@decaf-ts/integrations 0.2.1 → 0.3.0

package/lib/esm/keycloak/services/KeycloakService.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import { description } from "@decaf-ts/decoration";
 import { ClientBasedService, service, } from "@decaf-ts/core";
-import { NotFoundError } from "@decaf-ts/db-decorators";
+import { InternalError, NotFoundError } from "@decaf-ts/db-decorators";
 import Axios from "axios";
 import * as https from "node:https";
 import { KeycloakRealmService } from "./KeycloakRealmService.js";
@@ -86,6 +86,20 @@ let KeycloakService = class KeycloakService extends ClientBasedService {
         const { ctxArgs } = (await this.logCtx(args, "addRealmRolesToUser", true)).for(this.addRealmRolesToUser);
         await this.roleService.grantRealmRolesToUser(realmName, userUUID, roleNames, ...ctxArgs);
     }
+    /**
+     * Creates a realm-level role, optionally as a composite of existing roles.
+     */
+    async createRealmRole(realmName, roleName, compositeRoles, ...args) {
+        const { ctxArgs } = (await this.logCtx(args, "createRealmRole", true)).for(this.createRealmRole);
+        await this.roleService.createRealmRole(realmName, roleName, compositeRoles, ...ctxArgs);
+    }
+    /**
+     * Creates a client in the configured realm and returns its UUID.
+     */
+    async createClient(config, overrides, ...args) {
+        const { ctxArgs } = (await this.logCtx(args, "createClient", true)).for(this.createClient);
+        return this.clientService.createClient(config, overrides, ...ctxArgs);
+    }
     async addClientRolesToUser(realmName, clientUUID, userUUID, roleNames, ...args) {
         const { ctxArgs } = (await this.logCtx(args, "addClientRolesToUser", true)).for(this.addClientRolesToUser);
         await this.roleService.grantClientRolesToUser(realmName, clientUUID, userUUID, roleNames, ...ctxArgs);
@@ -99,6 +113,7 @@ let KeycloakService = class KeycloakService extends ClientBasedService {
         const { ctxArgs } = (await this.logCtx(args, "setupOrganization", true)).for(this.setupOrganization);
         const adminAccessToken = await this.authService.getAccessToken(config.adminApiUser, ...ctxArgs);
         await this.realmService.createRealm(config.realmApiUser.realm, config.realmConfig ?? {}, ...ctxArgs);
+        await this.waitForRealm(config.realmApiUser.realm, ...ctxArgs);
         const realmUserUUID = await this.userService.createRealmUser(config.realmApiUser, {}, ...ctxArgs);
         config.realmApiUser.usernameUUID = realmUserUUID;
         const realmManagementUUID = await this.clientService.getClientUUID(adminAccessToken, config.realmApiUser.realm, "realm-management", ...ctxArgs);
@@ -130,6 +145,20 @@ let KeycloakService = class KeycloakService extends ClientBasedService {
             }),
         });
     }
+    async waitForRealm(realmName, ...args) {
+        const { ctxArgs } = (await this.logCtx(args, "waitForRealm", true)).for(this.waitForRealm);
+        const deadline = Date.now() + 15000;
+        while (Date.now() < deadline) {
+            try {
+                await this.realmService.getRealm(realmName, ...ctxArgs);
+                return;
+            }
+            catch {
+                await new Promise((resolve) => setTimeout(resolve, 500));
+            }
+        }
+        throw new InternalError(`Timed out waiting for realm ${realmName}`);
+    }
     async updateClientScopesRolesMappers(keycloakUser, ...args) {
         this.logCtx(args, this.updateClientScopesRolesMappers);
         const client = this.createHttpClient(this.config);

