@decaf-ts/integrations 0.2.0 → 0.2.1

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,o;e=this,o=(e,o,r,i)=>{"use strict";e.COMMIT="96f5884",e.FULL_VERSION="0.1.4-96f5884",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.1.4",e.execWithLogging=async(e,n,t,s=r.LogLevel.info)=>(t.debug("Executing: "+e),new Promise((r,d)=>{const c=o.exec(e,n),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),t[s](e.trim())}),c.stderr?.on("data",e=>{l.push(e),t.error(e.trim())}),c.on("close",e=>{0===e?(t.silly("Command completed successfully"),r({stdout:a.join("\n"),stderr:l.join("\n")})):(t.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),d(new i.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{t.critical("Command execution error",e),d(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
+var e,o;e=this,o=(e,o,r,i)=>{"use strict";e.COMMIT="00bac68",e.FULL_VERSION="0.2.0-00bac68",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.2.0",e.execWithLogging=async(e,n,t,s=r.LogLevel.info)=>(t.debug("Executing: "+e),new Promise((r,d)=>{const c=o.exec(e,n),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),t[s](e.trim())}),c.stderr?.on("data",e=>{l.push(e),t.error(e.trim())}),c.on("close",e=>{0===e?(t.silly("Command completed successfully"),r({stdout:a.join("\n"),stderr:l.join("\n")})):(t.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),d(new i.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{t.critical("Command execution error",e),d(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
 //# sourceMappingURL=integrations.cjs.map

package/lib/cjs/index.cjs

@@ -21,9 +21,9 @@ exports.PACKAGE_NAME = exports.FULL_VERSION = exports.COMMIT = exports.VERSION =
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 __exportStar(require("./utils.cjs"), exports);
-exports.VERSION = "0.1.4";
-exports.COMMIT = "96f5884";
-exports.FULL_VERSION = "0.1.4-96f5884";
+exports.VERSION = "0.2.0";
+exports.COMMIT = "00bac68";
+exports.FULL_VERSION = "0.2.0-00bac68";
 exports.PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.cjs.map

package/lib/cjs/nest/index.cjs

@@ -19,9 +19,11 @@ __exportStar(require("./utils.cjs"), exports);
 __exportStar(require("./authService.cjs"), exports);
 __exportStar(require("./keycloakAuthHandler.cjs"), exports);
 __exportStar(require("./keycloakModule.cjs"), exports);
+require("./logging.cjs");
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/cjs/nest/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/index.cjs","sourceRoot":"","sources":["nest/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,6CAA2B;AAC3B,mDAAiC;AACjC,2DAAyC;AACzC,sDAAoC;AACpC;;;;;GAKG;AACH,iCAAiC"}
+{"version":3,"file":"nest/index.cjs","sourceRoot":"","sources":["nest/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,6CAA2B;AAC3B,mDAAiC;AACjC,2DAAyC;AACzC,sDAAoC;AACpC,wBAAsB;AACtB;;;;;;GAMG;AACH,iCAAiC"}

