@digitaldefiance/node-express-suite 3.7.5 → 3.8.0

package/src/interfaces/status-code-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-code-response.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/status-code-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,WAAW;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,CAAC,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC"}

package/src/interfaces/status-code-response.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * @fileoverview Status code response wrapper interface.
+ * Wraps API responses with HTTP status codes and optional headers.
+ * @module interfaces/status-code-response
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=status-code-response.js.map

package/src/interfaces/status-code-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-code-response.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/status-code-response.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/src/interfaces/{symmetric-encryption-results.ts → symmetric-encryption-results.d.ts}

@@ -3,13 +3,13 @@
  * Defines structure for symmetric encryption operation results.
  * @module interfaces/symmetric-encryption-results
  */
-
 /**
  * Results of symmetric encryption operation.
  * @property {Buffer} encryptedData - Encrypted data buffer
  * @property {Buffer} key - Encryption key used
  */
 export interface ISymmetricEncryptionResults {
-  encryptedData: Buffer;
-  key: Buffer;
+    encryptedData: Buffer;
+    key: Buffer;
 }
+//# sourceMappingURL=symmetric-encryption-results.d.ts.map

package/src/interfaces/symmetric-encryption-results.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symmetric-encryption-results.d.ts","sourceRoot":"","sources":["symmetric-encryption-results.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"symmetric-encryption-results.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/symmetric-encryption-results.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb"}

package/src/interfaces/symmetric-encryption-results.js

@@ -1,3 +1,8 @@
 "use strict";
+/**
+ * @fileoverview Symmetric encryption results interface.
+ * Defines structure for symmetric encryption operation results.
+ * @module interfaces/symmetric-encryption-results
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=symmetric-encryption-results.js.map

package/src/interfaces/symmetric-encryption-results.js.map

@@ -1 +1 @@
-{"version":3,"file":"symmetric-encryption-results.js","sourceRoot":"","sources":["symmetric-encryption-results.ts"],"names":[],"mappings":""}
+{"version":3,"file":"symmetric-encryption-results.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/symmetric-encryption-results.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/src/interfaces/{test-environment.ts → test-environment.d.ts}

@@ -3,21 +3,20 @@
  * Defines structure for test environment with in-memory MongoDB and initialized accounts.
  * @module interfaces/test-environment
  */
-
 import type { PlatformID } from '@digitaldefiance/node-ecies-lib';
 import { MongoMemoryReplSet } from 'mongodb-memory-server';
 import { IApplication } from './application';
 import { IServerInitResult } from './server-init-result';
-
 /**
  * Test environment configuration.
  * Contains application instance, in-memory MongoDB, and test account data.
  * @template TID - Platform ID type (defaults to Buffer)
  */
 export interface ITestEnvironment<TID extends PlatformID = Buffer> {
-  application: IApplication<TID>;
-  mongoServer: MongoMemoryReplSet;
-  mongoUri: string;
-  accountData: IServerInitResult<TID>;
-  dbName: string;
+    application: IApplication<TID>;
+    mongoServer: MongoMemoryReplSet;
+    mongoUri: string;
+    accountData: IServerInitResult<TID>;
+    dbName: string;
 }
+//# sourceMappingURL=test-environment.d.ts.map

package/src/interfaces/test-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-environment.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/test-environment.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB,CAAC,GAAG,SAAS,UAAU,GAAG,MAAM;IAC/D,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,WAAW,EAAE,kBAAkB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/src/interfaces/test-environment.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * @fileoverview Test environment interface.
+ * Defines structure for test environment with in-memory MongoDB and initialized accounts.
+ * @module interfaces/test-environment
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=test-environment.js.map

package/src/interfaces/test-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-environment.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/test-environment.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/src/interfaces/{token-response.ts → token-response.d.ts}