package/lib/esm/keycloak/services/KeycloakService.js.map

@@ -1 +1 @@
-{"version":3,"file":"KeycloakService.js","sourceRoot":"","sources":["../../../../src/keycloak/services/KeycloakService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAGlB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,kCAA+B;AAC9D,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAC5D,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAC5D,OAAO,EAAE,qBAAqB,EAAE,mCAAgC;AAChE,OAAO,EAAE,+BAA+B,EAAE,6CAA0C;AACpF,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAGrD,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,kBAGpC;IAaC;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAC5C,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAwB,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACjC,OAAO,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAE/B,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,uBAAuB,GAAG,IAAI,+BAA+B,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,6CAA6C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAC/C,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE1B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,mBAAmB,CAAC,YAAa,EACjC,EAAE,EACF,GAAG,OAAO,CACX,CAAC;QACF,mBAAmB,CAAC,YAAa,CAAC,YAAY,GAAG,gBAAgB,CAAC;QAClE,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAC1C,mBAAmB,CAAC,YAAa,CAAC,KAAK,EACvC,gBAAgB,EAChB,CAAC,OAAO,CAAC,EACT,GAAG,OAAO,CACX,CAAC;QACF,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAC1C,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAC7C,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,YAA0B,EAC1B,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAChD,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,QAAgB,EAChB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAC1C,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,QAAgB,EAChB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CACrD,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,QAAgB,EAChB,SAAmB,EACnB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CACrD,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAC1C,SAAS,EACT,QAAQ,EACR,SAAS,EACT,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,UAAkB,EAClB,QAAgB,EAChB,SAAmB,EACnB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CACtD,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC3C,SAAS,EACT,UAAU,EACV,QAAQ,EACR,SAAS,EACT,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CACpD,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC3D,mBAAmB,CAAC,WAAY,EAChC,GAAG,OAAO,CACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAC/B,eAAe,EACf,mBAAmB,CAAC,YAAa,EACjC,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAA2B,EAC3B,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,CACnD,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE9B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,MAAM,CAAC,YAAa,EACpB,GAAG,OAAO,CACX,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACjC,MAAM,CAAC,YAAa,CAAC,KAAK,EAC1B,MAAM,CAAC,WAAW,IAAI,EAAE,EACxB,GAAG,OAAO,CACX,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAC1D,MAAM,CAAC,YAAa,EACpB,EAAE,EACF,GAAG,OAAO,CACX,CAAC;QACF,MAAM,CAAC,YAAa,CAAC,YAAY,GAAG,aAAa,CAAC;QAElD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAChE,gBAAgB,EAChB,MAAM,CAAC,YAAa,CAAC,KAAK,EAC1B,kBAAkB,EAClB,GAAG,OAAO,CACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CACtC,iBAAiB,MAAM,CAAC,YAAa,CAAC,KAAK,YAAY,mBAAmB,QAAQ,EAClF,iBAAiB,MAAM,CAAC,YAAa,CAAC,KAAK,UAAU,aAAa,0BAA0B,mBAAmB,EAAE,EACjH,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,EAC/C,gBAAgB,EAChB,GAAG,OAAO,CACX,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACtD,MAAM,EACN,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAEtC,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,YAAa,EAAE,GAAG,OAAO,CAAC,CAAC;QAE5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CACtD,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACxC,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACF,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CACvD,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;YACF,MAAM,IAAI,CAAC,uBAAuB,CAAC,6BAA6B,CAC9D,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CACpD,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,KAAK,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;YAC1B,UAAU,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC;gBAC1B,kBAAkB,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;aAClE,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,8BAA8B,CAC1C,YAA0B,EAC1B,GAAG,IAAyB;QAE5B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,YAAY,EACZ,GAAG,IAAI,CACR,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACzC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,YAAY,CAAC,KAAK,gBAAgB;YACrG,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,gBAAgB,EAAE;aAC5C;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,YAAY,GAChB,IAAI,CAAC,iBAAiB,CAUpB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACxE,MAAM,iBAAiB,GAAG,UAAU,EAAE,eAAe,EAAE,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAC3C,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,YAAY,CAAC,KAAK,kBAAkB,UAAU,CAAC,EAAE,4BAA4B,iBAAiB,CAAC,EAAE,EAAE;YACtK,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACvC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,gBAAgB,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAI,IAAa;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA3WY,eAAe;IAD3B,WAAW,CAAC,yFAAyF,CAAC;;GAC1F,eAAe,CA2W3B"}
