@carlonicora/nestjs-neo4jsonapi 6.6.1 → 6.7.0

package/dist/common/guards/jwt.auth.any-scope.guard.js

@@ -11,21 +11,30 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AnyScopeAuthGuard = void 0;
 const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
+const token_scopes_decorator_1 = require("../decorators/token-scopes.decorator");
+const session_token_1 = require("./session.token");
 /**
- * Admits BOTH a full session JWT and a scoped selection JWT (e.g. the
- * short-lived "company-selection" token issued at login).
+ * Admits a full session JWT, or a selection JWT whose scope the route lists with
+ * `@AllowedTokenScopes(...)` (handler or class). Without that decorator only a full
+ * session passes.
  *
  * The company-selection routes are legitimately reachable by either: a user
  * who belongs to more than one company arrives from the login screen holding
  * only a selection token, while a user switching company from inside the app
  * arrives holding a full token.
+ *
+ * Always refused: a pending-2FA token (it would otherwise mint a full session through
+ * POST /auth/company-selection with a password only), a portal token, and a selection
+ * token of a scope the route does not list.
  */
 let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
-    constructor(cls) {
+    constructor(cls, reflector) {
         super();
         this.cls = cls;
+        this.reflector = reflector;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -48,6 +57,9 @@ let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard
                 throw err;
             throw new common_1.HttpException("Unauthorised", 401);
         }
+        const allowedScopes = this.reflector.getAllAndOverride(token_scopes_decorator_1.TOKEN_SCOPES_KEY, [context.getHandler(), context.getClass()]) ?? [];
+        if (!(0, session_token_1.isAcceptedScopedPayload)(user, allowedScopes))
+            throw new common_1.HttpException("Unauthorised", 401);
         this.cls.set("userId", user.userId);
         this.cls.set("token", token.startsWith("Bearer ") ? token.slice(7) : token);
         return user;
@@ -56,6 +68,7 @@ let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard
 exports.AnyScopeAuthGuard = AnyScopeAuthGuard;
 exports.AnyScopeAuthGuard = AnyScopeAuthGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [nestjs_cls_1.ClsService])
+    __metadata("design:paramtypes", [nestjs_cls_1.ClsService,
+        core_1.Reflector])
 ], AnyScopeAuthGuard);
 //# sourceMappingURL=jwt.auth.any-scope.guard.js.map

package/dist/common/guards/jwt.auth.any-scope.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.any-scope.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6E;AAC7E,+CAA6C;AAC7C,2CAAwC;AAExC;;;;;;;;GAQG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YAA6B,GAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,QAAG,GAAH,GAAG,CAAY;IAE5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,4EAA4E;QAC5E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEjF,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa;gBAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACnF,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEuB,uBAAU;GADjC,iBAAiB,CAgC7B"}
+{"version":3,"file":"jwt.auth.any-scope.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6E;AAC7E,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,iFAAwE;AACxE,mDAA0D;AAE1D;;;;;;;;;;;;;GAaG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACf,SAAoB;QAErC,KAAK,EAAE,CAAC;QAHS,QAAG,GAAH,GAAG,CAAY;QACf,cAAS,GAAT,SAAS,CAAW;IAGvC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,4EAA4E;QAC5E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEjF,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa;gBAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACnF,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,yCAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEjH,IAAI,CAAC,IAAA,uCAAuB,EAAC,IAAI,EAAE,aAAa,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEhG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGa,uBAAU;QACJ,gBAAS;GAH5B,iBAAiB,CAwC7B"}

package/dist/common/guards/jwt.auth.guard.d.ts

@@ -2,6 +2,7 @@ import { ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
 import { ClsService } from "nestjs-cls";
 import { Neo4jService } from "../../core/neo4j/services/neo4j.service";
+import { ModulePermissionGate } from "../../foundations/rbac/services/module-permission.gate";
 import { AuthContextHookInterface, SystemRolesInterface } from "../tokens";
 declare const JwtAuthGuard_base: import("@nestjs/passport", { with: { "resolution-mode": "import" } }).Type<import("@nestjs/passport", { with: { "resolution-mode": "import" } }).IAuthGuard>;
 export declare class JwtAuthGuard extends JwtAuthGuard_base {
@@ -10,7 +11,8 @@ export declare class JwtAuthGuard extends JwtAuthGuard_base {
     private readonly neo4j;
     private readonly systemRoles?;
     private readonly authContextHook?;
-    constructor(cls: ClsService, reflector: Reflector, neo4j: Neo4jService, systemRoles?: SystemRolesInterface, authContextHook?: AuthContextHookInterface);
+    private readonly permissionGate?;
+    constructor(cls: ClsService, reflector: Reflector, neo4j: Neo4jService, systemRoles?: SystemRolesInterface, authContextHook?: AuthContextHookInterface, permissionGate?: ModulePermissionGate);
     canActivate(context: ExecutionContext): Promise<boolean>;
     handleRequest(err: any, user: any, info: any, context: ExecutionContext): any;
     private _validateRoles;

