@discover-cloud/shared 1.0.4 → 1.0.6

package/dist/http/service-client.d.ts

@@ -3,29 +3,34 @@ import { Request } from "express";
 /**
  * SERVICE CLIENT
  * ───────────────
- * HTTP client for service-to-service calls.
- * Forwards the internal JWT and request ID from the current Express request.
+ * HTTP client for service-to-service communication.
  *
- * Fixes vs original:
- *   - Removed `validateStatus: () => true` — it silently swallowed 4xx/5xx,
- *     forcing every caller to manually check response.status. Removed so
- *     axios throws naturally on error responses.
- *   - `postWithAuth(url, data: any)` → `data: unknown` — no silent any
- *   - requestId fallback now consistent with requestId middleware logic
- *   - Added `patchWithAuth` and `deleteWithAuth` — common enough to include
- *   - Retry only on network errors + 5xx (not 4xx — those are caller errors)
+ * Two call patterns:
+ *
+ * 1. JWT-forwarding (user-initiated requests)
+ *    Pass the current Express Request — Authorization + x-request-id
+ *    are forwarded automatically.
+ *    Use: getWithAuth, postWithAuth, patchWithAuth, deleteWithAuth
+ *
+ * 2. Internal calls (service-to-service, no incoming request)
+ *    Pass explicit headers — used by UserServiceClient in auth service
+ *    where calls originate from service logic, not from an HTTP handler.
+ *    Use: get, post, patch, delete
+ *
+ * Retry strategy: network errors + 5xx only. Never retries 4xx —
+ * those are deterministic caller errors.
  */
 export declare class ServiceClient {
     readonly http: AxiosInstance;
     constructor(baseURL: string);
-    private setupRetry;
     getWithAuth<T = unknown>(url: string, req: Request, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
     postWithAuth<T = unknown>(url: string, data: unknown, req: Request, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
     patchWithAuth<T = unknown>(url: string, data: unknown, req: Request, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
     deleteWithAuth<T = unknown>(url: string, req: Request, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
-    /**
-     * Merges Authorization + x-request-id into any provided config.
-     * The internal JWT is forwarded as-is — the gateway already minted it.
-     */
+    get<T = unknown>(url: string, headers: Record<string, string>, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
+    post<T = unknown>(url: string, data: unknown, headers: Record<string, string>, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
+    patch<T = unknown>(url: string, data: unknown, headers: Record<string, string>, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
+    delete<T = unknown>(url: string, headers: Record<string, string>, config?: AxiosRequestConfig): Promise<AxiosResponse<T>>;
     private mergeAuth;
+    private mergeHeaders;
 }

package/dist/http/service-client.js

@@ -9,17 +9,22 @@ const axios_retry_1 = __importDefault(require("axios-retry"));
 /**
  * SERVICE CLIENT
  * ───────────────
- * HTTP client for service-to-service calls.
- * Forwards the internal JWT and request ID from the current Express request.
+ * HTTP client for service-to-service communication.
  *
- * Fixes vs original:
- *   - Removed `validateStatus: () => true` — it silently swallowed 4xx/5xx,
- *     forcing every caller to manually check response.status. Removed so
- *     axios throws naturally on error responses.
- *   - `postWithAuth(url, data: any)` → `data: unknown` — no silent any
- *   - requestId fallback now consistent with requestId middleware logic
- *   - Added `patchWithAuth` and `deleteWithAuth` — common enough to include
- *   - Retry only on network errors + 5xx (not 4xx — those are caller errors)
+ * Two call patterns:
+ *
+ * 1. JWT-forwarding (user-initiated requests)
+ *    Pass the current Express Request — Authorization + x-request-id
+ *    are forwarded automatically.
+ *    Use: getWithAuth, postWithAuth, patchWithAuth, deleteWithAuth
+ *
+ * 2. Internal calls (service-to-service, no incoming request)
+ *    Pass explicit headers — used by UserServiceClient in auth service
+ *    where calls originate from service logic, not from an HTTP handler.
+ *    Use: get, post, patch, delete
+ *
+ * Retry strategy: network errors + 5xx only. Never retries 4xx —
+ * those are deterministic caller errors.
  */
 class ServiceClient {
     constructor(baseURL) {
@@ -27,15 +32,10 @@ class ServiceClient {
             baseURL,
             timeout: 8000,
         });
-        this.setupRetry();
-    }
-    setupRetry() {
         (0, axios_retry_1.default)(this.http, {
             retries: 3,
             retryDelay: axios_retry_1.default.exponentialDelay,
             retryCondition: (err) => {
-                // Retry on network errors or 5xx only
-                // Do NOT retry 4xx — those are deterministic failures
                 if (axios_retry_1.default.isNetworkError(err))
                     return true;
                 const status = err.response?.status ?? 0;
@@ -44,10 +44,8 @@ class ServiceClient {
         });
     }
     /* ----------------------------------------------------------------
-       Auth-forwarding methods
-       Pass the current Express Request to automatically forward:
-         - Authorization: Bearer <internal-jwt>
-         - x-request-id: <propagated request ID>
+       Pattern 1 — JWT-forwarding (pass Express req)
+       Forwards Authorization header + x-request-id automatically.
     ---------------------------------------------------------------- */
     async getWithAuth(url, req, config) {
         return this.http.get(url, this.mergeAuth(req, config));
@@ -61,17 +59,28 @@ class ServiceClient {
     async deleteWithAuth(url, req, config) {
         return this.http.delete(url, this.mergeAuth(req, config));
     }
+    /* ----------------------------------------------------------------
+       Pattern 2 — Internal calls (explicit headers, no Express req)
+       Used for service-initiated calls (e.g. auth service → user service)
+       where there is no incoming HTTP request to forward from.
+    ---------------------------------------------------------------- */
+    async get(url, headers, config) {
+        return this.http.get(url, this.mergeHeaders(headers, config));
+    }
+    async post(url, data, headers, config) {
+        return this.http.post(url, data, this.mergeHeaders(headers, config));
+    }
+    async patch(url, data, headers, config) {
+        return this.http.patch(url, data, this.mergeHeaders(headers, config));
+    }
+    async delete(url, headers, config) {
+        return this.http.delete(url, this.mergeHeaders(headers, config));
+    }
     /* ----------------------------------------------------------------
        Private helpers
     ---------------------------------------------------------------- */
-    /**
-     * Merges Authorization + x-request-id into any provided config.
-     * The internal JWT is forwarded as-is — the gateway already minted it.
-     */
     mergeAuth(req, config) {
         const authHeader = req.headers.authorization;
-        // req.id is set by requestId middleware — always a string at this point.
-        // Fall back to x-request-id header if somehow req.id isn't set yet.
         const upstream = req.headers["x-request-id"];
         const requestId = req.id
             ?? (Array.isArray(upstream) ? upstream[0] : upstream)
@@ -85,5 +94,14 @@ class ServiceClient {
             },
         };
     }
+    mergeHeaders(headers, config) {
+        return {
+            ...config,
+            headers: {
+                ...config?.headers,
+                ...headers,
+            },
+        };
+    }
 }
 exports.ServiceClient = ServiceClient;