+{"version":3,"file":"KeycloakService.js","sourceRoot":"","sources":["../../../../src/keycloak/services/KeycloakService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAGlB,OAAO,GACR,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEvE,OAAO,KAAwB,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,kCAA+B;AAC9D,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAC5D,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAC5D,OAAO,EAAE,qBAAqB,EAAE,mCAAgC;AAChE,OAAO,EAAE,+BAA+B,EAAE,6CAA0C;AACpF,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAGrD,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,kBAGpC;IAaC;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED,KAAK,CAAC,UAAU,CACd,GAAG,IAA6B;QAEhC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CACvB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAC5C,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAwB,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAEtB,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACvC,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACjC,OAAO,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAE/B,GAAG,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,aAAa,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACjD,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,uBAAuB,GAAG,IAAI,+BAA+B,EAAE,CAAC;QACrE,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,6CAA6C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAC/C,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE1B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,mBAAmB,CAAC,YAAa,EACjC,EAAE,EACF,GAAG,OAAO,CACX,CAAC;QACF,mBAAmB,CAAC,YAAa,CAAC,YAAY,GAAG,gBAAgB,CAAC;QAClE,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAC1C,mBAAmB,CAAC,YAAa,CAAC,KAAK,EACvC,gBAAgB,EAChB,CAAC,OAAO,CAAC,EACT,GAAG,OAAO,CACX,CAAC;QACF,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAC1C,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,SAAiB,EACjB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAC3C,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CACf,SAAiB,EACjB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAC7C,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,YAA0B,EAC1B,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAChD,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,SAAiB,EACjB,QAAgB,EAChB,OAAY,EACZ,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAC1C,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,QAAgB,EAChB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CACrD,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,QAAgB,EAChB,SAAmB,EACnB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,qBAAqB,EAAE,IAAI,CAAC,CACrD,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAC1C,SAAS,EACT,QAAQ,EACR,SAAS,EACT,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,SAAiB,EACjB,QAAgB,EAChB,cAAoC,EACpC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CACjD,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CACpC,SAAS,EACT,QAAQ,EACR,cAAc,EACd,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,MAA2B,EAC3B,SAAuE,EACvE,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAC9C,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,UAAkB,EAClB,QAAgB,EAChB,SAAmB,EACnB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CACtD,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAC3C,SAAS,EACT,UAAU,EACV,QAAQ,EACR,SAAS,EACT,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CACpD,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC3D,mBAAmB,CAAC,WAAY,EAChC,GAAG,OAAO,CACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAC/B,eAAe,EACf,mBAAmB,CAAC,YAAa,EACjC,GAAG,OAAO,CACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAA2B,EAC3B,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,CAAC,CACnD,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE9B,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,MAAM,CAAC,YAAa,EACpB,GAAG,OAAO,CACX,CAAC;QAEF,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CACjC,MAAM,CAAC,YAAa,CAAC,KAAK,EAC1B,MAAM,CAAC,WAAW,IAAI,EAAE,EACxB,GAAG,OAAO,CACX,CAAC;QACF,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAa,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC;QAEhE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAC1D,MAAM,CAAC,YAAa,EACpB,EAAE,EACF,GAAG,OAAO,CACX,CAAC;QACF,MAAM,CAAC,YAAa,CAAC,YAAY,GAAG,aAAa,CAAC;QAElD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAChE,gBAAgB,EAChB,MAAM,CAAC,YAAa,CAAC,KAAK,EAC1B,kBAAkB,EAClB,GAAG,OAAO,CACX,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CACtC,iBAAiB,MAAM,CAAC,YAAa,CAAC,KAAK,YAAY,mBAAmB,QAAQ,EAClF,iBAAiB,MAAM,CAAC,YAAa,CAAC,KAAK,UAAU,aAAa,0BAA0B,mBAAmB,EAAE,EACjH,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,EAC/C,gBAAgB,EAChB,GAAG,OAAO,CACX,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CACtD,MAAM,EACN,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAEtC,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,YAAa,EAAE,GAAG,OAAO,CAAC,CAAC;QAE5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,mBAAwC,EACxC,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,CACtD,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CACxC,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACF,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,uBAAuB,CAAC,sBAAsB,CACvD,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;YACF,MAAM,IAAI,CAAC,uBAAuB,CAAC,6BAA6B,CAC9D,mBAAmB,EACnB,SAAS,EACT,GAAG,OAAO,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,CAAC,CACpD,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;IAC7D,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,KAAK,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;YAC1B,UAAU,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC;gBAC1B,kBAAkB,EAAE,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;aAClE,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,SAAiB,EACjB,GAAG,IAA6B;QAEhC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAC9C,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,OAAO,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,MAAM,IAAI,aAAa,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,8BAA8B,CAC1C,YAA0B,EAC1B,GAAG,IAAyB;QAE5B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAC5D,YAAY,EACZ,GAAG,IAAI,CACR,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACzC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,YAAY,CAAC,KAAK,gBAAgB;YACrG,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,gBAAgB,EAAE;aAC5C;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,YAAY,GAChB,IAAI,CAAC,iBAAiB,CAUpB,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACxE,MAAM,iBAAiB,GAAG,UAAU,EAAE,eAAe,EAAE,IAAI,CACzD,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc,CAC3C,CAAC;QACF,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtC,MAAM,IAAI,aAAa,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC;QACD,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;QACpD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,YAAY,CAAC,KAAK,kBAAkB,UAAU,CAAC,EAAE,4BAA4B,iBAAiB,CAAC,EAAE,EAAE;YACtK,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACvC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,gBAAgB,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAI,IAAa;QACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAlaY,eAAe;IAD3B,WAAW,CAAC,yFAAyF,CAAC;;GAC1F,eAAe,CAka3B"}

package/lib/esm/nest/authService.js

@@ -2,15 +2,28 @@
  * @module integrations/nest/authService
  * @summary Nest-compatible authentication service helpers.
  * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
+ *
+ * Supports two modes:
+ * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
+ *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
+ * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
+ *   decodes the JWT without signature verification (dev/local mode).
  */
 import { AuthorizationError } from "@decaf-ts/core";
-import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser } from "./utils.js";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser, getClientRoles, } from "./utils.js";
 export class AuthService {
+    constructor(options = {}) {
+        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
+        this.verifyUrl = options.verifyUrl ?? "";
+        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
+        this.excludedClients = options.excludedClients ?? ["account"];
+    }
     getTokenPayload(jwt) {
         return getTokenPayload(jwt);
     }
     getRoles(jwt) {
-        return extractKeycloakRoles(this.getTokenPayload(jwt));
+        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
     }
     getUser(jwt) {
         return getUser(jwt);
@@ -18,15 +31,53 @@ export class AuthService {
     extractKeycloakRoles(payload) {
         return extractKeycloakRoles(payload);
     }
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload) {
+        return getClientRoles(payload, this.excludedClients);
+    }
     getRealmFromIssuer(jwt) {
         return getRealmFromIssuer(jwt);
     }
-    assertValidToken(jwt) {
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    async assertValidToken(jwt) {
+        if (this.verifyToken) {
+            return this.verifyAgainstJwks(jwt);
+        }
         const payload = this.getTokenPayload(jwt);
         if (!payload) {
             throw new AuthorizationError("Invalid token");
         }
         return payload;
     }
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    async verifyAgainstJwks(jwt) {
+        if (!this.jwks) {
+            this.jwks = createRemoteJWKSet(new URL(this.verifyUrl));
+        }
+        try {
+            const { payload } = await jwtVerify(jwt, this.jwks, {
+                clockTolerance: `${this.clockToleranceSeconds}s`,
+            });
+            return payload;
+        }
+        catch (e) {
+            throw new AuthorizationError("Invalid token: " + (e?.message ?? e));
+        }
+    }
 }
 //# sourceMappingURL=authService.js.map

package/lib/esm/nest/authService.js.map

@@ -1 +1 @@
-{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAgB;AAG7F,MAAM,OAAO,WAAW;IACtB,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAAgB;QACnC,OAAO,oBAAoB,CAAC,OAA4C,CAAC,CAAC;IAC5E,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,gBAAgB,CAAC,GAAW;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"authService.js","sourceRoot":"","sources":["../../../src/nest/authService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,cAAc,GACf,mBAAgB;AA+BjB,MAAM,OAAO,WAAW;IAOtB,YAAY,UAA8B,EAAE;QAC1C,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAED,eAAe,CAAC,GAAW;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,oBAAoB,CAAC,OAA0C;QAC7D,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,OAA0C;QAE1C,OAAO,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,kBAAkB,CAAC,GAAW;QAC5B,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,GAAW;QAEX,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,GAAW;QAEX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;gBAClD,cAAc,EAAE,GAAG,IAAI,CAAC,qBAAqB,GAAG;aACjD,CAAC,CAAC;YACH,OAAO,OAAgD,CAAC;QAC1D,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;CACF"}