package/dist/common/guards/jwt.auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE5G,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAItB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAThB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAInB,WAAW,CAAC,EAAE,oBAAoB,EAGlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAc9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IA2BvE,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AAC9F,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG5G,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAIjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAZf,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAGlC,eAAe,CAAC,EAAE,wBAAwB,EAI1C,cAAc,CAAC,EAAE,oBAAoB;IAKlD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAwCvE,OAAO,CAAC,cAAc;CAavB"}

package/dist/common/guards/jwt.auth.guard.js

@@ -18,15 +18,18 @@ const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
 const neo4j_service_1 = require("../../core/neo4j/services/neo4j.service");
+const module_permission_gate_1 = require("../../foundations/rbac/services/module-permission.gate");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
-    constructor(cls, reflector, neo4j, systemRoles, authContextHook) {
+    constructor(cls, reflector, neo4j, systemRoles, authContextHook, permissionGate) {
         super();
         this.cls = cls;
         this.reflector = reflector;
         this.neo4j = neo4j;
         this.systemRoles = systemRoles;
         this.authContextHook = authContextHook;
+        this.permissionGate = permissionGate;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -36,6 +39,8 @@ let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
         const isAuthenticated = (await super.canActivate(context));
         if (isAuthenticated && request.user && this.authContextHook)
             await this.authContextHook.onAuthenticated({ request, context });
+        if (isAuthenticated && request.user && this.permissionGate)
+            await this.permissionGate.assert({ request, context });
         return isAuthenticated;
     }
     handleRequest(err, user, info, context) {
@@ -52,17 +57,33 @@ let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
             }
             throw new common_1.HttpException("Unauthorised", 401);
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
-        this.cls.set("roles", user.roles);
+        // Only a full session passes: pending-2FA, selection and portal tokens are signed
+        // with the same secret and verify, but must never act as a session.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
+        this.cls.set("roles", session.roles);
         this.cls.set("language", request.headers["x-language"]);
         this.cls.set("token", token.startsWith("Bearer ") ? token.slice(7) : token);
         this.cls.set("ipAddress", request.ip);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class: a class-level @Roles was inert while only the handler was read.
+        // Copied, because pushing into the array returned by the reflector mutates the
+        // decorator metadata for every later request.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         if (requiredRoles.length > 0) {
             const adminRole = this.systemRoles?.Administrator ?? "administrator";
             if (!requiredRoles.includes(adminRole))
@@ -76,12 +97,13 @@ exports.JwtAuthGuard = JwtAuthGuard;
 exports.JwtAuthGuard = JwtAuthGuard = __decorate([
     (0, common_1.Injectable)(),
     __param(3, (0, common_1.Optional)()),
-    __param(3, (0, common_1.Optional)()),
     __param(3, (0, common_1.Inject)(tokens_1.SYSTEM_ROLES)),
     __param(4, (0, common_1.Optional)()),
     __param(4, (0, common_1.Inject)(tokens_1.AUTH_CONTEXT_HOOK)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(module_permission_gate_1.ModulePermissionGate)),
     __metadata("design:paramtypes", [nestjs_cls_1.ClsService,
         core_1.Reflector,
-        neo4j_service_1.Neo4jService, Object, Object])
+        neo4j_service_1.Neo4jService, Object, Object, module_permission_gate_1.ModulePermissionGate])
 ], JwtAuthGuard);
 //# sourceMappingURL=jwt.auth.guard.js.map

package/dist/common/guards/jwt.auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAGrG,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAInB,WAAkC,EAGlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAXS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAInB,gBAAW,GAAX,WAAW,CAAuB;QAGlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAClG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAjEY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCARJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,YAAY,CAiExB"}
+{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,mGAA8F;AAC9F,sCAA4G;AAC5G,mDAAgG;AAGzF,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAGlC,eAA0C,EAI1C,cAAqC;QAEtD,KAAK,EAAE,CAAC;QAdS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAGlC,oBAAe,GAAf,eAAe,CAA2B;QAI1C,mBAAc,GAAd,cAAc,CAAuB;IAGxD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnH,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,oEAAoE;QACpE,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,qFAAqF;QACrF,+EAA+E;QAC/E,8CAA8C;QAC9C,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAxFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;IAGzB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,6CAAoB,CAAC,CAAA;qCAXP,uBAAU;QACb,gBAAS;QACJ,4BAAY,kBAUF,6CAAoB;GAd7C,YAAY,CAwFxB"}

package/dist/common/guards/jwt.auth.optional.guard.d.ts

@@ -1,13 +1,15 @@
 import { ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
 import { ClsService } from "nestjs-cls";
+import { ModulePermissionGate } from "../../foundations/rbac/services/module-permission.gate";
 import { SystemRolesInterface } from "../tokens";
 declare const OptionalJwtAuthGuard_base: import("@nestjs/passport", { with: { "resolution-mode": "import" } }).Type<import("@nestjs/passport", { with: { "resolution-mode": "import" } }).IAuthGuard>;
 export declare class OptionalJwtAuthGuard extends OptionalJwtAuthGuard_base {
     private readonly cls;
     private reflector;
     private readonly systemRoles?;
-    constructor(cls: ClsService, reflector: Reflector, systemRoles?: SystemRolesInterface);
+    private readonly permissionGate?;
+    constructor(cls: ClsService, reflector: Reflector, systemRoles?: SystemRolesInterface, permissionGate?: ModulePermissionGate);
     canActivate(context: ExecutionContext): Promise<boolean>;
     handleRequest(err: any, user: any, info: any, context: ExecutionContext): any;
     private _validateRoles;

