@decaf-ts/integrations 0.2.1 → 0.2.2

package/dist/integrations.cjs

@@ -1,2 +1,2 @@
-var e,o;e=this,o=(e,o,r,i)=>{"use strict";e.COMMIT="00bac68",e.FULL_VERSION="0.2.0-00bac68",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.2.0",e.execWithLogging=async(e,n,t,s=r.LogLevel.info)=>(t.debug("Executing: "+e),new Promise((r,d)=>{const c=o.exec(e,n),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),t[s](e.trim())}),c.stderr?.on("data",e=>{l.push(e),t.error(e.trim())}),c.on("close",e=>{0===e?(t.silly("Command completed successfully"),r({stdout:a.join("\n"),stderr:l.join("\n")})):(t.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),d(new i.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{t.critical("Command execution error",e),d(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
+var e,o;e=this,o=(e,o,i,n)=>{"use strict";e.COMMIT="4990f39",e.FULL_VERSION="0.2.1-4990f39",e.PACKAGE_NAME="@decaf-ts/integrations",e.VERSION="0.2.1",e.execWithLogging=async(e,t,r,d=i.LogLevel.info)=>(r.debug("Executing: "+e),new Promise((i,s)=>{const c=o.exec(e,t),a=[],l=[];c.stdout?.on("data",e=>{a.push(e),r[d](e.trim())}),c.stderr?.on("data",e=>{l.push(e),r.debug(e.trim())}),c.on("close",e=>{0===e?(r.silly("Command completed successfully"),i({stdout:a.join("\n"),stderr:l.join("\n")})):(r.critical(`Command failed with code ${e}:\n ${l.join("\n")}`),s(new n.InternalError(`Command failed with code ${e}: ${l.join("\n")}`)))}),c.on("error",e=>{r.critical("Command execution error",e),s(e)})}))},"object"==typeof exports&&"undefined"!=typeof module?o(exports,require("child_process"),require("@decaf-ts/logging"),require("@decaf-ts/db-decorators")):"function"==typeof define&&define.amd?define(["exports","child_process","@decaf-ts/logging","@decaf-ts/db-decorators"],o):o((e="undefined"!=typeof globalThis?globalThis:e||self).integrations={},e.childProcess,e.decafTsLogging,e.decafTsDbDecorators);
 //# sourceMappingURL=integrations.cjs.map

package/dist/integrations.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.cjs","sources":["../src/index.ts","../src/utils.ts"],"sourcesContent":[null,null],"names":["async","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","error","code","silly","join","critical","InternalError","err"],"mappings":"mDASsB,4BAEM,kCAEQ,wBANL,gCCExBA,MACLC,EACAC,EACAC,EACAC,EAAkBC,EAAAA,SAASC,QAE3BH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAAA,KAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAIgB,MAAMH,EAAKE,UAGjBP,EAAMI,GAAG,QAAUK,IACJ,IAATA,GACFjB,EAAIkB,MAAM,kCACVZ,EAAQ,CAAEI,OAAQA,EAAOS,KAAK,MAAOR,OAAQA,EAAOQ,KAAK,UAEzDnB,EAAIoB,SACF,4BAA4BH,QAAWN,EAAOQ,KAAK,SAErDZ,EACE,IAAIc,EAAAA,cACF,4BAA4BJ,MAASN,EAAOQ,KAAK,aAMzDX,EAAMI,GAAG,QAAUU,IACjBtB,EAAIoB,SAAS,0BAA2BE,GACxCf,EAAOe"}
+{"version":3,"file":"integrations.cjs","sources":["../src/index.ts","../src/utils.ts"],"sourcesContent":[null,null],"names":["async","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","code","silly","join","critical","InternalError","err"],"mappings":"mDASsB,4BAEM,kCAEQ,wBANL,gCCExBA,MACLC,EACAC,EACAC,EACAC,EAAkBC,EAAAA,SAASC,QAE3BH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAAA,KAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAII,MAAMS,EAAKE,UAGjBP,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,OAAQA,EAAOQ,KAAK,MAAOP,OAAQA,EAAOO,KAAK,UAEzDlB,EAAImB,SACF,4BAA4BH,QAAWL,EAAOO,KAAK,SAErDX,EACE,IAAIa,EAAAA,cACF,4BAA4BJ,MAASL,EAAOO,KAAK,aAMzDV,EAAMI,GAAG,QAAUS,IACjBrB,EAAImB,SAAS,0BAA2BE,GACxCd,EAAOc"}

package/dist/integrations.js

@@ -1,2 +1,2 @@
-import{exec as o}from"child_process";import{LogLevel as r}from"@decaf-ts/logging";import{InternalError as n}from"@decaf-ts/db-decorators";async function t(t,e,i,c=r.info){return i.debug("Executing: "+t),new Promise((r,d)=>{const s=o(t,e),m=[],a=[];s.stdout?.on("data",o=>{m.push(o),i[c](o.trim())}),s.stderr?.on("data",o=>{a.push(o),i.error(o.trim())}),s.on("close",o=>{0===o?(i.silly("Command completed successfully"),r({stdout:m.join("\n"),stderr:a.join("\n")})):(i.critical(`Command failed with code ${o}:\n ${a.join("\n")}`),d(new n(`Command failed with code ${o}: ${a.join("\n")}`)))}),s.on("error",o=>{i.critical("Command execution error",o),d(o)})})}const e="##VERSION##",i="##COMMIT##",c="##FULL_VERSION##",d="##PACKAGE##";export{i as COMMIT,c as FULL_VERSION,d as PACKAGE_NAME,e as VERSION,t as execWithLogging};
+import{exec as o}from"child_process";import{LogLevel as n}from"@decaf-ts/logging";import{InternalError as t}from"@decaf-ts/db-decorators";async function r(r,e,i,d=n.info){return i.debug("Executing: "+r),new Promise((n,c)=>{const s=o(r,e),m=[],a=[];s.stdout?.on("data",o=>{m.push(o),i[d](o.trim())}),s.stderr?.on("data",o=>{a.push(o),i.debug(o.trim())}),s.on("close",o=>{0===o?(i.silly("Command completed successfully"),n({stdout:m.join("\n"),stderr:a.join("\n")})):(i.critical(`Command failed with code ${o}:\n ${a.join("\n")}`),c(new t(`Command failed with code ${o}: ${a.join("\n")}`)))}),s.on("error",o=>{i.critical("Command execution error",o),c(o)})})}const e="##VERSION##",i="##COMMIT##",d="##FULL_VERSION##",c="##PACKAGE##";export{i as COMMIT,d as FULL_VERSION,c as PACKAGE_NAME,e as VERSION,r as execWithLogging};
 //# sourceMappingURL=integrations.js.map

package/dist/integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.js","sources":["../src/utils.ts","../src/index.ts"],"sourcesContent":[null,null],"names":["async","execWithLogging","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","error","code","silly","join","critical","InternalError","err","VERSION","COMMIT","FULL_VERSION","PACKAGE_NAME"],"mappings":"0IASOA,eAAeC,EACpBC,EACAC,EACAC,EACAC,EAAkBC,EAASC,MAI3B,OAFAH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAIgB,MAAMH,EAAKE,UAGjBP,EAAMI,GAAG,QAAUK,IACJ,IAATA,GACFjB,EAAIkB,MAAM,kCACVZ,EAAQ,CAAEI,OAAQA,EAAOS,KAAK,MAAOR,OAAQA,EAAOQ,KAAK,UAEzDnB,EAAIoB,SACF,4BAA4BH,QAAWN,EAAOQ,KAAK,SAErDZ,EACE,IAAIc,EACF,4BAA4BJ,MAASN,EAAOQ,KAAK,aAMzDX,EAAMI,GAAG,QAAUU,IACjBtB,EAAIoB,SAAS,0BAA2BE,GACxCf,EAAOe,MAGb,CC/CO,MAAMC,EAAkB,cAElBC,EAAS,aAETC,EAAe,mBAEfC,EAAuB"}
+{"version":3,"file":"integrations.js","sources":["../src/utils.ts","../src/index.ts"],"sourcesContent":[null,null],"names":["async","execWithLogging","command","options","log","level","LogLevel","info","debug","Promise","resolve","reject","child","exec","stdout","stderr","on","data","push","trim","code","silly","join","critical","InternalError","err","VERSION","COMMIT","FULL_VERSION","PACKAGE_NAME"],"mappings":"0IASOA,eAAeC,EACpBC,EACAC,EACAC,EACAC,EAAkBC,EAASC,MAI3B,OAFAH,EAAII,MAAM,cAAcN,GAEjB,IAAIO,QAAQ,CAACC,EAASC,KAC3B,MAAMC,EAAQC,EAAKX,EAASC,GAEtBW,EAAmB,GACnBC,EAAmB,GAEzBH,EAAME,QAAQE,GAAG,OAASC,IACxBH,EAAOI,KAAKD,GACZb,EAAIC,GAAOY,EAAKE,UAGlBP,EAAMG,QAAQC,GAAG,OAASC,IACxBF,EAAOG,KAAKD,GACZb,EAAII,MAAMS,EAAKE,UAGjBP,EAAMI,GAAG,QAAUI,IACJ,IAATA,GACFhB,EAAIiB,MAAM,kCACVX,EAAQ,CAAEI,OAAQA,EAAOQ,KAAK,MAAOP,OAAQA,EAAOO,KAAK,UAEzDlB,EAAImB,SACF,4BAA4BH,QAAWL,EAAOO,KAAK,SAErDX,EACE,IAAIa,EACF,4BAA4BJ,MAASL,EAAOO,KAAK,aAMzDV,EAAMI,GAAG,QAAUS,IACjBrB,EAAImB,SAAS,0BAA2BE,GACxCd,EAAOc,MAGb,CC/CO,MAAMC,EAAkB,cAElBC,EAAS,aAETC,EAAe,mBAEfC,EAAuB"}

