@discover-cloud/shared 1.2.6 → 1.2.8

package/dist/jwt/machine-token-client.d.ts

@@ -2,11 +2,12 @@ import { ILogger } from "../utils";
 export declare class MachineTokenClient {
     private readonly gatewayUrl;
     private readonly serviceId;
+    private readonly internalSecret?;
     private readonly logger;
     private cache;
     private fetchPromise;
-    constructor(gatewayUrl: string, serviceId: string, logger?: ILogger);
+    constructor(gatewayUrl: string, serviceId: string, internalSecret?: string | undefined, logger?: ILogger);
     getToken(requestId?: string): Promise<string>;
-    private isValid;
+    private getValidCachedToken;
     private fetchToken;
 }

package/dist/jwt/machine-token-client.js

@@ -4,16 +4,18 @@ exports.MachineTokenClient = void 0;
 const utils_1 = require("../utils");
 const REFRESH_BUFFER_S = 10;
 class MachineTokenClient {
-    constructor(gatewayUrl, serviceId, logger = utils_1.noopLogger) {
+    constructor(gatewayUrl, serviceId, internalSecret, logger = utils_1.noopLogger) {
         this.gatewayUrl = gatewayUrl;
         this.serviceId = serviceId;
+        this.internalSecret = internalSecret;
         this.logger = logger;
         this.cache = null;
         this.fetchPromise = null;
     }
     async getToken(requestId) {
-        if (this.isValid()) {
-            return this.cache.token;
+        const cachedToken = this.getValidCachedToken();
+        if (cachedToken) {
+            return cachedToken.token;
         }
         if (!this.fetchPromise) {
             this.fetchPromise = this.fetchToken(requestId).finally(() => {
@@ -22,21 +24,32 @@ class MachineTokenClient {
         }
         return this.fetchPromise;
     }
-    isValid() {
-        if (!this.cache)
-            return false;
+    getValidCachedToken() {
+        if (!this.cache) {
+            return null;
+        }
         const nowS = Math.floor(Date.now() / 1000);
-        return this.cache.expiresAt - REFRESH_BUFFER_S > nowS;
+        if (this.cache.expiresAt - REFRESH_BUFFER_S <= nowS) {
+            return null;
+        }
+        return this.cache;
     }
     async fetchToken(requestId) {
         const url = `${this.gatewayUrl}/internal/machine-token`;
         this.logger.debug({ serviceId: this.serviceId, requestId }, "Fetching machine token");
+        const headers = {
+            "content-type": "application/json",
+        };
+        if (this.internalSecret) {
+            headers["x-internal-secret"] = this.internalSecret;
+        }
         const response = await fetch(url, {
             method: "POST",
-            headers: {
-                "content-type": "application/json",
-            },
-            body: JSON.stringify({ serviceId: this.serviceId, requestId }),
+            headers,
+            body: JSON.stringify({
+                serviceId: this.serviceId,
+                requestId,
+            }),
         });
         if (!response.ok) {
             const text = await response.text().catch(() => "(unreadable)");
@@ -48,7 +61,10 @@ class MachineTokenClient {
             token: body.data.token,
             expiresAt: nowS + body.data.expiresIn,
         };
-        this.logger.info({ serviceId: this.serviceId, expiresAt: this.cache.expiresAt }, "Machine token cached");
+        this.logger.info({
+            serviceId: this.serviceId,
+            expiresAt: this.cache.expiresAt,
+        }, "Machine token cached");
         return this.cache.token;
     }
 }

package/dist/middleware/require-auth.middleware.d.ts

@@ -1,6 +1,5 @@
 import { Request, Response, NextFunction } from "express";
-import { AccountRole } from "../enums";
-import { GlobalPermission } from "../enums";
+import { AccountRole, GlobalPermission } from "../enums";
 import { ILogger } from "../utils";
 import { InternalJwtVerifier } from "../jwt/internal-jwt-verifier";
 /**