@@ -3,14 +3,13 @@
  * Extends API message response with JWT token.
  * @module interfaces/token-response
  */
-
 import { IApiMessageResponse } from './api-message-response';
-
 /**
  * API response containing authentication token.
  * @extends IApiMessageResponse
  * @property {string} token - JWT authentication token
  */
 export interface IApiTokenResponse extends IApiMessageResponse {
-  token: string;
+    token: string;
 }
+//# sourceMappingURL=token-response.d.ts.map

package/src/interfaces/token-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-response.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/token-response.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,KAAK,EAAE,MAAM,CAAC;CACf"}

package/src/interfaces/token-response.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * @fileoverview Token response interface for authentication.
+ * Extends API message response with JWT token.
+ * @module interfaces/token-response
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=token-response.js.map

package/src/interfaces/token-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-response.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/interfaces/token-response.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/src/middleware-utils.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @fileoverview Middleware initialization utilities.
+ * Configures Express middleware including Helmet, CORS, and body parsers.
+ * @module middleware-utils
+ */
+import cors from 'cors';
+import { Application } from 'express';
+import { HelmetOptions } from 'helmet';
+import { ISimpleCSPDef } from './interfaces/csp-definition';
+/**
+ * Creates a CORS options delegate function.
+ * @param {string[]} corsWhitelist - Array of allowed origins
+ * @returns {Function} CORS options delegate
+ */
+export declare const corsOptionsDelegate: (corsWhitelist: string[]) => (req: cors.CorsRequest, callback: (error: Error | null, options: cors.CorsOptions | undefined) => void) => void;
+/**
+ * Type guard to check if object is HelmetOptions.
+ * @param {unknown} obj - Object to check
+ * @returns {boolean} True if object is HelmetOptions
+ */
+export declare const isHelmetOptions: (obj: unknown) => obj is HelmetOptions;
+/**
+ * Initializes Express middleware stack.
+ * Configures Helmet for security headers, CORS, and body parsers.
+ * @param {Application} app - Express application instance
+ * @param {string[]} corsWhitelist - Array of allowed CORS origins
+ * @param {ISimpleCSPDef | HelmetOptions} csp - CSP configuration or Helmet options
+ * @throws {TranslatableSuiteError} If invalid CSP configuration provided
+ */
+export declare const initMiddleware: (app: Application, corsWhitelist: string[], csp: ISimpleCSPDef | HelmetOptions) => void;
+//# sourceMappingURL=middleware-utils.d.ts.map

package/src/middleware-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-utils.d.ts","sourceRoot":"","sources":["../../../../packages/digitaldefiance-node-express-suite/src/middleware-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,WAAW,EAMZ,MAAM,SAAS,CAAC;AACjB,OAAe,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAkB,MAAM,6BAA6B,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,eAAe,MAAM,EAAE,MAEvD,KAAK,IAAI,CAAC,WAAW,EACrB,UAAU,CACR,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,OAAO,EAAE,IAAI,CAAC,WAAW,GAAG,SAAS,KAClC,IAAI,SAoBZ,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,OAAO,KAAG,GAAG,IAAI,aAYrD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,WAAW,EAChB,eAAe,MAAM,EAAE,EACvB,KAAK,aAAa,GAAG,aAAa,KACjC,IAiDF,CAAC"}