package/lib/esm/nest/keycloakAuthHandler.js

@@ -1,11 +1,19 @@
 import { AuthorizationError } from "@decaf-ts/core";
 import { AuthHandler } from "@decaf-ts/for-http/server";
 import { AuthService } from "./authService.js";
-import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, } from "./utils.js";
+import { getRealmFromIssuer, getTokenPayload, extractKeycloakRoles, getClientRoles, } from "./utils.js";
 export class KeycloakAuthHandler extends AuthHandler {
-    constructor(authService = new AuthService()) {
+    /**
+     * @param authService  An {@link AuthService} configured with JWKS verification
+     *                     options.  When omitted a default decode-only service is
+     *                     used.
+     * @param authServiceOptions  Convenience: if `authService` is omitted, these
+     *                     options are used to construct one.
+     */
+    constructor(authService, authServiceOptions) {
         super();
-        this.authService = authService;
+        this.authService =
+            authService ?? new AuthService(authServiceOptions ?? {});
     }
     extractFromAuth(ctx) {
         const request = ctx.switchToHttp().getRequest();
@@ -30,15 +38,13 @@ export class KeycloakAuthHandler extends AuthHandler {
     async validate(data, routeRoles, model, ...args) {
         if (data.isPublic)
             return;
-        this.authService.assertValidToken(data.token);
+        await this.authService.assertValidToken(data.token);
         await super.validate(data, routeRoles, model, ...args);
     }
 }
 function isPublicRoute(req) {
     if (req.path?.startsWith("/public"))
         return true;
-    if (req.path === "/account" && req.method === "POST")
-        return true;
     return false;
 }
 function getToken(req) {
@@ -55,4 +61,5 @@ function resolveOrganization(payload, token) {
         return payload.azp;
     return getRealmFromIssuer(token);
 }
+export { getClientRoles };
 //# sourceMappingURL=keycloakAuthHandler.js.map

package/lib/esm/nest/keycloakAuthHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAE5C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,GACrB,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC,YAA6B,cAAc,IAAI,WAAW,EAAE;QAC1D,KAAK,EAAE,CAAC;QADmB,gBAAW,GAAX,WAAW,CAAoB;IAE5D,CAAC;IAES,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"keycloakAuthHandler.js","sourceRoot":"","sources":["../../../src/nest/keycloakAuthHandler.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kBAAkB,EAA2B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAY,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AAErE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,cAAc,GACf,mBAAgB;AAejB,MAAM,OAAO,mBAAoB,SAAQ,WAIxC;IACC;;;;;;OAMG;IACH,YACE,WAAyB,EACzB,kBAAuC;QAEvC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,WAAW;YACd,WAAW,IAAI,IAAI,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAIS,eAAe,CAAC,GAA6B;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAmB,CAAC;QAEjE,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,iDAAiD;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,IAAI,OAAO,EAAE,kBAAkB,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACgB,KAAK,CAAC,QAAQ,CAC/B,IAAsB,EACtB,UAAgC,EAChC,KAA2B,EAC3B,GAAG,IAA6B;QAEhC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,GAAoB;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,6BAA6B,CAAC;QACzD,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAuB,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA8C,EAC9C,KAAa;IAEb,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,IAAI,OAAO,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/lib/esm/nest/keycloakModule.js

@@ -6,12 +6,14 @@
 import { AuthService } from "./authService.js";
 import { KeycloakAuthHandler } from "./keycloakAuthHandler.js";
 export class KeycloakModule {
-    constructor(authService = new AuthService(), authHandler = new KeycloakAuthHandler(authService)) {
+    constructor(authService, authHandler) {
         this.authService = authService;
         this.authHandler = authHandler;
     }
-    static create() {
-        return new KeycloakModule();
+    static create(options) {
+        const authService = new AuthService(options);
+        const authHandler = new KeycloakAuthHandler(authService);
+        return new KeycloakModule(authService, authHandler);
     }
 }
 export class AuthModule extends KeycloakModule {