package/lib/cjs/nest/keycloakAuthHandler.cjs

@@ -1,38 +1,50 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeycloakAuthHandler = void 0;
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth context values.
- */
 const core_1 = require("@decaf-ts/core");
+const server_1 = require("@decaf-ts/for-http/server");
 const authService_js_1 = require("./authService.cjs");
 const utils_js_1 = require("./utils.cjs");
-class KeycloakAuthHandler {
+class KeycloakAuthHandler extends server_1.AuthHandler {
     constructor(authService = new authService_js_1.AuthService()) {
+        super();
         this.authService = authService;
     }
-    async authorize(context) {
-        const request = context.switchToHttp().getRequest();
-        if (request.path?.startsWith("/public"))
-            return;
-        if (request.path === "/account" && request.method === "POST")
-            return;
+    extractFromAuth(ctx) {
+        const request = ctx.switchToHttp().getRequest();
+        if (isPublicRoute(request)) {
+            return { roles: [], token: "", isPublic: true };
+        }
         const token = getToken(request);
         if (!token)
             throw new core_1.AuthorizationError("Token not found");
-        const payload = this.authService.assertValidToken(token);
-        const roles = this.authService.getRoles(token);
-        const organization = payload.aud || payload.azp || (0, utils_js_1.getRealmFromIssuer)(token);
-        request[utils_js_1.DECAF_ADAPTER_OPTIONS] = {
-            roles,
-            user: payload.email ?? payload.preferred_username,
-            msp: organization,
-        };
+        // Decode only — validation happens in `validate`
+        const payload = (0, utils_js_1.getTokenPayload)(token);
+        const roles = (0, utils_js_1.extractKeycloakRoles)(payload);
+        const organization = resolveOrganization(payload, token);
+        const user = payload?.email ?? payload?.preferred_username;
+        return { user, organization, roles, token, isPublic: false };
+    }
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    async validate(data, routeRoles, model, ...args) {
+        if (data.isPublic)
+            return;
+        this.authService.assertValidToken(data.token);
+        await super.validate(data, routeRoles, model, ...args);
     }
 }
 exports.KeycloakAuthHandler = KeycloakAuthHandler;
+function isPublicRoute(req) {
+    if (req.path?.startsWith("/public"))
+        return true;
+    if (req.path === "/account" && req.method === "POST")
+        return true;
+    return false;
+}
 function getToken(req) {
     const token = (req.headers?.["x-auth-request-access-token"] ??
         req.headers?.["authorization"]);
@@ -40,5 +52,12 @@ function getToken(req) {
         return undefined;
     return token.startsWith("Bearer ") ? token.slice("Bearer ".length) : token;
 }
+function resolveOrganization(payload, token) {
+    if (payload?.aud)
+        return payload.aud;
+    if (payload?.azp)
+        return payload.azp;
+    return (0, utils_js_1.getRealmFromIssuer)(token);
+}
 //# sourceMappingURL=keycloakAuthHandler.js.map
 //# sourceMappingURL=keycloakAuthHandler.cjs.map

package/lib/cjs/nest/keycloakAuthHandler.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,yCAAoD;AACpD,qDAA+C;AAC/C,yCAAuE;AACvE,MAAa,mBAAmB;IAC5B,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,OAAO;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YACnC,OAAO;QACX,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YACxD,OAAO;QACX,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,gCAAqB,CAAC,GAAG;YAC7B,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,kBAAkB;YACjD,GAAG,EAAE,YAAY;SACpB,CAAC;IACN,CAAC;CACJ;AAtBD,kDAsBC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,+CAA+C"}
+{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA,yCAAoD;AACpD,sDAAwD;AACxD,qDAA+C;AAC/C,yCAAwF;AACxF,MAAa,mBAAoB,SAAQ,oBAAW;IAChD,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,eAAe,CAAC,GAAG;QACf,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI;QAC3C,IAAI,IAAI,CAAC,QAAQ;YACb,OAAO;QACX,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;CACJ;AA/BD,kDA+BC;AACD,SAAS,aAAa,CAAC,GAAG;IACtB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAChD,OAAO,IAAI,CAAC;IAChB,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,SAAS,mBAAmB,CAAC,OAAO,EAAE,KAAK;IACvC,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,OAAO,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AACD,+CAA+C"}

package/lib/cjs/nest/logging.cjs

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @module integrations/nest/logging
+ * @summary Keycloak auth log parameters.
+ * @description Registers `user` and `organization` as log parameters sourced from the
+ * logging config (populated by the auth interceptor's child logger via `Logging.for({ user, organization })`).
+ *
+ * These parameters are registered here — in `integrations/nest` — because this is the
+ * layer that extracts user/organization identity from Keycloak JWTs. The `ip` parameter,
+ * by contrast, is registered in `@decaf-ts/for-http/server` where the HTTP request IP is
+ * available.
+ */
+const logging_1 = require("@decaf-ts/logging");
+logging_1.logParameterRegistry
+    .register({
+    key: "user",
+    shouldInclude(payload) {
+        return Boolean(payload.config.user);
+    },
+    render(payload) {
+        return String(payload.config.user);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+})
+    .register({
+    key: "organization",
+    shouldInclude(payload) {
+        return Boolean(payload.config.organization);
+    },
+    render(payload) {
+        return String(payload.config.organization);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+});
+//# sourceMappingURL=logging.js.map
+//# sourceMappingURL=logging.cjs.map

