@decaf-ts/integrations 0.2.0 → 0.2.2

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,o;e=this,o=(e,o,r,i)=>{"use strict";e.COMMIT="96f5884",e.FULL_VERSION="0.1.4-96f5884",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.1.4",e.execWithLogging=async(e,n,t,s=r.LogLevel.info)=>(t.debug("Executing: "+e),new Promise((r,d)=>{const c=o.exec(e,n),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),t[s](e.trim())}),c.stderr?.on("data",e=>{l.push(e),t.error(e.trim())}),c.on("close",e=>{0===e?(t.silly("Command completed successfully"),r({stdout:a.join("\n"),stderr:l.join("\n")})):(t.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),d(new i.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{t.critical("Command execution error",e),d(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
+var e,o;e=this,o=(e,o,i,n)=>{"use strict";e.COMMIT="4990f39",e.FULL_VERSION="0.2.1-4990f39",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.2.1",e.execWithLogging=async(e,t,r,d=i.LogLevel.info)=>(r.debug("Executing: "+e),new Promise((i,s)=>{const c=o.exec(e,t),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),r[d](e.trim())}),c.stderr?.on("data",e=>{l.push(e),r.debug(e.trim())}),c.on("close",e=>{0===e?(r.silly("Command completed successfully"),i({stdout:a.join("\n"),stderr:l.join("\n")})):(r.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),s(new n.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{r.critical("Command execution error",e),s(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
 //# sourceMappingURL=integrations.cjs.map

package/dist/integrations.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.cjs","sources":["../src/index.ts","../src/utils.ts"],"sourcesContent":[null,null],"names":["async","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","error","code","silly","join","critical","InternalError","err"],"mappings":"mDASsB,4BAEM,kCAEQ,wBANL,gCCExBA,MACLC,EACAC,EACAC,EACAC,EAAkBC,EAAAA,SAASC,QAE3BH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAAA,KAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAIgB,MAAMH,EAAKE,UAGjBP,EAAMI,GAAG,QAAUK,IACJ,IAATA,GACFjB,EAAIkB,MAAM,kCACVZ,EAAQ,CAAEI,OAAQA,EAAOS,KAAK,MAAOR,OAAQA,EAAOQ,KAAK,UAEzDnB,EAAIoB,SACF,4BAA4BH,QAAWN,EAAOQ,KAAK,SAErDZ,EACE,IAAIc,EAAAA,cACF,4BAA4BJ,MAASN,EAAOQ,KAAK,aAMzDX,EAAMI,GAAG,QAAUU,IACjBtB,EAAIoB,SAAS,0BAA2BE,GACxCf,EAAOe"}
+{"version":3,"file":"integrations.cjs","sources":["../src/index.ts","../src/utils.ts"],"sourcesContent":[null,null],"names":["async","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","code","silly","join","critical","InternalError","err"],"mappings":"mDASsB,4BAEM,kCAEQ,wBANL,gCCExBA,MACLC,EACAC,EACAC,EACAC,EAAkBC,EAAAA,SAASC,QAE3BH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAAA,KAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAII,MAAMS,EAAKE,UAGjBP,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,OAAQA,EAAOQ,KAAK,MAAOP,OAAQA,EAAOO,KAAK,UAEzDlB,EAAImB,SACF,4BAA4BH,QAAWL,EAAOO,KAAK,SAErDX,EACE,IAAIa,EAAAA,cACF,4BAA4BJ,MAASL,EAAOO,KAAK,aAMzDV,EAAMI,GAAG,QAAUS,IACjBrB,EAAImB,SAAS,0BAA2BE,GACxCd,EAAOc"}