package/lib/cjs/index.cjs

@@ -21,9 +21,9 @@ exports.PACKAGE_NAME = exports.FULL_VERSION = exports.COMMIT = exports.VERSION =
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 __exportStar(require("./utils.cjs"), exports);
-exports.VERSION = "0.2.0";
-exports.COMMIT = "00bac68";
-exports.FULL_VERSION = "0.2.0-00bac68";
+exports.VERSION = "0.2.1";
+exports.COMMIT = "4990f39";
+exports.FULL_VERSION = "0.2.1-4990f39";
 exports.PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.cjs.map

package/lib/cjs/nest/authService.cjs

@@ -5,15 +5,28 @@ exports.AuthService = void 0;
  * @module integrations/nest/authService
  * @summary Nest-compatible authentication service helpers.
  * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
+ *
+ * Supports two modes:
+ * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
+ *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
+ * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
+ *   decodes the JWT without signature verification (dev/local mode).
  */
 const core_1 = require("@decaf-ts/core");
+const jose_1 = require("jose");
 const utils_js_1 = require("./utils.cjs");
 class AuthService {
+    constructor(options = {}) {
+        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
+        this.verifyUrl = options.verifyUrl ?? "";
+        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+        this.excludedClients = options.excludedClients ?? ["account"];
+    }
     getTokenPayload(jwt) {
         return (0, utils_js_1.getTokenPayload)(jwt);
     }
     getRoles(jwt) {
-        return (0, utils_js_1.extractKeycloakRoles)(this.getTokenPayload(jwt));
+        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
     }
     getUser(jwt) {
         return (0, utils_js_1.getUser)(jwt);
@@ -21,16 +34,54 @@ class AuthService {
     extractKeycloakRoles(payload) {
         return (0, utils_js_1.extractKeycloakRoles)(payload);
     }
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload) {
+        return (0, utils_js_1.getClientRoles)(payload, this.excludedClients);
+    }
     getRealmFromIssuer(jwt) {
         return (0, utils_js_1.getRealmFromIssuer)(jwt);
     }
-    assertValidToken(jwt) {
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    async assertValidToken(jwt) {
+        if (this.verifyToken) {
+            return this.verifyAgainstJwks(jwt);
+        }
         const payload = this.getTokenPayload(jwt);
         if (!payload) {
             throw new core_1.AuthorizationError("Invalid token");
         }
         return payload;
     }
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    async verifyAgainstJwks(jwt) {
+        if (!this.jwks) {
+            this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(this.verifyUrl));
+        }
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(jwt, this.jwks, {
+                clockTolerance: `${this.clockToleranceSeconds}s`,
+            });
+            return payload;
+        }
+        catch (e) {
+            throw new core_1.AuthorizationError("Invalid token: " + (e?.message ?? e));
+        }
+    }
 }
 exports.AuthService = AuthService;
 //# sourceMappingURL=authService.js.map

package/lib/cjs/nest/authService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/authService.cjs","sourceRoot":"","sources":["nest/authService.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,yCAAoD;AACpD,yCAAgG;AAChG,MAAa,WAAW;IACpB,eAAe,CAAC,GAAG;QACf,OAAO,IAAA,0BAAe,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,QAAQ,CAAC,GAAG;QACR,OAAO,IAAA,+BAAoB,EAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,GAAG;QACP,OAAO,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,oBAAoB,CAAC,OAAO;QACxB,OAAO,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,kBAAkB,CAAC,GAAG;QAClB,OAAO,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,gBAAgB,CAAC,GAAG;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,yBAAkB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ;AAvBD,kCAuBC;AACD,uCAAuC"}
+{"version":3,"file":"nest/authService.cjs","sourceRoot":"","sources":["nest/authService.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,yCAAoD;AACpD,+BAAqD;AACrD,yCAAiH;AACjH,MAAa,WAAW;IACpB,YAAY,OAAO,GAAG,EAAE;QACpB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,GAAG;QACf,OAAO,IAAA,0BAAe,EAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,QAAQ,CAAC,GAAG;QACR,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,GAAG;QACP,OAAO,IAAA,kBAAO,EAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,oBAAoB,CAAC,OAAO;QACxB,OAAO,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD;;;OAGG;IACH,kBAAkB,CAAC,OAAO;QACtB,OAAO,IAAA,yBAAc,EAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACzD,CAAC;IACD,kBAAkB,CAAC,GAAG;QAClB,OAAO,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAG;QACtB,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,yBAAkB,CAAC,eAAe,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAG;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gBAChD,cAAc,EAAE,GAAG,IAAI,CAAC,qBAAqB,GAAG;aACnD,CAAC,CAAC;YACH,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;CACJ;AAnED,kCAmEC;AACD,uCAAuC"}