package/dist/common/guards/jwt.auth.optional.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.optional.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE/D,qBACa,oBAAqB,SAAQ,yBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAJZ,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EAGX,WAAW,CAAC,EAAE,oBAAoB;IAK/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAyBvE,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"jwt.auth.optional.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AAC9F,OAAO,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG/D,qBACa,oBAAqB,SAAQ,yBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAI7B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;gBARf,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EAGX,WAAW,CAAC,EAAE,oBAAoB,EAIlC,cAAc,CAAC,EAAE,oBAAoB;IAKlD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiB9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAsCvE,OAAO,CAAC,cAAc;CAYvB"}

package/dist/common/guards/jwt.auth.optional.guard.js

@@ -17,13 +17,16 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
+const module_permission_gate_1 = require("../../foundations/rbac/services/module-permission.gate");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let OptionalJwtAuthGuard = class OptionalJwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
-    constructor(cls, reflector, systemRoles) {
+    constructor(cls, reflector, systemRoles, permissionGate) {
         super();
         this.cls = cls;
         this.reflector = reflector;
         this.systemRoles = systemRoles;
+        this.permissionGate = permissionGate;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -31,7 +34,12 @@ let OptionalJwtAuthGuard = class OptionalJwtAuthGuard extends (0, passport_1.Aut
         if (!authorizationHeader && request.user) {
             return true;
         }
-        return super.canActivate(context);
+        const isAuthenticated = (await super.canActivate(context));
+        // Only a caller that authenticated as a session is checked; an anonymous
+        // caller (no token) keeps today's behaviour.
+        if (isAuthenticated && request.user && this.permissionGate)
+            await this.permissionGate.assert({ request, context });
+        return isAuthenticated;
     }
     handleRequest(err, user, info, context) {
         const request = context.switchToHttp().getRequest();
@@ -47,15 +55,29 @@ let OptionalJwtAuthGuard = class OptionalJwtAuthGuard extends (0, passport_1.Aut
             }
             return null;
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
+        // A token that is present and verifies but is not a full session (pending-2FA,
+        // selection, portal) is refused, not downgraded to anonymous.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
         this.cls.set("language", request.headers["x-language"]);
-        this.cls.set("roles", user.roles);
+        this.cls.set("roles", session.roles);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class, copied so pushing the admin role never mutates the metadata.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         if (requiredRoles.length > 0) {
             if (!user)
                 throw new common_1.HttpException("Unauthorised", 401);
@@ -72,7 +94,9 @@ exports.OptionalJwtAuthGuard = OptionalJwtAuthGuard = __decorate([
     (0, common_1.Injectable)(),
     __param(2, (0, common_1.Optional)()),
     __param(2, (0, common_1.Inject)(tokens_1.SYSTEM_ROLES)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(module_permission_gate_1.ModulePermissionGate)),
     __metadata("design:paramtypes", [nestjs_cls_1.ClsService,
-        core_1.Reflector, Object])
+        core_1.Reflector, Object, module_permission_gate_1.ModulePermissionGate])
 ], OptionalJwtAuthGuard);
 //# sourceMappingURL=jwt.auth.optional.guard.js.map

package/dist/common/guards/jwt.auth.optional.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.optional.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,sCAA+D;AAGxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACxD,YACmB,GAAe,EACxB,SAAoB,EAGX,WAAkC;QAEnD,KAAK,EAAE,CAAC;QANS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QAGX,gBAAW,GAAX,WAAW,CAAuB;IAGrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAY,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAClG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAxDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;qCAHC,uBAAU;QACb,gBAAS;GAHnB,oBAAoB,CAwDhC"}
+{"version":3,"file":"jwt.auth.optional.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,mGAA8F;AAC9F,sCAA+D;AAC/D,mDAAgG;AAGzF,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACxD,YACmB,GAAe,EACxB,SAAoB,EAGX,WAAkC,EAIlC,cAAqC;QAEtD,KAAK,EAAE,CAAC;QAVS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QAGX,gBAAW,GAAX,WAAW,CAAuB;QAIlC,mBAAc,GAAd,cAAc,CAAuB;IAGxD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnH,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+EAA+E;QAC/E,8DAA8D;QAC9D,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,kFAAkF;QAClF,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAlFY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAGpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,6CAAoB,CAAC,CAAA;qCAPP,uBAAU;QACb,gBAAS,UAOM,6CAAoB;GAV7C,oBAAoB,CAkFhC"}