package/lib/cjs/nest/logging.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest/logging.cjs","sourceRoot":"","sources":["nest/logging.js"],"names":[],"mappings":";;AAAA;;;;;;;;;;GAUG;AACH,+CAAyD;AACzD,8BAAoB;KACf,QAAQ,CAAC;IACV,GAAG,EAAE,MAAM;IACX,aAAa,CAAC,OAAO;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,OAAO;QACV,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACnB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;CACJ,CAAC;KACG,QAAQ,CAAC;IACV,GAAG,EAAE,cAAc;IACnB,aAAa,CAAC,OAAO;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,OAAO;QACV,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACnB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;CACJ,CAAC,CAAC;AACH,mCAAmC"}

package/lib/esm/index.js

@@ -4,8 +4,8 @@
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 export * from "./utils.js";
-export const VERSION = "0.1.4";
-export const COMMIT = "96f5884";
-export const FULL_VERSION = "0.1.4-96f5884";
+export const VERSION = "0.2.0";
+export const COMMIT = "00bac68";
+export const FULL_VERSION = "0.2.0-00bac68";
 export const PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map

package/lib/esm/nest/index.js

@@ -3,9 +3,11 @@ export * from "./utils.js";
 export * from "./authService.js";
 export * from "./keycloakAuthHandler.js";
 export * from "./keycloakModule.js";
+import "./logging.js";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/esm/nest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nest/index.ts"],"names":[],"mappings":"AAAA,2BAAwB;AACxB,2BAAwB;AACxB,iCAA8B;AAC9B,yCAAsC;AACtC,oCAAiC;AAEjC;;;;;GAKG"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nest/index.ts"],"names":[],"mappings":"AAAA,2BAAwB;AACxB,2BAAwB;AACxB,iCAA8B;AAC9B,yCAAsC;AACtC,oCAAiC;AAEjC,sBAAmB;AAEnB;;;;;;GAMG"}

package/lib/esm/nest/keycloakAuthHandler.js

@@ -1,34 +1,46 @@
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth context values.
- */
 import { AuthorizationError } from "@decaf-ts/core";
+import { AuthHandler } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.js";
-import { DECAF_ADAPTER_OPTIONS, getRealmFromIssuer } from "./utils.js";
-export class KeycloakAuthHandler {
+import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, } from "./utils.js";
+export class KeycloakAuthHandler extends AuthHandler {
     constructor(authService = new AuthService()) {
+        super();
         this.authService = authService;
     }
-    async authorize(context) {
-        const request = context.switchToHttp().getRequest();
-        if (request.path?.startsWith("/public"))
-            return;
-        if (request.path === "/account" && request.method === "POST")
-            return;
+    extractFromAuth(ctx) {
+        const request = ctx.switchToHttp().getRequest();
+        if (isPublicRoute(request)) {
+            return { roles: [], token: "", isPublic: true };
+        }
         const token = getToken(request);
         if (!token)
             throw new AuthorizationError("Token not found");
-        const payload = this.authService.assertValidToken(token);
-        const roles = this.authService.getRoles(token);
-        const organization = payload.aud || payload.azp || getRealmFromIssuer(token);
-        request[DECAF_ADAPTER_OPTIONS] = {
-            roles,
-            user: payload.email ?? payload.preferred_username,
-            msp: organization,
-        };
+        // Decode only — validation happens in `validate`
+        const payload = getTokenPayload(token);
+        const roles = extractKeycloakRoles(payload);
+        const organization = resolveOrganization(payload, token);
+        const user = payload?.email ?? payload?.preferred_username;
+        return { user, organization, roles, token, isPublic: false };
+    }
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    async validate(data, routeRoles, model, ...args) {
+        if (data.isPublic)
+            return;
+        this.authService.assertValidToken(data.token);
+        await super.validate(data, routeRoles, model, ...args);
     }
 }
+function isPublicRoute(req) {
+    if (req.path?.startsWith("/public"))
+        return true;
+    if (req.path === "/account" && req.method === "POST")
+        return true;
+    return false;
+}
 function getToken(req) {
     const token = (req.headers?.["x-auth-request-access-token"] ??
         req.headers?.["authorization"]);
@@ -36,4 +48,11 @@ function getToken(req) {
         return undefined;
     return token.startsWith("Bearer ") ? token.slice("Bearer ".length) : token;
 }
+function resolveOrganization(payload, token) {
+    if (payload?.aud)
+        return payload.aud;
+    if (payload?.azp)
+        return payload.azp;
+    return getRealmFromIssuer(token);
+}
 //# sourceMappingURL=keycloakAuthHandler.js.map

