@decaf-ts/integrations 0.3.12 → 0.4.1-0

package/lib/cjs/nest/authService.cjs

@@ -1,91 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
-/**
- * @module integrations/nest/authService
- * @summary Nest-compatible authentication service helpers.
- * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
- *
- * Supports two modes:
- * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
- *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
- * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
- *   decodes the JWT without signature verification (dev/local mode).
- */
-const core_1 = require("@decaf-ts/core");
-const jose_1 = require("jose");
-const utils_js_1 = require("./utils.cjs");
-class AuthService {
-    constructor(options = {}) {
-        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
-        this.verifyUrl = options.verifyUrl ?? "";
-        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
-        this.excludedClients = options.excludedClients ?? ["account"];
-    }
-    isTokenVerificationEnabled() {
-        return this.verifyToken;
-    }
-    getTokenPayload(jwt) {
-        return (0, utils_js_1.getTokenPayload)(jwt);
-    }
-    getRoles(jwt) {
-        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
-    }
-    getUser(jwt) {
-        return (0, utils_js_1.getUser)(jwt);
-    }
-    extractKeycloakRoles(payload) {
-        return (0, utils_js_1.extractKeycloakRoles)(payload);
-    }
-    /**
-     * Extracts client roles from the `resource_access` claim, excluding
-     * the configured `excludedClients` (default: `["account"]`).
-     */
-    extractClientRoles(payload) {
-        return (0, utils_js_1.getClientRoles)(payload, this.excludedClients);
-    }
-    getRealmFromIssuer(jwt) {
-        return (0, utils_js_1.getRealmFromIssuer)(jwt);
-    }
-    /**
-     * Validates a JWT:
-     * - In **verify mode**: verifies the signature against the Keycloak JWKS
-     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
-     * - In **decode-only mode**: decodes the JWT without verification and
-     *   returns the payload (or throws if unparseable).
-     *
-     * @throws {AuthorizationError} when the token is invalid, expired, or
-     *   signature verification fails.
-     */
-    async assertValidToken(jwt) {
-        if (this.verifyToken) {
-            return this.verifyAgainstJwks(jwt);
-        }
-        const payload = this.getTokenPayload(jwt);
-        if (!payload) {
-            throw new core_1.AuthorizationError("Invalid token");
-        }
-        return payload;
-    }
-    /**
-     * Verifies the JWT signature against the Keycloak JWKS endpoint.
-     * Lazily creates the JWKS keystore on first call.
-     */
-    async verifyAgainstJwks(jwt) {
-        if (!this.jwks) {
-            this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(this.verifyUrl));
-        }
-        try {
-            const { payload } = await (0, jose_1.jwtVerify)(jwt, this.jwks, {
-                clockTolerance: `${this.clockToleranceSeconds}s`,
-            });
-            return payload;
-        }
-        catch (e) {
-            throw new core_1.AuthorizationError("Invalid token: " + (e?.message ?? e));
-        }
-    }
-}
-exports.AuthService = AuthService;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aFNlcnZpY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbmVzdC9hdXRoU2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7OztHQVVHO0FBQ0gsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFNBQVMsRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUNyRCxPQUFPLEVBQ0wsb0JBQW9CLEVBQ3BCLGtCQUFrQixFQUNsQixlQUFlLEVBQ2YsT0FBTyxFQUNQLGNBQWMsR0FDZixtQkFBZ0I7QUErQmpCLE1BQU0sT0FBTyxXQUFXO0lBT3RCLFlBQVksVUFBOEIsRUFBRTtRQUMxQyxJQUFJLENBQUMsV0FBVyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO1FBQ2hFLElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLGVBQWUsR0FBRyxPQUFPLENBQUMsZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVELDBCQUEwQjtRQUN4QixPQUFPLElBQUksQ0FBQyxXQUFXLENBQUM7SUFDMUIsQ0FBQztJQUVELGVBQWUsQ0FBQyxHQUFXO1FBQ3pCLE9BQU8sZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRCxRQUFRLENBQUMsR0FBVztRQUNsQixPQUFPLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVELE9BQU8sQ0FBQyxHQUFXO1FBQ2pCLE9BQU8sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3RCLENBQUM7SUFFRCxvQkFBb0IsQ0FBQyxPQUEwQztRQUM3RCxPQUFPLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7O09BR0c7SUFDSCxrQkFBa0IsQ0FDaEIsT0FBMEM7UUFFMUMsT0FBTyxjQUFjLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBRUQsa0JBQWtCLENBQUMsR0FBVztRQUM1QixPQUFPLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSCxLQUFLLENBQUMsZ0JBQWdCLENBQ3BCLEdBQVc7UUFFWCxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNyQixPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNyQyxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksa0JBQWtCLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEQsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7O09BR0c7SUFDSyxLQUFLLENBQUMsaUJBQWlCLENBQzdCLEdBQVc7UUFFWCxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sU0FBUyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFO2dCQUNsRCxjQUFjLEVBQUUsR0FBRyxJQUFJLENBQUMscUJBQXFCLEdBQUc7YUFDakQsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxPQUFnRCxDQUFDO1FBQzFELENBQUM7UUFBQyxPQUFPLENBQU0sRUFBRSxDQUFDO1lBQ2hCLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxpQkFBaUIsR0FBRyxDQUFDLENBQUMsRUFBRSxPQUFPLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RSxDQUFDO0lBQ0gsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAbW9kdWxlIGludGVncmF0aW9ucy9uZXN0L2F1dGhTZXJ2aWNlXG4gKiBAc3VtbWFyeSBOZXN0LWNvbXBhdGlibGUgYXV0aGVudGljYXRpb24gc2VydmljZSBoZWxwZXJzLlxuICogQGRlc2NyaXB0aW9uIFJlcXVlc3QtY29udGV4dC1hd2FyZSBhdXRoIGhlbHBlcnMgZm9yIE5lc3QgYXBwbGljYXRpb25zIHVzaW5nIERlY2FmIGludGVncmF0aW9uIHBhdHRlcm5zLlxuICpcbiAqIFN1cHBvcnRzIHR3byBtb2RlczpcbiAqIC0gKipWZXJpZnkgbW9kZSoqIChkZWZhdWx0IHdoZW4gYHZlcmlmeVVybGAgaXMgc2V0KTogdmFsaWRhdGVzIHRoZSBKV1Qgc2lnbmF0dXJlXG4gKiAgIGFnYWluc3QgdGhlIEtleWNsb2FrIEpXS1MgZW5kcG9pbnQgdXNpbmcgYGpvc2Uuand0VmVyaWZ5YC5cbiAqIC0gKipEZWNvZGUtb25seSBtb2RlKiogKHdoZW4gYHZlcmlmeVRva2VuYCBpcyBmYWxzZSAvIGB2ZXJpZnlVcmxgIGlzIGVtcHR5KTpcbiAqICAgZGVjb2RlcyB0aGUgSldUIHdpdGhvdXQgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbiAoZGV2L2xvY2FsIG1vZGUpLlxuICovXG5pbXBvcnQgeyBBdXRob3JpemF0aW9uRXJyb3IgfSBmcm9tIFwiQGRlY2FmLXRzL2NvcmVcIjtcbmltcG9ydCB7IGNyZWF0ZVJlbW90ZUpXS1NldCwgand0VmVyaWZ5IH0gZnJvbSBcImpvc2VcIjtcbmltcG9ydCB7XG4gIGV4dHJhY3RLZXljbG9ha1JvbGVzLFxuICBnZXRSZWFsbUZyb21Jc3N1ZXIsXG4gIGdldFRva2VuUGF5bG9hZCxcbiAgZ2V0VXNlcixcbiAgZ2V0Q2xpZW50Um9sZXMsXG59IGZyb20gXCIuL3V0aWxzXCI7XG5pbXBvcnQgdHlwZSB7IEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkLCBLZXljbG9ha1VzZXIgfSBmcm9tIFwiLi90eXBlc1wiO1xuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gZm9yIHRoZSB7QGxpbmsgQXV0aFNlcnZpY2V9LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhTZXJ2aWNlT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHZlcmlmeSB0aGUgSldUIHNpZ25hdHVyZSBhZ2FpbnN0IHRoZSBLZXljbG9hayBKV0tTIGVuZHBvaW50LlxuICAgKiBXaGVuIGBmYWxzZWAgKG9yIGB2ZXJpZnlVcmxgIGlzIGVtcHR5KSwgdG9rZW5zIGFyZSBkZWNvZGVkIHdpdGhvdXRcbiAgICogc2lnbmF0dXJlIHZlcmlmaWNhdGlvbiAoZGV2L2xvY2FsIG1vZGUgb25seSkuXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICB2ZXJpZnlUb2tlbj86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBUaGUgS2V5Y2xvYWsgSldLUyBVUkwgKGUuZy4gYGh0dHBzOi8va2V5Y2xvYWsvcmVhbG1zL215cmVhbG0vcHJvdG9jb2wvb3BlbmlkLWNvbm5lY3QvY2VydHNgKS5cbiAgICogUmVxdWlyZWQgd2hlbiBgdmVyaWZ5VG9rZW5gIGlzIGB0cnVlYC5cbiAgICovXG4gIHZlcmlmeVVybD86IHN0cmluZztcbiAgLyoqXG4gICAqIENsb2NrIHRvbGVyYW5jZSBmb3IgSldUIGV4cGlyeSB2ZXJpZmljYXRpb24gKGluIHNlY29uZHMpLlxuICAgKiBAZGVmYXVsdCA1XG4gICAqL1xuICBjbG9ja1RvbGVyYW5jZVNlY29uZHM/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBLZXljbG9hayBjbGllbnQgSURzIHRvIGV4Y2x1ZGUgd2hlbiBleHRyYWN0aW5nIHJvbGVzIGZyb20gYHJlc291cmNlX2FjY2Vzc2AuXG4gICAqIEBkZWZhdWx0IFtcImFjY291bnRcIl1cbiAgICovXG4gIGV4Y2x1ZGVkQ2xpZW50cz86IHN0cmluZ1tdO1xufVxuXG5leHBvcnQgY2xhc3MgQXV0aFNlcnZpY2Uge1xuICBwcml2YXRlIHJlYWRvbmx5IHZlcmlmeVRva2VuOiBib29sZWFuO1xuICBwcml2YXRlIHJlYWRvbmx5IHZlcmlmeVVybDogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IGNsb2NrVG9sZXJhbmNlU2Vjb25kczogbnVtYmVyO1xuICBwcml2YXRlIHJlYWRvbmx5IGV4Y2x1ZGVkQ2xpZW50czogc3RyaW5nW107XG4gIHByaXZhdGUgandrczogUmV0dXJuVHlwZTx0eXBlb2YgY3JlYXRlUmVtb3RlSldLU2V0PiB8IHVuZGVmaW5lZDtcblxuICBjb25zdHJ1Y3RvcihvcHRpb25zOiBBdXRoU2VydmljZU9wdGlvbnMgPSB7fSkge1xuICAgIHRoaXMudmVyaWZ5VG9rZW4gPSAhIW9wdGlvbnMudmVyaWZ5VG9rZW4gJiYgISFvcHRpb25zLnZlcmlmeVVybDtcbiAgICB0aGlzLnZlcmlmeVVybCA9IG9wdGlvbnMudmVyaWZ5VXJsID8/IFwiXCI7XG4gICAgdGhpcy5jbG9ja1RvbGVyYW5jZVNlY29uZHMgPSBvcHRpb25zLmNsb2NrVG9sZXJhbmNlU2Vjb25kcyA/PyA1O1xuICAgIHRoaXMuZXhjbHVkZWRDbGllbnRzID0gb3B0aW9ucy5leGNsdWRlZENsaWVudHMgPz8gW1wiYWNjb3VudFwiXTtcbiAgfVxuXG4gIGlzVG9rZW5WZXJpZmljYXRpb25FbmFibGVkKCk6IGJvb2xlYW4ge1xuICAgIHJldHVybiB0aGlzLnZlcmlmeVRva2VuO1xuICB9XG5cbiAgZ2V0VG9rZW5QYXlsb2FkKGp3dDogc3RyaW5nKTogS2V5Y2xvYWtBY2Nlc3NUb2tlblBheWxvYWQgfCBudWxsIHtcbiAgICByZXR1cm4gZ2V0VG9rZW5QYXlsb2FkKGp3dCk7XG4gIH1cblxuICBnZXRSb2xlcyhqd3Q6IHN0cmluZyk6IHN0cmluZ1tdIHtcbiAgICByZXR1cm4gdGhpcy5leHRyYWN0S2V5Y2xvYWtSb2xlcyh0aGlzLmdldFRva2VuUGF5bG9hZChqd3QpKTtcbiAgfVxuXG4gIGdldFVzZXIoand0OiBzdHJpbmcpOiBLZXljbG9ha1VzZXIgfCB1bmRlZmluZWQge1xuICAgIHJldHVybiBnZXRVc2VyKGp3dCk7XG4gIH1cblxuICBleHRyYWN0S2V5Y2xvYWtSb2xlcyhwYXlsb2FkOiBLZXljbG9ha0FjY2Vzc1Rva2VuUGF5bG9hZCB8IG51bGwpOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIGV4dHJhY3RLZXljbG9ha1JvbGVzKHBheWxvYWQpO1xuICB9XG5cbiAgLyoqXG4gICAqIEV4dHJhY3RzIGNsaWVudCByb2xlcyBmcm9tIHRoZSBgcmVzb3VyY2VfYWNjZXNzYCBjbGFpbSwgZXhjbHVkaW5nXG4gICAqIHRoZSBjb25maWd1cmVkIGBleGNsdWRlZENsaWVudHNgIChkZWZhdWx0OiBgW1wiYWNjb3VudFwiXWApLlxuICAgKi9cbiAgZXh0cmFjdENsaWVudFJvbGVzKFxuICAgIHBheWxvYWQ6IEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkIHwgbnVsbFxuICApOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIGdldENsaWVudFJvbGVzKHBheWxvYWQsIHRoaXMuZXhjbHVkZWRDbGllbnRzKTtcbiAgfVxuXG4gIGdldFJlYWxtRnJvbUlzc3Vlcihqd3Q6IHN0cmluZyk6IHN0cmluZyB7XG4gICAgcmV0dXJuIGdldFJlYWxtRnJvbUlzc3Vlcihqd3QpO1xuICB9XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRlcyBhIEpXVDpcbiAgICogLSBJbiAqKnZlcmlmeSBtb2RlKio6IHZlcmlmaWVzIHRoZSBzaWduYXR1cmUgYWdhaW5zdCB0aGUgS2V5Y2xvYWsgSldLU1xuICAgKiAgIGVuZHBvaW50IHVzaW5nIGBqb3NlLmp3dFZlcmlmeWAsIHRoZW4gcmV0dXJucyB0aGUgdmVyaWZpZWQgcGF5bG9hZC5cbiAgICogLSBJbiAqKmRlY29kZS1vbmx5IG1vZGUqKjogZGVjb2RlcyB0aGUgSldUIHdpdGhvdXQgdmVyaWZpY2F0aW9uIGFuZFxuICAgKiAgIHJldHVybnMgdGhlIHBheWxvYWQgKG9yIHRocm93cyBpZiB1bnBhcnNlYWJsZSkuXG4gICAqXG4gICAqIEB0aHJvd3Mge0F1dGhvcml6YXRpb25FcnJvcn0gd2hlbiB0aGUgdG9rZW4gaXMgaW52YWxpZCwgZXhwaXJlZCwgb3JcbiAgICogICBzaWduYXR1cmUgdmVyaWZpY2F0aW9uIGZhaWxzLlxuICAgKi9cbiAgYXN5bmMgYXNzZXJ0VmFsaWRUb2tlbihcbiAgICBqd3Q6IHN0cmluZ1xuICApOiBQcm9taXNlPEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkPiB7XG4gICAgaWYgKHRoaXMudmVyaWZ5VG9rZW4pIHtcbiAgICAgIHJldHVybiB0aGlzLnZlcmlmeUFnYWluc3RKd2tzKGp3dCk7XG4gICAgfVxuICAgIGNvbnN0IHBheWxvYWQgPSB0aGlzLmdldFRva2VuUGF5bG9hZChqd3QpO1xuICAgIGlmICghcGF5bG9hZCkge1xuICAgICAgdGhyb3cgbmV3IEF1dGhvcml6YXRpb25FcnJvcihcIkludmFsaWQgdG9rZW5cIik7XG4gICAgfVxuICAgIHJldHVybiBwYXlsb2FkO1xuICB9XG5cbiAgLyoqXG4gICAqIFZlcmlmaWVzIHRoZSBKV1Qgc2lnbmF0dXJlIGFnYWluc3QgdGhlIEtleWNsb2FrIEpXS1MgZW5kcG9pbnQuXG4gICAqIExhemlseSBjcmVhdGVzIHRoZSBKV0tTIGtleXN0b3JlIG9uIGZpcnN0IGNhbGwuXG4gICAqL1xuICBwcml2YXRlIGFzeW5jIHZlcmlmeUFnYWluc3RKd2tzKFxuICAgIGp3dDogc3RyaW5nXG4gICk6IFByb21pc2U8S2V5Y2xvYWtBY2Nlc3NUb2tlblBheWxvYWQ+IHtcbiAgICBpZiAoIXRoaXMuandrcykge1xuICAgICAgdGhpcy5qd2tzID0gY3JlYXRlUmVtb3RlSldLU2V0KG5ldyBVUkwodGhpcy52ZXJpZnlVcmwpKTtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gYXdhaXQgand0VmVyaWZ5KGp3dCwgdGhpcy5qd2tzLCB7XG4gICAgICAgIGNsb2NrVG9sZXJhbmNlOiBgJHt0aGlzLmNsb2NrVG9sZXJhbmNlU2Vjb25kc31zYCxcbiAgICAgIH0pO1xuICAgICAgcmV0dXJuIHBheWxvYWQgYXMgdW5rbm93biBhcyBLZXljbG9ha0FjY2Vzc1Rva2VuUGF5bG9hZDtcbiAgICB9IGNhdGNoIChlOiBhbnkpIHtcbiAgICAgIHRocm93IG5ldyBBdXRob3JpemF0aW9uRXJyb3IoXCJJbnZhbGlkIHRva2VuOiBcIiArIChlPy5tZXNzYWdlID8/IGUpKTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aFNlcnZpY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJhdXRoU2VydmljZS5qcyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQTs7Ozs7Ozs7OztHQVVHO0FBQ0gseUNBQW9EO0FBQ3BELCtCQUFxRDtBQUNyRCx5Q0FBaUg7QUFDakgsTUFBYSxXQUFXO0lBQ3BCLFlBQVksT0FBTyxHQUFHLEVBQUU7UUFDcEIsSUFBSSxDQUFDLFdBQVcsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLFdBQVcsSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQztRQUNoRSxJQUFJLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLElBQUksRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxxQkFBcUIsR0FBRyxPQUFPLENBQUMscUJBQXFCLElBQUksQ0FBQyxDQUFDO1FBQ2hFLElBQUksQ0FBQyxlQUFlLEdBQUcsT0FBTyxDQUFDLGVBQWUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCwwQkFBMEI7UUFDdEIsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDO0lBQzVCLENBQUM7SUFDRCxlQUFlLENBQUMsR0FBRztRQUNmLE9BQU8sSUFBQSwwQkFBZSxFQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2hDLENBQUM7SUFDRCxRQUFRLENBQUMsR0FBRztRQUNSLE9BQU8sSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUc7UUFDUCxPQUFPLElBQUEsa0JBQU8sRUFBQyxHQUFHLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBQ0Qsb0JBQW9CLENBQUMsT0FBTztRQUN4QixPQUFPLElBQUEsK0JBQW9CLEVBQUMsT0FBTyxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUNEOzs7T0FHRztJQUNILGtCQUFrQixDQUFDLE9BQU87UUFDdEIsT0FBTyxJQUFBLHlCQUFjLEVBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0Qsa0JBQWtCLENBQUMsR0FBRztRQUNsQixPQUFPLElBQUEsNkJBQWtCLEVBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkMsQ0FBQztJQUNEOzs7Ozs7Ozs7T0FTRztJQUNILEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHO1FBQ3RCLElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ25CLE9BQU8sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZDLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSx5QkFBa0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRCxDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUM7SUFDbkIsQ0FBQztJQUNEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHO1FBQ3ZCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDYixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUEseUJBQWtCLEVBQUMsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELElBQUksQ0FBQztZQUNELE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLElBQUEsZ0JBQVMsRUFBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRTtnQkFDaEQsY0FBYyxFQUFFLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixHQUFHO2FBQ25ELENBQUMsQ0FBQztZQUNILE9BQU8sT0FBTyxDQUFDO1FBQ25CLENBQUM7UUFDRCxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ1AsTUFBTSxJQUFJLHlCQUFrQixDQUFDLGlCQUFpQixHQUFHLENBQUMsQ0FBQyxFQUFFLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7SUFDTCxDQUFDO0NBQ0o7QUF0RUQsa0NBc0VDO0FBQ0QsMHNSQUEwc1IiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIEBtb2R1bGUgaW50ZWdyYXRpb25zL25lc3QvYXV0aFNlcnZpY2VcbiAqIEBzdW1tYXJ5IE5lc3QtY29tcGF0aWJsZSBhdXRoZW50aWNhdGlvbiBzZXJ2aWNlIGhlbHBlcnMuXG4gKiBAZGVzY3JpcHRpb24gUmVxdWVzdC1jb250ZXh0LWF3YXJlIGF1dGggaGVscGVycyBmb3IgTmVzdCBhcHBsaWNhdGlvbnMgdXNpbmcgRGVjYWYgaW50ZWdyYXRpb24gcGF0dGVybnMuXG4gKlxuICogU3VwcG9ydHMgdHdvIG1vZGVzOlxuICogLSAqKlZlcmlmeSBtb2RlKiogKGRlZmF1bHQgd2hlbiBgdmVyaWZ5VXJsYCBpcyBzZXQpOiB2YWxpZGF0ZXMgdGhlIEpXVCBzaWduYXR1cmVcbiAqICAgYWdhaW5zdCB0aGUgS2V5Y2xvYWsgSldLUyBlbmRwb2ludCB1c2luZyBgam9zZS5qd3RWZXJpZnlgLlxuICogLSAqKkRlY29kZS1vbmx5IG1vZGUqKiAod2hlbiBgdmVyaWZ5VG9rZW5gIGlzIGZhbHNlIC8gYHZlcmlmeVVybGAgaXMgZW1wdHkpOlxuICogICBkZWNvZGVzIHRoZSBKV1Qgd2l0aG91dCBzaWduYXR1cmUgdmVyaWZpY2F0aW9uIChkZXYvbG9jYWwgbW9kZSkuXG4gKi9cbmltcG9ydCB7IEF1dGhvcml6YXRpb25FcnJvciB9IGZyb20gXCJAZGVjYWYtdHMvY29yZVwiO1xuaW1wb3J0IHsgY3JlYXRlUmVtb3RlSldLU2V0LCBqd3RWZXJpZnkgfSBmcm9tIFwiam9zZVwiO1xuaW1wb3J0IHsgZXh0cmFjdEtleWNsb2FrUm9sZXMsIGdldFJlYWxtRnJvbUlzc3VlciwgZ2V0VG9rZW5QYXlsb2FkLCBnZXRVc2VyLCBnZXRDbGllbnRSb2xlcywgfSBmcm9tIFwiLi91dGlscy5qc1wiO1xuZXhwb3J0IGNsYXNzIEF1dGhTZXJ2aWNlIHtcbiAgICBjb25zdHJ1Y3RvcihvcHRpb25zID0ge30pIHtcbiAgICAgICAgdGhpcy52ZXJpZnlUb2tlbiA9ICEhb3B0aW9ucy52ZXJpZnlUb2tlbiAmJiAhIW9wdGlvbnMudmVyaWZ5VXJsO1xuICAgICAgICB0aGlzLnZlcmlmeVVybCA9IG9wdGlvbnMudmVyaWZ5VXJsID8/IFwiXCI7XG4gICAgICAgIHRoaXMuY2xvY2tUb2xlcmFuY2VTZWNvbmRzID0gb3B0aW9ucy5jbG9ja1RvbGVyYW5jZVNlY29uZHMgPz8gNTtcbiAgICAgICAgdGhpcy5leGNsdWRlZENsaWVudHMgPSBvcHRpb25zLmV4Y2x1ZGVkQ2xpZW50cyA/PyBbXCJhY2NvdW50XCJdO1xuICAgIH1cbiAgICBpc1Rva2VuVmVyaWZpY2F0aW9uRW5hYmxlZCgpIHtcbiAgICAgICAgcmV0dXJuIHRoaXMudmVyaWZ5VG9rZW47XG4gICAgfVxuICAgIGdldFRva2VuUGF5bG9hZChqd3QpIHtcbiAgICAgICAgcmV0dXJuIGdldFRva2VuUGF5bG9hZChqd3QpO1xuICAgIH1cbiAgICBnZXRSb2xlcyhqd3QpIHtcbiAgICAgICAgcmV0dXJuIHRoaXMuZXh0cmFjdEtleWNsb2FrUm9sZXModGhpcy5nZXRUb2tlblBheWxvYWQoand0KSk7XG4gICAgfVxuICAgIGdldFVzZXIoand0KSB7XG4gICAgICAgIHJldHVybiBnZXRVc2VyKGp3dCk7XG4gICAgfVxuICAgIGV4dHJhY3RLZXljbG9ha1JvbGVzKHBheWxvYWQpIHtcbiAgICAgICAgcmV0dXJuIGV4dHJhY3RLZXljbG9ha1JvbGVzKHBheWxvYWQpO1xuICAgIH1cbiAgICAvKipcbiAgICAgKiBFeHRyYWN0cyBjbGllbnQgcm9sZXMgZnJvbSB0aGUgYHJlc291cmNlX2FjY2Vzc2AgY2xhaW0sIGV4Y2x1ZGluZ1xuICAgICAqIHRoZSBjb25maWd1cmVkIGBleGNsdWRlZENsaWVudHNgIChkZWZhdWx0OiBgW1wiYWNjb3VudFwiXWApLlxuICAgICAqL1xuICAgIGV4dHJhY3RDbGllbnRSb2xlcyhwYXlsb2FkKSB7XG4gICAgICAgIHJldHVybiBnZXRDbGllbnRSb2xlcyhwYXlsb2FkLCB0aGlzLmV4Y2x1ZGVkQ2xpZW50cyk7XG4gICAgfVxuICAgIGdldFJlYWxtRnJvbUlzc3Vlcihqd3QpIHtcbiAgICAgICAgcmV0dXJuIGdldFJlYWxtRnJvbUlzc3Vlcihqd3QpO1xuICAgIH1cbiAgICAvKipcbiAgICAgKiBWYWxpZGF0ZXMgYSBKV1Q6XG4gICAgICogLSBJbiAqKnZlcmlmeSBtb2RlKio6IHZlcmlmaWVzIHRoZSBzaWduYXR1cmUgYWdhaW5zdCB0aGUgS2V5Y2xvYWsgSldLU1xuICAgICAqICAgZW5kcG9pbnQgdXNpbmcgYGpvc2Uuand0VmVyaWZ5YCwgdGhlbiByZXR1cm5zIHRoZSB2ZXJpZmllZCBwYXlsb2FkLlxuICAgICAqIC0gSW4gKipkZWNvZGUtb25seSBtb2RlKio6IGRlY29kZXMgdGhlIEpXVCB3aXRob3V0IHZlcmlmaWNhdGlvbiBhbmRcbiAgICAgKiAgIHJldHVybnMgdGhlIHBheWxvYWQgKG9yIHRocm93cyBpZiB1bnBhcnNlYWJsZSkuXG4gICAgICpcbiAgICAgKiBAdGhyb3dzIHtBdXRob3JpemF0aW9uRXJyb3J9IHdoZW4gdGhlIHRva2VuIGlzIGludmFsaWQsIGV4cGlyZWQsIG9yXG4gICAgICogICBzaWduYXR1cmUgdmVyaWZpY2F0aW9uIGZhaWxzLlxuICAgICAqL1xuICAgIGFzeW5jIGFzc2VydFZhbGlkVG9rZW4oand0KSB7XG4gICAgICAgIGlmICh0aGlzLnZlcmlmeVRva2VuKSB7XG4gICAgICAgICAgICByZXR1cm4gdGhpcy52ZXJpZnlBZ2FpbnN0Sndrcyhqd3QpO1xuICAgICAgICB9XG4gICAgICAgIGNvbnN0IHBheWxvYWQgPSB0aGlzLmdldFRva2VuUGF5bG9hZChqd3QpO1xuICAgICAgICBpZiAoIXBheWxvYWQpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBBdXRob3JpemF0aW9uRXJyb3IoXCJJbnZhbGlkIHRva2VuXCIpO1xuICAgICAgICB9XG4gICAgICAgIHJldHVybiBwYXlsb2FkO1xuICAgIH1cbiAgICAvKipcbiAgICAgKiBWZXJpZmllcyB0aGUgSldUIHNpZ25hdHVyZSBhZ2FpbnN0IHRoZSBLZXljbG9hayBKV0tTIGVuZHBvaW50LlxuICAgICAqIExhemlseSBjcmVhdGVzIHRoZSBKV0tTIGtleXN0b3JlIG9uIGZpcnN0IGNhbGwuXG4gICAgICovXG4gICAgYXN5bmMgdmVyaWZ5QWdhaW5zdEp3a3Moand0KSB7XG4gICAgICAgIGlmICghdGhpcy5qd2tzKSB7XG4gICAgICAgICAgICB0aGlzLmp3a3MgPSBjcmVhdGVSZW1vdGVKV0tTZXQobmV3IFVSTCh0aGlzLnZlcmlmeVVybCkpO1xuICAgICAgICB9XG4gICAgICAgIHRyeSB7XG4gICAgICAgICAgICBjb25zdCB7IHBheWxvYWQgfSA9IGF3YWl0IGp3dFZlcmlmeShqd3QsIHRoaXMuandrcywge1xuICAgICAgICAgICAgICAgIGNsb2NrVG9sZXJhbmNlOiBgJHt0aGlzLmNsb2NrVG9sZXJhbmNlU2Vjb25kc31zYCxcbiAgICAgICAgICAgIH0pO1xuICAgICAgICAgICAgcmV0dXJuIHBheWxvYWQ7XG4gICAgICAgIH1cbiAgICAgICAgY2F0Y2ggKGUpIHtcbiAgICAgICAgICAgIHRocm93IG5ldyBBdXRob3JpemF0aW9uRXJyb3IoXCJJbnZhbGlkIHRva2VuOiBcIiArIChlPy5tZXNzYWdlID8/IGUpKTtcbiAgICAgICAgfVxuICAgIH1cbn1cbi8vIyBzb3VyY2VNYXBwaW5nVVJMPWRhdGE6YXBwbGljYXRpb24vanNvbjtiYXNlNjQsZXlKMlpYSnphVzl1SWpvekxDSm1hV3hsSWpvaVlYVjBhRk5sY25acFkyVXVhbk1pTENKemIzVnlZMlZTYjI5MElqb2lJaXdpYzI5MWNtTmxjeUk2V3lJdUxpOHVMaTh1TGk5emNtTXZibVZ6ZEM5aGRYUm9VMlZ5ZG1salpTNTBjeUpkTENKdVlXMWxjeUk2VzEwc0ltMWhjSEJwYm1keklqb2lRVUZCUVRzN096czdPenM3T3p0SFFWVkhPMEZCUTBnc1QwRkJUeXhGUVVGRkxHdENRVUZyUWl4RlFVRkZMRTFCUVUwc1owSkJRV2RDTEVOQlFVTTdRVUZEY0VRc1QwRkJUeXhGUVVGRkxHdENRVUZyUWl4RlFVRkZMRk5CUVZNc1JVRkJSU3hOUVVGTkxFMUJRVTBzUTBGQlF6dEJRVU55UkN4UFFVRlBMRVZCUTB3c2IwSkJRVzlDTEVWQlEzQkNMR3RDUVVGclFpeEZRVU5zUWl4bFFVRmxMRVZCUTJZc1QwRkJUeXhGUVVOUUxHTkJRV01zUjBGRFppeHRRa0ZCWjBJN1FVRXJRbXBDTEUxQlFVMHNUMEZCVHl4WFFVRlhPMGxCVDNSQ0xGbEJRVmtzVlVGQk9FSXNSVUZCUlR0UlFVTXhReXhKUVVGSkxFTkJRVU1zVjBGQlZ5eEhRVUZITEVOQlFVTXNRMEZCUXl4UFFVRlBMRU5CUVVNc1YwRkJWeXhKUVVGSkxFTkJRVU1zUTBGQlF5eFBRVUZQTEVOQlFVTXNVMEZCVXl4RFFVRkRPMUZCUTJoRkxFbEJRVWtzUTBGQlF5eFRRVUZUTEVkQlFVY3NUMEZCVHl4RFFVRkRMRk5CUVZNc1NVRkJTU3hGUVVGRkxFTkJRVU03VVVGRGVrTXNTVUZCU1N4RFFVRkRMSEZDUVVGeFFpeEhRVUZITEU5QlFVOHNRMEZCUXl4eFFrRkJjVUlzU1VGQlNTeERRVUZETEVOQlFVTTdVVUZEYUVVc1NVRkJTU3hEUVVGRExHVkJRV1VzUjBGQlJ5eFBRVUZQTEVOQlFVTXNaVUZCWlN4SlFVRkpMRU5CUVVNc1UwRkJVeXhEUVVGRExFTkJRVU03U1VGRGFFVXNRMEZCUXp0SlFVVkVMREJDUVVFd1FqdFJRVU40UWl4UFFVRlBMRWxCUVVrc1EwRkJReXhYUVVGWExFTkJRVU03U1VGRE1VSXNRMEZCUXp0SlFVVkVMR1ZCUVdVc1EwRkJReXhIUVVGWE8xRkJRM3BDTEU5QlFVOHNaVUZCWlN4RFFVRkRMRWRCUVVjc1EwRkJReXhEUVVGRE8wbEJRemxDTEVOQlFVTTdTVUZGUkN4UlFVRlJMRU5CUVVNc1IwRkJWenRSUVVOc1FpeFBRVUZQTEVsQlFVa3NRMEZCUXl4dlFrRkJiMElzUTBGQlF5eEpRVUZKTEVOQlFVTXNaVUZCWlN4RFFVRkRMRWRCUVVjc1EwRkJReXhEUVVGRExFTkJRVU03U1VGRE9VUXNRMEZCUXp0SlFVVkVMRTlCUVU4c1EwRkJReXhIUVVGWE8xRkJRMnBDTEU5QlFVOHNUMEZCVHl4RFFVRkRMRWRCUVVjc1EwRkJReXhEUVVGRE8wbEJRM1JDTEVOQlFVTTdTVUZGUkN4dlFrRkJiMElzUTBGQlF5eFBRVUV3UXp0UlFVTTNSQ3hQUVVGUExHOUNRVUZ2UWl4RFFVRkRMRTlCUVU4c1EwRkJReXhEUVVGRE8wbEJRM1pETEVOQlFVTTdTVUZGUkRzN08wOUJSMGM3U1VGRFNDeHJRa0ZCYTBJc1EwRkRhRUlzVDBGQk1FTTdVVUZGTVVNc1QwRkJUeXhqUVVGakxFTkJRVU1zVDBGQlR5eEZRVUZGTEVsQlFVa3NRMEZCUXl4bFFVRmxMRU5CUVVNc1EwRkJRenRKUVVOMlJDeERRVUZETzBsQlJVUXNhMEpCUVd0Q0xFTkJRVU1zUjBGQlZ6dFJRVU0xUWl4UFFVRlBMR3RDUVVGclFpeERRVUZETEVkQlFVY3NRMEZCUXl4RFFVRkRPMGxCUTJwRExFTkJRVU03U1VGRlJEczdPenM3T3pzN08wOUJVMGM3U1VGRFNDeExRVUZMTEVOQlFVTXNaMEpCUVdkQ0xFTkJRM0JDTEVkQlFWYzdVVUZGV0N4SlFVRkpMRWxCUVVrc1EwRkJReXhYUVVGWExFVkJRVVVzUTBGQlF6dFpRVU55UWl4UFFVRlBMRWxCUVVrc1EwRkJReXhwUWtGQmFVSXNRMEZCUXl4SFFVRkhMRU5CUVVNc1EwRkJRenRSUVVOeVF5eERRVUZETzFGQlEwUXNUVUZCVFN4UFFVRlBMRWRCUVVjc1NVRkJTU3hEUVVGRExHVkJRV1VzUTBGQlF5eEhRVUZITEVOQlFVTXNRMEZCUXp0UlFVTXhReXhKUVVGSkxFTkJRVU1zVDBGQlR5eEZRVUZGTEVOQlFVTTdXVUZEWWl4TlFVRk5MRWxCUVVrc2EwSkJRV3RDTEVOQlFVTXNaVUZCWlN4RFFVRkRMRU5CUVVNN1VVRkRhRVFzUTBGQlF6dFJRVU5FTEU5QlFVOHNUMEZCVHl4RFFVRkRPMGxCUTJwQ0xFTkJRVU03U1VGRlJEczdPMDlCUjBjN1NVRkRTeXhMUVVGTExFTkJRVU1zYVVKQlFXbENMRU5CUXpkQ0xFZEJRVmM3VVVGRldDeEpRVUZKTEVOQlFVTXNTVUZCU1N4RFFVRkRMRWxCUVVrc1JVRkJSU3hEUVVGRE8xbEJRMllzU1VGQlNTeERRVUZETEVsQlFVa3NSMEZCUnl4clFrRkJhMElzUTBGQlF5eEpRVUZKTEVkQlFVY3NRMEZCUXl4SlFVRkpMRU5CUVVNc1UwRkJVeXhEUVVGRExFTkJRVU1zUTBGQlF6dFJRVU14UkN4RFFVRkRPMUZCUTBRc1NVRkJTU3hEUVVGRE8xbEJRMGdzVFVGQlRTeEZRVUZGTEU5QlFVOHNSVUZCUlN4SFFVRkhMRTFCUVUwc1UwRkJVeXhEUVVGRExFZEJRVWNzUlVGQlJTeEpRVUZKTEVOQlFVTXNTVUZCU1N4RlFVRkZPMmRDUVVOc1JDeGpRVUZqTEVWQlFVVXNSMEZCUnl4SlFVRkpMRU5CUVVNc2NVSkJRWEZDTEVkQlFVYzdZVUZEYWtRc1EwRkJReXhEUVVGRE8xbEJRMGdzVDBGQlR5eFBRVUZuUkN4RFFVRkRPMUZCUXpGRUxFTkJRVU03VVVGQlF5eFBRVUZQTEVOQlFVMHNSVUZCUlN4RFFVRkRPMWxCUTJoQ0xFMUJRVTBzU1VGQlNTeHJRa0ZCYTBJc1EwRkJReXhwUWtGQmFVSXNSMEZCUnl4RFFVRkRMRU5CUVVNc1JVRkJSU3hQUVVGUExFbEJRVWtzUTBGQlF5eERRVUZETEVOQlFVTXNRMEZCUXp0UlFVTjBSU3hEUVVGRE8wbEJRMGdzUTBGQlF6dERRVU5HSWl3aWMyOTFjbU5sYzBOdmJuUmxiblFpT2xzaUx5b3FYRzRnS2lCQWJXOWtkV3hsSUdsdWRHVm5jbUYwYVc5dWN5OXVaWE4wTDJGMWRHaFRaWEoyYVdObFhHNGdLaUJBYzNWdGJXRnllU0JPWlhOMExXTnZiWEJoZEdsaWJHVWdZWFYwYUdWdWRHbGpZWFJwYjI0Z2MyVnlkbWxqWlNCb1pXeHdaWEp6TGx4dUlDb2dRR1JsYzJOeWFYQjBhVzl1SUZKbGNYVmxjM1F0WTI5dWRHVjRkQzFoZDJGeVpTQmhkWFJvSUdobGJIQmxjbk1nWm05eUlFNWxjM1FnWVhCd2JHbGpZWFJwYjI1eklIVnphVzVuSUVSbFkyRm1JR2x1ZEdWbmNtRjBhVzl1SUhCaGRIUmxjbTV6TGx4dUlDcGNiaUFxSUZOMWNIQnZjblJ6SUhSM2J5QnRiMlJsY3pwY2JpQXFJQzBnS2lwV1pYSnBabmtnYlc5a1pTb3FJQ2hrWldaaGRXeDBJSGRvWlc0Z1lIWmxjbWxtZVZWeWJHQWdhWE1nYzJWMEtUb2dkbUZzYVdSaGRHVnpJSFJvWlNCS1YxUWdjMmxuYm1GMGRYSmxYRzRnS2lBZ0lHRm5ZV2x1YzNRZ2RHaGxJRXRsZVdOc2IyRnJJRXBYUzFNZ1pXNWtjRzlwYm5RZ2RYTnBibWNnWUdwdmMyVXVhbmQwVm1WeWFXWjVZQzVjYmlBcUlDMGdLaXBFWldOdlpHVXRiMjVzZVNCdGIyUmxLaW9nS0hkb1pXNGdZSFpsY21sbWVWUnZhMlZ1WUNCcGN5Qm1ZV3h6WlNBdklHQjJaWEpwWm5sVmNteGdJR2x6SUdWdGNIUjVLVHBjYmlBcUlDQWdaR1ZqYjJSbGN5QjBhR1VnU2xkVUlIZHBkR2h2ZFhRZ2MybG5ibUYwZFhKbElIWmxjbWxtYVdOaGRHbHZiaUFvWkdWMkwyeHZZMkZzSUcxdlpHVXBMbHh1SUNvdlhHNXBiWEJ2Y25RZ2V5QkJkWFJvYjNKcGVtRjBhVzl1UlhKeWIzSWdmU0JtY205dElGd2lRR1JsWTJGbUxYUnpMMk52Y21WY0lqdGNibWx0Y0c5eWRDQjdJR055WldGMFpWSmxiVzkwWlVwWFMxTmxkQ3dnYW5kMFZtVnlhV1o1SUgwZ1puSnZiU0JjSW1wdmMyVmNJanRjYm1sdGNHOXlkQ0I3WEc0Z0lHVjRkSEpoWTNSTFpYbGpiRzloYTFKdmJHVnpMRnh1SUNCblpYUlNaV0ZzYlVaeWIyMUpjM04xWlhJc1hHNGdJR2RsZEZSdmEyVnVVR0Y1Ykc5aFpDeGNiaUFnWjJWMFZYTmxjaXhjYmlBZ1oyVjBRMnhwWlc1MFVtOXNaWE1zWEc1OUlHWnliMjBnWENJdUwzVjBhV3h6WENJN1hHNXBiWEJ2Y25RZ2RIbHdaU0I3SUV0bGVXTnNiMkZyUVdOalpYTnpWRzlyWlc1UVlYbHNiMkZrTENCTFpYbGpiRzloYTFWelpYSWdmU0JtY205dElGd2lMaTkwZVhCbGMxd2lPMXh1WEc0dktpcGNiaUFxSUVOdmJtWnBaM1Z5WVhScGIyNGdabTl5SUhSb1pTQjdRR3hwYm1zZ1FYVjBhRk5sY25acFkyVjlMbHh1SUNvdlhHNWxlSEJ2Y25RZ2FXNTBaWEptWVdObElFRjFkR2hUWlhKMmFXTmxUM0IwYVc5dWN5QjdYRzRnSUM4cUtseHVJQ0FnS2lCWGFHVjBhR1Z5SUhSdklIWmxjbWxtZVNCMGFHVWdTbGRVSUhOcFoyNWhkSFZ5WlNCaFoyRnBibk4wSUhSb1pTQkxaWGxqYkc5aGF5QktWMHRUSUdWdVpIQnZhVzUwTGx4dUlDQWdLaUJYYUdWdUlHQm1ZV3h6WldBZ0tHOXlJR0IyWlhKcFpubFZjbXhnSUdseklHVnRjSFI1S1N3Z2RHOXJaVzV6SUdGeVpTQmtaV052WkdWa0lIZHBkR2h2ZFhSY2JpQWdJQ29nYzJsbmJtRjBkWEpsSUhabGNtbG1hV05oZEdsdmJpQW9aR1YyTDJ4dlkyRnNJRzF2WkdVZ2IyNXNlU2t1WEc0Z0lDQXFJRUJrWldaaGRXeDBJR1poYkhObFhHNGdJQ0FxTDF4dUlDQjJaWEpwWm5sVWIydGxiajg2SUdKdmIyeGxZVzQ3WEc0Z0lDOHFLbHh1SUNBZ0tpQlVhR1VnUzJWNVkyeHZZV3NnU2xkTFV5QlZVa3dnS0dVdVp5NGdZR2gwZEhCek9pOHZhMlY1WTJ4dllXc3ZjbVZoYkcxekwyMTVjbVZoYkcwdmNISnZkRzlqYjJ3dmIzQmxibWxrTFdOdmJtNWxZM1F2WTJWeWRITmdLUzVjYmlBZ0lDb2dVbVZ4ZFdseVpXUWdkMmhsYmlCZ2RtVnlhV1o1Vkc5clpXNWdJR2x6SUdCMGNuVmxZQzVjYmlBZ0lDb3ZYRzRnSUhabGNtbG1lVlZ5YkQ4NklITjBjbWx1Wnp0Y2JpQWdMeW9xWEc0Z0lDQXFJRU5zYjJOcklIUnZiR1Z5WVc1alpTQm1iM0lnU2xkVUlHVjRjR2x5ZVNCMlpYSnBabWxqWVhScGIyNGdLR2x1SUhObFkyOXVaSE1wTGx4dUlDQWdLaUJBWkdWbVlYVnNkQ0ExWEc0Z0lDQXFMMXh1SUNCamJHOWphMVJ2YkdWeVlXNWpaVk5sWTI5dVpITS9PaUJ1ZFcxaVpYSTdYRzRnSUM4cUtseHVJQ0FnS2lCTFpYbGpiRzloYXlCamJHbGxiblFnU1VSeklIUnZJR1Y0WTJ4MVpHVWdkMmhsYmlCbGVIUnlZV04wYVc1bklISnZiR1Z6SUdaeWIyMGdZSEpsYzI5MWNtTmxYMkZqWTJWemMyQXVYRzRnSUNBcUlFQmtaV1poZFd4MElGdGNJbUZqWTI5MWJuUmNJbDFjYmlBZ0lDb3ZYRzRnSUdWNFkyeDFaR1ZrUTJ4cFpXNTBjejg2SUhOMGNtbHVaMXRkTzF4dWZWeHVYRzVsZUhCdmNuUWdZMnhoYzNNZ1FYVjBhRk5sY25acFkyVWdlMXh1SUNCd2NtbDJZWFJsSUhKbFlXUnZibXg1SUhabGNtbG1lVlJ2YTJWdU9pQmliMjlzWldGdU8xeHVJQ0J3Y21sMllYUmxJSEpsWVdSdmJteDVJSFpsY21sbWVWVnliRG9nYzNSeWFXNW5PMXh1SUNCd2NtbDJZWFJsSUhKbFlXUnZibXg1SUdOc2IyTnJWRzlzWlhKaGJtTmxVMlZqYjI1a2N6b2diblZ0WW1WeU8xeHVJQ0J3Y21sMllYUmxJSEpsWVdSdmJteDVJR1Y0WTJ4MVpHVmtRMnhwWlc1MGN6b2djM1J5YVc1blcxMDdYRzRnSUhCeWFYWmhkR1VnYW5kcmN6b2dVbVYwZFhKdVZIbHdaVHgwZVhCbGIyWWdZM0psWVhSbFVtVnRiM1JsU2xkTFUyVjBQaUI4SUhWdVpHVm1hVzVsWkR0Y2JseHVJQ0JqYjI1emRISjFZM1J2Y2lodmNIUnBiMjV6T2lCQmRYUm9VMlZ5ZG1salpVOXdkR2x2Ym5NZ1BTQjdmU2tnZTF4dUlDQWdJSFJvYVhNdWRtVnlhV1o1Vkc5clpXNGdQU0FoSVc5d2RHbHZibk11ZG1WeWFXWjVWRzlyWlc0Z0ppWWdJU0Z2Y0hScGIyNXpMblpsY21sbWVWVnliRHRjYmlBZ0lDQjBhR2x6TG5abGNtbG1lVlZ5YkNBOUlHOXdkR2x2Ym5NdWRtVnlhV1o1VlhKc0lEOC9JRndpWENJN1hHNGdJQ0FnZEdocGN5NWpiRzlqYTFSdmJHVnlZVzVqWlZObFkyOXVaSE1nUFNCdmNIUnBiMjV6TG1Oc2IyTnJWRzlzWlhKaGJtTmxVMlZqYjI1a2N5QS9QeUExTzF4dUlDQWdJSFJvYVhNdVpYaGpiSFZrWldSRGJHbGxiblJ6SUQwZ2IzQjBhVzl1Y3k1bGVHTnNkV1JsWkVOc2FXVnVkSE1nUHo4Z1cxd2lZV05qYjNWdWRGd2lYVHRjYmlBZ2ZWeHVYRzRnSUdselZHOXJaVzVXWlhKcFptbGpZWFJwYjI1RmJtRmliR1ZrS0NrNklHSnZiMnhsWVc0Z2UxeHVJQ0FnSUhKbGRIVnliaUIwYUdsekxuWmxjbWxtZVZSdmEyVnVPMXh1SUNCOVhHNWNiaUFnWjJWMFZHOXJaVzVRWVhsc2IyRmtLR3AzZERvZ2MzUnlhVzVuS1RvZ1MyVjVZMnh2WVd0QlkyTmxjM05VYjJ0bGJsQmhlV3h2WVdRZ2ZDQnVkV3hzSUh0Y2JpQWdJQ0J5WlhSMWNtNGdaMlYwVkc5clpXNVFZWGxzYjJGa0tHcDNkQ2s3WEc0Z0lIMWNibHh1SUNCblpYUlNiMnhsY3locWQzUTZJSE4wY21sdVp5azZJSE4wY21sdVoxdGRJSHRjYmlBZ0lDQnlaWFIxY200Z2RHaHBjeTVsZUhSeVlXTjBTMlY1WTJ4dllXdFNiMnhsY3loMGFHbHpMbWRsZEZSdmEyVnVVR0Y1Ykc5aFpDaHFkM1FwS1R0Y2JpQWdmVnh1WEc0Z0lHZGxkRlZ6WlhJb2FuZDBPaUJ6ZEhKcGJtY3BPaUJMWlhsamJHOWhhMVZ6WlhJZ2ZDQjFibVJsWm1sdVpXUWdlMXh1SUNBZ0lISmxkSFZ5YmlCblpYUlZjMlZ5S0dwM2RDazdYRzRnSUgxY2JseHVJQ0JsZUhSeVlXTjBTMlY1WTJ4dllXdFNiMnhsY3lod1lYbHNiMkZrT2lCTFpYbGpiRzloYTBGalkyVnpjMVJ2YTJWdVVHRjViRzloWkNCOElHNTFiR3dwT2lCemRISnBibWRiWFNCN1hHNGdJQ0FnY21WMGRYSnVJR1Y0ZEhKaFkzUkxaWGxqYkc5aGExSnZiR1Z6S0hCaGVXeHZZV1FwTzF4dUlDQjlYRzVjYmlBZ0x5b3FYRzRnSUNBcUlFVjRkSEpoWTNSeklHTnNhV1Z1ZENCeWIyeGxjeUJtY205dElIUm9aU0JnY21WemIzVnlZMlZmWVdOalpYTnpZQ0JqYkdGcGJTd2daWGhqYkhWa2FXNW5YRzRnSUNBcUlIUm9aU0JqYjI1bWFXZDFjbVZrSUdCbGVHTnNkV1JsWkVOc2FXVnVkSE5nSUNoa1pXWmhkV3gwT2lCZ1cxd2lZV05qYjNWdWRGd2lYV0FwTGx4dUlDQWdLaTljYmlBZ1pYaDBjbUZqZEVOc2FXVnVkRkp2YkdWektGeHVJQ0FnSUhCaGVXeHZZV1E2SUV0bGVXTnNiMkZyUVdOalpYTnpWRzlyWlc1UVlYbHNiMkZrSUh3Z2JuVnNiRnh1SUNBcE9pQnpkSEpwYm1kYlhTQjdYRzRnSUNBZ2NtVjBkWEp1SUdkbGRFTnNhV1Z1ZEZKdmJHVnpLSEJoZVd4dllXUXNJSFJvYVhNdVpYaGpiSFZrWldSRGJHbGxiblJ6S1R0Y2JpQWdmVnh1WEc0Z0lHZGxkRkpsWVd4dFJuSnZiVWx6YzNWbGNpaHFkM1E2SUhOMGNtbHVaeWs2SUhOMGNtbHVaeUI3WEc0Z0lDQWdjbVYwZFhKdUlHZGxkRkpsWVd4dFJuSnZiVWx6YzNWbGNpaHFkM1FwTzF4dUlDQjlYRzVjYmlBZ0x5b3FYRzRnSUNBcUlGWmhiR2xrWVhSbGN5QmhJRXBYVkRwY2JpQWdJQ29nTFNCSmJpQXFLblpsY21sbWVTQnRiMlJsS2lvNklIWmxjbWxtYVdWeklIUm9aU0J6YVdkdVlYUjFjbVVnWVdkaGFXNXpkQ0IwYUdVZ1MyVjVZMnh2WVdzZ1NsZExVMXh1SUNBZ0tpQWdJR1Z1WkhCdmFXNTBJSFZ6YVc1bklHQnFiM05sTG1wM2RGWmxjbWxtZVdBc0lIUm9aVzRnY21WMGRYSnVjeUIwYUdVZ2RtVnlhV1pwWldRZ2NHRjViRzloWkM1Y2JpQWdJQ29nTFNCSmJpQXFLbVJsWTI5a1pTMXZibXg1SUcxdlpHVXFLam9nWkdWamIyUmxjeUIwYUdVZ1NsZFVJSGRwZEdodmRYUWdkbVZ5YVdacFkyRjBhVzl1SUdGdVpGeHVJQ0FnS2lBZ0lISmxkSFZ5Ym5NZ2RHaGxJSEJoZVd4dllXUWdLRzl5SUhSb2NtOTNjeUJwWmlCMWJuQmhjbk5sWVdKc1pTa3VYRzRnSUNBcVhHNGdJQ0FxSUVCMGFISnZkM01nZTBGMWRHaHZjbWw2WVhScGIyNUZjbkp2Y24wZ2QyaGxiaUIwYUdVZ2RHOXJaVzRnYVhNZ2FXNTJZV3hwWkN3Z1pYaHdhWEpsWkN3Z2IzSmNiaUFnSUNvZ0lDQnphV2R1WVhSMWNtVWdkbVZ5YVdacFkyRjBhVzl1SUdaaGFXeHpMbHh1SUNBZ0tpOWNiaUFnWVhONWJtTWdZWE56WlhKMFZtRnNhV1JVYjJ0bGJpaGNiaUFnSUNCcWQzUTZJSE4wY21sdVoxeHVJQ0FwT2lCUWNtOXRhWE5sUEV0bGVXTnNiMkZyUVdOalpYTnpWRzlyWlc1UVlYbHNiMkZrUGlCN1hHNGdJQ0FnYVdZZ0tIUm9hWE11ZG1WeWFXWjVWRzlyWlc0cElIdGNiaUFnSUNBZ0lISmxkSFZ5YmlCMGFHbHpMblpsY21sbWVVRm5ZV2x1YzNSS2QydHpLR3AzZENrN1hHNGdJQ0FnZlZ4dUlDQWdJR052Ym5OMElIQmhlV3h2WVdRZ1BTQjBhR2x6TG1kbGRGUnZhMlZ1VUdGNWJHOWhaQ2hxZDNRcE8xeHVJQ0FnSUdsbUlDZ2hjR0Y1Ykc5aFpDa2dlMXh1SUNBZ0lDQWdkR2h5YjNjZ2JtVjNJRUYxZEdodmNtbDZZWFJwYjI1RmNuSnZjaWhjSWtsdWRtRnNhV1FnZEc5clpXNWNJaWs3WEc0Z0lDQWdmVnh1SUNBZ0lISmxkSFZ5YmlCd1lYbHNiMkZrTzF4dUlDQjlYRzVjYmlBZ0x5b3FYRzRnSUNBcUlGWmxjbWxtYVdWeklIUm9aU0JLVjFRZ2MybG5ibUYwZFhKbElHRm5ZV2x1YzNRZ2RHaGxJRXRsZVdOc2IyRnJJRXBYUzFNZ1pXNWtjRzlwYm5RdVhHNGdJQ0FxSUV4aGVtbHNlU0JqY21WaGRHVnpJSFJvWlNCS1YwdFRJR3RsZVhOMGIzSmxJRzl1SUdacGNuTjBJR05oYkd3dVhHNGdJQ0FxTDF4dUlDQndjbWwyWVhSbElHRnplVzVqSUhabGNtbG1lVUZuWVdsdWMzUktkMnR6S0Z4dUlDQWdJR3AzZERvZ2MzUnlhVzVuWEc0Z0lDazZJRkJ5YjIxcGMyVThTMlY1WTJ4dllXdEJZMk5sYzNOVWIydGxibEJoZVd4dllXUStJSHRjYmlBZ0lDQnBaaUFvSVhSb2FYTXVhbmRyY3lrZ2UxeHVJQ0FnSUNBZ2RHaHBjeTVxZDJ0eklEMGdZM0psWVhSbFVtVnRiM1JsU2xkTFUyVjBLRzVsZHlCVlVrd29kR2hwY3k1MlpYSnBabmxWY213cEtUdGNiaUFnSUNCOVhHNGdJQ0FnZEhKNUlIdGNiaUFnSUNBZ0lHTnZibk4wSUhzZ2NHRjViRzloWkNCOUlEMGdZWGRoYVhRZ2FuZDBWbVZ5YVdaNUtHcDNkQ3dnZEdocGN5NXFkMnR6TENCN1hHNGdJQ0FnSUNBZ0lHTnNiMk5yVkc5c1pYSmhibU5sT2lCZ0pIdDBhR2x6TG1Oc2IyTnJWRzlzWlhKaGJtTmxVMlZqYjI1a2MzMXpZQ3hjYmlBZ0lDQWdJSDBwTzF4dUlDQWdJQ0FnY21WMGRYSnVJSEJoZVd4dllXUWdZWE1nZFc1cmJtOTNiaUJoY3lCTFpYbGpiRzloYTBGalkyVnpjMVJ2YTJWdVVHRjViRzloWkR0Y2JpQWdJQ0I5SUdOaGRHTm9JQ2hsT2lCaGJua3BJSHRjYmlBZ0lDQWdJSFJvY205M0lHNWxkeUJCZFhSb2IzSnBlbUYwYVc5dVJYSnliM0lvWENKSmJuWmhiR2xrSUhSdmEyVnVPaUJjSWlBcklDaGxQeTV0WlhOellXZGxJRDgvSUdVcEtUdGNiaUFnSUNCOVhHNGdJSDFjYm4xY2JpSmRmUT09Il19

package/lib/esm/nest/authService.js

@@ -1,86 +0,0 @@
-/**
- * @module integrations/nest/authService
- * @summary Nest-compatible authentication service helpers.
- * @description Request-context-aware auth helpers for Nest applications using Decaf integration patterns.
- *
- * Supports two modes:
- * - **Verify mode** (default when `verifyUrl` is set): validates the JWT signature
- *   against the Keycloak JWKS endpoint using `jose.jwtVerify`.
- * - **Decode-only mode** (when `verifyToken` is false / `verifyUrl` is empty):
- *   decodes the JWT without signature verification (dev/local mode).
- */
-import { AuthorizationError } from "@decaf-ts/core";
-import { createRemoteJWKSet, jwtVerify } from "jose";
-import { extractKeycloakRoles, getRealmFromIssuer, getTokenPayload, getUser, getClientRoles, } from "./utils.js";
-export class AuthService {
-    constructor(options = {}) {
-        this.verifyToken = !!options.verifyToken && !!options.verifyUrl;
-        this.verifyUrl = options.verifyUrl ?? "";
-        this.clockToleranceSeconds = options.clockToleranceSeconds ?? 5;
-        this.excludedClients = options.excludedClients ?? ["account"];
-    }
-    isTokenVerificationEnabled() {
-        return this.verifyToken;
-    }
-    getTokenPayload(jwt) {
-        return getTokenPayload(jwt);
-    }
-    getRoles(jwt) {
-        return this.extractKeycloakRoles(this.getTokenPayload(jwt));
-    }
-    getUser(jwt) {
-        return getUser(jwt);
-    }
-    extractKeycloakRoles(payload) {
-        return extractKeycloakRoles(payload);
-    }
-    /**
-     * Extracts client roles from the `resource_access` claim, excluding
-     * the configured `excludedClients` (default: `["account"]`).
-     */
-    extractClientRoles(payload) {
-        return getClientRoles(payload, this.excludedClients);
-    }
-    getRealmFromIssuer(jwt) {
-        return getRealmFromIssuer(jwt);
-    }
-    /**
-     * Validates a JWT:
-     * - In **verify mode**: verifies the signature against the Keycloak JWKS
-     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
-     * - In **decode-only mode**: decodes the JWT without verification and
-     *   returns the payload (or throws if unparseable).
-     *
-     * @throws {AuthorizationError} when the token is invalid, expired, or
-     *   signature verification fails.
-     */
-    async assertValidToken(jwt) {
-        if (this.verifyToken) {
-            return this.verifyAgainstJwks(jwt);
-        }
-        const payload = this.getTokenPayload(jwt);
-        if (!payload) {
-            throw new AuthorizationError("Invalid token");
-        }
-        return payload;
-    }
-    /**
-     * Verifies the JWT signature against the Keycloak JWKS endpoint.
-     * Lazily creates the JWKS keystore on first call.