package/src/middleware-utils.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * @fileoverview Middleware initialization utilities.
+ * Configures Express middleware including Helmet, CORS, and body parsers.
+ * @module middleware-utils
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initMiddleware = exports.isHelmetOptions = exports.corsOptionsDelegate = void 0;
+const tslib_1 = require("tslib");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const cors_1 = tslib_1.__importDefault(require("cors"));
+const crypto_1 = require("crypto");
+const express_1 = require("express");
+const helmet_1 = tslib_1.__importDefault(require("helmet"));
+const csp_definition_1 = require("./interfaces/csp-definition");
+/**
+ * Creates a CORS options delegate function.
+ * @param {string[]} corsWhitelist - Array of allowed origins
+ * @returns {Function} CORS options delegate
+ */
+const corsOptionsDelegate = (corsWhitelist) => {
+    return (req, callback) => {
+        let corsOptions;
+        const origin = req.headers.origin;
+        if (origin &&
+            corsWhitelist.find((w) => {
+                if (w instanceof RegExp) {
+                    return w.test(origin);
+                }
+                else {
+                    return w === origin;
+                }
+            })) {
+            corsOptions = { origin: true };
+        }
+        else {
+            corsOptions = { origin: false };
+        }
+        callback(null, corsOptions);
+    };
+};
+exports.corsOptionsDelegate = corsOptionsDelegate;
+/**
+ * Type guard to check if object is HelmetOptions.
+ * @param {unknown} obj - Object to check
+ * @returns {boolean} True if object is HelmetOptions
+ */
+const isHelmetOptions = (obj) => {
+    // A very basic check; in real scenarios, you might want to be more thorough
+    return !!(obj &&
+        typeof obj === 'object' &&
+        ('contentSecurityPolicy' in obj ||
+            'crossOriginEmbedderPolicy' in obj ||
+            'crossOriginOpenerPolicy' in obj ||
+            'crossOriginResourcePolicy' in obj ||
+            'originAgentCluster' in obj ||
+            'referrerPolicy' in obj));
+};
+exports.isHelmetOptions = isHelmetOptions;
+/**
+ * Initializes Express middleware stack.
+ * Configures Helmet for security headers, CORS, and body parsers.
+ * @param {Application} app - Express application instance
+ * @param {string[]} corsWhitelist - Array of allowed CORS origins
+ * @param {ISimpleCSPDef | HelmetOptions} csp - CSP configuration or Helmet options
+ * @throws {TranslatableSuiteError} If invalid CSP configuration provided
+ */
+const initMiddleware = (app, corsWhitelist, csp) => {
+    // Helmet helps you secure your Express apps by setting various HTTP headers
+    // CSP nonce
+    app.use((req, res, next) => {
+        res.locals['cspNonce'] = (0, crypto_1.randomBytes)(32).toString('hex');
+        next();
+    });
+    if ((0, csp_definition_1.isSimpleCSPDef)(csp)) {
+        app.use((0, helmet_1.default)({
+            contentSecurityPolicy: {
+                directives: {
+                    defaultSrc: ["'self'", ...csp.defaultSrc],
+                    imgSrc: ["'self'", 'data:', 'blob:', ...csp.imgSrc],
+                    connectSrc: ["'self'", ...csp.connectSrc],
+                    scriptSrc: [
+                        "'self'",
+                        //"'unsafe-inline'",
+                        "'strict-dynamic'",
+                        (req, res) => {
+                            const response = res;
+                            return `'nonce-${response.locals['cspNonce']}'`;
+                        },
+                        ...csp.scriptSrc,
+                    ],
+                    styleSrc: [
+                        "'self'",
+                        // "'unsafe-inline'",
+                        ...csp.styleSrc,
+                    ],
+                    fontSrc: ["'self'", ...csp.fontSrc],
+                    frameSrc: ["'self'", ...csp.frameSrc],
+                },
+            },
+        }));
+    }
+    else if ((0, exports.isHelmetOptions)(csp)) {
+        app.use((0, helmet_1.default)(csp));
+    }
+    else {
+        throw new suite_core_lib_1.TranslatableSuiteError(suite_core_lib_1.SuiteCoreStringKey.Error_InvalidCspOrHelmetOptionsProvided);
+    }
+    // Enable CORS
+    app.use((0, cors_1.default)((0, exports.corsOptionsDelegate)(corsWhitelist)));
+    // Parse incoming requests with JSON payloads
+    app.use((0, express_1.json)());
+    // Parse incoming requests with urlencoded payloads
+    app.use((0, express_1.urlencoded)({ extended: true }));
+};
+exports.initMiddleware = initMiddleware;
+//# sourceMappingURL=middleware-utils.js.map

package/src/middleware-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware-utils.js","sourceRoot":"","sources":["../../../../packages/digitaldefiance-node-express-suite/src/middleware-utils.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;AAEH,oEAGyC;AACzC,wDAAwB;AACxB,mCAAqC;AACrC,qCAOiB;AACjB,4DAA+C;AAE/C,gEAA4E;AAE5E;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,CAAC,aAAuB,EAAE,EAAE;IAC7D,OAAO,CACL,GAAqB,EACrB,QAGS,EACT,EAAE;QACF,IAAI,WAA6B,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IACE,MAAM;YACN,aAAa,CAAC,IAAI,CAAC,CAAC,CAAkB,EAAE,EAAE;gBACxC,IAAI,CAAC,YAAY,MAAM,EAAE,CAAC;oBACxB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,MAAM,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,EACF,CAAC;YACD,WAAW,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC,CAAC;AA1BW,QAAA,mBAAmB,uBA0B9B;AAEF;;;;GAIG;AACI,MAAM,eAAe,GAAG,CAAC,GAAY,EAAwB,EAAE;IACpE,4EAA4E;IAC5E,OAAO,CAAC,CAAC,CACP,GAAG;QACH,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,uBAAuB,IAAI,GAAG;YAC7B,2BAA2B,IAAI,GAAG;YAClC,yBAAyB,IAAI,GAAG;YAChC,2BAA2B,IAAI,GAAG;YAClC,oBAAoB,IAAI,GAAG;YAC3B,gBAAgB,IAAI,GAAG,CAAC,CAC3B,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,eAAe,mBAY1B;AAEF;;;;;;;GAOG;AACI,MAAM,cAAc,GAAG,CAC5B,GAAgB,EAChB,aAAuB,EACvB,GAAkC,EAC5B,EAAE;IACR,4EAA4E;IAC5E,YAAY;IACZ,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,IAAA,+BAAc,EAAC,GAAG,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,GAAG,CACL,IAAA,gBAAM,EAAC;YACL,qBAAqB,EAAE;gBACrB,UAAU,EAAE;oBACV,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;oBACzC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;oBACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC;oBACzC,SAAS,EAAE;wBACT,QAAQ;wBACR,oBAAoB;wBACpB,kBAAkB;wBAClB,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;4BAC5C,MAAM,QAAQ,GAAG,GAAe,CAAC;4BACjC,OAAO,UAAU,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;wBAClD,CAAC;wBACD,GAAG,GAAG,CAAC,SAAS;qBACjB;oBACD,QAAQ,EAAE;wBACR,QAAQ;wBACR,qBAAqB;wBACrB,GAAG,GAAG,CAAC,QAAQ;qBAChB;oBACD,OAAO,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;oBACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;iBACtC;aACF;SACF,CAAC,CACH,CAAC;IACJ,CAAC;SAAM,IAAI,IAAA,uBAAe,EAAC,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,GAAG,CAAC,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,uCAAsB,CAC9B,mCAAkB,CAAC,uCAAuC,CAC3D,CAAC;IACJ,CAAC;IACD,cAAc;IACd,GAAG,CAAC,GAAG,CAAC,IAAA,cAAI,EAAC,IAAA,2BAAmB,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAClD,6CAA6C;IAC7C,GAAG,CAAC,GAAG,CAAC,IAAA,cAAI,GAAE,CAAC,CAAC;IAChB,mDAAmD;IACnD,GAAG,CAAC,GAAG,CAAC,IAAA,oBAAU,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1C,CAAC,CAAC;AArDW,QAAA,cAAc,kBAqDzB"}

package/src/middlewares/authenticate-crypto.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Cryptographic authentication middleware for operations requiring private keys.
+ * Validates mnemonic or password to unlock user's private key for sensitive operations.
+ * @module middlewares/authenticate-crypto
+ */
+import { PlatformID } from '@digitaldefiance/node-ecies-lib';
+import { AccountStatus } from '@digitaldefiance/suite-core-lib';
+import { NextFunction, Request, Response } from 'express';
+import { IApplication } from '../interfaces/application';
+/**
+ * Express middleware for cryptographic authentication.
+ * Requires mnemonic or password in request body to unlock user's private key.
+ * Attaches authenticated BackendMember with private key to req.eciesUser.
+ * Used for operations requiring cryptographic signing or decryption.
+ * @template TID - Platform ID type (defaults to Buffer)
+ * @template TAccountStatus - Account status type (defaults to AccountStatus)
+ * @param {IApplication<TID>} application - Application instance
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {NextFunction} next - Express next function
+ * @param {TAccountStatus} [activeStatusValue] - Expected active account status
+ * @returns {Promise<Response | void>} Response or void if successful
+ * @throws {InvalidCredentialsError} When credentials are invalid
+ * @throws {InvalidPasswordError} When password is incorrect
+ */
+export declare function authenticateCrypto<TID extends PlatformID = Buffer, TAccountStatus extends string = AccountStatus>(application: IApplication<TID>, req: Request, res: Response, next: NextFunction, activeStatusValue?: TAccountStatus): Promise<Response | void>;
+//# sourceMappingURL=authenticate-crypto.d.ts.map

package/src/middlewares/authenticate-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-crypto.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/middlewares/authenticate-crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAEL,UAAU,EACX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,aAAa,EAId,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK1D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGzD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,cAAc,SAAS,MAAM,GAAG,aAAa,EAE7C,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,EAClB,iBAAiB,GAAE,cAAuD,GACzE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyL1B"}

