@conduitplatform/module-tools 0.17.0-alpha.7 → 0.17.0-alpha.9

package/dist/index.cjs

@@ -30,6 +30,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AUTHENTICATION_CONFIG_UPDATE_CHANNEL: () => AUTHENTICATION_CONFIG_UPDATE_CHANNEL,
+  AccessTokenVerifier: () => AccessTokenVerifier,
   ConduitActiveSchema: () => ConduitActiveSchema,
   ConduitBoolean: () => ConduitBoolean,
   ConduitDate: () => ConduitDate,
@@ -40,6 +42,7 @@ __export(index_exports, {
   ConduitServiceModule: () => ConduitServiceModule,
   ConduitString: () => ConduitString,
   ConfigController: () => ConfigController,
+  DEFAULT_LEEWAY_SECONDS: () => DEFAULT_LEEWAY_SECONDS,
   DEFAULT_STRIP_FIELDS: () => DEFAULT_STRIP_FIELDS,
   GrpcServer: () => GrpcServer,
   ManagedModule: () => ManagedModule,
@@ -52,20 +55,27 @@ __export(index_exports, {
   convictConfigParser: () => convictConfigParser,
   createParsedRouterRequest: () => createParsedRouterRequest,
   createServer: () => createServer,
+  createUserHydrator: () => createUserHydrator,
   exportModel: () => exportModel,
+  getAuthMiddlewareKind: () => getAuthMiddlewareKind,
+  hydrateContextUser: () => hydrateContextUser,
   importModel: () => importModel,
   initializeSdk: () => initializeSdk,
   linearBackoffTimeout: () => linearBackoffTimeout,
   linearBackoffTimeoutAsync: () => linearBackoffTimeoutAsync,
+  mapHydrationErrorCode: () => mapHydrationErrorCode,
   merge: () => merge,
   readConduitPeersManifest: () => readConduitPeersManifest,
   reconcileStoredModuleConfig: () => reconcileStoredModuleConfig,
   redactSensitiveConfig: () => redactSensitiveConfig,
   restoreRedactedSecrets: () => restoreRedactedSecrets,
   sanitizeDocumentsForExport: () => sanitizeDocumentsForExport,
+  selectVerificationKey: () => selectVerificationKey,
+  shouldHydrateUser: () => shouldHydrateUser,
   stableConfigJson: () => stableConfigJson,
   storedConfigsEquivalent: () => storedConfigsEquivalent,
   stripInternalFields: () => stripInternalFields,
+  verifyAccessToken: () => verifyAccessToken,
   wrapFunctionsAsync: () => wrapFunctionsAsync,
   wrapGrpcFunctions: () => wrapGrpcFunctions,
   wrapRouterGrpcFunction: () => wrapRouterGrpcFunction
@@ -461,8 +471,8 @@ var GrpcServer = class {
 var import_path = __toESM(require("path"), 1);
 var import_events = require("events");
 var import_lodash_es2 = require("lodash-es");
-var import_grpc_js4 = require("@grpc/grpc-js");
-var import_grpc_sdk8 = require("@conduitplatform/grpc-sdk");
+var import_grpc_js6 = require("@grpc/grpc-js");
+var import_grpc_sdk9 = require("@conduitplatform/grpc-sdk");
 
 // src/routing/RouteBuilder.ts
 var import_grpc_sdk5 = require("@conduitplatform/grpc-sdk");
@@ -540,6 +550,16 @@ var RouteBuilder = class {
     this._options.captureRawHeaders = capture;
     return this;
   }
+  /**
+   * Whether module-tools hydrates `context.user` from `context.userId` on routes with
+   * `authMiddleware` / `authMiddleware?` (default true).
+   * @deprecated The default flips to false in the next major; call
+   * `grpcSdk.authentication.getUser(userId)` explicitly instead.
+   */
+  hydrateUser(hydrate) {
+    this._options.hydrateUser = hydrate;
+    return this;
+  }
   return(name, fields) {
     this._returns = new import_grpc_sdk5.ConduitRouteReturnDefinition(name, fields);
     return this;
@@ -572,44 +592,104 @@ var RouteBuilder = class {
 };
 