package/lib/esm/nest/keycloakModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,yBAAsB;AAC5C,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,cAAc,IAAI,WAAW,EAAE,EAC/B,cAAc,IAAI,mBAAmB,CAAC,WAAW,CAAC;QADlD,gBAAW,GAAX,WAAW,CAAoB;QAC/B,gBAAW,GAAX,WAAW,CAAuC;IACjE,CAAC;IAEJ,MAAM,CAAC,MAAM;QACX,OAAO,IAAI,cAAc,EAAE,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}
+{"version":3,"file":"keycloakModule.js","sourceRoot":"","sources":["../../../src/nest/keycloakModule.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAA2B,yBAAsB;AACrE,OAAO,EAAE,mBAAmB,EAAE,iCAA8B;AAE5D,MAAM,OAAO,cAAc;IACzB,YACkB,WAAwB,EACxB,WAAgC;QADhC,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAqB;IAC/C,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,OAA4B;QACxC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,mBAAmB,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;CACF;AAED,MAAM,OAAO,UAAW,SAAQ,cAAc;CAAG"}

package/lib/esm/nest/utils.js

@@ -23,6 +23,29 @@ export function extractKeycloakRoles(payload) {
     }
     return [...roles];
 }
+/**
+ * Extracts roles from the `resource_access` claim only, optionally excluding
+ * specified client IDs (e.g. `"account"`).  Unlike {@link extractKeycloakRoles}
+ * this does NOT include `realm_access.roles`.
+ *
+ * @param payload   The decoded JWT payload.
+ * @param excluded  Client IDs to skip.  @default ["account"]
+ */
+export function getClientRoles(payload, excluded = ["account"]) {
+    const resourceAccess = payload?.resource_access;
+    if (!resourceAccess || typeof resourceAccess !== "object")
+        return [];
+    const roles = new Set();
+    for (const [clientId, data] of Object.entries(resourceAccess)) {
+        if (excluded.includes(clientId))
+            continue;
+        if (Array.isArray(data?.roles)) {
+            for (const role of data.roles)
+                roles.add(role);
+        }
+    }
+    return [...roles];
+}
 export function getUser(jwt) {
     const payload = getTokenPayload(jwt);
     if (!payload)

package/lib/esm/nest/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/nest/utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA+B,CAAC;IACtH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA0C;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA0C,EAC1C,WAAqB,CAAC,SAAS,CAAC;IAEhC,MAAM,cAAc,GAAG,OAAO,EAAE,eAAe,CAAC;IAChD,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9D,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/lib/esm/utils.js

@@ -18,7 +18,7 @@ export async function execWithLogging(command, options, log, level = LogLevel.in
         });
         child.stderr?.on("data", (data) => {
             stderr.push(data);
-            log.error(data.trim());
+            log.debug(data.trim());
         });
         child.on("close", (code) => {
             if (code === 0) {

package/lib/types/index.d.cts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.cts";
 export declare const VERSION: string;
-export declare const COMMIT = "00bac68";
-export declare const FULL_VERSION = "0.2.0-00bac68";
+export declare const COMMIT = "5dab9b8";
+export declare const FULL_VERSION = "0.2.2-5dab9b8";
 export declare const PACKAGE_NAME: string;

package/lib/types/index.d.mts

@@ -5,6 +5,6 @@
  */
 export * from "./utils.d.mts";
 export declare const VERSION: string;
-export declare const COMMIT = "00bac68";
-export declare const FULL_VERSION = "0.2.0-00bac68";
+export declare const COMMIT = "5dab9b8";
+export declare const FULL_VERSION = "0.2.2-5dab9b8";
 export declare const PACKAGE_NAME: string;