package/lib/cjs/nest/keycloakAuthHandler.cjs

@@ -1,14 +1,23 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.KeycloakAuthHandler = void 0;
+exports.getClientRoles = exports.KeycloakAuthHandler = void 0;
 const core_1 = require("@decaf-ts/core");
 const server_1 = require("@decaf-ts/for-http/server");
 const authService_js_1 = require("./authService.cjs");
 const utils_js_1 = require("./utils.cjs");
+Object.defineProperty(exports, "getClientRoles", { enumerable: true, get: function () { return utils_js_1.getClientRoles; } });
 class KeycloakAuthHandler extends server_1.AuthHandler {
-    constructor(authService = new authService_js_1.AuthService()) {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService, authServiceOptions) {
         super();
-        this.authService = authService;
+        this.authService =
+            authService ?? new authService_js_1.AuthService(authServiceOptions ?? {});
     }
     extractFromAuth(ctx) {
         const request = ctx.switchToHttp().getRequest();
@@ -33,7 +42,7 @@ class KeycloakAuthHandler extends server_1.AuthHandler {
     async validate(data, routeRoles, model, ...args) {
         if (data.isPublic)
             return;
-        this.authService.assertValidToken(data.token);
+        await this.authService.assertValidToken(data.token);
         await super.validate(data, routeRoles, model, ...args);
     }
 }
@@ -41,8 +50,6 @@ exports.KeycloakAuthHandler = KeycloakAuthHandler;
 function isPublicRoute(req) {
     if (req.path?.startsWith("/public"))
         return true;
-    if (req.path === "/account" && req.method === "POST")
-        return true;
     return false;
 }
 function getToken(req) {

package/lib/cjs/nest/keycloakAuthHandler.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA,yCAAoD;AACpD,sDAAwD;AACxD,qDAA+C;AAC/C,yCAAwF;AACxF,MAAa,mBAAoB,SAAQ,oBAAW;IAChD,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,eAAe,CAAC,GAAG;QACf,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI;QAC3C,IAAI,IAAI,CAAC,QAAQ;YACb,OAAO;QACX,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;CACJ;AA/BD,kDA+BC;AACD,SAAS,aAAa,CAAC,GAAG;IACtB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAChD,OAAO,IAAI,CAAC;IAChB,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,SAAS,mBAAmB,CAAC,OAAO,EAAE,KAAK;IACvC,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,OAAO,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AACD,+CAA+C"}
+{"version":3,"file":"nest/keycloakAuthHandler.cjs","sourceRoot":"","sources":["nest/keycloakAuthHandler.js"],"names":[],"mappings":";;;AAAA,yCAAoD;AACpD,sDAAwD;AACxD,qDAA+C;AAC/C,yCAAwG;AA4D/F,+FA5D2D,yBAAc,OA4D3D;AA3DvB,MAAa,mBAAoB,SAAQ,oBAAW;IAChD;;;;;;OAMG;IACH,YAAY,WAAW,EAAE,kBAAkB;QACvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW;YACZ,WAAW,IAAI,IAAI,4BAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,eAAe,CAAC,GAAG;QACf,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,yBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACpD,iDAAiD;QACjD,MAAM,OAAO,GAAG,IAAA,0BAAe,EAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAA,+BAAoB,EAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjE,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI;QAC3C,IAAI,IAAI,CAAC,QAAQ;YACb,OAAO;QACX,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;CACJ;AAvCD,kDAuCC;AACD,SAAS,aAAa,CAAC,GAAG;IACtB,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,GAAG;IACjB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACvD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QACN,OAAO,SAAS,CAAC;IACrB,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AACD,SAAS,mBAAmB,CAAC,OAAO,EAAE,KAAK;IACvC,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,IAAI,OAAO,EAAE,GAAG;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC;IACvB,OAAO,IAAA,6BAAkB,EAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,+CAA+C"}

package/lib/cjs/nest/keycloakModule.cjs

@@ -9,12 +9,14 @@ exports.AuthModule = exports.KeycloakModule = void 0;
 const authService_js_1 = require("./authService.cjs");
 const keycloakAuthHandler_js_1 = require("./keycloakAuthHandler.cjs");
 class KeycloakModule {
-    constructor(authService = new authService_js_1.AuthService(), authHandler = new keycloakAuthHandler_js_1.KeycloakAuthHandler(authService)) {
+    constructor(authService, authHandler) {
         this.authService = authService;
         this.authHandler = authHandler;
     }
-    static create() {
-        return new KeycloakModule();
+    static create(options) {
+        const authService = new authService_js_1.AuthService(options);
+        const authHandler = new keycloakAuthHandler_js_1.KeycloakAuthHandler(authService);
+        return new KeycloakModule(authService, authHandler);
     }
 }
 exports.KeycloakModule = KeycloakModule;

package/lib/cjs/nest/keycloakModule.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/keycloakModule.cjs","sourceRoot":"","sources":["nest/keycloakModule.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,qDAA+C;AAC/C,qEAA+D;AAC/D,MAAa,cAAc;IACvB,YAAY,WAAW,GAAG,IAAI,4BAAW,EAAE,EAAE,WAAW,GAAG,IAAI,4CAAmB,CAAC,WAAW,CAAC;QAC3F,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,MAAM;QACT,OAAO,IAAI,cAAc,EAAE,CAAC;IAChC,CAAC;CACJ;AARD,wCAQC;AACD,MAAa,UAAW,SAAQ,cAAc;CAC7C;AADD,gCACC;AACD,0CAA0C"}
+{"version":3,"file":"nest/keycloakModule.cjs","sourceRoot":"","sources":["nest/keycloakModule.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,qDAA+C;AAC/C,qEAA+D;AAC/D,MAAa,cAAc;IACvB,YAAY,WAAW,EAAE,WAAW;QAChC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,WAAW,GAAG,IAAI,4BAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,4CAAmB,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;CACJ;AAVD,wCAUC;AACD,MAAa,UAAW,SAAQ,cAAc;CAC7C;AADD,gCACC;AACD,0CAA0C"}

package/lib/cjs/nest/utils.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.DECAF_ADAPTER_OPTIONS = void 0;
 exports.getTokenPayload = getTokenPayload;
 exports.extractKeycloakRoles = extractKeycloakRoles;
+exports.getClientRoles = getClientRoles;
 exports.getUser = getUser;
 exports.getRealmFromIssuer = getRealmFromIssuer;
 const core_1 = require("@decaf-ts/core");
@@ -30,6 +31,29 @@ function extractKeycloakRoles(payload) {
     }
     return [...roles];
 }
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+function getClientRoles(payload, excluded = ["account"]) {
+    const resourceAccess = payload?.resource_access;
+    if (!resourceAccess || typeof resourceAccess !== "object")
+        return [];
+    const roles = new Set();
+    for (const [clientId, data] of Object.entries(resourceAccess)) {
+        if (excluded.includes(clientId))
+            continue;
+        if (Array.isArray(data?.roles)) {
+            for (const role of data.roles)
+                roles.add(role);
+        }
+    }
+    return [...roles];
+}
 function getUser(jwt) {
     const payload = getTokenPayload(jwt);
     if (!payload)

package/lib/cjs/nest/utils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest/utils.cjs","sourceRoot":"","sources":["nest/utils.js"],"names":[],"mappings":";;;AAEA,0CAOC;AACD,oDAcC;AACD,0BAaC;AACD,gDAmBC;AA1DD,yCAAoD;AACvC,QAAA,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACtE,SAAgB,eAAe,CAAC,GAAG;IAC/B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AACD,SAAgB,oBAAoB,CAAC,OAAO;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YACzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC1E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD,SAAgB,OAAO,CAAC,GAAG;IACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QACR,OAAO,SAAS,CAAC;IACrB,OAAO;QACH,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KACjC,CAAC;AACN,CAAC;AACD,SAAgB,kBAAkB,CAAC,GAAG;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,yBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC;QACH,MAAM,IAAI,yBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AACD,iCAAiC"}
+{"version":3,"file":"nest/utils.cjs","sourceRoot":"","sources":["nest/utils.js"],"names":[],"mappings":";;;AAEA,0CAOC;AACD,oDAcC;AASD,wCAcC;AACD,0BAaC;AACD,gDAmBC;AAjFD,yCAAoD;AACvC,QAAA,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACtE,SAAgB,eAAe,CAAC,GAAG;IAC/B,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AACD,SAAgB,oBAAoB,CAAC,OAAO;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YACzC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC1E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YACxD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAC9D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,OAAO,EAAE,QAAQ,GAAG,CAAC,SAAS,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,EAAE,eAAe,CAAC;IAChD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QACrD,OAAO,EAAE,CAAC;IACd,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,SAAS;QACb,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBACzB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC;AACD,SAAgB,OAAO,CAAC,GAAG;IACvB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QACR,OAAO,SAAS,CAAC;IACrB,OAAO;QACH,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KACjC,CAAC;AACN,CAAC;AACD,SAAgB,kBAAkB,CAAC,GAAG;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,yBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,CAAC;QACH,MAAM,IAAI,yBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,yBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC;AACD,iCAAiC"}

package/lib/cjs/utils.cjs

@@ -21,7 +21,7 @@ async function execWithLogging(command, options, log, level = logging_1.LogLevel
         });
         child.stderr?.on("data", (data) => {
             stderr.push(data);
-            log.error(data.trim());
+            log.debug(data.trim());
         });
         child.on("close", (code) => {
             if (code === 0) {