 // src/routing/wrapRouterFunctions.ts
+var import_grpc_sdk7 = require("@conduitplatform/grpc-sdk");
+var import_grpc_js4 = require("@grpc/grpc-js");
+
+// src/routing/hydrateUser.ts
 var import_grpc_sdk6 = require("@conduitplatform/grpc-sdk");
 var import_grpc_js3 = require("@grpc/grpc-js");
+function middlewareList(routeOptions) {
+  const m = routeOptions?.middlewares;
+  if (Array.isArray(m)) return m.filter((x) => typeof x === "string");
+  if (typeof m === "string") return [m];
+  return [];
+}
+function getAuthMiddlewareKind(routeOptions) {
+  const list = middlewareList(routeOptions);
+  if (list.includes("authMiddleware")) return "required";
+  if (list.includes("authMiddleware?")) return "optional";
+  return void 0;
+}
+function shouldHydrateUser(routeOptions, context) {
+  if (!routeOptions || !context) return false;
+  if (routeOptions.hydrateUser === false) return false;
+  if (!getAuthMiddlewareKind(routeOptions)) return false;
+  return typeof context.userId === "string" && !!context.userId && !context.user;
+}
+function createUserHydrator(routeOptions, resolve) {
+  if (!routeOptions) return void 0;
+  const kind = getAuthMiddlewareKind(routeOptions);
+  if (!kind || routeOptions.hydrateUser === false) return void 0;
+  return {
+    optional: kind === "optional",
+    getUser: async (userId) => {
+      const resolver = resolve();
+      if (!resolver) throw new import_grpc_sdk6.GrpcError(import_grpc_js3.status.UNAVAILABLE, "User lookup unavailable");
+      return resolver(userId);
+    }
+  };
+}
+function mapHydrationErrorCode(error) {
+  const code = error?.code;
+  if (typeof code !== "number" || code === import_grpc_js3.status.OK) return import_grpc_js3.status.INTERNAL;
+  if (code === import_grpc_js3.status.NOT_FOUND) return import_grpc_js3.status.UNAUTHENTICATED;
+  return code;
+}
+async function hydrateContextUser(routeOptions, context, hydrator) {
+  if (!shouldHydrateUser(routeOptions, context)) return;
+  try {
+    context.user = await hydrator.getUser(context.userId);
+  } catch (e) {
+    import_grpc_sdk6.ConduitGrpcSdk.Logger.warn(
+      `User hydration failed: ${e?.message ?? String(e)}`
+    );
+    if (!hydrator.optional) {
+      const code = mapHydrationErrorCode(e);
+      throw new import_grpc_sdk6.GrpcError(
+        code,
+        code === import_grpc_js3.status.UNAUTHENTICATED ? "Unauthorized" : "User lookup failed"
+      );
+    }
+  }
+}
+
+// src/routing/wrapRouterFunctions.ts
 var mapGrpcStatusToHttp = (code) => {
   if (!code) return "200 (OK)";
   switch (code) {
-    case import_grpc_js3.status.OK:
+    case import_grpc_js4.status.OK:
       return `200 (OK)`;
-    case import_grpc_js3.status.CANCELLED:
+    case import_grpc_js4.status.CANCELLED:
       return `499 (Cancelled)`;
-    case import_grpc_js3.status.INVALID_ARGUMENT:
+    case import_grpc_js4.status.INVALID_ARGUMENT:
       return `400 (Invalid Argument)`;
-    case import_grpc_js3.status.DEADLINE_EXCEEDED:
+    case import_grpc_js4.status.DEADLINE_EXCEEDED:
       return `504 (Deadline Exceeded)`;
-    case import_grpc_js3.status.NOT_FOUND:
+    case import_grpc_js4.status.NOT_FOUND:
       return `404 (Not Found)`;
-    case import_grpc_js3.status.ALREADY_EXISTS:
+    case import_grpc_js4.status.ALREADY_EXISTS:
       return `409 (Already Exists)`;
-    case import_grpc_js3.status.PERMISSION_DENIED:
+    case import_grpc_js4.status.PERMISSION_DENIED:
       return `403 (Permission Denied)`;
-    case import_grpc_js3.status.UNAUTHENTICATED:
+    case import_grpc_js4.status.UNAUTHENTICATED:
       return `401 (Unauthenticated)`;
-    case import_grpc_js3.status.OUT_OF_RANGE:
+    case import_grpc_js4.status.OUT_OF_RANGE:
       return `416 (Out of Range)`;
-    case import_grpc_js3.status.FAILED_PRECONDITION:
+    case import_grpc_js4.status.FAILED_PRECONDITION:
       return `412 (Failed Precondition)`;
-    case import_grpc_js3.status.ABORTED:
+    case import_grpc_js4.status.ABORTED:
       return `409 (Aborted)`;
-    case import_grpc_js3.status.INTERNAL:
+    case import_grpc_js4.status.INTERNAL:
       return `416 (Internal)`;
-    case import_grpc_js3.status.UNAVAILABLE:
+    case import_grpc_js4.status.UNAVAILABLE:
       return `503 (Service Unavailable)`;
-    case import_grpc_js3.status.DATA_LOSS:
+    case import_grpc_js4.status.DATA_LOSS:
       return `500 (Data Loss)`;
     default:
       return `500 (Unknown)`;
   }
 };
-function generateLog(routerType, routerRequest, requestReceive, call, status6) {
+function generateLog(routerType, routerRequest, requestReceive, call, status10) {
   let log = "";
   const latency = Date.now() - requestReceive;
   if (routerRequest) {
@@ -619,15 +699,15 @@ function generateLog(routerType, routerRequest, requestReceive, call, status6) {
     const socketLabel = socketReq.socketId ?? socketReq.socket;
     log += `(${routerType})  Socket: ${socketReq.event} socket: ${socketLabel}`;
   }
-  log += ` ${mapGrpcStatusToHttp(status6) ?? "200"} ${latency}ms`;
-  import_grpc_sdk6.ConduitGrpcSdk.Logger.log(log);
-  import_grpc_sdk6.ConduitGrpcSdk.Metrics?.set("grpc_request_latency_seconds", latency / 1e3);
-  import_grpc_sdk6.ConduitGrpcSdk.Metrics?.set(
+  log += ` ${mapGrpcStatusToHttp(status10) ?? "200"} ${latency}ms`;
+  import_grpc_sdk7.ConduitGrpcSdk.Logger.log(log);
+  import_grpc_sdk7.ConduitGrpcSdk.Metrics?.set("grpc_request_latency_seconds", latency / 1e3);
+  import_grpc_sdk7.ConduitGrpcSdk.Metrics?.set(
     `${routerType}_grpc_request_latency_seconds`,
     latency / 1e3
   );
-  const successStatus = !status6 || status6.toString().startsWith("2");
-  import_grpc_sdk6.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_response_statuses_total`, 1, {
+  const successStatus = !status10 || status10.toString().startsWith("2");
+  import_grpc_sdk7.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_response_statuses_total`, 1, {
     success: successStatus ? "true" : "false"
   });
 }
@@ -643,7 +723,7 @@ function parseResponseData(r, routerRequest, requestReceive, call, callback, res
   responded.did = true;
   if (!r) {
     callback({
-      code: import_grpc_js3.status.INTERNAL,
+      code: import_grpc_js4.status.INTERNAL,
       message: "Handler did not return a response"
     });
   }
@@ -674,11 +754,11 @@ function parseResponseData(r, routerRequest, requestReceive, call, callback, res
   }
   generateLog(routerType, routerRequest, requestReceive, call, void 0);
 }
-function wrapRouterGrpcFunction(fun, routerType) {
+function wrapRouterGrpcFunction(fun, routerType, hydration) {
   return (call, callback) => {
     const requestReceive = Date.now();
     let routerRequest = true;
-    import_grpc_sdk6.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_requests_total`);
+    import_grpc_sdk7.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_requests_total`);
     try {
       call.request.context = parseRequestData(call.request.context);
       call.request.params = parseRequestData(call.request.params);
@@ -697,16 +777,16 @@ function wrapRouterGrpcFunction(fun, routerType) {
         }
       }
     } catch (e) {
-      import_grpc_sdk6.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_errors_total`);
-      generateLog(routerType, routerRequest, requestReceive, call, import_grpc_js3.status.INTERNAL);
-      import_grpc_sdk6.ConduitGrpcSdk.Logger.error(e.message ?? "Something went wrong");
+      import_grpc_sdk7.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_errors_total`);
+      generateLog(routerType, routerRequest, requestReceive, call, import_grpc_js4.status.INTERNAL);
+      import_grpc_sdk7.ConduitGrpcSdk.Logger.error(e.message ?? "Something went wrong");
       return callback({
-        code: import_grpc_js3.status.INTERNAL,
+        code: import_grpc_js4.status.INTERNAL,
         message: e.message ?? "Something went wrong"
       });
     }
     const responded = { did: false };
-    fun(call, (r) => {
+    const invoke = () => fun(call, (r) => {
       parseResponseData(
         r,
         routerRequest,
@@ -716,7 +796,13 @@ function wrapRouterGrpcFunction(fun, routerType) {
         responded,
         routerType
       );
-    }).then(
+    });
+    const needsHydration = hydration && shouldHydrateUser(hydration.options, call.request.context);
+    (needsHydration ? hydrateContextUser(
+      hydration.options,
+      call.request.context,
+      hydration.hydrator
+    ).then(invoke) : invoke()).then(
       (r) => parseResponseData(
         r,
         routerRequest,
@@ -727,19 +813,19 @@ function wrapRouterGrpcFunction(fun, routerType) {
         routerType
       )
     ).catch((error) => {
-      import_grpc_sdk6.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_errors_total`);
+      import_grpc_sdk7.ConduitGrpcSdk.Metrics?.increment(`${routerType}_grpc_errors_total`);
       generateLog(
         routerType,
         routerRequest,
         requestReceive,
         call,
-        error.code ?? import_grpc_js3.status.INTERNAL
+        error.code ?? import_grpc_js4.status.INTERNAL
       );
-      import_grpc_sdk6.ConduitGrpcSdk.Logger.error(
+      import_grpc_sdk7.ConduitGrpcSdk.Logger.error(
         error.debugLogInfo ?? error.message ?? "Something went wrong"
       );
       callback({
-        code: error.code ?? import_grpc_js3.status.INTERNAL,
+        code: error.code ?? import_grpc_js4.status.INTERNAL,
         message: error.details ?? error.message ?? "Something went wrong"
       });
     });
@@ -747,21 +833,26 @@ function wrapRouterGrpcFunction(fun, routerType) {
 }
 
 // src/routing/RoutingUtilities.ts
-function wrapFunctionsAsync(functions, routerType) {
+function wrapFunctionsAsync(functions, routerType, hydrations = {}) {
   const modifiedFunctions = {};
   Object.keys(functions).forEach((key) => {
-    modifiedFunctions[key] = wrapRouterGrpcFunction(functions[key], routerType);
+    modifiedFunctions[key] = wrapRouterGrpcFunction(
+      functions[key],
+      routerType,
+      hydrations[key]
+    );
   });
   return modifiedFunctions;
 }
 
 // src/routing/RoutingManager.ts
-var import_grpc_sdk7 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk8 = require("@conduitplatform/grpc-sdk");
+var import_grpc_js5 = require("@grpc/grpc-js");
 var RoutingManager = class _RoutingManager {
   constructor(_router, _server) {
     this._router = _router;
     this._server = _server;
-    if (_router instanceof import_grpc_sdk7.Admin) {
+    if (_router instanceof import_grpc_sdk8.Admin) {
       this.isAdmin = true;
     }
   }
@@ -770,22 +861,46 @@ var RoutingManager = class _RoutingManager {
   _moduleRoutes = {};
   static ClientController;
   static AdminController;
+  /** Set by ManagedModule; used to hydrate context.user on client routes. */
+  static grpcSdk;
+  static userResolver;
+  static warnedNoResolver = false;
+  /**
+   * Overrides how users are fetched for hydration (default: grpcSdk.authentication.getUser).
+   * Intended for the module that owns the users: the authentication module has no gRPC
+   * client to itself and will register a local resolver here.
+   */
+  static setUserResolver(resolver) {
+    _RoutingManager.userResolver = resolver;
+  }
+  static resolveUser() {
+    if (_RoutingManager.userResolver) return _RoutingManager.userResolver;
+    const sdk = _RoutingManager.grpcSdk;
+    if (!sdk) return void 0;
+    return async (userId) => {
+      const auth = sdk.authentication;
+      if (!auth) {
+        throw new import_grpc_sdk8.GrpcError(import_grpc_js5.status.UNAVAILABLE, "authentication module unavailable");
+      }
+      return auth.getUser(userId);
+    };
+  }
   _routeHandlers = {};
   isAdmin = false;
   get(path4) {
-    return new RouteBuilder(this).method(import_grpc_sdk7.ConduitRouteActions.GET).path(path4);
+    return new RouteBuilder(this).method(import_grpc_sdk8.ConduitRouteActions.GET).path(path4);
   }
   post(path4) {
-    return new RouteBuilder(this).method(import_grpc_sdk7.ConduitRouteActions.POST).path(path4);
+    return new RouteBuilder(this).method(import_grpc_sdk8.ConduitRouteActions.POST).path(path4);
   }
   delete(path4) {
-    return new RouteBuilder(this).method(import_grpc_sdk7.ConduitRouteActions.DELETE).path(path4);
+    return new RouteBuilder(this).method(import_grpc_sdk8.ConduitRouteActions.DELETE).path(path4);
   }
   update(path4) {
-    return new RouteBuilder(this).method(import_grpc_sdk7.ConduitRouteActions.UPDATE).path(path4);
+    return new RouteBuilder(this).method(import_grpc_sdk8.ConduitRouteActions.UPDATE).path(path4);
   }
   patch(path4) {
-    return new RouteBuilder(this).method(import_grpc_sdk7.ConduitRouteActions.PATCH).path(path4);
+    return new RouteBuilder(this).method(import_grpc_sdk8.ConduitRouteActions.PATCH).path(path4);
   }
   clear() {
     this._moduleRoutes = {};
@@ -836,7 +951,27 @@ var RoutingManager = class _RoutingManager {
   }
   async registerRoutes() {
     if (Object.keys(this._routeHandlers).length === 0) return;
-    const modifiedFunctions = wrapFunctionsAsync(this._routeHandlers, this.isAdmin ? "admin" : "client");
+    const hydrations = {};
+    if (!this.isAdmin) {
+      for (const [name, route] of Object.entries(this._moduleRoutes)) {
+        const options = route.options;
+        const hydrator = createUserHydrator(options, _RoutingManager.resolveUser);
+        if (!hydrator) continue;
+        const names = "events" in route ? Object.keys(JSON.parse(route.events || "{}")) : [name];
+        for (const n of names) hydrations[n] = { options, hydrator };
+        if (!_RoutingManager.grpcSdk && !_RoutingManager.userResolver && !_RoutingManager.warnedNoResolver) {
+          _RoutingManager.warnedNoResolver = true;
+          import_grpc_sdk8.ConduitGrpcSdk.Logger.warn(
+            "User hydration is needed but RoutingManager.grpcSdk is not set; hydration will fail"
+          );
+        }
+      }
+    }
+    const modifiedFunctions = wrapFunctionsAsync(
+      this._routeHandlers,
+      this.isAdmin ? "admin" : "client",
+      hydrations
+    );
     if (this.isAdmin) {
       _RoutingManager.AdminController.setRoutes(modifiedFunctions);
     } else {
@@ -882,7 +1017,7 @@ var ConduitServiceModule = class {
   // external address:port of service (LoadBalancer)
   grpcServer;
   events = new import_events.EventEmitter();
-  _serviceHealthState = import_grpc_sdk8.HealthCheckStatus.SERVING;
+  _serviceHealthState = import_grpc_sdk9.HealthCheckStatus.SERVING;
   // default for health-agnostic modules
   constructor(moduleName) {
     this._moduleName = (0, import_lodash_es2.camelCase)(moduleName);
@@ -909,15 +1044,15 @@ var ConduitServiceModule = class {
     return this._serviceHealthState;
   }
   updateHealth(state, init = false) {
-    if (state === import_grpc_sdk8.HealthCheckStatus.UNKNOWN && !init || state === import_grpc_sdk8.HealthCheckStatus.SERVICE_UNKNOWN) {
+    if (state === import_grpc_sdk9.HealthCheckStatus.UNKNOWN && !init || state === import_grpc_sdk9.HealthCheckStatus.SERVICE_UNKNOWN) {
       throw new Error(
-        `Cannot explicitly set gRPC health state to ${import_grpc_sdk8.HealthCheckStatus[state]}`
+        `Cannot explicitly set gRPC health state to ${import_grpc_sdk9.HealthCheckStatus[state]}`
       );
     }
     if (!init) {
-      import_grpc_sdk8.ConduitGrpcSdk.Metrics?.set(
+      import_grpc_sdk9.ConduitGrpcSdk.Metrics?.set(
         "module_health_state",
-        state === import_grpc_sdk8.HealthCheckStatus.SERVING ? 1 : 0
+        state === import_grpc_sdk9.HealthCheckStatus.SERVING ? 1 : 0
       );
     }
     if (init) {
@@ -936,12 +1071,12 @@ var ConduitServiceModule = class {
     const service = call.request.service.substring(call.request.service.indexOf(".") + 1);
     if (service && service !== this._serviceName) {
       callback(null, {
-        status: import_grpc_sdk8.HealthCheckStatus.SERVICE_UNKNOWN
+        status: import_grpc_sdk9.HealthCheckStatus.SERVICE_UNKNOWN
       });
     } else {
       if (!this._registered) {
         return callback(null, {
-          status: import_grpc_sdk8.HealthCheckResponse_ServingStatus.UNKNOWN
+          status: import_grpc_sdk9.HealthCheckResponse_ServingStatus.UNKNOWN
         });
       }
       callback(null, {
@@ -953,14 +1088,14 @@ var ConduitServiceModule = class {
     const service = call.request.service.substring(call.request.service.indexOf(".") + 1);
     if (service && service !== this._serviceName) {
       call.write({
-        status: import_grpc_sdk8.HealthCheckStatus.SERVICE_UNKNOWN
+        status: import_grpc_sdk9.HealthCheckStatus.SERVICE_UNKNOWN
       });
     } else {
       this.events.on(
         `grpc-health-change:${this._serviceName}`,
-        (status6) => {
+        (status10) => {
           call.write({
-            status: status6
+            status: status10
           });
         }
       );
@@ -983,7 +1118,7 @@ var ConduitServiceModule = class {
       const resources = this.getExportableResources();
       callback(null, { resources: JSON.stringify(resources) });
     } catch (e) {
-      callback({ code: import_grpc_js4.status.INTERNAL, message: e.message });
+      callback({ code: import_grpc_js6.status.INTERNAL, message: e.message });
     }
   }
   async exportResourcesHandler(call, callback) {
@@ -992,7 +1127,7 @@ var ConduitServiceModule = class {
       const data = await this.exportResources(resourceTypes);
       callback(null, { data: JSON.stringify(data) });
     } catch (e) {
-      callback({ code: import_grpc_js4.status.INTERNAL, message: e.message });
+      callback({ code: import_grpc_js6.status.INTERNAL, message: e.message });
     }
   }
   async importResourcesHandler(call, callback) {
@@ -1004,11 +1139,11 @@ var ConduitServiceModule = class {
       const err = e;
       if (err instanceof SyntaxError) {
         callback({
-          code: import_grpc_js4.status.INVALID_ARGUMENT,
+          code: import_grpc_js6.status.INVALID_ARGUMENT,
           message: "Invalid JSON in import data"
         });
       } else {
-        callback({ code: import_grpc_js4.status.INTERNAL, message: err.message });
+        callback({ code: import_grpc_js6.status.INTERNAL, message: err.message });
       }
     }
   }
@@ -1081,7 +1216,7 @@ var ConfigController = class _ConfigController {
 