package/dist/integrations.js

@@ -1,2 +1,2 @@
-import{exec as o}from"child_process";import{LogLevel as r}from"@decaf-ts/logging";import{InternalError as n}from"@decaf-ts/db-decorators";async function t(t,e,i,c=r.info){return i.debug("Executing: "+t),new Promise((r,d)=>{const s=o(t,e),m=[],a=[];s.stdout?.on("data",o=>{m.push(o),i[c](o.trim())}),s.stderr?.on("data",o=>{a.push(o),i.error(o.trim())}),s.on("close",o=>{0===o?(i.silly("Command completed successfully"),r({stdout:m.join("\n"),stderr:a.join("\n")})):(i.critical(`Command failed with code ${o}:\n ${a.join("\n")}`),d(new n(`Command failed with code ${o}: ${a.join("\n")}`)))}),s.on("error",o=>{i.critical("Command execution error",o),d(o)})})}const e="##VERSION##",i="##COMMIT##",c="##FULL_VERSION##",d="##PACKAGE##";export{i as COMMIT,c as FULL_VERSION,d as PACKAGE_NAME,e as VERSION,t as execWithLogging};
+import{exec as o}from"child_process";import{LogLevel as n}from"@decaf-ts/logging";import{InternalError as t}from"@decaf-ts/db-decorators";async function r(r,e,i,d=n.info){return i.debug("Executing: "+r),new Promise((n,c)=>{const s=o(r,e),m=[],a=[];s.stdout?.on("data",o=>{m.push(o),i[d](o.trim())}),s.stderr?.on("data",o=>{a.push(o),i.debug(o.trim())}),s.on("close",o=>{0===o?(i.silly("Command completed successfully"),n({stdout:m.join("\n"),stderr:a.join("\n")})):(i.critical(`Command failed with code ${o}:\n ${a.join("\n")}`),c(new t(`Command failed with code ${o}: ${a.join("\n")}`)))}),s.on("error",o=>{i.critical("Command execution error",o),c(o)})})}const e="##VERSION##",i="##COMMIT##",d="##FULL_VERSION##",c="##PACKAGE##";export{i as COMMIT,d as FULL_VERSION,c as PACKAGE_NAME,e as VERSION,r as execWithLogging};
 //# sourceMappingURL=integrations.js.map

package/dist/integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.js","sources":["../src/utils.ts","../src/index.ts"],"sourcesContent":[null,null],"names":["async","execWithLogging","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","error","code","silly","join","critical","InternalError","err","VERSION","COMMIT","FULL_VERSION","PACKAGE_NAME"],"mappings":"0IASOA,eAAeC,EACpBC,EACAC,EACAC,EACAC,EAAkBC,EAASC,MAI3B,OAFAH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAIgB,MAAMH,EAAKE,UAGjBP,EAAMI,GAAG,QAAUK,IACJ,IAATA,GACFjB,EAAIkB,MAAM,kCACVZ,EAAQ,CAAEI,OAAQA,EAAOS,KAAK,MAAOR,OAAQA,EAAOQ,KAAK,UAEzDnB,EAAIoB,SACF,4BAA4BH,QAAWN,EAAOQ,KAAK,SAErDZ,EACE,IAAIc,EACF,4BAA4BJ,MAASN,EAAOQ,KAAK,aAMzDX,EAAMI,GAAG,QAAUU,IACjBtB,EAAIoB,SAAS,0BAA2BE,GACxCf,EAAOe,MAGb,CC/CO,MAAMC,EAAkB,cAElBC,EAAS,aAETC,EAAe,mBAEfC,EAAuB"}
+{"version":3,"file":"integrations.js","sources":["../src/utils.ts","../src/index.ts"],"sourcesContent":[null,null],"names":["async","execWithLogging","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","code","silly","join","critical","InternalError","err","VERSION","COMMIT","FULL_VERSION","PACKAGE_NAME"],"mappings":"0IASOA,eAAeC,EACpBC,EACAC,EACAC,EACAC,EAAkBC,EAASC,MAI3B,OAFAH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAII,MAAMS,EAAKE,UAGjBP,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,OAAQA,EAAOQ,KAAK,MAAOP,OAAQA,EAAOO,KAAK,UAEzDlB,EAAImB,SACF,4BAA4BH,QAAWL,EAAOO,KAAK,SAErDX,EACE,IAAIa,EACF,4BAA4BJ,MAASL,EAAOO,KAAK,aAMzDV,EAAMI,GAAG,QAAUS,IACjBrB,EAAImB,SAAS,0BAA2BE,GACxCd,EAAOc,MAGb,CC/CO,MAAMC,EAAkB,cAElBC,EAAS,aAETC,EAAe,mBAEfC,EAAuB"}