package/src/middlewares/authenticate-crypto.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * @fileoverview Cryptographic authentication middleware for operations requiring private keys.
+ * Validates mnemonic or password to unlock user's private key for sensitive operations.
+ * @module middlewares/authenticate-crypto
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateCrypto = authenticateCrypto;
+const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const container_1 = require("../container");
+const enumerations_1 = require("../enumerations");
+const errors_1 = require("../errors");
+const utils_1 = require("../utils");
+/**
+ * Express middleware for cryptographic authentication.
+ * Requires mnemonic or password in request body to unlock user's private key.
+ * Attaches authenticated BackendMember with private key to req.eciesUser.
+ * Used for operations requiring cryptographic signing or decryption.
+ * @template TID - Platform ID type (defaults to Buffer)
+ * @template TAccountStatus - Account status type (defaults to AccountStatus)
+ * @param {IApplication<TID>} application - Application instance
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {NextFunction} next - Express next function
+ * @param {TAccountStatus} [activeStatusValue] - Expected active account status
+ * @returns {Promise<Response | void>} Response or void if successful
+ * @throws {InvalidCredentialsError} When credentials are invalid
+ * @throws {InvalidPasswordError} When password is incorrect
+ */
+async function authenticateCrypto(application, req, res, next, activeStatusValue = suite_core_lib_1.AccountStatus.Active) {
+    if (!req.user) {
+        return res.status(401).send(
+        // amazonq-ignore-next-line false positive, hardcoded string
+        (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidToken));
+    }
+    // Try validatedBody first (if validation has run), then fall back to raw body
+    // Note: This middleware runs BEFORE validation, so validatedBody may not exist yet
+    const validatedBody = req
+        .validatedBody;
+    const rawBody = req.body;
+    const sourceBody = validatedBody ?? rawBody;
+    if (!sourceBody) {
+        return res.status(400).send({
+            // amazonq-ignore-next-line false positive, hardcoded string
+            message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired),
+        });
+    }
+    const mnemonic = typeof sourceBody['mnemonic'] === 'string'
+        ? sourceBody['mnemonic']
+        : undefined;
+    const password = 
+    // amazonq-ignore-next-line false positive
+    typeof sourceBody['password'] === 'string'
+        ? sourceBody['password']
+        : undefined;
+    if (!mnemonic && !password) {
+        return res.status(400).send({
+            // amazonq-ignore-next-line false positive, hardcoded string
+            message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired),
+        });
+    }
+    const UserModel = application.getModel(enumerations_1.BaseModelName.User);
+    const userService = application.services.get(container_1.ServiceKeys.USER);
+    try {
+        return await (0, utils_1.withTransaction)(application.db.connection, application.environment.mongo.useTransactions, undefined, async (sess) => {
+            const userDoc = await UserModel.findById(req.user.id)
+                .session(sess ?? null)
+                .exec();
+            if (!userDoc || userDoc.accountStatus !== activeStatusValue) {
+                return res.status(403).send(
+                // amazonq-ignore-next-line false positive, hardcoded string
+                (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UserNotFound));
+            }
+            // Ensure we're only authenticating the currently logged-in user
+            if (userDoc._id.toString() !== req.user.id) {
+                return res.status(403).send(
+                // amazonq-ignore-next-line false positive, hardcoded string
+                (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidCredentials));
+            }
+            let loginResult;
+            if (mnemonic) {
+                // Authenticate with mnemonic
+                const userMnemonic = new ecies_lib_1.SecureString(mnemonic);
+                try {
+                    loginResult = await userService.loginWithMnemonic(userDoc.email, userMnemonic, sess);
+                }
+                finally {
+                    userMnemonic.dispose();
+                }
+            }
+            else if (password) {
+                // Authenticate with password
+                loginResult = await userService.loginWithPassword(userDoc.email, password, sess);
+            }
+            else {
+                // Should not happen due to earlier guard; keeps TypeScript happy
+                return res.status(400).send({
+                    // amazonq-ignore-next-line false positive, hardcoded string
+                    message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_MnemonicOrPasswordRequired),
+                });
+            }
+            // Double-check authenticated user matches logged-in user
+            if (loginResult.userDoc._id.toString() !== req.user.id) {
+                return res.status(403).send(
+                // amazonq-ignore-next-line false positive, hardcoded string
+                (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidCredentials));
+            }
+            // Attach the fully authenticated member (with private key) to the request
+            req.eciesUser = loginResult.userMember;
+            // Do not attach the admin user to the request; it's a process-wide singleton
+            // and must not be disposed as part of request cleanup.
+            next();
+            return;
+        }, {
+            timeoutMs: application.environment.mongo.transactionTimeout,
+        });
+    }
+    catch (err) {
+        if (err instanceof suite_core_lib_1.InvalidCredentialsError ||
+            err instanceof errors_1.InvalidPasswordError) {
+            // amazonq-ignore-next-line false positive
+            console.error('Crypto authentication failed:', `userId=${String(req.user?.id || 'unknown').replace(/[\r\n]/g, '')} hasPassword=${!!password} hasMnemonic=${!!mnemonic}`);
+            return res.status(401).send({
+                // amazonq-ignore-next-line false positive, hardcoded string
+                message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidCredentials),
+            });
+        }
+        const sanitizedErr = err instanceof Error
+            ? err.message.replace(/[\r\n]/g, ' ')
+            : String(err).replace(/[\r\n]/g, ' ');
+        console.error(`${(0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Error_UnexpectedErrorInAuthenticateCrypto)}:`, sanitizedErr);
+        if (err instanceof Error && err.stack) {
+            console.error(`${(0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_StackTrace)}:`, err.stack);
+        }
+        return res.status(500).send({
+            // amazonq-ignore-next-line false positive, hardcoded string
+            message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_UnexpectedError),
+            error: err,
+        });
+    }
+}
+//# sourceMappingURL=authenticate-crypto.js.map

package/src/middlewares/authenticate-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-crypto.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/middlewares/authenticate-crypto.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAsCH,gDAkMC;AAtOD,0DAA0D;AAM1D,oEAKyC;AAEzC,4CAA2C;AAE3C,kDAAgD;AAChD,sCAAiD;AAEjD,oCAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,kBAAkB,CAItC,WAA8B,EAC9B,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,oBAAoC,8BAAa,CAAC,MAAwB;IAE1E,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI;QACzB,4DAA4D;QAC5D,IAAA,wCAAuB,EAAC,mCAAkB,CAAC,uBAAuB,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,mFAAmF;IACnF,MAAM,aAAa,GAAI,GAA6C;SACjE,aAAoD,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,IAA2C,CAAC;IAChE,MAAM,UAAU,GAAG,aAAa,IAAI,OAAO,CAAC;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,4DAA4D;YAC5D,OAAO,EAAE,IAAA,wCAAuB,EAC9B,mCAAkB,CAAC,qCAAqC,CACzD;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GACZ,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,QAAQ;QACxC,CAAC,CAAE,UAAU,CAAC,UAAU,CAAY;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ;IACZ,0CAA0C;IAC1C,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,QAAQ;QACxC,CAAC,CAAE,UAAU,CAAC,UAAU,CAAY;QACpC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,4DAA4D;YAC5D,OAAO,EAAE,IAAA,wCAAuB,EAC9B,mCAAkB,CAAC,qCAAqC,CACzD;SACF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CACpC,4BAAa,CAAC,IAAI,CACnB,CAAC;IACF,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAW,CAAC,IAAI,CAW5D,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,MAAM,IAAA,uBAAe,EAC1B,WAAW,CAAC,EAAE,CAAC,UAAU,EACzB,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,EAC7C,SAAS,EACT,KAAK,EAAE,IAA+B,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAK,CAAC,EAAE,CAAC;iBACnD,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;iBACrB,IAAI,EAAE,CAAC;YAEV,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI;gBACzB,4DAA4D;gBAC5D,IAAA,wCAAuB,EAAC,mCAAkB,CAAC,uBAAuB,CAAC,CACpE,CAAC;YACJ,CAAC;YAED,gEAAgE;YAChE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,IAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI;gBACzB,4DAA4D;gBAC5D,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,6BAA6B,CACjD,CACF,CAAC;YACJ,CAAC;YAED,IAAI,WAIH,CAAC;YAEF,IAAI,QAAQ,EAAE,CAAC;gBACb,6BAA6B;gBAC7B,MAAM,YAAY,GAAG,IAAI,wBAAY,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAC/C,OAAO,CAAC,KAAK,EACb,YAAY,EACZ,IAAI,CACL,CAAC;gBACJ,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,OAAO,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,6BAA6B;gBAC7B,WAAW,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAC/C,OAAO,CAAC,KAAK,EACb,QAAQ,EACR,IAAI,CACL,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,4DAA4D;oBAC5D,OAAO,EAAE,IAAA,wCAAuB,EAC9B,mCAAkB,CAAC,qCAAqC,CACzD;iBACF,CAAC,CAAC;YACL,CAAC;YAED,yDAAyD;YACzD,IAAI,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,CAAC,IAAK,CAAC,EAAE,EAAE,CAAC;gBACxD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI;gBACzB,4DAA4D;gBAC5D,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,6BAA6B,CACjD,CACF,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC;YACvC,6EAA6E;YAC7E,uDAAuD;YAEvD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC,EACD;YACE,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,kBAAkB;SAC5D,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IACE,GAAG,YAAY,wCAAuB;YACtC,GAAG,YAAY,6BAAoB,EACnC,CAAC;YACD,0CAA0C;YAC1C,OAAO,CAAC,KAAK,CACX,+BAA+B,EAC/B,UAAU,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,SAAS,CAAC,CAAC,OAAO,CACjD,SAAS,EACT,EAAE,CACH,gBAAgB,CAAC,CAAC,QAAQ,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CACxD,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,4DAA4D;gBAC5D,OAAO,EAAE,IAAA,wCAAuB,EAC9B,mCAAkB,CAAC,6BAA6B,CACjD;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,YAAY,GAChB,GAAG,YAAY,KAAK;YAClB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,CACX,GAAG,IAAA,wCAAuB,EACxB,mCAAkB,CAAC,yCAAyC,CAC7D,GAAG,EACJ,YAAY,CACb,CAAC;QACF,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CACX,GAAG,IAAA,wCAAuB,EAAC,mCAAkB,CAAC,iBAAiB,CAAC,GAAG,EACnE,GAAG,CAAC,KAAK,CACV,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,4DAA4D;YAC5D,OAAO,EAAE,IAAA,wCAAuB,EAC9B,mCAAkB,CAAC,sBAAsB,CAC1C;YACD,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/src/middlewares/authenticate-token.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @fileoverview JWT token authentication middleware.
+ * Validates bearer tokens, loads user data, and sets up request context.
+ * @module middlewares/authenticate-token
+ */
+import { ITokenRole, ITokenUser } from '@digitaldefiance/suite-core-lib';
+import { NextFunction, Request, Response } from 'express';
+import { IncomingHttpHeaders } from 'http';
+import { IApplication } from '../interfaces/application';
+import type { PlatformID } from '@digitaldefiance/node-ecies-lib';
+/**
+ * Extracts bearer token from HTTP request headers.
+ * @param {IncomingHttpHeaders} headers - HTTP request headers
+ * @returns {string | null} Bearer token if found, null otherwise
+ */
+export declare function findAuthToken(headers: IncomingHttpHeaders): string | null;
+/**
+ * Express middleware for JWT token authentication.
+ * Validates token, loads user from database, checks account status,
+ * and populates req.user with authenticated user data.
+ * @template TID - Platform ID type (defaults to Buffer)
+ * @template D - Date type (defaults to Date)
+ * @template TTokenRole - Token role interface type
+ * @template TTokenUser - Token user interface type
+ * @template TApplication - Application interface type
+ * @param {TApplication} application - Application instance
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {NextFunction} next - Express next function
+ * @returns {Promise<Response>} Response object
+ * @throws {TokenExpiredError} When token has expired
+ */
+export declare function authenticateToken<TID extends PlatformID = Buffer, D extends Date = Date, TTokenRole extends ITokenRole<TID, D> = ITokenRole<TID, D>, TTokenUser extends ITokenUser = ITokenUser, TApplication extends IApplication<TID> = IApplication<TID>>(application: TApplication, req: Request, res: Response, next: NextFunction): Promise<Response>;
+//# sourceMappingURL=authenticate-token.d.ts.map