 // src/ManagedModule.ts
 var import_lodash_es6 = require("lodash-es");
-var import_grpc_js6 = require("@grpc/grpc-js");
+var import_grpc_js10 = require("@grpc/grpc-js");
 var import_convict = __toESM(require("convict"), 1);
 
 // src/interfaces/ModuleLifecycleStage.ts
@@ -1095,13 +1230,13 @@ var ModuleLifecycleStage = /* @__PURE__ */ ((ModuleLifecycleStage2) => {
 })(ModuleLifecycleStage || {});
 
 // src/ManagedModule.ts
-var import_grpc_sdk14 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk17 = require("@conduitplatform/grpc-sdk");
 
 // src/utilities/initializeSdk.ts
-var import_grpc_sdk13 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk14 = require("@conduitplatform/grpc-sdk");
 
 // src/logging/index.ts
-var import_grpc_sdk9 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk10 = require("@conduitplatform/grpc-sdk");
 var import_winston = __toESM(require("winston"), 1);
 var import_lodash_es3 = require("lodash-es");
 var import_http = require("http");
@@ -1258,7 +1393,7 @@ async function setupLoki(module2, instance) {
     if (lokiUrl.endsWith("/")) lokiUrl = lokiUrl.slice(0, -1);
     const onTry = async () => {
       return await lokiReadyCheck(lokiUrl).then(() => {
-        import_grpc_sdk9.ConduitGrpcSdk.Logger.addTransport(
+        import_grpc_sdk10.ConduitGrpcSdk.Logger.addTransport(
           new import_winston_loki.default({
             level: "debug",
             host: lokiUrl,
@@ -1277,15 +1412,90 @@ async function setupLoki(module2, instance) {
       }).catch(() => true);
     };
     const onFailure = () => {
-      import_grpc_sdk9.ConduitGrpcSdk.Logger.error(`Failed to connect to Loki on '${lokiUrl}'`);
+      import_grpc_sdk10.ConduitGrpcSdk.Logger.error(`Failed to connect to Loki on '${lokiUrl}'`);
     };
     await linearBackoffTimeoutAsync(onTry, 250, 15, onFailure, true);
   }
 }
 
-// src/utilities/initializeSdk.ts
-var import_winston2 = __toESM(require("winston"), 1);
+// src/logging/fileTransports.ts
+var import_fs = __toESM(require("fs"), 1);
+var import_os = __toESM(require("os"), 1);
 var import_path2 = __toESM(require("path"), 1);
+var import_winston2 = __toESM(require("winston"), 1);
+var import_winston_daily_rotate_file = __toESM(require("winston-daily-rotate-file"), 1);
+var DEFAULT_RETENTION_DAYS = 3;
+var DEFAULT_MAX_SIZE = "20m";
+var SIZE_STRING = /^(?:0\.)?\d+[kmg]$/i;
+function positiveIntFromEnv(raw, fallback) {
+  if (raw === void 0) return fallback;
+  const trimmed = raw.trim();
+  if (!/^[0-9]+$/.test(trimmed)) return fallback;
+  const value = Number(trimmed);
+  if (!Number.isSafeInteger(value) || value <= 0) return fallback;
+  return value;
+}
+function logFileMaxSize() {
+  const raw = process.env.LOG_FILE_MAX_SIZE?.trim();
+  if (!raw) return DEFAULT_MAX_SIZE;
+  if (SIZE_STRING.test(raw)) return raw.toLowerCase();
+  if (/^[0-9]+$/.test(raw)) {
+    const bytes = Number(raw);
+    if (Number.isSafeInteger(bytes) && bytes > 0) return bytes;
+  }
+  return DEFAULT_MAX_SIZE;
+}
+function formatMeta(meta) {
+  if (Array.isArray(meta)) {
+    if (meta.length === 0) return "";
+    return meta.map((item) => JSON.stringify(item)).join(" ");
+  }
+  if (meta !== null && typeof meta === "object") {
+    if (Object.keys(meta).length === 0) return "";
+    return JSON.stringify(meta);
+  }
+  return "";
+}
+function createFileFormat() {
+  return import_winston2.default.format.combine(
+    import_winston2.default.format.errors({ stack: true }),
+    import_winston2.default.format.timestamp({
+      format: "YYYY-MM-DD HH:mm:ss"
+    }),
+    import_winston2.default.format.printf((info) => {
+      const metaText = formatMeta(info.meta);
+      const line = `[${info.timestamp}] [${info.level.toUpperCase()}]: ${info.message}`;
+      if (info.stack) {
+        return `${line} ${info.stack}`;
+      }
+      return metaText ? `${line} ${metaText}` : line;
+    })
+  );
+}
+function rotateTransport(logDir, name, level) {
+  return new import_winston_daily_rotate_file.default({
+    dirname: logDir,
+    filename: `${name}-%DATE%.log`,
+    datePattern: "YYYY-MM-DD",
+    level,
+    maxFiles: `${positiveIntFromEnv(process.env.LOG_RETENTION_DAYS, DEFAULT_RETENTION_DAYS)}d`,
+    maxSize: logFileMaxSize(),
+    zippedArchive: false,
+    auditFile: import_path2.default.join(logDir, `.${name}-audit.json`),
+    format: createFileFormat()
+  });
+}
+function createFileLogTransports() {
+  if (process.env.LOG_TO_FILE?.trim() === "false") {
+    return [];
+  }
+  const logDir = process.env.LOG_FILE_DIR?.trim() || import_path2.default.join(import_os.default.tmpdir(), "conduit-logs");
+  import_fs.default.mkdirSync(logDir, { recursive: true });
+  return [
+    rotateTransport(logDir, "combined", "info"),
+    rotateTransport(logDir, "errors", "error")
+  ];
+}
 
 // src/metrics/index.ts
 var import_prom_client = require("prom-client");
@@ -1293,7 +1503,7 @@ var import_prom_client = require("prom-client");
 // src/metrics/MetricsServer.ts
 var import_http2 = require("http");
 var import_lodash_es4 = require("lodash-es");
-var import_grpc_sdk10 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk11 = require("@conduitplatform/grpc-sdk");
 var MetricsServer = class {
   moduleName;
   instance;
@@ -1308,7 +1518,7 @@ var MetricsServer = class {
     const url = "0.0.0.0:" + port.toString();
     const server = (0, import_http2.createServer)(this.requestHandler.bind(this));
     server.listen(port, () => {
-      import_grpc_sdk10.ConduitGrpcSdk.Logger.info(`Metrics server listening on: ${url}`);
+      import_grpc_sdk11.ConduitGrpcSdk.Logger.info(`Metrics server listening on: ${url}`);
     });
     return server;
   }
@@ -1330,12 +1540,12 @@ var MetricsServer = class {
   getHttpPort() {
     const value = process.env["METRICS_PORT"];
     if (!value) {
-      import_grpc_sdk10.ConduitGrpcSdk.Logger.error(`Metrics HTTP port not set`);
+      import_grpc_sdk11.ConduitGrpcSdk.Logger.error(`Metrics HTTP port not set`);
       process.exit(-1);
     }
     const port = parseInt(value, 10);
     if ((0, import_lodash_es4.isNaN)(port) || port < 1 || port > 65535) {
-      import_grpc_sdk10.ConduitGrpcSdk.Logger.error(`Invalid HTTP port value: ${port}`);
+      import_grpc_sdk11.ConduitGrpcSdk.Logger.error(`Invalid HTTP port value: ${port}`);
       process.exit(-1);
     }
     return port;
@@ -1343,73 +1553,73 @@ var MetricsServer = class {
 };
 
 // src/metrics/config/defaults.ts
-var import_grpc_sdk11 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk12 = require("@conduitplatform/grpc-sdk");
 var defaults_default = {
   internalGrpcRequests: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "internal_grpc_requests_total",
       help: "Tracks the total number of Conduit's internal gRPC requests"
     }
   },
   clientGrpcRequests: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "client_grpc_requests_total",
       help: "Tracks the total number of the client gRPC requests"
     }
   },
   adminGrpcRequests: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "admin_grpc_requests_total",
       help: "Tracks the total number of the admin gRPC requests"
     }
   },
   clientGrpcErrors: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "client_grpc_errors_total",
       help: "Tracks the total number of client grpc errors"
     }
   },
   adminGrpcErrors: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "admin_grpc_errors_total",
       help: "Tracks the total number of admin grpc errors"
     }
   },
   moduleHealthState: {
-    type: import_grpc_sdk11.MetricType.Gauge,
+    type: import_grpc_sdk12.MetricType.Gauge,
     config: {
       name: "module_health_state",
       help: "Tracks the health state of the module"
     }
   },
   grpcRequestLatency: {
-    type: import_grpc_sdk11.MetricType.Gauge,
+    type: import_grpc_sdk12.MetricType.Gauge,
     config: {
       name: "grpc_request_latency_seconds",
       help: "Tracks the latency of grpc requests in seconds"
     }
   },
   adminGrpcRequestLatency: {
-    type: import_grpc_sdk11.MetricType.Gauge,
+    type: import_grpc_sdk12.MetricType.Gauge,
     config: {
       name: "admin_grpc_request_latency_seconds",
       help: "Tracks the latency of admin grpc requests in seconds"
     }
   },
   clientGrpcRequestLatency: {
-    type: import_grpc_sdk11.MetricType.Gauge,
+    type: import_grpc_sdk12.MetricType.Gauge,
     config: {
       name: "client_grpc_request_latency_seconds",
       help: "Tracks the latency of client grpc requests in seconds"
     }
   },
   grpcResponseStatuses: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "grpc_response_statuses_total",
       help: "Tracks the total number of grpc response codes",
@@ -1417,7 +1627,7 @@ var defaults_default = {
     }
   },
   adminGrpcResponseStatuses: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "admin_grpc_response_statuses_total",
       help: "Tracks the total number of admin grpc response codes",
@@ -1425,7 +1635,7 @@ var defaults_default = {
     }
   },
   clientGrpcResponseStatuses: {
-    type: import_grpc_sdk11.MetricType.Counter,
+    type: import_grpc_sdk12.MetricType.Counter,
     config: {
       name: "client_grpc_response_statuses_total",
       help: "Tracks the total number  of client grpc response codes",
@@ -1435,7 +1645,7 @@ var defaults_default = {
 };
 
 // src/metrics/index.ts
-var import_grpc_sdk12 = require("@conduitplatform/grpc-sdk");
+var import_grpc_sdk13 = require("@conduitplatform/grpc-sdk");
 var METRICS_PREFIX = "cnd_";
 var ConduitMetrics = class {
   moduleName;
@@ -1467,16 +1677,16 @@ var ConduitMetrics = class {
     const metricConfig = JSON.parse(JSON.stringify(config));
     metricConfig.name = this.addPrefix(config.name);
     switch (type) {
-      case import_grpc_sdk12.MetricType.Counter:
+      case import_grpc_sdk13.MetricType.Counter:
         this.createCounter(metricConfig);
         break;
-      case import_grpc_sdk12.MetricType.Gauge:
+      case import_grpc_sdk13.MetricType.Gauge:
         this.createGauge(metricConfig);
         break;
-      case import_grpc_sdk12.MetricType.Histogram:
+      case import_grpc_sdk13.MetricType.Histogram:
         this.createHistogram(metricConfig);
         break;
-      case import_grpc_sdk12.MetricType.Summary:
+      case import_grpc_sdk13.MetricType.Summary:
         this.createSummary(metricConfig);
         break;
     }
@@ -1624,7 +1834,7 @@ function clientMiddleware() {
     clientStartedMetric.inc(labels);
     const stopTimer = clientHandlingSecondsMetric.startTimer(labels);
     let settled = false;
-    let status6 = import_nice_grpc_common.Status.OK;
+    let status10 = import_nice_grpc_common.Status.OK;
     try {
       let request;
       if (!call.requestStream) {
@@ -1650,44 +1860,36 @@ function clientMiddleware() {
     } catch (err) {
       settled = true;
       if (err instanceof import_nice_grpc_common.ClientError) {
-        status6 = err.code;
+        status10 = err.code;
       } else if ((0, import_abort_controller_x.isAbortError)(err)) {
-        status6 = import_nice_grpc_common.Status.ABORTED;
+        status10 = import_nice_grpc_common.Status.ABORTED;
       } else {
-        status6 = import_nice_grpc_common.Status.UNKNOWN;
+        status10 = import_nice_grpc_common.Status.UNKNOWN;
       }
       throw err;
     } finally {
       if (!settled) {
-        status6 = import_nice_grpc_common.Status.CANCELLED;
+        status10 = import_nice_grpc_common.Status.CANCELLED;
       }
-      stopTimer({ [codeLabel]: import_nice_grpc_common.Status[status6] });
+      stopTimer({ [codeLabel]: import_nice_grpc_common.Status[status10] });
       clientHandledMetric.inc({
         ...labels,
-        [codeLabel]: import_nice_grpc_common.Status[status6]
+        [codeLabel]: import_nice_grpc_common.Status[status10]
       });
     }
   };
 }
 