package/lib/esm/nest/keycloakAuthHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAC5C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAgB;AAEpE,MAAM,OAAO,mBAAmB;IAC9B,YAA6B,cAAc,IAAI,WAAW,EAAE;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAAG,CAAC;IAEhE,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAErE,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE7E,OAAO,CAAC,qBAAqB,CAAC,GAAG;YAC/B,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,kBAAkB;YACjD,GAAG,EAAE,YAAY;SAClB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAE5C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC,YAA6B,cAAc,IAAI,WAAW,EAAE;QAC1D,KAAK,EAAE,CAAC;QADmB,gBAAW,GAAX,WAAW,CAAoB;IAE5D,CAAC;IAES,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/lib/esm/nest/logging.js

@@ -0,0 +1,38 @@
+/**
+ * @module integrations/nest/logging
+ * @summary Keycloak auth log parameters.
+ * @description Registers `user` and `organization` as log parameters sourced from the
+ * logging config (populated by the auth interceptor's child logger via `Logging.for({ user, organization })`).
+ *
+ * These parameters are registered here — in `integrations/nest` — because this is the
+ * layer that extracts user/organization identity from Keycloak JWTs. The `ip` parameter,
+ * by contrast, is registered in `@decaf-ts/for-http/server` where the HTTP request IP is
+ * available.
+ */
+import { logParameterRegistry } from "@decaf-ts/logging";
+logParameterRegistry
+    .register({
+    key: "user",
+    shouldInclude(payload) {
+        return Boolean(payload.config.user);
+    },
+    render(payload) {
+        return String(payload.config.user);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+})
+    .register({
+    key: "organization",
+    shouldInclude(payload) {
+        return Boolean(payload.config.organization);
+    },
+    render(payload) {
+        return String(payload.config.organization);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+});
+//# sourceMappingURL=logging.js.map

package/lib/esm/nest/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/nest/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,oBAAoB;KACjB,QAAQ,CAAC;IACR,GAAG,EAAE,MAAM;IACX,aAAa,CAAC,OAAO;QACnB,OAAO,OAAO,CAAE,OAAO,CAAC,MAAkC,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,OAAO;QACZ,OAAO,MAAM,CAAE,OAAO,CAAC,MAAkC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACrB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC;KACD,QAAQ,CAAC;IACR,GAAG,EAAE,cAAc;IACnB,aAAa,CAAC,OAAO;QACnB,OAAO,OAAO,CAAE,OAAO,CAAC,MAAkC,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,CAAC,OAAO;QACZ,OAAO,MAAM,CAAE,OAAO,CAAC,MAAkC,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACrB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC"}

package/lib/types/index.d.cts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "96f5884";
-export declare const FULL_VERSION = "0.1.4-96f5884";
+export declare const COMMIT = "00bac68";
+export declare const FULL_VERSION = "0.2.0-00bac68";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "96f5884";
-export declare const FULL_VERSION = "0.1.4-96f5884";
+export declare const COMMIT = "00bac68";
+export declare const FULL_VERSION = "0.2.0-00bac68";
 export declare const PACKAGE_NAME: string;

package/lib/types/nest/index.d.cts

@@ -3,9 +3,11 @@ export * from "./utils.d.cts";
 export * from "./authService.d.cts";
 export * from "./keycloakAuthHandler.d.cts";
 export * from "./keycloakModule.d.cts";
+import "./logging";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/types/nest/index.d.mts