package/lib/cjs/index.cjs

@@ -21,9 +21,9 @@ exports.PACKAGE_NAME = exports.FULL_VERSION = exports.COMMIT = exports.VERSION =
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 __exportStar(require("./utils.cjs"), exports);
-exports.VERSION = "0.1.4";
-exports.COMMIT = "96f5884";
-exports.FULL_VERSION = "0.1.4-96f5884";
+exports.VERSION = "0.2.1";
+exports.COMMIT = "4990f39";
+exports.FULL_VERSION = "0.2.1-4990f39";
 exports.PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.cjs.map

package/lib/cjs/nest/authService.cjs

@@ -5,15 +5,28 @@ exports.AuthService = void 0;
  * @module integrations/nest/authService
  * @summary Nest-compatible authentication service helpers.
  * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
+ *
+ * Supports two modes:
+ * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
+ *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
+ * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
+ *   decodes the JWT without signature verification (dev/local mode).
  */
 const core_1 = require("@decaf-ts/core");
+const jose_1 = require("jose");
 const utils_js_1 = require("./utils.cjs");
 class AuthService {
+    constructor(options = {}) {
+        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
+        this.verifyUrl = options.verifyUrl ?? "";
+        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+        this.excludedClients = options.excludedClients ?? ["account"];
+    }
     getTokenPayload(jwt) {
         return (0, utils_js_1.getTokenPayload)(jwt);
     }
     getRoles(jwt) {
-        return (0, utils_js_1.extractKeycloakRoles)(this.getTokenPayload(jwt));
+        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
     }
     getUser(jwt) {
         return (0, utils_js_1.getUser)(jwt);
@@ -21,16 +34,54 @@ class AuthService {
     extractKeycloakRoles(payload) {
         return (0, utils_js_1.extractKeycloakRoles)(payload);
     }
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload) {
+        return (0, utils_js_1.getClientRoles)(payload, this.excludedClients);
+    }
     getRealmFromIssuer(jwt) {
         return (0, utils_js_1.getRealmFromIssuer)(jwt);
     }
-    assertValidToken(jwt) {
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    async assertValidToken(jwt) {
+        if (this.verifyToken) {
+            return this.verifyAgainstJwks(jwt);
+        }
         const payload = this.getTokenPayload(jwt);
         if (!payload) {
             throw new core_1.AuthorizationError("Invalid token");
         }
         return payload;
     }
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    async verifyAgainstJwks(jwt) {
+        if (!this.jwks) {
+            this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(this.verifyUrl));
+        }
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(jwt, this.jwks, {
+                clockTolerance: `${this.clockToleranceSeconds}s`,
+            });
+            return payload;
+        }
+        catch (e) {
+            throw new core_1.AuthorizationError("Invalid token: " + (e?.message ?? e));
+        }
+    }
 }
 exports.AuthService = AuthService;
 //# sourceMappingURL=authService.js.map

package/lib/cjs/nest/authService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/authService.cjs","sourceRoot":"","sources":["nest/authService.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,yCAAoD;AACpD,yCAAgG;AAChG,MAAa,WAAW;IACpB,eAAe,CAAC,GAAG;QACf,OAAO,IAAA,0BAAe,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,QAAQ,CAAC,GAAG;QACR,OAAO,IAAA,+BAAoB,EAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG;QACP,OAAO,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,oBAAoB,CAAC,OAAO;QACxB,OAAO,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,kBAAkB,CAAC,GAAG;QAClB,OAAO,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,gBAAgB,CAAC,GAAG;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,yBAAkB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ;AAvBD,kCAuBC;AACD,uCAAuC"}
+{"version":3,"file":"nest/authService.cjs","sourceRoot":"","sources":["nest/authService.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,yCAAoD;AACpD,+BAAqD;AACrD,yCAAiH;AACjH,MAAa,WAAW;IACpB,YAAY,OAAO,GAAG,EAAE;QACpB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,GAAG;QACf,OAAO,IAAA,0BAAe,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,QAAQ,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,GAAG;QACP,OAAO,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,oBAAoB,CAAC,OAAO;QACxB,OAAO,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD;;;OAGG;IACH,kBAAkB,CAAC,OAAO;QACtB,OAAO,IAAA,yBAAc,EAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IACD,kBAAkB,CAAC,GAAG;QAClB,OAAO,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAG;QACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,yBAAkB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAG;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gBAChD,cAAc,EAAE,GAAG,IAAI,CAAC,qBAAqB,GAAG;aACnD,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;CACJ;AAnED,kCAmEC;AACD,uCAAuC"}

