -0,0 +1,6 @@
+export declare const ACCESS: {
+    readonly ALI_FC: "ALI_FC";
+    readonly APPLE_IAP: "APPLE_IAP";
+    readonly GUEST: "GUEST";
+    readonly USER: "USER";
+};

package/dist/authentication/authentication.enum.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESS = void 0;
+exports.ACCESS = {
+    ALI_FC: 'ALI_FC',
+    APPLE_IAP: 'APPLE_IAP',
+    GUEST: 'GUEST',
+    USER: 'USER'
+};

package/dist/authentication/authentication.guard.d.ts

@@ -0,0 +1,13 @@
+import type { CanActivate, ExecutionContext } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Reflector } from '@nestjs/core';
+import { JwtService } from '../jwt';
+export declare class AuthenticationGuard implements CanActivate {
+    private readonly configService;
+    private readonly jwtService;
+    private readonly reflector;
+    constructor(configService: ConfigService, jwtService: JwtService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private validatePayload;
+    private getHeader;
+}

package/dist/authentication/authentication.guard.js

@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationGuard = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const core_1 = require("@nestjs/core");
+const decorators_1 = require("../decorators");
+const exception_1 = require("../exception");
+const jwt_1 = require("../jwt");
+const utils_1 = require("../utils");
+const authentication_enum_1 = require("./authentication.enum");
+let AuthenticationGuard = class AuthenticationGuard {
+    configService;
+    jwtService;
+    reflector;
+    constructor(configService, jwtService, reflector) {
+        this.configService = configService;
+        this.jwtService = jwtService;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const allowedAccessTypes = this.reflector.getAllAndOverride(decorators_1.ALLOWED_ACCESS_TYPES, [
+            context.getClass(),
+            context.getHandler()
+        ]) ?? [];
+        const isPublic = [authentication_enum_1.ACCESS.ALI_FC, authentication_enum_1.ACCESS.APPLE_IAP].some(accessType => allowedAccessTypes.includes(accessType));
+        if (isPublic) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const headers = request.headers;
+        const authorizationHeader = headers['x-bearei-internal-authorization'] ? 'x-bearei-internal-authorization' : 'authorization';
+        const token = (0, utils_1.extractBearerToken)(headers, authorizationHeader);
+        if (!token) {
+            return (0, exception_1.throwHttpException)(exception_1.HTTP_EXCEPTION.UNAUTHORIZED, {
+                code: exception_1.HTTP_EXCEPTION_CODE.TOKEN_IS_NOT_FOUND,
+                message: 'Authentication token is not found.'
+            });
+        }
+        const payload = await this.jwtService.verifyAsync(token);
+        return this.validatePayload(request, allowedAccessTypes, payload);
+    }
+    validatePayload(request, accessTypes, payload) {
+        const { aud: audience, iss: issuer, sub: subject } = payload;
+        if (request.headers['x-bearei-internal-authorization']) {
+            const secret = `${this.configService.get('service.accessKey')}:${this.configService.get('service.secretKey')}`;
+            const isSignatureValid = (0, utils_1.verifyHmacSignature)(secret, { serviceName: this.configService.get('service.name') }, subject);
+            if (!isSignatureValid) {
+                (0, exception_1.throwHttpException)(exception_1.HTTP_EXCEPTION.UNAUTHORIZED, {
+                    code: exception_1.HTTP_EXCEPTION_CODE.INTERNAL_SERVER_SIGNATURE_VERIFICATION_FAILED,
+                    message: 'Internal service signature verification failed.'
+                });
+            }
+            request.isInternalAccess = true;
+            request.audience = this.getHeader(request, 'x-bearei-client');
+            request.issuer = this.getHeader(request, 'x-bearei-domain-id');
+            request.subject = this.getHeader(request, 'x-bearei-subject');
+            return true;
+        }
+        const isGuestAccessAllowed = accessTypes.includes(authentication_enum_1.ACCESS.GUEST);
+        if (subject === authentication_enum_1.ACCESS.GUEST && !isGuestAccessAllowed) {
+            (0, exception_1.throwHttpException)(exception_1.HTTP_EXCEPTION.UNAUTHORIZED, {
+                code: exception_1.HTTP_EXCEPTION_CODE.ACCESS_DENIED_FOR_GUEST,
+                message: 'Access denied for guest users.'
+            });
+        }
+        request.audience = audience;
+        request.issuer = issuer;
+        request.subject = subject;
+        return Boolean(subject);
+    }
+    getHeader(request, key) {
+        const value = request.headers[key];
+        return Array.isArray(value) ? value[0] : value;
+    }
+};
+exports.AuthenticationGuard = AuthenticationGuard;
+exports.AuthenticationGuard = AuthenticationGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService,
+        jwt_1.JwtService,
+        core_1.Reflector])
+], AuthenticationGuard);

package/dist/authentication/authentication.interface.d.ts

@@ -0,0 +1,2 @@
+import type { ACCESS } from './authentication.enum';
+export type AccessType = (typeof ACCESS)[keyof typeof ACCESS];

package/dist/authentication/authentication.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });