@decaf-ts/integrations 0.2.0 → 0.2.2

package/lib/esm/nest/keycloakAuthHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAC5C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAgB;AAEpE,MAAM,OAAO,mBAAmB;IAC9B,YAA6B,cAAc,IAAI,WAAW,EAAE;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAAG,CAAC;IAEhE,KAAK,CAAC,SAAS,CAAC,OAAiC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAErE,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO;QAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE7E,OAAO,CAAC,qBAAqB,CAAC,GAAG;YAC/B,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,kBAAkB;YACjD,GAAG,EAAE,YAAY;SAClB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AAErE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC;;;;;;OAMG;IACH,YACE,WAAyB,EACzB,kBAAuC;QAEvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW;YACd,WAAW,IAAI,IAAI,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAIS,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/lib/esm/nest/keycloakModule.js

@@ -6,12 +6,14 @@
 import { AuthService } from "./authService.js";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.js";
 export class KeycloakModule {
-    constructor(authService = new AuthService(), authHandler = new KeycloakAuthHandler(authService)) {
+    constructor(authService, authHandler) {
         this.authService = authService;
         this.authHandler = authHandler;
     }
-    static create() {
-        return new KeycloakModule();
+    static create(options) {
+        const authService = new AuthService(options);
+        const authHandler = new KeycloakAuthHandler(authService);
+        return new KeycloakModule(authService, authHandler);
     }
 }
 export class AuthModule extends KeycloakModule {

package/lib/esm/nest/keycloakModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAC5C,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,cAAc,IAAI,WAAW,EAAE,EAC/B,cAAc,IAAI,mBAAmB,CAAC,WAAW,CAAC;QADlD,gBAAW,GAAX,WAAW,CAAoB;QAC/B,gBAAW,GAAX,WAAW,CAAuC;IACjE,CAAC;IAEJ,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,cAAc,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}
+{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AACrE,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,WAAwB,EACxB,WAAgC;QADhC,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAqB;IAC/C,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,OAA4B;QACxC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}

package/lib/esm/nest/logging.js

@@ -0,0 +1,38 @@
+/**
+ * @module integrations/nest/logging
+ * @summary Keycloak auth log parameters.
+ * @description Registers `user` and `organization` as log parameters sourced from the
+ * logging config (populated by the auth interceptor's child logger via `Logging.for({ user, organization })`).
+ *
+ * These parameters are registered here — in `integrations/nest` — because this is the
+ * layer that extracts user/organization identity from Keycloak JWTs. The `ip` parameter,
+ * by contrast, is registered in `@decaf-ts/for-http/server` where the HTTP request IP is
+ * available.
+ */
+import { logParameterRegistry } from "@decaf-ts/logging";
+logParameterRegistry
+    .register({
+    key: "user",
+    shouldInclude(payload) {
+        return Boolean(payload.config.user);
+    },
+    render(payload) {
+        return String(payload.config.user);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+})
+    .register({
+    key: "organization",
+    shouldInclude(payload) {
+        return Boolean(payload.config.organization);
+    },
+    render(payload) {
+        return String(payload.config.organization);
+    },
+    style(rendered, payload) {
+        return payload.applyTheme(rendered, "app");
+    },
+});
+//# sourceMappingURL=logging.js.map

package/lib/esm/nest/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/nest/logging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,oBAAoB;KACjB,QAAQ,CAAC;IACR,GAAG,EAAE,MAAM;IACX,aAAa,CAAC,OAAO;QACnB,OAAO,OAAO,CAAE,OAAO,CAAC,MAAkC,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,CAAC,OAAO;QACZ,OAAO,MAAM,CAAE,OAAO,CAAC,MAAkC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACrB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC;KACD,QAAQ,CAAC;IACR,GAAG,EAAE,cAAc;IACnB,aAAa,CAAC,OAAO;QACnB,OAAO,OAAO,CAAE,OAAO,CAAC,MAAkC,CAAC,YAAY,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,CAAC,OAAO;QACZ,OAAO,MAAM,CAAE,OAAO,CAAC,MAAkC,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,QAAQ,EAAE,OAAO;QACrB,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC"}

package/lib/esm/nest/utils.js

@@ -23,6 +23,29 @@ export function extractKeycloakRoles(payload) {
     }
     return [...roles];
 }
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export function getClientRoles(payload, excluded = ["account"]) {
+    const resourceAccess = payload?.resource_access;
+    if (!resourceAccess || typeof resourceAccess !== "object")
+        return [];
+    const roles = new Set();
+    for (const [clientId, data] of Object.entries(resourceAccess)) {
+        if (excluded.includes(clientId))
+            continue;
+        if (Array.isArray(data?.roles)) {
+            for (const role of data.roles)
+                roles.add(role);
+        }
+    }
+    return [...roles];
+}
 export function getUser(jwt) {
     const payload = getTokenPayload(jwt);
     if (!payload)

package/lib/esm/nest/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA0C,EAC1C,WAAqB,CAAC,SAAS,CAAC;IAEhC,MAAM,cAAc,GAAG,OAAO,EAAE,eAAe,CAAC;IAChD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/lib/esm/utils.js

@@ -18,7 +18,7 @@ export async function execWithLogging(command, options, log, level = LogLevel.in
         });
         child.stderr?.on("data", (data) => {
             stderr.push(data);
-            log.error(data.trim());
+            log.debug(data.trim());
         });
         child.on("close", (code) => {
             if (code === 0) {

package/lib/types/index.d.cts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "96f5884";
-export declare const FULL_VERSION = "0.1.4-96f5884";
+export declare const COMMIT = "4990f39";
+export declare const FULL_VERSION = "0.2.1-4990f39";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "96f5884";
-export declare const FULL_VERSION = "0.1.4-96f5884";
+export declare const COMMIT = "4990f39";
+export declare const FULL_VERSION = "0.2.1-4990f39";
 export declare const PACKAGE_NAME: string;

package/lib/types/nest/authService.d.cts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }

package/lib/types/nest/authService.d.mts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }

package/lib/types/nest/index.d.cts

@@ -3,9 +3,11 @@ export * from "./utils.d.cts";
 export * from "./authService.d.cts";
 export * from "./keycloakAuthHandler.d.cts";
 export * from "./keycloakModule.d.cts";
+import "./logging";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/types/nest/index.d.mts

@@ -3,9 +3,11 @@ export * from "./utils.d.mts";
 export * from "./authService.d.mts";
 export * from "./keycloakAuthHandler.d.mts";
 export * from "./keycloakModule.d.mts";
+import "./logging";
 /**
  * @summary Nest-style auth integrations.
  * @description Framework-agnostic auth helpers compatible with Decaf request context handling.
+ * Imports the `user`/`organization` log parameter registrations as a side effect.
  * @namespace nest
  * @memberOf module:integrations
  */

package/lib/types/nest/keycloakAuthHandler.d.cts

@@ -1,7 +1,53 @@
+/**
+ * @module integrations/nest/keycloakAuthHandler
+ * @summary Keycloak request auth handler.
+ * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
+ * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
+ *
+ * Only overrides the two extension points:
+ * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ *   Returns empty data for public routes without requiring a token.
+ * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
+ *   then delegates to the base class for route-level and model-level role checks.
+ *   Skips entirely for public routes.
+ *
+ * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
+ * is sufficient. Does NOT override `authorize`.
+ */
+import type { Constructor } from "@decaf-ts/decoration";
+import { Context, ContextualArgs } from "@decaf-ts/core";
+import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
+import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
 import type { AuthExecutionContextLike } from "./types.d.cts";
-import { AuthService } from "./authService.d.cts";
-export declare class KeycloakAuthHandler {
-    private readonly authService;
-    constructor(authService?: AuthService);
-    authorize(context: AuthExecutionContextLike): Promise<void>;
+import { getClientRoles } from "./utils.d.cts";
+/**
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
+ *
+ * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
+ * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ */
+export interface KeycloakAuthData extends AuthData {
+    /** The raw JWT extracted from the request. Empty for public routes. */
+    token: string;
+    /** Whether the request targets a public route (skips validation). */
+    isPublic: boolean;
 }
+export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
+    protected readonly authService: AuthService;
+    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
+}
+export { getClientRoles };

package/lib/types/nest/keycloakAuthHandler.d.mts

@@ -1,7 +1,53 @@
+/**
+ * @module integrations/nest/keycloakAuthHandler
+ * @summary Keycloak request auth handler.
+ * @description Translates Keycloak JWT payloads into Decaf-friendly auth data.
+ * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
+ *
+ * Only overrides the two extension points:
+ * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ *   Returns empty data for public routes without requiring a token.
+ * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
+ *   then delegates to the base class for route-level and model-level role checks.
+ *   Skips entirely for public routes.
+ *
+ * Does NOT override `bindToContext` — the base class default `ctx.accumulate(data)`
+ * is sufficient. Does NOT override `authorize`.
+ */
+import type { Constructor } from "@decaf-ts/decoration";
+import { Context, ContextualArgs } from "@decaf-ts/core";
+import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
+import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
 import type { AuthExecutionContextLike } from "./types.d.mts";
-import { AuthService } from "./authService.d.mts";
-export declare class KeycloakAuthHandler {
-    private readonly authService;
-    constructor(authService?: AuthService);
-    authorize(context: AuthExecutionContextLike): Promise<void>;
+import { getClientRoles } from "./utils.d.mts";
+/**
+ * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
+ *
+ * Carries the raw JWT `token` so that {@link KeycloakAuthHandler.validate} can
+ * validate it against the Keycloak instance (signature, expiry, revocation, etc.).
+ */
+export interface KeycloakAuthData extends AuthData {
+    /** The raw JWT extracted from the request. Empty for public routes. */
+    token: string;
+    /** Whether the request targets a public route (skips validation). */
+    isPublic: boolean;
 }
+export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
+    protected readonly authService: AuthService;
+    protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
+    /**
+     * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
+     * via {@link AuthService.assertValidToken}, then delegates to the base class
+     * for route-level and model-level role checks. Skips entirely for public routes.
+     */
+    protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
+}
+export { getClientRoles };

package/lib/types/nest/keycloakModule.d.cts

@@ -3,13 +3,13 @@
  * @summary Nest module wiring for Keycloak auth.
  * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
  */
-import { AuthService } from "./authService.d.cts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.cts";
 export declare class KeycloakModule {
     readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService?: AuthService, authHandler?: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
+    static create(options?: AuthServiceOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/keycloakModule.d.mts