package/lib/esm/index.js

@@ -4,8 +4,8 @@
  * @description Exposes the package utilities and build-time version metadata for `@decaf-ts/integrations`.
  */
 export * from "./utils.js";
-export const VERSION = "0.2.0";
-export const COMMIT = "00bac68";
-export const FULL_VERSION = "0.2.0-00bac68";
+export const VERSION = "0.2.1";
+export const COMMIT = "4990f39";
+export const FULL_VERSION = "0.2.1-4990f39";
 export const PACKAGE_NAME = "@decaf-ts/integrations";
 //# sourceMappingURL=index.js.map

package/lib/esm/nest/authService.js

@@ -2,15 +2,28 @@
  * @module integrations/nest/authService
  * @summary Nest-compatible authentication service helpers.
  * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
+ *
+ * Supports two modes:
+ * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
+ *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
+ * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
+ *   decodes the JWT without signature verification (dev/local mode).
  */
 import { AuthorizationError } from "@decaf-ts/core";
-import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser } from "./utils.js";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser, getClientRoles, } from "./utils.js";
 export class AuthService {
+    constructor(options = {}) {
+        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
+        this.verifyUrl = options.verifyUrl ?? "";
+        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+        this.excludedClients = options.excludedClients ?? ["account"];
+    }
     getTokenPayload(jwt) {
         return getTokenPayload(jwt);
     }
     getRoles(jwt) {
-        return extractKeycloakRoles(this.getTokenPayload(jwt));
+        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
     }
     getUser(jwt) {
         return getUser(jwt);
@@ -18,15 +31,53 @@ export class AuthService {
     extractKeycloakRoles(payload) {
         return extractKeycloakRoles(payload);
     }
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload) {
+        return getClientRoles(payload, this.excludedClients);
+    }
     getRealmFromIssuer(jwt) {
         return getRealmFromIssuer(jwt);
     }
-    assertValidToken(jwt) {
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    async assertValidToken(jwt) {
+        if (this.verifyToken) {
+            return this.verifyAgainstJwks(jwt);
+        }
         const payload = this.getTokenPayload(jwt);
         if (!payload) {
             throw new AuthorizationError("Invalid token");
         }
         return payload;
     }
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    async verifyAgainstJwks(jwt) {
+        if (!this.jwks) {
+            this.jwks = createRemoteJWKSet(new URL(this.verifyUrl));
+        }
+        try {
+            const { payload } = await jwtVerify(jwt, this.jwks, {
+                clockTolerance: `${this.clockToleranceSeconds}s`,
+            });
+            return payload;
+        }
+        catch (e) {
+            throw new AuthorizationError("Invalid token: " + (e?.message ?? e));
+        }
+    }
 }
 //# sourceMappingURL=authService.js.map

package/lib/esm/nest/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAgB;AAG7F,MAAM,OAAO,WAAW;IACtB,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAAgB;QACnC,OAAO,oBAAoB,CAAC,OAA4C,CAAC,CAAC;IAC5E,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB,CAAC,GAAW;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,cAAc,GACf,mBAAgB;AA+BjB,MAAM,OAAO,WAAW;IAOtB,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAA0C;QAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,OAA0C;QAE1C,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAAW;QAEX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,GAAW;QAEX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,cAAc,EAAE,GAAG,IAAI,CAAC,qBAAqB,GAAG;aACjD,CAAC,CAAC;YACH,OAAO,OAAgD,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF"}

package/lib/esm/nest/keycloakAuthHandler.js

@@ -1,11 +1,19 @@
 import { AuthorizationError } from "@decaf-ts/core";
 import { AuthHandler } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.js";
-import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, } from "./utils.js";
+import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, getClientRoles, } from "./utils.js";
 export class KeycloakAuthHandler extends AuthHandler {
-    constructor(authService = new AuthService()) {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService, authServiceOptions) {
         super();
-        this.authService = authService;
+        this.authService =
+            authService ?? new AuthService(authServiceOptions ?? {});
     }
     extractFromAuth(ctx) {
         const request = ctx.switchToHttp().getRequest();
@@ -30,15 +38,13 @@ export class KeycloakAuthHandler extends AuthHandler {
     async validate(data, routeRoles, model, ...args) {
         if (data.isPublic)
             return;
-        this.authService.assertValidToken(data.token);
+        await this.authService.assertValidToken(data.token);
         await super.validate(data, routeRoles, model, ...args);
     }
 }
 function isPublicRoute(req) {
     if (req.path?.startsWith("/public"))
         return true;
-    if (req.path === "/account" && req.method === "POST")
-        return true;
     return false;
 }
 function getToken(req) {
@@ -55,4 +61,5 @@ function resolveOrganization(payload, token) {
         return payload.azp;
     return getRealmFromIssuer(token);
 }
+export { getClientRoles };
 //# sourceMappingURL=keycloakAuthHandler.js.map

package/lib/esm/nest/keycloakAuthHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAE5C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC,YAA6B,cAAc,IAAI,WAAW,EAAE;QAC1D,KAAK,EAAE,CAAC;QADmB,gBAAW,GAAX,WAAW,CAAoB;IAE5D,CAAC;IAES,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AAErE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC;;;;;;OAMG;IACH,YACE,WAAyB,EACzB,kBAAuC;QAEvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW;YACd,WAAW,IAAI,IAAI,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAIS,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/lib/esm/nest/keycloakModule.js