package/lib/cjs/nest/index.cjs

@@ -19,9 +19,11 @@ __exportStar(require("./utils.cjs"), exports);
 __exportStar(require("./authService.cjs"), exports);
 __exportStar(require("./keycloakAuthHandler.cjs"), exports);
 __exportStar(require("./keycloakModule.cjs"), exports);
+require("./logging.cjs");
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/cjs/nest/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/index.cjs","sourceRoot":"","sources":["nest/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,6CAA2B;AAC3B,mDAAiC;AACjC,2DAAyC;AACzC,sDAAoC;AACpC;;;;;GAKG;AACH,iCAAiC"}
+{"version":3,"file":"nest/index.cjs","sourceRoot":"","sources":["nest/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,6CAA2B;AAC3B,mDAAiC;AACjC,2DAAyC;AACzC,sDAAoC;AACpC,wBAAsB;AACtB;;;;;;GAMG;AACH,iCAAiC"}

package/lib/cjs/nest/keycloakAuthHandler.cjs

@@ -1,38 +1,57 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KeycloakAuthHandler = void 0;
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth context values.
- */
+exports.getClientRoles = exports.KeycloakAuthHandler = void 0;
 const core_1 = require("@decaf-ts/core");
+const server_1 = require("@decaf-ts/for-http/server");
 const authService_js_1 = require("./authService.cjs");
 const utils_js_1 = require("./utils.cjs");
-class KeycloakAuthHandler {
-    constructor(authService = new authService_js_1.AuthService()) {
-        this.authService = authService;
+Object.defineProperty(exports, "getClientRoles", { enumerable: true, get: function () { return utils_js_1.getClientRoles; } });
+class KeycloakAuthHandler extends server_1.AuthHandler {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService, authServiceOptions) {
+        super();
+        this.authService =
+            authService ?? new authService_js_1.AuthService(authServiceOptions ?? {});
     }
-    async authorize(context) {
-        const request = context.switchToHttp().getRequest();
-        if (request.path?.startsWith("/public"))
-            return;
-        if (request.path === "/account" && request.method === "POST")
-            return;
+    extractFromAuth(ctx) {
+        const request = ctx.switchToHttp().getRequest();
+        if (isPublicRoute(request)) {
+            return { roles: [], token: "", isPublic: true };
+        }
         const token = getToken(request);
         if (!token)
             throw new core_1.AuthorizationError("Token not found");
-        const payload = this.authService.assertValidToken(token);
-        const roles = this.authService.getRoles(token);
-        const organization = payload.aud || payload.azp || (0, utils_js_1.getRealmFromIssuer)(token);
-        request[utils_js_1.DECAF_ADAPTER_OPTIONS] = {
-            roles,
-            user: payload.email ?? payload.preferred_username,
-            msp: organization,
-        };
+        // Decode only — validation happens in `validate`
+        const payload = (0, utils_js_1.getTokenPayload)(token);
+        const roles = (0, utils_js_1.extractKeycloakRoles)(payload);
+        const organization = resolveOrganization(payload, token);
+        const user = payload?.email ?? payload?.preferred_username;
+        return { user, organization, roles, token, isPublic: false };
+    }
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    async validate(data, routeRoles, model, ...args) {
+        if (data.isPublic)
+            return;
+        await this.authService.assertValidToken(data.token);
+        await super.validate(data, routeRoles, model, ...args);
     }
 }
 exports.KeycloakAuthHandler = KeycloakAuthHandler;
+function isPublicRoute(req) {
+    if (req.path?.startsWith("/public"))
+        return true;
+    return false;
+}
 function getToken(req) {
     const token = (req.headers?.["x-auth-request-access-token"] ??
         req.headers?.["authorization"]);
@@ -40,5 +59,12 @@ function getToken(req) {
         return undefined;
     return token.startsWith("Bearer ") ? token.slice("Bearer ".length) : token;
 }
+function resolveOrganization(payload, token) {
+    if (payload?.aud)
+        return payload.aud;
+    if (payload?.azp)
+        return payload.azp;
+    return (0, utils_js_1.getRealmFromIssuer)(token);
+}
 //# sourceMappingURL=keycloakAuthHandler.js.map
 //# sourceMappingURL=keycloakAuthHandler.cjs.map