@@ -3,9 +3,11 @@ export * from "./utils.d.mts";
 export * from "./authService.d.mts";
 export * from "./keycloakAuthHandler.d.mts";
 export * from "./keycloakModule.d.mts";
+import "./logging";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/types/nest/keycloakAuthHandler.d.cts

@@ -1,7 +1,44 @@
-import type { AuthExecutionContextLike } from "./types.d.cts";
+/**
+ * @module integrations/nest/keycloakAuthHandler
+ * @summary Keycloak request auth handler.
+ * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
+ * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
+ *
+ * Only overrides the two extension points:
+ * - {@link extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ *   Returns empty data for public routes without requiring a token.
+ * - {@link validate} — validates the JWT via {@link AuthService.assertValidToken},
+ *   then delegates to the base class for route-level and model-level role checks.
+ *   Skips entirely for public routes.
+ *
+ * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
+ * is sufficient. Does NOT override `authorize`.
+ */
+import type { Constructor } from "@decaf-ts/decoration";
+import { Context, ContextualArgs } from "@decaf-ts/core";
+import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.d.cts";
-export declare class KeycloakAuthHandler {
+import type { AuthExecutionContextLike } from "./types.d.cts";
+/**
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
+ *
+ * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
+ * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ */
+export interface KeycloakAuthData extends AuthData {
+    /** The raw JWT extracted from the request. Empty for public routes. */
+    token: string;
+    /** Whether the request targets a public route (skips validation). */
+    isPublic: boolean;
+}
+export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
     private readonly authService;
     constructor(authService?: AuthService);
-    authorize(context: AuthExecutionContextLike): Promise<void>;
+    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
 }

package/lib/types/nest/keycloakAuthHandler.d.mts

@@ -1,7 +1,44 @@
-import type { AuthExecutionContextLike } from "./types.d.mts";
+/**
+ * @module integrations/nest/keycloakAuthHandler
+ * @summary Keycloak request auth handler.
+ * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
+ * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
+ *
+ * Only overrides the two extension points:
+ * - {@link extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ *   Returns empty data for public routes without requiring a token.
+ * - {@link validate} — validates the JWT via {@link AuthService.assertValidToken},
+ *   then delegates to the base class for route-level and model-level role checks.
+ *   Skips entirely for public routes.
+ *
+ * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
+ * is sufficient. Does NOT override `authorize`.
+ */
+import type { Constructor } from "@decaf-ts/decoration";
+import { Context, ContextualArgs } from "@decaf-ts/core";
+import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.d.mts";
-export declare class KeycloakAuthHandler {
+import type { AuthExecutionContextLike } from "./types.d.mts";
+/**
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
+ *
+ * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
+ * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ */
+export interface KeycloakAuthData extends AuthData {
+    /** The raw JWT extracted from the request. Empty for public routes. */
+    token: string;
+    /** Whether the request targets a public route (skips validation). */
+    isPublic: boolean;
+}
+export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
     private readonly authService;
     constructor(authService?: AuthService);
-    authorize(context: AuthExecutionContextLike): Promise<void>;
+    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
 }

package/lib/types/nest/logging.d.cts

@@ -0,0 +1 @@
+export {};

package/lib/types/nest/logging.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/types/nest/types.d.cts