package/lib/types/keycloak/services/KeycloakRoleService.d.cts

@@ -8,6 +8,20 @@ export declare class KeycloakRoleService extends ClientBasedService<AxiosInstanc
         client: AxiosInstance;
     }>;
     createClientRoles(keycloakSetupConfig: KeycloakSetupConfig, roleConfigs: KeycloakClientRoleConfig[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a realm-level role in the specified realm.
+     *
+     * When `compositeRoles` is provided, the role is created as a Keycloak
+     * composite role that includes the given sub-roles.  This allows role
+     * hierarchies (e.g. `admin ⊃ writer ⊃ reader`) so that a user assigned
+     * the composite role automatically inherits all sub-roles in their JWT.
+     *
+     * @param realmName      The realm in which to create the role.
+     * @param roleName       The name of the realm role to create.
+     * @param compositeRoles Optional array of existing realm role names to
+     *                       include as composites.
+     */
+    createRealmRole(realmName: string, roleName: string, compositeRoles: string[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
     getRealmRoles(realmName: string, ...args: MaybeContextualArg<any>): Promise<any[]>;
     getClientRoles(realmName: string, clientUUID: string, ...args: MaybeContextualArg<any>): Promise<any[]>;
     grantRealmRolesToUser(realmName: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;

package/lib/types/keycloak/services/KeycloakRoleService.d.mts

@@ -8,6 +8,20 @@ export declare class KeycloakRoleService extends ClientBasedService<AxiosInstanc
         client: AxiosInstance;
     }>;
     createClientRoles(keycloakSetupConfig: KeycloakSetupConfig, roleConfigs: KeycloakClientRoleConfig[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a realm-level role in the specified realm.
+     *
+     * When `compositeRoles` is provided, the role is created as a Keycloak
+     * composite role that includes the given sub-roles.  This allows role
+     * hierarchies (e.g. `admin ⊃ writer ⊃ reader`) so that a user assigned
+     * the composite role automatically inherits all sub-roles in their JWT.
+     *
+     * @param realmName      The realm in which to create the role.
+     * @param roleName       The name of the realm role to create.
+     * @param compositeRoles Optional array of existing realm role names to
+     *                       include as composites.
+     */
+    createRealmRole(realmName: string, roleName: string, compositeRoles: string[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
     getRealmRoles(realmName: string, ...args: MaybeContextualArg<any>): Promise<any[]>;
     getClientRoles(realmName: string, clientUUID: string, ...args: MaybeContextualArg<any>): Promise<any[]>;
     grantRealmRolesToUser(realmName: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;

package/lib/types/keycloak/services/KeycloakService.d.cts

@@ -27,12 +27,21 @@ export declare class KeycloakService extends ClientBasedService<AxiosInstance, K
     editUser(realmName: string, userUUID: string, payload: any, ...args: MaybeContextualArg<any>): Promise<void>;
     removeUserFromRealm(realmName: string, userUUID: string, ...args: MaybeContextualArg<any>): Promise<void>;
     addRealmRolesToUser(realmName: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a realm-level role, optionally as a composite of existing roles.
+     */
+    createRealmRole(realmName: string, roleName: string, compositeRoles: string[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a client in the configured realm and returns its UUID.
+     */
+    createClient(config: KeycloakSetupConfig, overrides: Partial<import("../types.d.cts").KeycloakClientConfig> | undefined, ...args: MaybeContextualArg<any>): Promise<string>;
     addClientRolesToUser(realmName: string, clientUUID: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;
     deleteAdminApiUser(keycloakSetupConfig: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<void>;
     setupOrganization(config: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<KeycloakSetupConfig>;
     setupOrganizationSSO(keycloakSetupConfig: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<void>;
     deleteOrganization(realmName: string, ...args: MaybeContextualArg<any>): Promise<void>;
     private createHttpClient;
+    private waitForRealm;
     private updateClientScopesRolesMappers;
     private parseJsonResponse;
 }

package/lib/types/keycloak/services/KeycloakService.d.mts

@@ -27,12 +27,21 @@ export declare class KeycloakService extends ClientBasedService<AxiosInstance, K
     editUser(realmName: string, userUUID: string, payload: any, ...args: MaybeContextualArg<any>): Promise<void>;
     removeUserFromRealm(realmName: string, userUUID: string, ...args: MaybeContextualArg<any>): Promise<void>;
     addRealmRolesToUser(realmName: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a realm-level role, optionally as a composite of existing roles.
+     */
+    createRealmRole(realmName: string, roleName: string, compositeRoles: string[] | undefined, ...args: MaybeContextualArg<any>): Promise<void>;
+    /**
+     * Creates a client in the configured realm and returns its UUID.
+     */
+    createClient(config: KeycloakSetupConfig, overrides: Partial<import("../types.d.mts").KeycloakClientConfig> | undefined, ...args: MaybeContextualArg<any>): Promise<string>;
     addClientRolesToUser(realmName: string, clientUUID: string, userUUID: string, roleNames: string[], ...args: MaybeContextualArg<any>): Promise<void>;
     deleteAdminApiUser(keycloakSetupConfig: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<void>;
     setupOrganization(config: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<KeycloakSetupConfig>;
     setupOrganizationSSO(keycloakSetupConfig: KeycloakSetupConfig, ...args: MaybeContextualArg<any>): Promise<void>;
     deleteOrganization(realmName: string, ...args: MaybeContextualArg<any>): Promise<void>;
     private createHttpClient;
+    private waitForRealm;
     private updateClientScopesRolesMappers;
     private parseJsonResponse;
 }