package/dist/common/guards/session.token.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Every token the library issues is signed with the same `jwt.secret`, so a valid
+ * signature alone does not make a session. `JwtStrategy` accepts all of them:
+ *
+ * - full session (`SecurityService.signJwt`): `{ userId, roles, companyId?, features, userName, expiration }`
+ * - pending 2FA (`signPendingJwt`): `{ userId, pendingId, pending: true, type: "pending_2fa", expiration }`
+ * - company selection (`signCompanySelectionJwt`): `{ userId, scope: "company-selection", expiration }`
+ * - invitation selection (`signInvitationSelectionJwt`): `{ userId, scope: "invitation-selection", expiration }`
+ *
+ * Apps may also sign portal tokens (`personEmail`) with the same secret. The helpers
+ * below tell these classes apart, so each guard admits only the class it is meant for.
+ */
+export interface SessionPayload {
+    userId: string;
+    roles: string[];
+    companyId?: string | null;
+    features?: string[];
+    userName?: string;
+    expiration?: string | Date;
+}
+/** The selection scopes the library signs. */
+export type TokenScope = "company-selection" | "invitation-selection";
+/**
+ * True only for a full session payload: a non-empty string `userId`, a `roles` array
+ * of strings, a string-or-absent `companyId`, and none of the non-session markers.
+ */
+export declare function isSessionPayload(payload: unknown): payload is SessionPayload;
+/** Throws 401 unless `payload` is a full session payload. */
+export declare function assertSessionPayload(payload: unknown): asserts payload is SessionPayload;
+/**
+ * True for a full session, or for a selection token whose `scope` is in
+ * `allowedScopes`. A pending-2FA token, a portal token and a selection token of
+ * another scope are refused: a pending-2FA token must never reach a route that can
+ * mint a full session.
+ */
+export declare function isAcceptedScopedPayload(payload: unknown, allowedScopes: readonly string[]): boolean;
+/**
+ * The company a session acts in.
+ *
+ * - The token carries a company: that company, whatever the `x-companyid` header says.
+ * - The token carries no company: only a system Administrator may pick one through the
+ *   header (or act without one). Any other user is refused with 401, because a request
+ *   without a company runs with no tenant filter.
+ */
+export declare function resolveSessionCompanyId(params: {
+    payload: SessionPayload;
+    headerCompanyId: unknown;
+    administratorRole?: string;
+}): string | undefined;
+//# sourceMappingURL=session.token.d.ts.map

package/dist/common/guards/session.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.token.d.ts","sourceRoot":"","sources":["../../../src/common/guards/session.token.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;AAQtE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,cAAc,CAW5E;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CASnG;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,GAAG,SAAS,CASrB"}

package/dist/common/guards/session.token.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSessionPayload = isSessionPayload;
+exports.assertSessionPayload = assertSessionPayload;
+exports.isAcceptedScopedPayload = isAcceptedScopedPayload;
+exports.resolveSessionCompanyId = resolveSessionCompanyId;
+const common_1 = require("@nestjs/common");
+const system_roles_1 = require("../constants/system.roles");
+/** Keys that only non-session tokens carry. */
+const NON_SESSION_KEYS = ["personEmail", "pending", "pendingId", "scope", "type"];
+/** Keys a selection token must never carry (it carries `scope`, nothing else of these). */
+const NON_SELECTION_KEYS = ["personEmail", "pending", "pendingId", "type"];
+/**
+ * True only for a full session payload: a non-empty string `userId`, a `roles` array
+ * of strings, a string-or-absent `companyId`, and none of the non-session markers.
+ */
+function isSessionPayload(payload) {
+    if (!payload || typeof payload !== "object")
+        return false;
+    const candidate = payload;
+    if (typeof candidate.userId !== "string" || candidate.userId.length === 0)
+        return false;
+    if (!Array.isArray(candidate.roles) || !candidate.roles.every((role) => typeof role === "string"))
+        return false;
+    if (NON_SESSION_KEYS.some((key) => candidate[key] !== undefined))
+        return false;
+    if (candidate.companyId !== undefined && candidate.companyId !== null && typeof candidate.companyId !== "string")
+        return false;
+    return true;
+}
+/** Throws 401 unless `payload` is a full session payload. */
+function assertSessionPayload(payload) {
+    if (!isSessionPayload(payload))
+        throw new common_1.HttpException("Unauthorised", 401);
+}
+/**
+ * True for a full session, or for a selection token whose `scope` is in
+ * `allowedScopes`. A pending-2FA token, a portal token and a selection token of
+ * another scope are refused: a pending-2FA token must never reach a route that can
+ * mint a full session.
+ */
+function isAcceptedScopedPayload(payload, allowedScopes) {
+    if (isSessionPayload(payload))
+        return true;
+    if (!payload || typeof payload !== "object")
+        return false;
+    const candidate = payload;
+    if (typeof candidate.userId !== "string" || candidate.userId.length === 0)
+        return false;
+    if (NON_SELECTION_KEYS.some((key) => candidate[key] !== undefined))
+        return false;
+    return typeof candidate.scope === "string" && allowedScopes.includes(candidate.scope);
+}
+/**
+ * The company a session acts in.
+ *
+ * - The token carries a company: that company, whatever the `x-companyid` header says.
+ * - The token carries no company: only a system Administrator may pick one through the
+ *   header (or act without one). Any other user is refused with 401, because a request
+ *   without a company runs with no tenant filter.
+ */
+function resolveSessionCompanyId(params) {
+    const { payload, headerCompanyId } = params;
+    if (typeof payload.companyId === "string" && payload.companyId.length > 0)
+        return payload.companyId;
+    const administratorRole = params.administratorRole ?? system_roles_1.SystemRoles.Administrator;
+    if (!payload.roles.includes(administratorRole))
+        throw new common_1.HttpException("Unauthorised", 401);
+    return typeof headerCompanyId === "string" && headerCompanyId.length > 0 ? headerCompanyId : undefined;
+}
+//# sourceMappingURL=session.token.js.map