 // src/utilities/initializeSdk.ts
-var initializeSdk = (coreUrl, moduleName, watchModules = true, serviceHealthStatusGetter = () => import_grpc_sdk13.HealthCheckStatus.SERVING) => {
+var initializeSdk = (coreUrl, moduleName, watchModules = true, serviceHealthStatusGetter = () => import_grpc_sdk14.HealthCheckStatus.SERVING) => {
   let logger;
   try {
-    logger = new ConduitLogger([
-      new import_winston2.default.transports.File({
-        filename: import_path2.default.join(__dirname, ".logs/combined.log"),
-        level: "info"
-      }),
-      new import_winston2.default.transports.File({
-        filename: import_path2.default.join(__dirname, ".logs/errors.log"),
-        level: "error"
-      })
-    ]);
-  } catch (e) {
+    const fileTransports = createFileLogTransports();
+    logger = fileTransports.length > 0 ? new ConduitLogger(fileTransports) : new ConduitLogger();
+  } catch {
     logger = new ConduitLogger();
   }
-  const grpcSdk = new import_grpc_sdk13.ConduitGrpcSdk(
+  const grpcSdk = new import_grpc_sdk14.ConduitGrpcSdk(
     coreUrl,
     moduleName,
     watchModules,
@@ -1696,7 +1898,7 @@ var initializeSdk = (coreUrl, moduleName, watchModules = true, serviceHealthStat
   );
   setupLoki(grpcSdk.name, grpcSdk.instance).then();
   if (process.env.METRICS_PORT) {
-    import_grpc_sdk13.ConduitGrpcSdk.Metrics = new ConduitMetrics(grpcSdk.name, grpcSdk.instance);
+    import_grpc_sdk14.ConduitGrpcSdk.Metrics = new ConduitMetrics(grpcSdk.name, grpcSdk.instance);
     grpcSdk.addMiddleware(clientMiddleware());
   }
   return grpcSdk;
@@ -1894,8 +2096,346 @@ async function reconcileStoredModuleConfig(args) {
   return { config: persisted, persisted: true };
 }
 