package/lib/cjs/nest/keycloakAuthHandler.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,yCAAoD;AACpD,qDAA+C;AAC/C,yCAAuE;AACvE,MAAa,mBAAmB;IAC5B,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,OAAO;QACnB,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YACnC,OAAO;QACX,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YACxD,OAAO;QACX,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,gCAAqB,CAAC,GAAG;YAC7B,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,kBAAkB;YACjD,GAAG,EAAE,YAAY;SACpB,CAAC;IACN,CAAC;CACJ;AAtBD,kDAsBC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,+CAA+C"}
+{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA,yCAAoD;AACpD,sDAAwD;AACxD,qDAA+C;AAC/C,yCAAwG;AA4D/F,+FA5D2D,yBAAc,OA4D3D;AA3DvB,MAAa,mBAAoB,SAAQ,oBAAW;IAChD;;;;;;OAMG;IACH,YAAY,WAAW,EAAE,kBAAkB;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW;YACZ,WAAW,IAAI,IAAI,4BAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,eAAe,CAAC,GAAG;QACf,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI;QAC3C,IAAI,IAAI,CAAC,QAAQ;YACb,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;CACJ;AAvCD,kDAuCC;AACD,SAAS,aAAa,CAAC,GAAG;IACtB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,SAAS,mBAAmB,CAAC,OAAO,EAAE,KAAK;IACvC,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,OAAO,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,+CAA+C"}

package/lib/cjs/nest/keycloakModule.cjs

@@ -9,12 +9,14 @@ exports.AuthModule = exports.KeycloakModule = void 0;
 const authService_js_1 = require("./authService.cjs");
 const keycloakAuthHandler_js_1 = require("./keycloakAuthHandler.cjs");
 class KeycloakModule {
-    constructor(authService = new authService_js_1.AuthService(), authHandler = new keycloakAuthHandler_js_1.KeycloakAuthHandler(authService)) {
+    constructor(authService, authHandler) {
         this.authService = authService;
         this.authHandler = authHandler;
     }
-    static create() {
-        return new KeycloakModule();
+    static create(options) {
+        const authService = new authService_js_1.AuthService(options);
+        const authHandler = new keycloakAuthHandler_js_1.KeycloakAuthHandler(authService);
+        return new KeycloakModule(authService, authHandler);
     }
 }
 exports.KeycloakModule = KeycloakModule;

package/lib/cjs/nest/keycloakModule.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/keycloakModule.cjs","sourceRoot":"","sources":["nest/keycloakModule.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,qDAA+C;AAC/C,qEAA+D;AAC/D,MAAa,cAAc;IACvB,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE,EAAE,WAAW,GAAG,IAAI,4CAAmB,CAAC,WAAW,CAAC;QAC3F,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,MAAM;QACT,OAAO,IAAI,cAAc,EAAE,CAAC;IAChC,CAAC;CACJ;AARD,wCAQC;AACD,MAAa,UAAW,SAAQ,cAAc;CAC7C;AADD,gCACC;AACD,0CAA0C"}
+{"version":3,"file":"nest/keycloakModule.cjs","sourceRoot":"","sources":["nest/keycloakModule.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,qDAA+C;AAC/C,qEAA+D;AAC/D,MAAa,cAAc;IACvB,YAAY,WAAW,EAAE,WAAW;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,WAAW,GAAG,IAAI,4BAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,4CAAmB,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;CACJ;AAVD,wCAUC;AACD,MAAa,UAAW,SAAQ,cAAc;CAC7C;AADD,gCACC;AACD,0CAA0C"}