@@ -6,12 +6,14 @@
 import { AuthService } from "./authService.js";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.js";
 export class KeycloakModule {
-    constructor(authService = new AuthService(), authHandler = new KeycloakAuthHandler(authService)) {
+    constructor(authService, authHandler) {
         this.authService = authService;
         this.authHandler = authHandler;
     }
-    static create() {
-        return new KeycloakModule();
+    static create(options) {
+        const authService = new AuthService(options);
+        const authHandler = new KeycloakAuthHandler(authService);
+        return new KeycloakModule(authService, authHandler);
     }
 }
 export class AuthModule extends KeycloakModule {

package/lib/esm/nest/keycloakModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAC5C,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,cAAc,IAAI,WAAW,EAAE,EAC/B,cAAc,IAAI,mBAAmB,CAAC,WAAW,CAAC;QADlD,gBAAW,GAAX,WAAW,CAAoB;QAC/B,gBAAW,GAAX,WAAW,CAAuC;IACjE,CAAC;IAEJ,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,cAAc,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}
+{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AACrE,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,WAAwB,EACxB,WAAgC;QADhC,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAqB;IAC/C,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,OAA4B;QACxC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}

package/lib/esm/nest/utils.js

@@ -23,6 +23,29 @@ export function extractKeycloakRoles(payload) {
     }
     return [...roles];
 }
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export function getClientRoles(payload, excluded = ["account"]) {
+    const resourceAccess = payload?.resource_access;
+    if (!resourceAccess || typeof resourceAccess !== "object")
+        return [];
+    const roles = new Set();
+    for (const [clientId, data] of Object.entries(resourceAccess)) {
+        if (excluded.includes(clientId))
+            continue;
+        if (Array.isArray(data?.roles)) {
+            for (const role of data.roles)
+                roles.add(role);
+        }
+    }
+    return [...roles];
+}
 export function getUser(jwt) {
     const payload = getTokenPayload(jwt);
     if (!payload)

package/lib/esm/nest/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA0C,EAC1C,WAAqB,CAAC,SAAS,CAAC;IAEhC,MAAM,cAAc,GAAG,OAAO,EAAE,eAAe,CAAC;IAChD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/lib/esm/utils.js

@@ -18,7 +18,7 @@ export async function execWithLogging(command, options, log, level = LogLevel.in
         });
         child.stderr?.on("data", (data) => {
             stderr.push(data);
-            log.error(data.trim());
+            log.debug(data.trim());
         });
         child.on("close", (code) => {
             if (code === 0) {

package/lib/types/index.d.cts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "00bac68";
-export declare const FULL_VERSION = "0.2.0-00bac68";
+export declare const COMMIT = "4990f39";
+export declare const FULL_VERSION = "0.2.1-4990f39";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "00bac68";
-export declare const FULL_VERSION = "0.2.0-00bac68";
+export declare const COMMIT = "4990f39";
+export declare const FULL_VERSION = "0.2.1-4990f39";
 export declare const PACKAGE_NAME: string;

package/lib/types/nest/authService.d.cts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }

package/lib/types/nest/authService.d.mts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }

package/lib/types/nest/keycloakAuthHandler.d.cts

@@ -5,9 +5,9 @@
  * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
  *
  * Only overrides the two extension points:
- * - {@link extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
  *   Returns empty data for public routes without requiring a token.
- * - {@link validate} — validates the JWT via {@link AuthService.assertValidToken},
+ * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
  *   then delegates to the base class for route-level and model-level role checks.
  *   Skips entirely for public routes.
  *
@@ -17,8 +17,9 @@
 import type { Constructor } from "@decaf-ts/decoration";
 import { Context, ContextualArgs } from "@decaf-ts/core";
 import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
-import { AuthService } from "./authService.d.cts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
 import type { AuthExecutionContextLike } from "./types.d.cts";
+import { getClientRoles } from "./utils.d.cts";
 /**
  * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
  *
@@ -32,8 +33,15 @@ export interface KeycloakAuthData extends AuthData {
     isPublic: boolean;
 }
 export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
-    private readonly authService;
-    constructor(authService?: AuthService);
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
+    protected readonly authService: AuthService;
     protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
     /**
      * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
@@ -42,3 +50,4 @@ export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContex
      */
     protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
 }
+export { getClientRoles };