+// src/utilities/accessTokenVerifier.ts
+var import_grpc_sdk16 = require("@conduitplatform/grpc-sdk");
+var import_grpc_js8 = require("@grpc/grpc-js");
+var import_node_crypto = require("crypto");
+
+// src/utilities/accessTokenVerifier.logic.ts
+var import_fast_jwt2 = require("fast-jwt");
+var import_grpc_js7 = require("@grpc/grpc-js");
+var import_grpc_sdk15 = require("@conduitplatform/grpc-sdk");
+var DEFAULT_LEEWAY_SECONDS = 5;
+var verifiers = /* @__PURE__ */ new Map();
+var decode = (0, import_fast_jwt2.createDecoder)({ complete: true });
+function fail(reason) {
+  throw new import_grpc_sdk15.GrpcError(import_grpc_js7.status.UNAUTHENTICATED, reason);
+}
+function getVerifier(publicKey) {
+  let verifier = verifiers.get(publicKey);
+  if (!verifier) {
+    verifier = (0, import_fast_jwt2.createVerifier)({
+      key: publicKey,
+      algorithms: ["EdDSA"],
+      ignoreExpiration: true,
+      ignoreNotBefore: true,
+      cache: false
+    });
+    verifiers.set(publicKey, verifier);
+  }
+  return verifier;
+}
+function selectVerificationKey(kid, signing, now) {
+  if (!kid) return void 0;
+  if (signing.publicKey && kid === signing.kid) return signing.publicKey;
+  if (signing.previousKid && signing.previousPublicKey && kid === signing.previousKid && (signing.previousRetiredAt ?? 0) > now) {
+    return signing.previousPublicKey;
+  }
+  return void 0;
+}
+function verifyAccessToken(token, state, options = {}) {
+  const now = options.now ?? Date.now();
+  const leeway = options.leewaySeconds ?? DEFAULT_LEEWAY_SECONDS;
+  if (typeof token !== "string" || token.length === 0) fail("malformed token");
+  let kid;
+  try {
+    const decoded = decode(token);
+    if (decoded.header.alg !== "EdDSA") fail("unsupported algorithm");
+    kid = decoded.header.kid;
+  } catch (e) {
+    if (e instanceof import_grpc_sdk15.GrpcError) throw e;
+    fail("malformed token");
+  }
+  const key = selectVerificationKey(kid, state.signing, now);
+  if (!key) fail("unknown kid");
+  let claims;
+  try {
+    claims = getVerifier(key)(token);
+  } catch {
+    fail("bad signature");
+  }
+  if (typeof claims.sub !== "string" || typeof claims.sid !== "string" || typeof claims.exp !== "number") {
+    fail("malformed token");
+  }
+  if (now / 1e3 >= claims.exp + leeway) fail("expired");
+  if (claims.tv !== state.tokenVersion) fail("version mismatch");
+  if (options.clientId !== void 0 && claims.cid !== options.clientId) {
+    fail("client mismatch");
+  }
+  return claims;
+}
+
+// src/utilities/accessTokenVerifier.ts
+var AUTHENTICATION_CONFIG_UPDATE_CHANNEL = "authentication:config:update";
+var INITIAL_RETRY_MS = 1e3;
+var MAX_RETRY_MS = 3e4;
+var REFRESH_INTERVAL_MS = 5 * 60 * 1e3;
+var UNKNOWN_KID_REFETCH_MIN_MS = 10 * 1e3;
+var SUBSCRIBER_ID = "access-token-verifier";
+function isConfigWithAccessTokens(config) {
+  return typeof config === "object" && config !== null && typeof config.accessTokens === "object" && config.accessTokens !== null;
+}
+var AccessTokenVerifier = class _AccessTokenVerifier {
+  constructor(grpcSdk) {
+    this.grpcSdk = grpcSdk;
+  }
+  grpcSdk;
+  static instance;
+  _mode = "session";
+  _strictRevocation = false;
+  _tokenVersion = 0;
+  _signing;
+  _loaded = false;
+  _subscribed = false;
+  _generation = 0;
+  _running = false;
+  _retryTimer;
+  _refreshTimer;
+  _lastRefetch = 0;
+  _refetching = false;
+  _warned = /* @__PURE__ */ new Set();
+  _listeners = /* @__PURE__ */ new Set();
+  static getInstance(grpcSdk) {
+    if (!_AccessTokenVerifier.instance) {
+      _AccessTokenVerifier.instance = new _AccessTokenVerifier(grpcSdk);
+    }
+    return _AccessTokenVerifier.instance;
+  }
+  /**
+   * Internal, for tests only: stops the verifier, clears all state and drops the singleton.
+   */
+  static resetForTests() {
+    _AccessTokenVerifier.instance?.stop();
+    _AccessTokenVerifier.instance?.resetState();
+    _AccessTokenVerifier.instance = void 0;
+  }
+  resetState() {
+    this._mode = "session";
+    this._strictRevocation = false;
+    this._tokenVersion = 0;
+    this._signing = void 0;
+    this._loaded = false;
+    this._lastRefetch = 0;
+    this._warned.clear();
+    this._listeners.clear();
+  }
+  /** Snapshot of the verifier's observable state. */
+  get state() {
+    return {
+      mode: this._mode,
+      strictRevocation: this._strictRevocation,
+      ready: this.ready,
+      tokenVersion: this._tokenVersion,
+      kid: this._signing?.kid
+    };
+  }
+  /**
+   * Registers a listener fired synchronously at the end of every applyConfig that changed
+   * anything (including the first successful load). Returns an unsubscribe function.
+   */
+  onChange(listener) {
+    this._listeners.add(listener);
+    return () => {
+      this._listeners.delete(listener);
+    };
+  }
+  fingerprint() {
+    return JSON.stringify([this._loaded, this._signing, this.state]);
+  }
+  get mode() {
+    return this._mode;
+  }
+  get strictRevocation() {
+    return this._strictRevocation;
+  }
+  /** True once signing keys have been loaded. */
+  get ready() {
+    return !!this._signing?.publicKey;
+  }
+  get tokenVersion() {
+    return this._tokenVersion;
+  }
+  /**
+   * Loads the authentication config, subscribes to its updates and starts a slow periodic
+   * refresh. The first attempt is awaited; if it fails, retries continue in the background
+   * with capped backoff until the config is loaded and the subscription is acknowledged.
+   * Idempotent while running; never throws.
+   */
+  async start() {
+    if (this._running) return;
+    this._running = true;
+    const generation = ++this._generation;
+    await this.attempt(generation, INITIAL_RETRY_MS);
+    if (generation !== this._generation) return;
+    this._refreshTimer = setInterval(() => void this.refetch(true), REFRESH_INTERVAL_MS);
+    this._refreshTimer.unref?.();
+  }
+  stop() {
+    this._running = false;
+    this._generation++;
+    if (this._retryTimer) clearTimeout(this._retryTimer);
+    if (this._refreshTimer) clearInterval(this._refreshTimer);
+    this._retryTimer = void 0;
+    this._refreshTimer = void 0;
+    if (this._subscribed) {
+      try {
+        this.grpcSdk.bus?.unsubscribe(SUBSCRIBER_ID);
+      } catch {
+      }
+      this._subscribed = false;
+    }
+  }
+  async attempt(generation, delay) {
+    if (generation !== this._generation) return;
+    try {
+      await this.subscribe(generation);
+      if (!this._loaded) {
+        this.applyConfig(await this.grpcSdk.config.get("authentication"));
+      }
+    } catch {
+    }
+    if (generation !== this._generation) return;
+    if (this._subscribed && this._loaded) return;
+    this._retryTimer = setTimeout(
+      () => void this.attempt(generation, Math.min(delay * 2, MAX_RETRY_MS)),
+      delay
+    );
+    this._retryTimer.unref?.();
+  }
+  async subscribe(generation) {
+    if (this._subscribed) return;
+    const bus = this.grpcSdk.bus;
+    if (!bus) return;
+    await bus.subscribeAck(
+      AUTHENTICATION_CONFIG_UPDATE_CHANNEL,
+      (message) => {
+        try {
+          this.applyConfig(JSON.parse(message));
+        } catch {
+        }
+      },
+      SUBSCRIBER_ID
+    );
+    if (generation !== this._generation) {
+      bus.unsubscribe(SUBSCRIBER_ID);
+      return;
+    }
+    this._subscribed = true;
+  }
+  /** Refetches the config from the authentication module; failures keep the previous state. */
+  async refetch(force = false) {
+    const now = Date.now();
+    if (this._refetching) return;
+    if (!force && now - this._lastRefetch < UNKNOWN_KID_REFETCH_MIN_MS) return;
+    this._lastRefetch = now;
+    this._refetching = true;
+    try {
+      this.applyConfig(await this.grpcSdk.config.get("authentication"));
+    } catch {
+    } finally {
+      this._refetching = false;
+    }
+  }
+  warnOnce(key, message) {
+    if (this._warned.has(key)) return;
+    this._warned.add(key);
+    import_grpc_sdk16.ConduitGrpcSdk.Logger.warn(`AccessTokenVerifier: ${message}`);
+  }
+  static validPem(pem) {
+    if (typeof pem !== "string" || !pem) return false;
+    try {
+      (0, import_node_crypto.createPublicKey)(pem);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Validates and normalizes the signing keys. Returns undefined when no signing block is
+   * configured, null when the public key is invalid (the caller keeps the previous state).
+   */
+  normalizeSigning(s) {
+    if (!(s && typeof s.kid === "string" && s.kid && s.publicKey)) return void 0;
+    if (!_AccessTokenVerifier.validPem(s.publicKey)) {
+      this.warnOnce("publicKey", "invalid signing public key, keeping previous state");
+      return null;
+    }
+    const previousPublicKey = this.validPreviousKey(s.previousPublicKey);
+    return {
+      kid: s.kid,
+      publicKey: s.publicKey,
+      previousKid: previousPublicKey ? s.previousKid || void 0 : void 0,
+      previousPublicKey,
+      previousRetiredAt: Number(s.previousRetiredAt ?? 0)
+    };
+  }
+  validPreviousKey(pem) {
+    if (!pem) return void 0;
+    if (_AccessTokenVerifier.validPem(pem)) return pem;
+    this.warnOnce("previousPublicKey", "invalid previous public key, ignoring it");
+    return void 0;
+  }
+  parseTokenVersion(raw) {
+    const version = Number(raw ?? 0);
+    if (Number.isNaN(version)) {
+      this.warnOnce("tokenVersion", "invalid tokenVersion, all tokens will be rejected");
+    }
+    return version;
+  }
+  notifyListeners() {
+    const state = this.state;
+    for (const listener of [...this._listeners]) {
+      try {
+        listener(state);
+      } catch (e) {
+        import_grpc_sdk16.ConduitGrpcSdk.Logger.warn(
+          `AccessTokenVerifier: change listener failed: ${e?.message}`
+        );
+      }
+    }
+  }
+  /**
+   * Applies an authentication module config object (full config). Invalid input is ignored
+   * and the previous state is kept; invalid keys are logged once.
+   */
+  applyConfig(config) {
+    if (!isConfigWithAccessTokens(config)) return;
+    const tokens = config.accessTokens;
+    const before = this.fingerprint();
+    const signing = this.normalizeSigning(tokens.signing);
+    if (signing === null) return;
+    const version = this.parseTokenVersion(tokens.tokenVersion);
+    this._mode = tokens.mode === "jwt" ? "jwt" : "session";
+    this._tokenVersion = version;
+    this._strictRevocation = tokens.strictRevocation === true;
+    this._signing = signing;
+    this._loaded = true;
+    if (this.fingerprint() !== before) this.notifyListeners();
+  }
+  /**
+   * Verifies an access token, throwing GrpcError(UNAUTHENTICATED) with a short reason on failure.
+   * `options.now` is epoch milliseconds. An `unknown kid` triggers a throttled (at most once
+   * per 10 s) background refetch of the config, to pick up a rotation sooner.
+   */
+  verify(token, options) {
+    if (!this._signing) {
+      throw new import_grpc_sdk16.GrpcError(import_grpc_js8.status.UNAUTHENTICATED, "verifier not ready");
+    }
+    try {
+      return verifyAccessToken(
+        token,
+        { tokenVersion: this._tokenVersion, signing: this._signing },
+        options
+      );
+    } catch (e) {
+      if (e.message === "unknown kid") void this.refetch();
+      throw e;
+    }
+  }
+};
+
 // src/routing/RoutingController.ts
-var import_grpc_js5 = require("@grpc/grpc-js");
+var import_grpc_js9 = require("@grpc/grpc-js");
 var RoutingController = class {
   _routeHandlers = {};
   handleRequest(call, callback) {
@@ -1903,7 +2443,7 @@ var RoutingController = class {
       this._routeHandlers[call.request.functionName](call, callback);
     } else {
       callback({
-        code: import_grpc_js5.status.NOT_FOUND,
+        code: import_grpc_js9.status.NOT_FOUND,
         message: "Not found"
       });
     }
@@ -1962,13 +2502,13 @@ var ManagedModule = class extends ConduitServiceModule {
       await this.preRegisterLifecycle();
       await this.grpcSdk.config.registerModule(this.name, this.address, this.healthState);
     } catch (err) {
-      import_grpc_sdk14.ConduitGrpcSdk.Logger.error("Failed to initialize server");
-      import_grpc_sdk14.ConduitGrpcSdk.Logger.error(err);
+      import_grpc_sdk17.ConduitGrpcSdk.Logger.error("Failed to initialize server");
+      import_grpc_sdk17.ConduitGrpcSdk.Logger.error(err);
       process.exit(-1);
     }
     await this.postRegisterLifecycle().catch((err) => {
-      import_grpc_sdk14.ConduitGrpcSdk.Logger.error("Failed to activate module");
-      import_grpc_sdk14.ConduitGrpcSdk.Logger.error(err);
+      import_grpc_sdk17.ConduitGrpcSdk.Logger.error("Failed to activate module");
+      import_grpc_sdk17.ConduitGrpcSdk.Logger.error(err);
       process.exit(-1);
     });
   }
@@ -2035,11 +2575,11 @@ var ManagedModule = class extends ConduitServiceModule {
    * Registers common and module-specific metric types.
    */
   async registerMetrics() {
-    if (import_grpc_sdk14.ConduitGrpcSdk.Metrics) {
-      import_grpc_sdk14.ConduitGrpcSdk.Metrics.initializeDefaultMetrics();
+    if (import_grpc_sdk17.ConduitGrpcSdk.Metrics) {
+      import_grpc_sdk17.ConduitGrpcSdk.Metrics.initializeDefaultMetrics();
       if (this.metricsSchema) {
         Object.values(this.metricsSchema).forEach((metric) => {
-          import_grpc_sdk14.ConduitGrpcSdk.Metrics.registerMetric(metric.type, metric.config);
+          import_grpc_sdk17.ConduitGrpcSdk.Metrics.registerMetric(metric.type, metric.config);
         });
       }
     }
@@ -2063,7 +2603,7 @@ var ManagedModule = class extends ConduitServiceModule {
     const known = new Set(this.grpcSdk.getKnownModuleNames());
     for (const n of names) {
       if (!known.has(n)) {
-        import_grpc_sdk14.ConduitGrpcSdk.Logger.warn(
+        import_grpc_sdk17.ConduitGrpcSdk.Logger.warn(
           `Declared Conduit peer "${n}" is not a known built-in module (see ConduitGrpcSdk.getKnownModuleNames).`
         );
       }
@@ -2124,18 +2664,19 @@ var ManagedModule = class extends ConduitServiceModule {
         this.service.functions
       );
     }
+    RoutingManager.grpcSdk = this.grpcSdk;
     RoutingManager.ClientController = new RoutingController();
     RoutingManager.AdminController = new RoutingController();
     await this.addHealthCheckService();
     await this.addModuleService();
     await this.grpcServer.start();
-    import_grpc_sdk14.ConduitGrpcSdk.Logger.log("gRPC server listening on " + this._port);
+    import_grpc_sdk17.ConduitGrpcSdk.Logger.log("gRPC server listening on " + this._port);
   }
   async setConfig(call, callback) {
     try {
       if (!this.config) {
         return callback({
-          code: import_grpc_js6.status.INVALID_ARGUMENT,
+          code: import_grpc_js10.status.INVALID_ARGUMENT,
           message: "Module is not configurable"
         });
       }
@@ -2154,7 +2695,7 @@ var ManagedModule = class extends ConduitServiceModule {
         this.config = (0, import_convict.default)(this.configSchema);
         this.config.load(previousConfig);
         return callback({
-          code: import_grpc_js6.status.INVALID_ARGUMENT,
+          code: import_grpc_js10.status.INVALID_ARGUMENT,
           message: "Invalid configuration values: " + e.message
         });
       }
@@ -2163,7 +2704,7 @@ var ManagedModule = class extends ConduitServiceModule {
       await this._drainConfigQueue();
       this.grpcSdk.bus?.publish((0, import_lodash_es6.kebabCase)(this.name) + ":config:update", configJson);
     } catch (e) {
-      return callback({ code: import_grpc_js6.status.INTERNAL, message: e.message });
+      return callback({ code: import_grpc_js10.status.INTERNAL, message: e.message });
     }
   }
   /** Used to update the module's configuration on initial Redis/DB reconciliation. */
@@ -2243,8 +2784,8 @@ var ManagedModule = class extends ConduitServiceModule {
 };
 