package/dist/common/guards/session.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.token.js","sourceRoot":"","sources":["../../../src/common/guards/session.token.ts"],"names":[],"mappings":";;AAqCA,4CAWC;AAGD,oDAEC;AAQD,0DASC;AAUD,0DAaC;AA7FD,2CAA+C;AAC/C,4DAAwD;AA0BxD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAE3F,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAU,CAAC;AAEpF;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,SAAS,GAAG,OAAkC,CAAC;IACrD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChH,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QAC9G,OAAO,KAAK,CAAC;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAgB,EAAE,aAAgC;IACxF,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,SAAS,GAAG,OAAkC,CAAC;IACrD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,MAIvC;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE5C,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IAEpG,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,0BAAW,CAAC,aAAa,CAAC;IAChF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE7F,OAAO,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AACzG,CAAC"}

package/dist/common/index.d.ts

@@ -19,5 +19,6 @@ export * from "./types";
 export * from "./handlers";
 export * from "./tokens";
 export * from "./constants/system.roles";
+export * from "./constants/core-module.ids";
 export * from "./utils/chunk-content.util";
 //# sourceMappingURL=index.d.ts.map

package/dist/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAC;AAG5B,cAAc,YAAY,CAAC;AAG3B,cAAc,cAAc,CAAC;AAG7B,cAAc,SAAS,CAAC;AAGxB,cAAc,WAAW,CAAC;AAG1B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,cAAc,CAAC;AAG7B,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,cAAc,CAAC;AAG7B,cAAc,SAAS,CAAC;AAGxB,cAAc,YAAY,CAAC;AAG3B,cAAc,UAAU,CAAC;AAGzB,cAAc,0BAA0B,CAAC;AAKzC,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,aAAa,CAAC;AAG5B,cAAc,YAAY,CAAC;AAG3B,cAAc,cAAc,CAAC;AAG7B,cAAc,SAAS,CAAC;AAGxB,cAAc,WAAW,CAAC;AAG1B,cAAc,UAAU,CAAC;AAGzB,cAAc,WAAW,CAAC;AAG1B,cAAc,cAAc,CAAC;AAG7B,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,cAAc,CAAC;AAG7B,cAAc,SAAS,CAAC;AAGxB,cAAc,YAAY,CAAC;AAG3B,cAAc,UAAU,CAAC;AAGzB,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAK5C,cAAc,4BAA4B,CAAC"}

package/dist/common/index.js

@@ -50,6 +50,7 @@ __exportStar(require("./handlers"), exports);
 __exportStar(require("./tokens"), exports);
 // Constants
 __exportStar(require("./constants/system.roles"), exports);
+__exportStar(require("./constants/core-module.ids"), exports);
 // Utils
 // Exported by file, like ./constants/system.roles above: src/common/utils has no
 // barrel of its own and settled.ts is deliberately relative-import only.

package/dist/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,YAAY;AACZ,8CAA4B;AAE5B,WAAW;AACX,6CAA2B;AAE3B,aAAa;AACb,+CAA6B;AAE7B,QAAQ;AACR,0CAAwB;AAExB,UAAU;AACV,4CAA0B;AAE1B,SAAS;AACT,2CAAyB;AAEzB,UAAU;AACV,4CAA0B;AAE1B,aAAa;AACb,+CAA6B;AAE7B,aAAa;AACb,+CAA6B;AAE7B,eAAe;AACf,iDAA+B;AAE/B,aAAa;AACb,+CAA6B;AAE7B,QAAQ;AACR,0CAAwB;AAExB,WAAW;AACX,6CAA2B;AAE3B,iDAAiD;AACjD,2CAAyB;AAEzB,YAAY;AACZ,2DAAyC;AAEzC,QAAQ;AACR,iFAAiF;AACjF,yEAAyE;AACzE,6DAA2C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,YAAY;AACZ,8CAA4B;AAE5B,WAAW;AACX,6CAA2B;AAE3B,aAAa;AACb,+CAA6B;AAE7B,QAAQ;AACR,0CAAwB;AAExB,UAAU;AACV,4CAA0B;AAE1B,SAAS;AACT,2CAAyB;AAEzB,UAAU;AACV,4CAA0B;AAE1B,aAAa;AACb,+CAA6B;AAE7B,aAAa;AACb,+CAA6B;AAE7B,eAAe;AACf,iDAA+B;AAE/B,aAAa;AACb,+CAA6B;AAE7B,QAAQ;AACR,0CAAwB;AAExB,WAAW;AACX,6CAA2B;AAE3B,iDAAiD;AACjD,2CAAyB;AAEzB,YAAY;AACZ,2DAAyC;AACzC,8DAA4C;AAE5C,QAAQ;AACR,iFAAiF;AACjF,yEAAyE;AACzE,6DAA2C"}