package/lib/cjs/nest/logging.cjs

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @module integrations/nest/logging
+ * @summary Keycloak auth log parameters.
+ * @description Registers `user` and `organization` as log parameters sourced from the
+ * logging config (populated by the auth interceptor's child logger via `Logging.for({ user, organization })`).
+ *
+ * These parameters are registered here — in `integrations/nest` — because this is the
+ * layer that extracts user/organization identity from Keycloak JWTs. The `ip` parameter,
+ * by contrast, is registered in `@decaf-ts/for-http/server` where the HTTP request IP is
+ * available.
+ */
+const logging_1 = require("@decaf-ts/logging");
+logging_1.logParameterRegistry
+    .register({
+    key: "user",
+    shouldInclude(payload) {
+        return Boolean(payload.config.user);
+    },
+    render(payload) {
+        return String(payload.config.user);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+})
+    .register({
+    key: "organization",
+    shouldInclude(payload) {
+        return Boolean(payload.config.organization);
+    },
+    render(payload) {
+        return String(payload.config.organization);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+});
+//# sourceMappingURL=logging.js.map
+//# sourceMappingURL=logging.cjs.map

package/lib/cjs/nest/logging.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nest/logging.cjs","sourceRoot":"","sources":["nest/logging.js"],"names":[],"mappings":";;AAAA;;;;;;;;;;GAUG;AACH,+CAAyD;AACzD,8BAAoB;KACf,QAAQ,CAAC;IACV,GAAG,EAAE,MAAM;IACX,aAAa,CAAC,OAAO;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,OAAO;QACV,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACnB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;CACJ,CAAC;KACG,QAAQ,CAAC;IACV,GAAG,EAAE,cAAc;IACnB,aAAa,CAAC,OAAO;QACjB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,CAAC,OAAO;QACV,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACnB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;CACJ,CAAC,CAAC;AACH,mCAAmC"}

package/lib/cjs/nest/utils.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DECAF_ADAPTER_OPTIONS = void 0;
 exports.getTokenPayload = getTokenPayload;
 exports.extractKeycloakRoles = extractKeycloakRoles;
+exports.getClientRoles = getClientRoles;
 exports.getUser = getUser;
 exports.getRealmFromIssuer = getRealmFromIssuer;
 const core_1 = require("@decaf-ts/core");
@@ -30,6 +31,29 @@ function extractKeycloakRoles(payload) {
     }
     return [...roles];
 }
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+function getClientRoles(payload, excluded = ["account"]) {
+    const resourceAccess = payload?.resource_access;
+    if (!resourceAccess || typeof resourceAccess !== "object")
+        return [];
+    const roles = new Set();
+    for (const [clientId, data] of Object.entries(resourceAccess)) {
+        if (excluded.includes(clientId))
+            continue;
+        if (Array.isArray(data?.roles)) {
+            for (const role of data.roles)
+                roles.add(role);
+        }
+    }
+    return [...roles];
+}
 function getUser(jwt) {
     const payload = getTokenPayload(jwt);
     if (!payload)

package/lib/cjs/nest/utils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/utils.cjs","sourceRoot":"","sources":["nest/utils.js"],"names":[],"mappings":";;;AAEA,0CAOC;AACD,oDAcC;AACD,0BAaC;AACD,gDAmBC;AA1DD,yCAAoD;AACvC,QAAA,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACtE,SAAgB,eAAe,CAAC,GAAG;IAC/B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AACD,SAAgB,oBAAoB,CAAC,OAAO;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YACzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC1E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD,SAAgB,OAAO,CAAC,GAAG;IACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QACR,OAAO,SAAS,CAAC;IACrB,OAAO;QACH,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KACjC,CAAC;AACN,CAAC;AACD,SAAgB,kBAAkB,CAAC,GAAG;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,yBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC;QACH,MAAM,IAAI,yBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AACD,iCAAiC"}
+{"version":3,"file":"nest/utils.cjs","sourceRoot":"","sources":["nest/utils.js"],"names":[],"mappings":";;;AAEA,0CAOC;AACD,oDAcC;AASD,wCAcC;AACD,0BAaC;AACD,gDAmBC;AAjFD,yCAAoD;AACvC,QAAA,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACtE,SAAgB,eAAe,CAAC,GAAG;IAC/B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AACD,SAAgB,oBAAoB,CAAC,OAAO;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YACzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC1E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,CAAC,SAAS,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,EAAE,eAAe,CAAC;IAChD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QACrD,OAAO,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,SAAS;QACb,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBACzB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD,SAAgB,OAAO,CAAC,GAAG;IACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QACR,OAAO,SAAS,CAAC;IACrB,OAAO;QACH,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KACjC,CAAC;AACN,CAAC;AACD,SAAgB,kBAAkB,CAAC,GAAG;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,yBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC;QACH,MAAM,IAAI,yBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AACD,iCAAiC"}