package/lib/types/keycloak/types.d.cts

@@ -100,4 +100,15 @@ export interface KeycloakSetupConfig {
     client: KeycloakClientConfig;
     identityProvider?: KeycloakIdentityProviderConfig;
     realmConfig?: KeycloakRealmConfig;
+    /**
+     * When true, realm roles are created as Keycloak composite roles forming a
+     * hierarchy (e.g. admin ⊃ writer ⊃ reader).  A user assigned the composite
+     * role automatically inherits all sub-roles in their JWT.
+     *
+     * When false (default), roles are independent — admin does NOT imply writer
+     * or reader.  Each user must be explicitly granted every role they need.
+     *
+     * @default false
+     */
+    useCompositeRoles?: boolean;
 }

package/lib/types/keycloak/types.d.mts

@@ -100,4 +100,15 @@ export interface KeycloakSetupConfig {
     client: KeycloakClientConfig;
     identityProvider?: KeycloakIdentityProviderConfig;
     realmConfig?: KeycloakRealmConfig;
+    /**
+     * When true, realm roles are created as Keycloak composite roles forming a
+     * hierarchy (e.g. admin ⊃ writer ⊃ reader).  A user assigned the composite
+     * role automatically inherits all sub-roles in their JWT.
+     *
+     * When false (default), roles are independent — admin does NOT imply writer
+     * or reader.  Each user must be explicitly granted every role they need.
+     *
+     * @default false
+     */
+    useCompositeRoles?: boolean;
 }

package/lib/types/nest/authService.d.cts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }

package/lib/types/nest/authService.d.mts

@@ -1,9 +1,62 @@
 import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
+/**
+ * Configuration for the {@link AuthService}.
+ */
+export interface AuthServiceOptions {
+    /**
+     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
+     * When `false` (or `verifyUrl` is empty), tokens are decoded without
+     * signature verification (dev/local mode only).
+     * @default false
+     */
+    verifyToken?: boolean;
+    /**
+     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
+     * Required when `verifyToken` is `true`.
+     */
+    verifyUrl?: string;
+    /**
+     * Clock tolerance for JWT expiry verification (in seconds).
+     * @default 5
+     */
+    clockToleranceSeconds?: number;
+    /**
+     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
+     * @default ["account"]
+     */
+    excludedClients?: string[];
+}
 export declare class AuthService {
+    private readonly verifyToken;
+    private readonly verifyUrl;
+    private readonly clockToleranceSeconds;
+    private readonly excludedClients;
+    private jwks;
+    constructor(options?: AuthServiceOptions);
     getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
     getRoles(jwt: string): string[];
     getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: unknown): string[];
+    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
+    /**
+     * Extracts client roles from the `resource_access` claim, excluding
+     * the configured `excludedClients` (default: `["account"]`).
+     */
+    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
     getRealmFromIssuer(jwt: string): string;
-    assertValidToken(jwt: string): KeycloakAccessTokenPayload;
+    /**
+     * Validates a JWT:
+     * - In **verify mode**: verifies the signature against the Keycloak JWKS
+     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
+     * - In **decode-only mode**: decodes the JWT without verification and
+     *   returns the payload (or throws if unparseable).
+     *
+     * @throws {AuthorizationError} when the token is invalid, expired, or
+     *   signature verification fails.
+     */
+    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
+    /**
+     * Verifies the JWT signature against the Keycloak JWKS endpoint.
+     * Lazily creates the JWKS keystore on first call.
+     */
+    private verifyAgainstJwks;
 }