package/src/middlewares/authenticate-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-token.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/middlewares/authenticate-token.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAGL,UAAU,EACV,UAAU,EAEX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAI3C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAalE;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CASzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,CAAC,SAAS,IAAI,GAAG,IAAI,EACrB,UAAU,SAAS,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAC1D,UAAU,SAAS,UAAU,GAAG,UAAU,EAC1C,YAAY,SAAS,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,EAE1D,WAAW,EAAE,YAAY,EACzB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,QAAQ,CAAC,CAkFnB"}

package/src/middlewares/authenticate-token.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * @fileoverview JWT token authentication middleware.
+ * Validates bearer tokens, loads user data, and sets up request context.
+ * @module middlewares/authenticate-token
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findAuthToken = findAuthToken;
+exports.authenticateToken = authenticateToken;
+const i18n_lib_1 = require("@digitaldefiance/i18n-lib");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const base_model_name_1 = require("../enumerations/base-model-name");
+const token_expired_1 = require("../errors/token-expired");
+const jwt_1 = require("../services/jwt");
+const request_user_1 = require("../services/request-user");
+const role_1 = require("../services/role");
+const utils_1 = require("../utils");
+// Helper to create Timezone from the same module instance as GlobalActiveContext
+function createTimezone(tz) {
+    const context = i18n_lib_1.GlobalActiveContext.getInstance();
+    const TimezoneConstructor = context.adminTimezone
+        .constructor;
+    return new TimezoneConstructor(tz);
+}
+/**
+ * Extracts bearer token from HTTP request headers.
+ * @param {IncomingHttpHeaders} headers - HTTP request headers
+ * @returns {string | null} Bearer token if found, null otherwise
+ */
+function findAuthToken(headers) {
+    const authHeader = headers['Authorization'] || headers['authorization'];
+    if (authHeader && typeof authHeader === 'string') {
+        const parts = authHeader.split(' ');
+        if (parts.length === 2 && parts[0].toLowerCase() === 'bearer') {
+            return parts[1];
+        }
+    }
+    return null;
+}
+/**
+ * Express middleware for JWT token authentication.
+ * Validates token, loads user from database, checks account status,
+ * and populates req.user with authenticated user data.
+ * @template TID - Platform ID type (defaults to Buffer)
+ * @template D - Date type (defaults to Date)
+ * @template TTokenRole - Token role interface type
+ * @template TTokenUser - Token user interface type
+ * @template TApplication - Application interface type
+ * @param {TApplication} application - Application instance
+ * @param {Request} req - Express request object
+ * @param {Response} res - Express response object
+ * @param {NextFunction} next - Express next function
+ * @returns {Promise<Response>} Response object
+ * @throws {TokenExpiredError} When token has expired
+ */
+async function authenticateToken(application, req, res, next) {
+    const UserModel = application.getModel(base_model_name_1.BaseModelName.User);
+    const token = findAuthToken(req.headers);
+    if (token == null) {
+        return res
+            .status(401)
+            .send((0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidToken));
+    }
+    try {
+        return await (0, utils_1.withTransaction)(application.db.connection, application.environment.mongo.useTransactions, undefined, async (sess) => {
+            const jwtService = new jwt_1.JwtService(application);
+            const user = await jwtService.verifyToken(token);
+            if (user === null) {
+                return res.status(403).send(
+                // amazonq-ignore-next-line false positive, hardcoded string
+                (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UserNotFound));
+            }
+            const userDoc = await UserModel.findById(user.userId)
+                .select('-password')
+                .session(sess ?? null)
+                .exec();
+            if (!userDoc || userDoc.accountStatus !== suite_core_lib_1.AccountStatus.Active) {
+                return res.status(403).send(
+                // amazonq-ignore-next-line false positive, hardcoded string
+                (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UserNotFound));
+            }
+            const roleService = new role_1.RoleService(application);
+            const roles = await roleService.getUserRoles(userDoc._id, sess);
+            const tokenRoles = roleService.rolesToTokenRoles(roles);
+            req.user = request_user_1.RequestUserService.makeRequestUserDTO(userDoc, tokenRoles);
+            const context = i18n_lib_1.GlobalActiveContext.getInstance();
+            context.userLanguage = userDoc.siteLanguage ?? context.userLanguage;
+            context.setLanguageContextSpace('user');
+            context.userTimezone = createTimezone(userDoc.timezone);
+            next();
+            return res;
+        }, {
+            timeoutMs: application.environment.mongo.transactionTimeout,
+        });
+    }
+    catch (err) {
+        if (err instanceof token_expired_1.TokenExpiredError) {
+            return res.status(401).send({
+                message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_TokenExpired),
+                error: err,
+            });
+        }
+        else if (err instanceof Error && err.name === 'JsonWebTokenError') {
+            return res.status(400).send({
+                message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_InvalidToken),
+                error: err,
+            });
+        }
+        else {
+            return res.status(500).send({
+                message: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_UnexpectedError),
+                error: err,
+            });
+        }
+    }
+}
+//# sourceMappingURL=authenticate-token.js.map