package/lib/cjs/utils.cjs

@@ -21,7 +21,7 @@ async function execWithLogging(command, options, log, level = logging_1.LogLevel
         });
         child.stderr?.on("data", (data) => {
             stderr.push(data);
-            log.error(data.trim());
+            log.debug(data.trim());
         });
         child.on("close", (code) => {
             if (code === 0) {

package/lib/esm/index.js

@@ -4,8 +4,8 @@
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 export * from "./utils.js";
-export const VERSION = "0.1.4";
-export const COMMIT = "96f5884";
-export const FULL_VERSION = "0.1.4-96f5884";
+export const VERSION = "0.2.1";
+export const COMMIT = "4990f39";
+export const FULL_VERSION = "0.2.1-4990f39";
 export const PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map

package/lib/esm/nest/authService.js

@@ -2,15 +2,28 @@
  * @module integrations/nest/authService
  * @summary Nest-compatible authentication service helpers.
  * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
+ *
+ * Supports two modes:
+ * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
+ *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
+ * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
+ *   decodes the JWT without signature verification (dev/local mode).
  */
 import { AuthorizationError } from "@decaf-ts/core";
-import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser } from "./utils.js";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser, getClientRoles, } from "./utils.js";
 export class AuthService {
+    constructor(options = {}) {
+        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
+        this.verifyUrl = options.verifyUrl ?? "";
+        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+        this.excludedClients = options.excludedClients ?? ["account"];
+    }
     getTokenPayload(jwt) {
         return getTokenPayload(jwt);
     }
     getRoles(jwt) {
-        return extractKeycloakRoles(this.getTokenPayload(jwt));
+        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
     }
     getUser(jwt) {
         return getUser(jwt);
@@ -18,15 +31,53 @@ export class AuthService {
     extractKeycloakRoles(payload) {
         return extractKeycloakRoles(payload);
     }
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload) {
+        return getClientRoles(payload, this.excludedClients);
+    }
     getRealmFromIssuer(jwt) {
         return getRealmFromIssuer(jwt);
     }
-    assertValidToken(jwt) {
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    async assertValidToken(jwt) {
+        if (this.verifyToken) {
+            return this.verifyAgainstJwks(jwt);
+        }
         const payload = this.getTokenPayload(jwt);
         if (!payload) {
             throw new AuthorizationError("Invalid token");
         }
         return payload;
     }
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    async verifyAgainstJwks(jwt) {
+        if (!this.jwks) {
+            this.jwks = createRemoteJWKSet(new URL(this.verifyUrl));
+        }
+        try {
+            const { payload } = await jwtVerify(jwt, this.jwks, {
+                clockTolerance: `${this.clockToleranceSeconds}s`,
+            });
+            return payload;
+        }
+        catch (e) {
+            throw new AuthorizationError("Invalid token: " + (e?.message ?? e));
+        }
+    }
 }
 //# sourceMappingURL=authService.js.map