package/dist/common/strategies/jwt.strategy.d.ts

@@ -8,6 +8,14 @@ declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").Strat
 export declare class JwtStrategy extends JwtStrategy_base {
     private readonly cls;
     constructor(cls: ClsService, configService: ConfigService<BaseConfigInterface>);
+    /**
+     * Accepts every payload signed with `jwt.secret`: full sessions, pending-2FA and
+     * selection tokens all share the key, and `AnyScopeAuthGuard` must still see the
+     * selection tokens. The token class is enforced by each guard after this runs
+     * (`assertSessionPayload` / `isAcceptedScopedPayload` in `guards/session.token.ts`),
+     * so a guard built on `AuthGuard("jwt")` must never trust `request.user` without one
+     * of those checks.
+     */
     validate(req: Request, payload: any): Promise<any>;
 }
 export {};

package/dist/common/strategies/jwt.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../../src/common/strategies/jwt.strategy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;;;;AAElF,qBACa,WAAY,SAAQ,gBAA0B;IAEvD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU,EAChC,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC;IAU7C,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG;CAU1C"}
+{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../../src/common/strategies/jwt.strategy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,yBAAyB,CAAC;;;;AAElF,qBACa,WAAY,SAAQ,gBAA0B;IAEvD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU,EAChC,aAAa,EAAE,aAAa,CAAC,mBAAmB,CAAC;IAUnD;;;;;;;OAOG;IACG,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG;CAU1C"}

package/dist/common/strategies/jwt.strategy.js

@@ -25,6 +25,14 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
         });
         this.cls = cls;
     }
+    /**
+     * Accepts every payload signed with `jwt.secret`: full sessions, pending-2FA and
+     * selection tokens all share the key, and `AnyScopeAuthGuard` must still see the
+     * selection tokens. The token class is enforced by each guard after this runs
+     * (`assertSessionPayload` / `isAcceptedScopedPayload` in `guards/session.token.ts`),
+     * so a guard built on `AuthGuard("jwt")` must never trust `request.user` without one
+     * of those checks.
+     */
     async validate(req, payload) {
         const now = new Date();
         const expiration = new Date(payload.expiration);

package/dist/common/strategies/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/common/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2D;AAC3D,2CAA+C;AAC/C,+CAAoD;AACpD,2CAAwC;AACxC,+CAAoD;AAI7C,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IACzD,YACmB,GAAe,EAChC,aAAiD;QAEjD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAqB,KAAK,CAAC,CAAC;QAC/D,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,WAAW,EAAE,SAAS,EAAE,MAAM;YAC9B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QARc,QAAG,GAAH,GAAG,CAAY;IASlC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,OAAY;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,UAAU,GAAG,GAAG;YAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAEvC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAvBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGa,uBAAU;QACjB,sBAAa;GAHnB,WAAW,CAuBvB"}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/common/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2D;AAC3D,2CAA+C;AAC/C,+CAAoD;AACpD,2CAAwC;AACxC,+CAAoD;AAI7C,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IACzD,YACmB,GAAe,EAChC,aAAiD;QAEjD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAqB,KAAK,CAAC,CAAC;QAC/D,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,WAAW,EAAE,SAAS,EAAE,MAAM;YAC9B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QARc,QAAG,GAAH,GAAG,CAAY;IASlC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,OAAY;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,UAAU,GAAG,GAAG;YAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAEvC,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA/BY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGa,uBAAU;QACjB,sBAAa;GAHnB,WAAW,CA+BvB"}

package/dist/core/websocket/gateways/event.gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"event.gateway.d.ts","sourceRoot":"","sources":["../../../../src/core/websocket/gateways/event.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAGL,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAkB,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAajE,qBASa,aAAc,YAAW,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe;IAO1G,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAX/B,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,CAAC,cAAc,CAAS;gBAGZ,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,iBAAiB,EACzB,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,aAAa;IAG9C,SAAS;IAKH,gBAAgB,CAAC,MAAM,EAAE,MAAM;IAkC/B,gBAAgB,CAAC,MAAM,EAAE,MAAM;IA8B/B,eAAe;IAKf,eAAe,CAAoB,MAAM,EAAE,MAAM;;;;;;IASvD,aAAa,CACI,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,EAChC,MAAM,EAAE,MAAM,GAChC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAE;IAU/B,OAAO,CAAC,yBAAyB;CAelC"}
+{"version":3,"file":"event.gateway.d.ts","sourceRoot":"","sources":["../../../../src/core/websocket/gateways/event.gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAGL,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAkB,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAajE,qBASa,aAAc,YAAW,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,eAAe;IAO1G,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAX/B,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,CAAC,cAAc,CAAS;gBAGZ,gBAAgB,EAAE,gBAAgB,EAClC,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,iBAAiB,EACzB,eAAe,EAAE,eAAe,EAChC,YAAY,EAAE,aAAa;IAG9C,SAAS;IAKH,gBAAgB,CAAC,MAAM,EAAE,MAAM;IA8C/B,gBAAgB,CAAC,MAAM,EAAE,MAAM;IA8B/B,eAAe;IAKf,eAAe,CAAoB,MAAM,EAAE,MAAM;;;;;;IASvD,aAAa,CACI,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,GAAG,CAAA;KAAE,EAChC,MAAM,EAAE,MAAM,GAChC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAE;IAU/B,OAAO,CAAC,yBAAyB;CAelC"}