package/dist/middleware/index.d.ts

@@ -2,3 +2,4 @@ export * from "./error-handler.middleware";
 export * from "./validate.middleware";
 export * from "./request-id.middleware";
 export * from "./authorize.middleware";
+export * from "./validated-merge.middleware";

package/dist/middleware/index.js

@@ -18,3 +18,4 @@ __exportStar(require("./error-handler.middleware"), exports);
 __exportStar(require("./validate.middleware"), exports);
 __exportStar(require("./request-id.middleware"), exports);
 __exportStar(require("./authorize.middleware"), exports);
+__exportStar(require("./validated-merge.middleware"), exports);

package/dist/middleware/validated-merge.middleware.d.ts

@@ -0,0 +1,20 @@
+import { Request, Response, NextFunction } from "express";
+/**
+ * VALIDATED MERGE HELPERS
+ * ─────────────────────────
+ * Used in routes that run two Validator.validate calls (e.g. params + body,
+ * or params + query). Each call overwrites req.validated, so values from
+ * the first validator must be captured before the second runs.
+ *
+ * Pattern:
+ *   Validator.validate(paramsSchema, "params"),   // req.validated = { id }
+ *   captureValidated("id", "_capturedId"),        // stashes id
+ *   Validator.validate(bodySchema, "body"),        // req.validated = { role }
+ *   mergeValidated("id", "_capturedId"),           // req.validated = { id, role }
+ *
+ * The cast through unknown is required — TypeScript won't allow a direct
+ * cast from Request to Record<string, unknown> because they don't overlap
+ * enough. Casting to unknown first tells TypeScript we know what we're doing.
+ */
+export declare const captureValidated: (key: string, tempKey: string) => (req: Request, _res: Response, next: NextFunction) => void;
+export declare const mergeValidated: (key: string, tempKey: string) => (req: Request, _res: Response, next: NextFunction) => void;

package/dist/middleware/validated-merge.middleware.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeValidated = exports.captureValidated = void 0;
+/**
+ * VALIDATED MERGE HELPERS
+ * ─────────────────────────
+ * Used in routes that run two Validator.validate calls (e.g. params + body,
+ * or params + query). Each call overwrites req.validated, so values from
+ * the first validator must be captured before the second runs.
+ *
+ * Pattern:
+ *   Validator.validate(paramsSchema, "params"),   // req.validated = { id }
+ *   captureValidated("id", "_capturedId"),        // stashes id
+ *   Validator.validate(bodySchema, "body"),        // req.validated = { role }
+ *   mergeValidated("id", "_capturedId"),           // req.validated = { id, role }
+ *
+ * The cast through unknown is required — TypeScript won't allow a direct
+ * cast from Request to Record<string, unknown> because they don't overlap
+ * enough. Casting to unknown first tells TypeScript we know what we're doing.
+ */
+const captureValidated = (key, tempKey) => (req, _res, next) => {
+    req[tempKey] =
+        req.validated[key];
+    next();
+};
+exports.captureValidated = captureValidated;
+const mergeValidated = (key, tempKey) => (req, _res, next) => {
+    req.validated = {
+        ...req.validated,
+        [key]: req[tempKey],
+    };
+    next();
+};
+exports.mergeValidated = mergeValidated;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@discover-cloud/shared",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "private": false,
   "type": "commonjs",
   "main": "dist/index.js",