package/lib/esm/nest/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAgB;AAG7F,MAAM,OAAO,WAAW;IACtB,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAAgB;QACnC,OAAO,oBAAoB,CAAC,OAA4C,CAAC,CAAC;IAC5E,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB,CAAC,GAAW;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,cAAc,GACf,mBAAgB;AA+BjB,MAAM,OAAO,WAAW;IAOtB,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAA0C;QAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,OAA0C;QAE1C,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAAW;QAEX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,GAAW;QAEX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,cAAc,EAAE,GAAG,IAAI,CAAC,qBAAqB,GAAG;aACjD,CAAC,CAAC;YACH,OAAO,OAAgD,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF"}

package/lib/esm/nest/index.js

@@ -3,9 +3,11 @@ export * from "./utils.js";
 export * from "./authService.js";
 export * from "./keycloakAuthHandler.js";
 export * from "./keycloakModule.js";
+import "./logging.js";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/esm/nest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nest/index.ts"],"names":[],"mappings":"AAAA,2BAAwB;AACxB,2BAAwB;AACxB,iCAA8B;AAC9B,yCAAsC;AACtC,oCAAiC;AAEjC;;;;;GAKG"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nest/index.ts"],"names":[],"mappings":"AAAA,2BAAwB;AACxB,2BAAwB;AACxB,iCAA8B;AAC9B,yCAAsC;AACtC,oCAAiC;AAEjC,sBAAmB;AAEnB;;;;;;GAMG"}

package/lib/esm/nest/keycloakAuthHandler.js

@@ -1,34 +1,52 @@
-/**
- * @module integrations/nest/keycloakAuthHandler
- * @summary Keycloak request auth handler.
- * @description Translates Keycloak JWT payloads into Decaf-friendly auth context values.
- */
 import { AuthorizationError } from "@decaf-ts/core";
+import { AuthHandler } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.js";
-import { DECAF_ADAPTER_OPTIONS, getRealmFromIssuer } from "./utils.js";
-export class KeycloakAuthHandler {
-    constructor(authService = new AuthService()) {
-        this.authService = authService;
+import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, getClientRoles, } from "./utils.js";
+export class KeycloakAuthHandler extends AuthHandler {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService, authServiceOptions) {
+        super();
+        this.authService =
+            authService ?? new AuthService(authServiceOptions ?? {});
     }
-    async authorize(context) {
-        const request = context.switchToHttp().getRequest();
-        if (request.path?.startsWith("/public"))
-            return;
-        if (request.path === "/account" && request.method === "POST")
-            return;
+    extractFromAuth(ctx) {
+        const request = ctx.switchToHttp().getRequest();
+        if (isPublicRoute(request)) {
+            return { roles: [], token: "", isPublic: true };
+        }
         const token = getToken(request);
         if (!token)
             throw new AuthorizationError("Token not found");
-        const payload = this.authService.assertValidToken(token);
-        const roles = this.authService.getRoles(token);
-        const organization = payload.aud || payload.azp || getRealmFromIssuer(token);
-        request[DECAF_ADAPTER_OPTIONS] = {
-            roles,
-            user: payload.email ?? payload.preferred_username,
-            msp: organization,
-        };
+        // Decode only — validation happens in `validate`
+        const payload = getTokenPayload(token);
+        const roles = extractKeycloakRoles(payload);
+        const organization = resolveOrganization(payload, token);
+        const user = payload?.email ?? payload?.preferred_username;
+        return { user, organization, roles, token, isPublic: false };
+    }
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    async validate(data, routeRoles, model, ...args) {
+        if (data.isPublic)
+            return;
+        await this.authService.assertValidToken(data.token);
+        await super.validate(data, routeRoles, model, ...args);
     }
 }
+function isPublicRoute(req) {
+    if (req.path?.startsWith("/public"))
+        return true;
+    return false;
+}
 function getToken(req) {
     const token = (req.headers?.["x-auth-request-access-token"] ??
         req.headers?.["authorization"]);
@@ -36,4 +54,12 @@ function getToken(req) {
         return undefined;
     return token.startsWith("Bearer ") ? token.slice("Bearer ".length) : token;
 }
+function resolveOrganization(payload, token) {
+    if (payload?.aud)
+        return payload.aud;
+    if (payload?.azp)
+        return payload.azp;
+    return getRealmFromIssuer(token);
+}
+export { getClientRoles };
 //# sourceMappingURL=keycloakAuthHandler.js.map