@@ -3,13 +3,13 @@
  * @summary Nest module wiring for Keycloak auth.
  * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
  */
-import { AuthService } from "./authService.d.mts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.mts";
 export declare class KeycloakModule {
     readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService?: AuthService, authHandler?: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
+    static create(options?: AuthServiceOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/logging.d.cts

@@ -0,0 +1 @@
+export {};

package/lib/types/nest/logging.d.mts

@@ -0,0 +1 @@
+export {};

package/lib/types/nest/types.d.cts

@@ -1,8 +1,30 @@
 /**
  * @module integrations/nest/types
  * @summary Nest integration types.
- * @description Shared request-context and auth payload types for Nest integration helpers.
+ * @description Keycloak-specific payload types, a platform-specific execution context
+ * type, and re-exports of the framework-agnostic auth primitives from
+ * `@decaf-ts/for-http/server`.
  */
+import type { AuthData, AuthRequestLike, UserData } from "@decaf-ts/for-http/server";
+export type { AuthData, AuthRequestLike, UserData };
+/**
+ * Structural subset of a NestJS-like execution context that exposes the HTTP request.
+ *
+ * Defined here (not in for-http) because the base `AuthHandler` class is intentionally
+ * generic over its execution context — only the platform that consumes it needs to know
+ * the concrete shape.
+ */
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+    getClass?(): {
+        name?: string;
+    };
+}
 export interface KeycloakAccessTokenPayload {
     preferred_username?: string;
     email?: string;
@@ -29,20 +51,3 @@ export interface KeycloakUser {
     family_name?: string;
     realm?: string;
 }
-export interface AuthRequestLike {
-    path?: string;
-    method?: string;
-    headers?: Record<string, unknown>;
-    [key: symbol | string]: unknown;
-}
-export interface AuthExecutionContextLike {
-    switchToHttp(): {
-        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
-    };
-    getHandler?(): {
-        name?: string;
-    };
-}
-export interface AuthHandlerLike {
-    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
-}

package/lib/types/nest/types.d.mts

@@ -1,8 +1,30 @@
 /**
  * @module integrations/nest/types
  * @summary Nest integration types.
- * @description Shared request-context and auth payload types for Nest integration helpers.
+ * @description Keycloak-specific payload types, a platform-specific execution context
+ * type, and re-exports of the framework-agnostic auth primitives from
+ * `@decaf-ts/for-http/server`.
  */
+import type { AuthData, AuthRequestLike, UserData } from "@decaf-ts/for-http/server";
+export type { AuthData, AuthRequestLike, UserData };
+/**
+ * Structural subset of a NestJS-like execution context that exposes the HTTP request.
+ *
+ * Defined here (not in for-http) because the base `AuthHandler` class is intentionally
+ * generic over its execution context — only the platform that consumes it needs to know
+ * the concrete shape.
+ */
+export interface AuthExecutionContextLike {
+    switchToHttp(): {
+        getRequest<T = AuthRequestLike>(): T;
+    };
+    getHandler?(): {
+        name?: string;
+    };
+    getClass?(): {
+        name?: string;
+    };
+}
 export interface KeycloakAccessTokenPayload {
     preferred_username?: string;
     email?: string;
@@ -29,20 +51,3 @@ export interface KeycloakUser {
     family_name?: string;
     realm?: string;
 }
-export interface AuthRequestLike {
-    path?: string;
-    method?: string;
-    headers?: Record<string, unknown>;
-    [key: symbol | string]: unknown;
-}
-export interface AuthExecutionContextLike {
-    switchToHttp(): {
-        getRequest<T extends AuthRequestLike = AuthRequestLike>(): T;
-    };
-    getHandler?(): {
-        name?: string;
-    };
-}
-export interface AuthHandlerLike {
-    authorize(context: AuthExecutionContextLike, resource?: string): Promise<void>;
-}

package/lib/types/nest/utils.d.cts

@@ -7,5 +7,14 @@ import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
 export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
 export declare function getUser(jwt: string): KeycloakUser | undefined;
 export declare function getRealmFromIssuer(jwt: string): string;

package/lib/types/nest/utils.d.mts

@@ -7,5 +7,14 @@ import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
 export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
 export declare function getUser(jwt: string): KeycloakUser | undefined;
 export declare function getRealmFromIssuer(jwt: string): string;