 // src/classes/ModuleError.ts
-var import_grpc_sdk15 = require("@conduitplatform/grpc-sdk");
-var ModuleError = class extends import_grpc_sdk15.GrpcError {
+var import_grpc_sdk18 = require("@conduitplatform/grpc-sdk");
+var ModuleError = class extends import_grpc_sdk18.GrpcError {
   debugLogInfo;
   constructor(errorDefinition, debugLogInfo) {
     const { grpcCode, conduitCode, message } = errorDefinition;
@@ -2260,6 +2801,8 @@ var ModuleError = class extends import_grpc_sdk15.GrpcError {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AUTHENTICATION_CONFIG_UPDATE_CHANNEL,
+  AccessTokenVerifier,
   ConduitActiveSchema,
   ConduitBoolean,
   ConduitDate,
@@ -2270,6 +2813,7 @@ var ModuleError = class extends import_grpc_sdk15.GrpcError {
   ConduitServiceModule,
   ConduitString,
   ConfigController,
+  DEFAULT_LEEWAY_SECONDS,
   DEFAULT_STRIP_FIELDS,
   GrpcServer,
   ManagedModule,
@@ -2282,20 +2826,27 @@ var ModuleError = class extends import_grpc_sdk15.GrpcError {
   convictConfigParser,
   createParsedRouterRequest,
   createServer,
+  createUserHydrator,
   exportModel,
+  getAuthMiddlewareKind,
+  hydrateContextUser,
   importModel,
   initializeSdk,
   linearBackoffTimeout,
   linearBackoffTimeoutAsync,
+  mapHydrationErrorCode,
   merge,
   readConduitPeersManifest,
   reconcileStoredModuleConfig,
   redactSensitiveConfig,
   restoreRedactedSecrets,
   sanitizeDocumentsForExport,
+  selectVerificationKey,
+  shouldHydrateUser,
   stableConfigJson,
   storedConfigsEquivalent,
   stripInternalFields,
+  verifyAccessToken,
   wrapFunctionsAsync,
   wrapGrpcFunctions,
   wrapRouterGrpcFunction