package/lib/types/nest/keycloakAuthHandler.d.mts

@@ -5,9 +5,9 @@
  * Extends the framework-agnostic {@link AuthHandler} from `@decaf-ts/for-http/server`.
  *
  * Only overrides the two extension points:
- * - {@link extractFromAuth} — decodes the JWT and returns auth data (no validation).
+ * - {@link KeycloakAuthHandler.extractFromAuth} — decodes the JWT and returns auth data (no validation).
  *   Returns empty data for public routes without requiring a token.
- * - {@link validate} — validates the JWT via {@link AuthService.assertValidToken},
+ * - {@link KeycloakAuthHandler.validate} — validates the JWT via {@link AuthService.assertValidToken},
  *   then delegates to the base class for route-level and model-level role checks.
  *   Skips entirely for public routes.
  *
@@ -17,8 +17,9 @@
 import type { Constructor } from "@decaf-ts/decoration";
 import { Context, ContextualArgs } from "@decaf-ts/core";
 import { AuthHandler, AuthData } from "@decaf-ts/for-http/server";
-import { AuthService } from "./authService.d.mts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
 import type { AuthExecutionContextLike } from "./types.d.mts";
+import { getClientRoles } from "./utils.d.mts";
 /**
  * Auth data returned by {@link KeycloakAuthHandler.extractFromAuth}.
  *
@@ -32,8 +33,15 @@ export interface KeycloakAuthData extends AuthData {
     isPublic: boolean;
 }
 export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContextLike, Context, KeycloakAuthData> {
-    private readonly authService;
-    constructor(authService?: AuthService);
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService?: AuthService, authServiceOptions?: AuthServiceOptions);
+    protected readonly authService: AuthService;
     protected extractFromAuth(ctx: AuthExecutionContextLike): KeycloakAuthData;
     /**
      * Validates the JWT against the Keycloak instance (signature, expiry, etc.)
@@ -42,3 +50,4 @@ export declare class KeycloakAuthHandler extends AuthHandler<AuthExecutionContex
      */
     protected validate(data: KeycloakAuthData, routeRoles: string[] | undefined, model: string | Constructor, ...args: ContextualArgs<Context>): Promise<void>;
 }
+export { getClientRoles };

package/lib/types/nest/keycloakModule.d.cts

@@ -3,13 +3,13 @@
  * @summary Nest module wiring for Keycloak auth.
  * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
  */
-import { AuthService } from "./authService.d.cts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.cts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.cts";
 export declare class KeycloakModule {
     readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService?: AuthService, authHandler?: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
+    static create(options?: AuthServiceOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/keycloakModule.d.mts

@@ -3,13 +3,13 @@
  * @summary Nest module wiring for Keycloak auth.
  * @description Exposes the Nest module setup for the integration auth service and Keycloak handler.
  */
-import { AuthService } from "./authService.d.mts";
+import { AuthService, type AuthServiceOptions } from "./authService.d.mts";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.d.mts";
 export declare class KeycloakModule {
     readonly authService: AuthService;
     readonly authHandler: KeycloakAuthHandler;
-    constructor(authService?: AuthService, authHandler?: KeycloakAuthHandler);
-    static create(): KeycloakModule;
+    constructor(authService: AuthService, authHandler: KeycloakAuthHandler);
+    static create(options?: AuthServiceOptions): KeycloakModule;
 }
 export declare class AuthModule extends KeycloakModule {
 }

package/lib/types/nest/utils.d.cts

@@ -7,5 +7,14 @@ import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
 export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
 export declare function getUser(jwt: string): KeycloakUser | undefined;
 export declare function getRealmFromIssuer(jwt: string): string;

package/lib/types/nest/utils.d.mts

@@ -7,5 +7,14 @@ import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
 export declare const DECAF_ADAPTER_OPTIONS: unique symbol;
 export declare function getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
 export declare function extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export declare function getClientRoles(payload: KeycloakAccessTokenPayload | null, excluded?: string[]): string[];
 export declare function getUser(jwt: string): KeycloakUser | undefined;
 export declare function getRealmFromIssuer(jwt: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decaf-ts/integrations",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.mts",
@@ -255,7 +255,7 @@
   },
   "devDependencies": {
     "@decaf-ts/for-http": "latest",
-    "@decaf-ts/for-nest": "^0.11.2-refactor",
+    "@decaf-ts/for-nest": "^0.11.2-refactor.2",
     "@decaf-ts/utils": "latest",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
@@ -269,11 +269,19 @@
     "supertest": "^7.0.0"
   },
   "peerDependencies": {
-    "@decaf-ts/for-http": ">=0.18.0"
+    "@decaf-ts/for-http": "latest",
+    "@decaf-ts/for-nest": "0.11.2.refactor.2",
+    "jose": ">=5.0.0"
   },
   "peerDependenciesMeta": {
     "@decaf-ts/for-http": {
       "optional": true
+    },
+    "@decaf-ts/for-nest": {
+      "optional": true
+    },
+    "jose": {
+      "optional": true
     }
   },
   "overrides": {