package/dist/middleware/require-auth.middleware.js

@@ -4,7 +4,6 @@ exports.RequireAuthMiddleware = void 0;
 const jose_1 = require("jose");
 const utils_1 = require("../utils");
 const internal_jwt_verifier_1 = require("../jwt/internal-jwt-verifier");
-const utils_2 = require("../utils");
 /**
  * REQUIRE AUTH MIDDLEWARE  (@discover-cloud/shared)
  * ─────────────────────────────────────────────────────────────────────────
@@ -53,7 +52,7 @@ class RequireAuthMiddleware {
         this.handle = async (req, res, next) => {
             const token = this.extractBearer(req);
             if (!token) {
-                (0, utils_2.failure)(res, req, "Missing Authorization header", "UNAUTHORIZED", 401);
+                (0, utils_1.failure)(res, req, "Missing Authorization header", "UNAUTHORIZED", 401);
                 return;
             }
             try {
@@ -83,11 +82,11 @@ class RequireAuthMiddleware {
             const ctx = req.accessContext;
             if (!ctx) {
                 // Should not happen after handle() — indicates middleware ordering bug
-                (0, utils_2.failure)(res, req, "No access context — ensure requireAuth runs first", "UNAUTHORIZED", 401);
+                (0, utils_1.failure)(res, req, "No access context — ensure requireAuth runs first", "UNAUTHORIZED", 401);
                 return;
             }
             if (!internal_jwt_verifier_1.InternalJwtVerifier.hasPermission(ctx, permission)) {
-                (0, utils_2.failure)(res, req, `Missing required permission: ${permission}`, "FORBIDDEN", 403);
+                (0, utils_1.failure)(res, req, `Missing required permission: ${permission}`, "FORBIDDEN", 403);
                 return;
             }
             next();
@@ -101,11 +100,11 @@ class RequireAuthMiddleware {
         this.requireRole = (role) => (req, res, next) => {
             const ctx = req.accessContext;
             if (!ctx) {
-                (0, utils_2.failure)(res, req, "No access context — ensure requireAuth runs first", "UNAUTHORIZED", 401);
+                (0, utils_1.failure)(res, req, "No access context — ensure requireAuth runs first", "UNAUTHORIZED", 401);
                 return;
             }
             if (!internal_jwt_verifier_1.InternalJwtVerifier.hasRole(ctx, role)) {
-                (0, utils_2.failure)(res, req, `Missing required role: ${role}`, "FORBIDDEN", 403);
+                (0, utils_1.failure)(res, req, `Missing required role: ${role}`, "FORBIDDEN", 403);
                 return;
             }
             next();
@@ -145,19 +144,19 @@ class RequireAuthMiddleware {
      */
     handleJwtError(err, req, res) {
         if (err instanceof jose_1.errors.JWTExpired) {
-            (0, utils_2.failure)(res, req, "Your session has expired. Please log in again.", "TOKEN_EXPIRED", 401);
+            (0, utils_1.failure)(res, req, "Your session has expired. Please log in again.", "TOKEN_EXPIRED", 401);
             return;
         }
         if (err instanceof jose_1.errors.JWTClaimValidationFailed ||
             err instanceof jose_1.errors.JWSSignatureVerificationFailed ||
             err instanceof jose_1.errors.JWSInvalid ||
             err instanceof jose_1.errors.JWTInvalid) {
-            (0, utils_2.failure)(res, req, "Token is invalid or has been tampered with.", "INVALID_TOKEN", 401);
+            (0, utils_1.failure)(res, req, "Token is invalid or has been tampered with.", "INVALID_TOKEN", 401);
             return;
         }
         // Unexpected error — log for investigation, return a safe 503
         this.logger.error({ err, requestId: req.id }, "RequireAuthMiddleware: unexpected error during JWT verification");
-        (0, utils_2.failure)(res, req, "Authentication service is temporarily unavailable.", "SERVICE_UNAVAILABLE", 503);
+        (0, utils_1.failure)(res, req, "Authentication service is temporarily unavailable.", "SERVICE_UNAVAILABLE", 503);
     }
 }
 exports.RequireAuthMiddleware = RequireAuthMiddleware;

package/package.json

@@ -1,36 +1,36 @@
-{
-  "name": "@discover-cloud/shared",
-  "version": "1.2.6",
-  "private": false,
-  "type": "commonjs",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "prepublishOnly": "npm run build"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "axios-retry": "^4.5.0",
-    "jose": "^6.1.3",
-    "redis": "^5.11.0"
-  },
-  "peerDependencies": {
-    "axios": "^1.13.5",
-    "express": "^5.2.1",
-    "zod": "^4.3.6"
-  },
-  "devDependencies": {
-    "@types/express": "^5.0.6",
-    "@types/node": "^25.3.0",
-    "axios": "^1.13.5",
-    "express": "^5.2.1",
-    "typescript": "^5.9.3",
-    "zod": "^4.3.6"
-  }
-}
+{
+  "name": "@discover-cloud/shared",
+  "version": "1.2.8",
+  "private": false,
+  "type": "commonjs",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "axios-retry": "^4.5.0",
+    "jose": "^6.1.3",
+    "redis": "^5.11.0"
+  },
+  "peerDependencies": {
+    "axios": "^1.13.5",
+    "express": "^5.2.1",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.6",
+    "@types/node": "^25.3.0",
+    "axios": "^1.13.5",
+    "express": "^5.2.1",
+    "typescript": "^5.9.3",
+    "zod": "^4.3.6"
+  }
+}