-     */
-    async verifyAgainstJwks(jwt) {
-        if (!this.jwks) {
-            this.jwks = createRemoteJWKSet(new URL(this.verifyUrl));
-        }
-        try {
-            const { payload } = await jwtVerify(jwt, this.jwks, {
-                clockTolerance: `${this.clockToleranceSeconds}s`,
-            });
-            return payload;
-        }
-        catch (e) {
-            throw new AuthorizationError("Invalid token: " + (e?.message ?? e));
-        }
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aFNlcnZpY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbmVzdC9hdXRoU2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7OztHQVVHO0FBQ0gsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxFQUFFLGtCQUFrQixFQUFFLFNBQVMsRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUNyRCxPQUFPLEVBQ0wsb0JBQW9CLEVBQ3BCLGtCQUFrQixFQUNsQixlQUFlLEVBQ2YsT0FBTyxFQUNQLGNBQWMsR0FDZixtQkFBZ0I7QUErQmpCLE1BQU0sT0FBTyxXQUFXO0lBT3RCLFlBQVksVUFBOEIsRUFBRTtRQUMxQyxJQUFJLENBQUMsV0FBVyxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxJQUFJLENBQUMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO1FBQ2hFLElBQUksQ0FBQyxTQUFTLEdBQUcsT0FBTyxDQUFDLFNBQVMsSUFBSSxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLGVBQWUsR0FBRyxPQUFPLENBQUMsZUFBZSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVELDBCQUEwQjtRQUN4QixPQUFPLElBQUksQ0FBQyxXQUFXLENBQUM7SUFDMUIsQ0FBQztJQUVELGVBQWUsQ0FBQyxHQUFXO1FBQ3pCLE9BQU8sZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRCxRQUFRLENBQUMsR0FBVztRQUNsQixPQUFPLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVELE9BQU8sQ0FBQyxHQUFXO1FBQ2pCLE9BQU8sT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3RCLENBQUM7SUFFRCxvQkFBb0IsQ0FBQyxPQUEwQztRQUM3RCxPQUFPLG9CQUFvQixDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7O09BR0c7SUFDSCxrQkFBa0IsQ0FDaEIsT0FBMEM7UUFFMUMsT0FBTyxjQUFjLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxlQUFlLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBRUQsa0JBQWtCLENBQUMsR0FBVztRQUM1QixPQUFPLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSCxLQUFLLENBQUMsZ0JBQWdCLENBQ3BCLEdBQVc7UUFFWCxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNyQixPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNyQyxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksa0JBQWtCLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEQsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7O09BR0c7SUFDSyxLQUFLLENBQUMsaUJBQWlCLENBQzdCLEdBQVc7UUFFWCxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksR0FBRyxrQkFBa0IsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sU0FBUyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFO2dCQUNsRCxjQUFjLEVBQUUsR0FBRyxJQUFJLENBQUMscUJBQXFCLEdBQUc7YUFDakQsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxPQUFnRCxDQUFDO1FBQzFELENBQUM7UUFBQyxPQUFPLENBQU0sRUFBRSxDQUFDO1lBQ2hCLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxpQkFBaUIsR0FBRyxDQUFDLENBQUMsRUFBRSxPQUFPLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RSxDQUFDO0lBQ0gsQ0FBQztDQUNGIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAbW9kdWxlIGludGVncmF0aW9ucy9uZXN0L2F1dGhTZXJ2aWNlXG4gKiBAc3VtbWFyeSBOZXN0LWNvbXBhdGlibGUgYXV0aGVudGljYXRpb24gc2VydmljZSBoZWxwZXJzLlxuICogQGRlc2NyaXB0aW9uIFJlcXVlc3QtY29udGV4dC1hd2FyZSBhdXRoIGhlbHBlcnMgZm9yIE5lc3QgYXBwbGljYXRpb25zIHVzaW5nIERlY2FmIGludGVncmF0aW9uIHBhdHRlcm5zLlxuICpcbiAqIFN1cHBvcnRzIHR3byBtb2RlczpcbiAqIC0gKipWZXJpZnkgbW9kZSoqIChkZWZhdWx0IHdoZW4gYHZlcmlmeVVybGAgaXMgc2V0KTogdmFsaWRhdGVzIHRoZSBKV1Qgc2lnbmF0dXJlXG4gKiAgIGFnYWluc3QgdGhlIEtleWNsb2FrIEpXS1MgZW5kcG9pbnQgdXNpbmcgYGpvc2Uuand0VmVyaWZ5YC5cbiAqIC0gKipEZWNvZGUtb25seSBtb2RlKiogKHdoZW4gYHZlcmlmeVRva2VuYCBpcyBmYWxzZSAvIGB2ZXJpZnlVcmxgIGlzIGVtcHR5KTpcbiAqICAgZGVjb2RlcyB0aGUgSldUIHdpdGhvdXQgc2lnbmF0dXJlIHZlcmlmaWNhdGlvbiAoZGV2L2xvY2FsIG1vZGUpLlxuICovXG5pbXBvcnQgeyBBdXRob3JpemF0aW9uRXJyb3IgfSBmcm9tIFwiQGRlY2FmLXRzL2NvcmVcIjtcbmltcG9ydCB7IGNyZWF0ZVJlbW90ZUpXS1NldCwgand0VmVyaWZ5IH0gZnJvbSBcImpvc2VcIjtcbmltcG9ydCB7XG4gIGV4dHJhY3RLZXljbG9ha1JvbGVzLFxuICBnZXRSZWFsbUZyb21Jc3N1ZXIsXG4gIGdldFRva2VuUGF5bG9hZCxcbiAgZ2V0VXNlcixcbiAgZ2V0Q2xpZW50Um9sZXMsXG59IGZyb20gXCIuL3V0aWxzXCI7XG5pbXBvcnQgdHlwZSB7IEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkLCBLZXljbG9ha1VzZXIgfSBmcm9tIFwiLi90eXBlc1wiO1xuXG4vKipcbiAqIENvbmZpZ3VyYXRpb24gZm9yIHRoZSB7QGxpbmsgQXV0aFNlcnZpY2V9LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEF1dGhTZXJ2aWNlT3B0aW9ucyB7XG4gIC8qKlxuICAgKiBXaGV0aGVyIHRvIHZlcmlmeSB0aGUgSldUIHNpZ25hdHVyZSBhZ2FpbnN0IHRoZSBLZXljbG9hayBKV0tTIGVuZHBvaW50LlxuICAgKiBXaGVuIGBmYWxzZWAgKG9yIGB2ZXJpZnlVcmxgIGlzIGVtcHR5KSwgdG9rZW5zIGFyZSBkZWNvZGVkIHdpdGhvdXRcbiAgICogc2lnbmF0dXJlIHZlcmlmaWNhdGlvbiAoZGV2L2xvY2FsIG1vZGUgb25seSkuXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICB2ZXJpZnlUb2tlbj86IGJvb2xlYW47XG4gIC8qKlxuICAgKiBUaGUgS2V5Y2xvYWsgSldLUyBVUkwgKGUuZy4gYGh0dHBzOi8va2V5Y2xvYWsvcmVhbG1zL215cmVhbG0vcHJvdG9jb2wvb3BlbmlkLWNvbm5lY3QvY2VydHNgKS5cbiAgICogUmVxdWlyZWQgd2hlbiBgdmVyaWZ5VG9rZW5gIGlzIGB0cnVlYC5cbiAgICovXG4gIHZlcmlmeVVybD86IHN0cmluZztcbiAgLyoqXG4gICAqIENsb2NrIHRvbGVyYW5jZSBmb3IgSldUIGV4cGlyeSB2ZXJpZmljYXRpb24gKGluIHNlY29uZHMpLlxuICAgKiBAZGVmYXVsdCA1XG4gICAqL1xuICBjbG9ja1RvbGVyYW5jZVNlY29uZHM/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBLZXljbG9hayBjbGllbnQgSURzIHRvIGV4Y2x1ZGUgd2hlbiBleHRyYWN0aW5nIHJvbGVzIGZyb20gYHJlc291cmNlX2FjY2Vzc2AuXG4gICAqIEBkZWZhdWx0IFtcImFjY291bnRcIl1cbiAgICovXG4gIGV4Y2x1ZGVkQ2xpZW50cz86IHN0cmluZ1tdO1xufVxuXG5leHBvcnQgY2xhc3MgQXV0aFNlcnZpY2Uge1xuICBwcml2YXRlIHJlYWRvbmx5IHZlcmlmeVRva2VuOiBib29sZWFuO1xuICBwcml2YXRlIHJlYWRvbmx5IHZlcmlmeVVybDogc3RyaW5nO1xuICBwcml2YXRlIHJlYWRvbmx5IGNsb2NrVG9sZXJhbmNlU2Vjb25kczogbnVtYmVyO1xuICBwcml2YXRlIHJlYWRvbmx5IGV4Y2x1ZGVkQ2xpZW50czogc3RyaW5nW107XG4gIHByaXZhdGUgandrczogUmV0dXJuVHlwZTx0eXBlb2YgY3JlYXRlUmVtb3RlSldLU2V0PiB8IHVuZGVmaW5lZDtcblxuICBjb25zdHJ1Y3RvcihvcHRpb25zOiBBdXRoU2VydmljZU9wdGlvbnMgPSB7fSkge1xuICAgIHRoaXMudmVyaWZ5VG9rZW4gPSAhIW9wdGlvbnMudmVyaWZ5VG9rZW4gJiYgISFvcHRpb25zLnZlcmlmeVVybDtcbiAgICB0aGlzLnZlcmlmeVVybCA9IG9wdGlvbnMudmVyaWZ5VXJsID8/IFwiXCI7XG4gICAgdGhpcy5jbG9ja1RvbGVyYW5jZVNlY29uZHMgPSBvcHRpb25zLmNsb2NrVG9sZXJhbmNlU2Vjb25kcyA/PyA1O1xuICAgIHRoaXMuZXhjbHVkZWRDbGllbnRzID0gb3B0aW9ucy5leGNsdWRlZENsaWVudHMgPz8gW1wiYWNjb3VudFwiXTtcbiAgfVxuXG4gIGlzVG9rZW5WZXJpZmljYXRpb25FbmFibGVkKCk6IGJvb2xlYW4ge1xuICAgIHJldHVybiB0aGlzLnZlcmlmeVRva2VuO1xuICB9XG5cbiAgZ2V0VG9rZW5QYXlsb2FkKGp3dDogc3RyaW5nKTogS2V5Y2xvYWtBY2Nlc3NUb2tlblBheWxvYWQgfCBudWxsIHtcbiAgICByZXR1cm4gZ2V0VG9rZW5QYXlsb2FkKGp3dCk7XG4gIH1cblxuICBnZXRSb2xlcyhqd3Q6IHN0cmluZyk6IHN0cmluZ1tdIHtcbiAgICByZXR1cm4gdGhpcy5leHRyYWN0S2V5Y2xvYWtSb2xlcyh0aGlzLmdldFRva2VuUGF5bG9hZChqd3QpKTtcbiAgfVxuXG4gIGdldFVzZXIoand0OiBzdHJpbmcpOiBLZXljbG9ha1VzZXIgfCB1bmRlZmluZWQge1xuICAgIHJldHVybiBnZXRVc2VyKGp3dCk7XG4gIH1cblxuICBleHRyYWN0S2V5Y2xvYWtSb2xlcyhwYXlsb2FkOiBLZXljbG9ha0FjY2Vzc1Rva2VuUGF5bG9hZCB8IG51bGwpOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIGV4dHJhY3RLZXljbG9ha1JvbGVzKHBheWxvYWQpO1xuICB9XG5cbiAgLyoqXG4gICAqIEV4dHJhY3RzIGNsaWVudCByb2xlcyBmcm9tIHRoZSBgcmVzb3VyY2VfYWNjZXNzYCBjbGFpbSwgZXhjbHVkaW5nXG4gICAqIHRoZSBjb25maWd1cmVkIGBleGNsdWRlZENsaWVudHNgIChkZWZhdWx0OiBgW1wiYWNjb3VudFwiXWApLlxuICAgKi9cbiAgZXh0cmFjdENsaWVudFJvbGVzKFxuICAgIHBheWxvYWQ6IEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkIHwgbnVsbFxuICApOiBzdHJpbmdbXSB7XG4gICAgcmV0dXJuIGdldENsaWVudFJvbGVzKHBheWxvYWQsIHRoaXMuZXhjbHVkZWRDbGllbnRzKTtcbiAgfVxuXG4gIGdldFJlYWxtRnJvbUlzc3Vlcihqd3Q6IHN0cmluZyk6IHN0cmluZyB7XG4gICAgcmV0dXJuIGdldFJlYWxtRnJvbUlzc3Vlcihqd3QpO1xuICB9XG5cbiAgLyoqXG4gICAqIFZhbGlkYXRlcyBhIEpXVDpcbiAgICogLSBJbiAqKnZlcmlmeSBtb2RlKio6IHZlcmlmaWVzIHRoZSBzaWduYXR1cmUgYWdhaW5zdCB0aGUgS2V5Y2xvYWsgSldLU1xuICAgKiAgIGVuZHBvaW50IHVzaW5nIGBqb3NlLmp3dFZlcmlmeWAsIHRoZW4gcmV0dXJucyB0aGUgdmVyaWZpZWQgcGF5bG9hZC5cbiAgICogLSBJbiAqKmRlY29kZS1vbmx5IG1vZGUqKjogZGVjb2RlcyB0aGUgSldUIHdpdGhvdXQgdmVyaWZpY2F0aW9uIGFuZFxuICAgKiAgIHJldHVybnMgdGhlIHBheWxvYWQgKG9yIHRocm93cyBpZiB1bnBhcnNlYWJsZSkuXG4gICAqXG4gICAqIEB0aHJvd3Mge0F1dGhvcml6YXRpb25FcnJvcn0gd2hlbiB0aGUgdG9rZW4gaXMgaW52YWxpZCwgZXhwaXJlZCwgb3JcbiAgICogICBzaWduYXR1cmUgdmVyaWZpY2F0aW9uIGZhaWxzLlxuICAgKi9cbiAgYXN5bmMgYXNzZXJ0VmFsaWRUb2tlbihcbiAgICBqd3Q6IHN0cmluZ1xuICApOiBQcm9taXNlPEtleWNsb2FrQWNjZXNzVG9rZW5QYXlsb2FkPiB7XG4gICAgaWYgKHRoaXMudmVyaWZ5VG9rZW4pIHtcbiAgICAgIHJldHVybiB0aGlzLnZlcmlmeUFnYWluc3RKd2tzKGp3dCk7XG4gICAgfVxuICAgIGNvbnN0IHBheWxvYWQgPSB0aGlzLmdldFRva2VuUGF5bG9hZChqd3QpO1xuICAgIGlmICghcGF5bG9hZCkge1xuICAgICAgdGhyb3cgbmV3IEF1dGhvcml6YXRpb25FcnJvcihcIkludmFsaWQgdG9rZW5cIik7XG4gICAgfVxuICAgIHJldHVybiBwYXlsb2FkO1xuICB9XG5cbiAgLyoqXG4gICAqIFZlcmlmaWVzIHRoZSBKV1Qgc2lnbmF0dXJlIGFnYWluc3QgdGhlIEtleWNsb2FrIEpXS1MgZW5kcG9pbnQuXG4gICAqIExhemlseSBjcmVhdGVzIHRoZSBKV0tTIGtleXN0b3JlIG9uIGZpcnN0IGNhbGwuXG4gICAqL1xuICBwcml2YXRlIGFzeW5jIHZlcmlmeUFnYWluc3RKd2tzKFxuICAgIGp3dDogc3RyaW5nXG4gICk6IFByb21pc2U8S2V5Y2xvYWtBY2Nlc3NUb2tlblBheWxvYWQ+IHtcbiAgICBpZiAoIXRoaXMuandrcykge1xuICAgICAgdGhpcy5qd2tzID0gY3JlYXRlUmVtb3RlSldLU2V0KG5ldyBVUkwodGhpcy52ZXJpZnlVcmwpKTtcbiAgICB9XG4gICAgdHJ5IHtcbiAgICAgIGNvbnN0IHsgcGF5bG9hZCB9ID0gYXdhaXQgand0VmVyaWZ5KGp3dCwgdGhpcy5qd2tzLCB7XG4gICAgICAgIGNsb2NrVG9sZXJhbmNlOiBgJHt0aGlzLmNsb2NrVG9sZXJhbmNlU2Vjb25kc31zYCxcbiAgICAgIH0pO1xuICAgICAgcmV0dXJuIHBheWxvYWQgYXMgdW5rbm93biBhcyBLZXljbG9ha0FjY2Vzc1Rva2VuUGF5bG9hZDtcbiAgICB9IGNhdGNoIChlOiBhbnkpIHtcbiAgICAgIHRocm93IG5ldyBBdXRob3JpemF0aW9uRXJyb3IoXCJJbnZhbGlkIHRva2VuOiBcIiArIChlPy5tZXNzYWdlID8/IGUpKTtcbiAgICB9XG4gIH1cbn1cbiJdfQ==

package/lib/types/nest/authService.d.cts

@@ -1,63 +0,0 @@
-import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.cts";
-/**
- * Configuration for the {@link AuthService}.
- */
-export interface AuthServiceOptions {
-    /**
-     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
-     * When `false` (or `verifyUrl` is empty), tokens are decoded without
-     * signature verification (dev/local mode only).
-     * @default false
-     */
-    verifyToken?: boolean;
-    /**
-     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
-     * Required when `verifyToken` is `true`.
-     */
-    verifyUrl?: string;
-    /**
-     * Clock tolerance for JWT expiry verification (in seconds).
-     * @default 5
-     */
-    clockToleranceSeconds?: number;
-    /**
-     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
-     * @default ["account"]
-     */
-    excludedClients?: string[];
-}
-export declare class AuthService {
-    private readonly verifyToken;
-    private readonly verifyUrl;
-    private readonly clockToleranceSeconds;
-    private readonly excludedClients;
-    private jwks;
-    constructor(options?: AuthServiceOptions);
-    isTokenVerificationEnabled(): boolean;
-    getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
-    getRoles(jwt: string): string[];
-    getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
-    /**
-     * Extracts client roles from the `resource_access` claim, excluding
-     * the configured `excludedClients` (default: `["account"]`).
-     */
-    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
-    getRealmFromIssuer(jwt: string): string;
-    /**
-     * Validates a JWT:
-     * - In **verify mode**: verifies the signature against the Keycloak JWKS
-     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
-     * - In **decode-only mode**: decodes the JWT without verification and
-     *   returns the payload (or throws if unparseable).
-     *
-     * @throws {AuthorizationError} when the token is invalid, expired, or
-     *   signature verification fails.
-     */
-    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
-    /**
-     * Verifies the JWT signature against the Keycloak JWKS endpoint.
-     * Lazily creates the JWKS keystore on first call.
-     */
-    private verifyAgainstJwks;
-}

package/lib/types/nest/authService.d.mts

@@ -1,63 +0,0 @@
-import type { KeycloakAccessTokenPayload, KeycloakUser } from "./types.d.mts";
-/**
- * Configuration for the {@link AuthService}.
- */
-export interface AuthServiceOptions {
-    /**
-     * Whether to verify the JWT signature against the Keycloak JWKS endpoint.
-     * When `false` (or `verifyUrl` is empty), tokens are decoded without
-     * signature verification (dev/local mode only).
-     * @default false
-     */
-    verifyToken?: boolean;
-    /**
-     * The Keycloak JWKS URL (e.g. `https://keycloak/realms/myrealm/protocol/openid-connect/certs`).
-     * Required when `verifyToken` is `true`.
-     */
-    verifyUrl?: string;
-    /**
-     * Clock tolerance for JWT expiry verification (in seconds).
-     * @default 5
-     */
-    clockToleranceSeconds?: number;
-    /**
-     * Keycloak client IDs to exclude when extracting roles from `resource_access`.
-     * @default ["account"]
-     */
-    excludedClients?: string[];
-}
-export declare class AuthService {
-    private readonly verifyToken;
-    private readonly verifyUrl;
-    private readonly clockToleranceSeconds;
-    private readonly excludedClients;
-    private jwks;
-    constructor(options?: AuthServiceOptions);
-    isTokenVerificationEnabled(): boolean;
-    getTokenPayload(jwt: string): KeycloakAccessTokenPayload | null;
-    getRoles(jwt: string): string[];
-    getUser(jwt: string): KeycloakUser | undefined;
-    extractKeycloakRoles(payload: KeycloakAccessTokenPayload | null): string[];
-    /**
-     * Extracts client roles from the `resource_access` claim, excluding
-     * the configured `excludedClients` (default: `["account"]`).
-     */
-    extractClientRoles(payload: KeycloakAccessTokenPayload | null): string[];
-    getRealmFromIssuer(jwt: string): string;
-    /**
-     * Validates a JWT:
-     * - In **verify mode**: verifies the signature against the Keycloak JWKS
-     *   endpoint using `jose.jwtVerify`, then returns the verified payload.
-     * - In **decode-only mode**: decodes the JWT without verification and
-     *   returns the payload (or throws if unparseable).
-     *
-     * @throws {AuthorizationError} when the token is invalid, expired, or
-     *   signature verification fails.
-     */
-    assertValidToken(jwt: string): Promise<KeycloakAccessTokenPayload>;
-    /**
-     * Verifies the JWT signature against the Keycloak JWKS endpoint.
-     * Lazily creates the JWKS keystore on first call.
-     */
-    private verifyAgainstJwks;
-}