package/dist/core/websocket/gateways/event.gateway.js

@@ -19,6 +19,7 @@ const jwt_1 = require("@nestjs/jwt");
 const websockets_1 = require("@nestjs/websockets");
 const nestjs_cls_1 = require("nestjs-cls");
 const socket_io_1 = require("socket.io");
+const session_token_1 = require("../../../common/guards/session.token");
 const logging_service_1 = require("../../logging/services/logging.service");
 const neo4j_service_1 = require("../../neo4j/services/neo4j.service");
 const presence_service_1 = require("../services/presence.service");
@@ -56,10 +57,20 @@ let EventsGateway = class EventsGateway {
         else {
             try {
                 const payload = this.jwtService.verify(token);
+                // Pending-2FA, selection and portal tokens verify with the same secret but are
+                // not sessions: such a socket stays anonymous, exactly like an invalid token.
+                if (!(0, session_token_1.isSessionPayload)(payload)) {
+                    this.logger.error(`[PRESENCE] Non-session token refused for client: ${client.id}`);
+                    client.data.user = { userId: null };
+                    return;
+                }
                 client.data.user = payload;
                 this.webSocketService.addClient(payload.userId, client);
                 // Set user as online
-                await this.presenceService.setUserOnline(payload.userId, payload.userName || payload.name, client.id);
+                // `userName` is what `SecurityService.signJwt` writes; `name` is the legacy key
+                // read since the first release, kept for tokens an app signs itself.
+                const displayName = payload.userName || (typeof payload.name === "string" ? payload.name : undefined);
+                await this.presenceService.setUserOnline(payload.userId, displayName, client.id);
                 // Presence goes to the user's company only, never to every socket.
                 const presencePayload = {
                     userId: payload.userId,