@@ -1,8 +1,30 @@
 /**
  * @module integrations/nest/types
  * @summary Nest integration types.
- * @description Shared request-context and auth payload types for Nest integration helpers.
+ * @description Keycloak-specific payload types, a platform-specific execution context
+ * type, and re-exports of the framework-agnostic auth primitives from
+ * `@decaf-ts/for-http/server`.
  */
+import type { AuthData, AuthRequestLike, UserData } from "@decaf-ts/for-http/server";
+export type { AuthData, AuthRequestLike, UserData };
+/**
+ * Structural subset of a NestJS-like execution context that exposes the HTTP request.
+ *
+ * Defined here (not in for-http) because the base `AuthHandler` class is intentionally
+ * generic over its execution context — only the platform that consumes it needs to know
+ * the concrete shape.
+ */
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+    getClass?(): {
+        name?: string;
+    };
+}
 export interface KeycloakAccessTokenPayload {
     preferred_username?: string;
     email?: string;
@@ -29,20 +51,3 @@ export interface KeycloakUser {
     family_name?: string;
     realm?: string;
 }
-export interface AuthRequestLike {
-    path?: string;
-    method?: string;
-    headers?: Record<string, unknown>;
-    [key: symbol | string]: unknown;
-}
-export interface AuthExecutionContextLike {
-    switchToHttp(): {
-        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
-    };
-    getHandler?(): {
-        name?: string;
-    };
-}
-export interface AuthHandlerLike {
-    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
-}

package/lib/types/nest/types.d.mts

@@ -1,8 +1,30 @@
 /**
  * @module integrations/nest/types
  * @summary Nest integration types.
- * @description Shared request-context and auth payload types for Nest integration helpers.
+ * @description Keycloak-specific payload types, a platform-specific execution context
+ * type, and re-exports of the framework-agnostic auth primitives from
+ * `@decaf-ts/for-http/server`.
  */
+import type { AuthData, AuthRequestLike, UserData } from "@decaf-ts/for-http/server";
+export type { AuthData, AuthRequestLike, UserData };
+/**
+ * Structural subset of a NestJS-like execution context that exposes the HTTP request.
+ *
+ * Defined here (not in for-http) because the base `AuthHandler` class is intentionally
+ * generic over its execution context — only the platform that consumes it needs to know
+ * the concrete shape.
+ */
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+    getClass?(): {
+        name?: string;
+    };
+}
 export interface KeycloakAccessTokenPayload {
     preferred_username?: string;
     email?: string;
@@ -29,20 +51,3 @@ export interface KeycloakUser {
     family_name?: string;
     realm?: string;
 }
-export interface AuthRequestLike {
-    path?: string;
-    method?: string;
-    headers?: Record<string, unknown>;
-    [key: symbol | string]: unknown;
-}
-export interface AuthExecutionContextLike {
-    switchToHttp(): {
-        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
-    };
-    getHandler?(): {
-        name?: string;
-    };
-}
-export interface AuthHandlerLike {
-    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decaf-ts/integrations",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.mts",
@@ -244,6 +244,7 @@
     "@decaf-ts/crypto": "latest",
     "@decaf-ts/db-decorators": "latest",
     "@decaf-ts/decoration": "latest",
+    "@decaf-ts/decorator-validation": "latest",
     "@decaf-ts/injectable-decorators": "latest",
     "@decaf-ts/logging": "latest",
     "@decaf-ts/transactional-decorators": "latest",
@@ -253,11 +254,31 @@
     "uuid": "^11.1.1"
   },
   "devDependencies": {
+    "@decaf-ts/for-http": "latest",
+    "@decaf-ts/for-nest": "^0.11.2-refactor",
     "@decaf-ts/utils": "latest",
-    "@types/jest": "^30.0.0"
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/platform-express": "^11.0.0",
+    "@nestjs/swagger": "^11.4.4",
+    "@nestjs/testing": "^11.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/supertest": "^6.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0",
+    "supertest": "^7.0.0"
+  },
+  "peerDependencies": {
+    "@decaf-ts/for-http": ">=0.18.0"
+  },
+  "peerDependenciesMeta": {
+    "@decaf-ts/for-http": {
+      "optional": true
+    }
   },
   "overrides": {
-    "js-yaml": "^4.2.0"
+    "js-yaml": "^4.2.0",
+    "multer": "^2.1.2"
   },
   "optionalDependencies": {
     "@aws-sdk/client-s3": "^3.1075.0",