package/dist/core/websocket/gateways/event.gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"event.gateway.js","sourceRoot":"","sources":["../../../../src/core/websocket/gateways/event.gateway.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,yDAAsD;AACtD,qCAAyC;AACzC,mDAS4B;AAC5B,2CAAwD;AACxD,yCAA2C;AAC3C,4EAA2E;AAC3E,sEAAkE;AAClE,mEAA+D;AAC/D,qEAAiE;AAEjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC;AAWM,IAAM,aAAa,GAAnB,MAAM,aAAa;IAMxB,YACmB,gBAAkC,EAClC,UAAsB,EACtB,GAAe,EACf,KAAmB,EACnB,MAAyB,EACzB,eAAgC,EAChC,YAA2B;QAN3B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAmB;QACzB,oBAAe,GAAf,eAAe,CAAiB;QAChC,iBAAY,GAAZ,YAAY,CAAe;QATtC,mBAAc,GAAG,KAAK,CAAC;IAU5B,CAAC;IAEJ,SAAS;QACP,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;gBAE3B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAExD,qBAAqB;gBACrB,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAEtG,mEAAmE;gBACnE,MAAM,eAAe,GAAG;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAQ;iBACjB,CAAC;gBACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;gBAEtF,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,YAAqB,EAAE,EAAE;oBACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,KAAK,CAAC;wBAAE,OAAO;oBACtE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,EAAE,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAExD,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAErE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,eAAe,GAAG;wBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,MAAM,CAAC,YAAY;qBAC9B,CAAC;oBACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,8CAA8C;gBAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAoB,MAAc;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IACxD,CAAC;IAGD,aAAa,CACI,IAAoC,EAChC,MAAc;QAEjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,qFAAqF;QACrF,oFAAoF;QACpF,MAAM,QAAQ,GACZ,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;YACzC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;IACpF,CAAC;IAEO,yBAAyB,CAAC,MAAc;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QAE3C,IAAI,KAAK;YAAE,OAAO,KAAe,CAAC;QAElC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAoB,CAAC;QAC9B,CAAC;aAAM,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/HY,sCAAa;AAExB;IADC,IAAA,4BAAe,GAAE;8BACV,kBAAM;6CAAC;AAwFT;IADL,IAAA,6BAAgB,EAAC,WAAW,CAAC;IACP,WAAA,IAAA,4BAAe,GAAE,CAAA;;qCAAS,kBAAM;;oDAMtD;AAGD;IADC,IAAA,6BAAgB,EAAC,SAAS,CAAC;IAEzB,WAAA,IAAA,wBAAW,GAAE,CAAA;IACb,WAAA,IAAA,4BAAe,GAAE,CAAA;;6CAAS,kBAAM;;kDASlC;wBA9GU,aAAa;IATzB,IAAA,6BAAgB,EAAC;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,IAAI;SAClB;QACD,UAAU,EAAE,CAAC,WAAW,CAAC;KAC1B,CAAC;IACD,IAAA,wBAAe,EAAC,2BAAc,CAAC;qCAQO,oCAAgB;QACtB,gBAAU;QACjB,uBAAU;QACR,4BAAY;QACX,mCAAiB;QACR,kCAAe;QAClB,6BAAa;GAbnC,aAAa,CA+HzB"}
+{"version":3,"file":"event.gateway.js","sourceRoot":"","sources":["../../../../src/core/websocket/gateways/event.gateway.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,yDAAsD;AACtD,qCAAyC;AACzC,mDAS4B;AAC5B,2CAAwD;AACxD,yCAA2C;AAC3C,wEAAwE;AACxE,4EAA2E;AAC3E,sEAAkE;AAClE,mEAA+D;AAC/D,qEAAiE;AAEjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACtE,CAAC;AAWM,IAAM,aAAa,GAAnB,MAAM,aAAa;IAMxB,YACmB,gBAAkC,EAClC,UAAsB,EACtB,GAAe,EACf,KAAmB,EACnB,MAAyB,EACzB,eAAgC,EAChC,YAA2B;QAN3B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAmB;QACzB,oBAAe,GAAf,eAAe,CAAiB;QAChC,iBAAY,GAAZ,YAAY,CAAe;QATtC,mBAAc,GAAG,KAAK,CAAC;IAU5B,CAAC;IAEJ,SAAS;QACP,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;QAErD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,OAAO,GAA4B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAEvE,+EAA+E;gBAC/E,8EAA8E;gBAC9E,IAAI,CAAC,IAAA,gCAAgB,EAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnF,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBACpC,OAAO;gBACT,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;gBAE3B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAExD,qBAAqB;gBACrB,gFAAgF;gBAChF,qEAAqE;gBACrE,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACtG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAEjF,mEAAmE;gBACnE,MAAM,eAAe,GAAG;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAQ;iBACjB,CAAC;gBACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;gBAEtF,MAAM,CAAC,KAAK,CAAC,CAAC,KAAa,EAAE,YAAqB,EAAE,EAAE;oBACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,KAAK,CAAC;wBAAE,OAAO;oBACtE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnG,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,MAAM,CAAC,EAAE,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxG,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,yCAAyC;QACzC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAExD,iCAAiC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAErE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,eAAe,GAAG;wBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,SAAS;wBACjB,QAAQ,EAAE,MAAM,CAAC,YAAY;qBAC9B,CAAC;oBACF,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBACpB,8CAA8C;gBAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAoB,MAAc;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IACxD,CAAC;IAGD,aAAa,CACI,IAAoC,EAChC,MAAc;QAEjC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,qFAAqF;QACrF,oFAAoF;QACpF,MAAM,QAAQ,GACZ,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;YACzC,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC;IACpF,CAAC;IAEO,yBAAyB,CAAC,MAAc;QAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC;QAE3C,IAAI,KAAK;YAAE,OAAO,KAAe,CAAC;QAElC,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAoB,CAAC;QAC9B,CAAC;aAAM,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA3IY,sCAAa;AAExB;IADC,IAAA,4BAAe,GAAE;8BACV,kBAAM;6CAAC;AAoGT;IADL,IAAA,6BAAgB,EAAC,WAAW,CAAC;IACP,WAAA,IAAA,4BAAe,GAAE,CAAA;;qCAAS,kBAAM;;oDAMtD;AAGD;IADC,IAAA,6BAAgB,EAAC,SAAS,CAAC;IAEzB,WAAA,IAAA,wBAAW,GAAE,CAAA;IACb,WAAA,IAAA,4BAAe,GAAE,CAAA;;6CAAS,kBAAM;;kDASlC;wBA1HU,aAAa;IATzB,IAAA,6BAAgB,EAAC;QAChB,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,IAAI;SAClB;QACD,UAAU,EAAE,CAAC,WAAW,CAAC;KAC1B,CAAC;IACD,IAAA,wBAAe,EAAC,2BAAc,CAAC;qCAQO,oCAAgB;QACtB,gBAAU;QACjB,uBAAU;QACR,4BAAY;QACX,mCAAiB;QACR,kCAAe;QAClB,6BAAa;GAbnC,aAAa,CA2IzB"}

package/dist/core/websocket/guards/ws.jwt.auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws.jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../../src/core/websocket/guards/ws.jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,qBACa,UAAW,YAAW,WAAW;IAE1C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,YAAY;IAGhC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB9D,OAAO,CAAC,yBAAyB;CAiBlC"}
+{"version":3,"file":"ws.jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../../src/core/websocket/guards/ws.jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxC,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,qBACa,UAAW,YAAW,WAAW;IAE1C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,YAAY;IAGhC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB9D,OAAO,CAAC,yBAAyB;CAiBlC"}