@discover-cloud/shared 1.2.9 → 1.4.0

package/dist/enums/auth-service.enums.js

@@ -1,17 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccountRole = exports.AccountStatus = void 0;
-var AccountStatus;
-(function (AccountStatus) {
-    AccountStatus["ACTIVE"] = "ACTIVE";
-    AccountStatus["SUSPENDED"] = "SUSPENDED";
-    AccountStatus["DELETED"] = "DELETED";
-})(AccountStatus || (exports.AccountStatus = AccountStatus = {}));
-var AccountRole;
-(function (AccountRole) {
-    AccountRole["SUPERADMIN"] = "SUPERADMIN";
-    AccountRole["ADMIN"] = "ADMIN";
-    AccountRole["SUPPORT"] = "SUPPORT";
-    AccountRole["MODERATOR"] = "MODERATOR";
-    AccountRole["USER"] = "USER";
-})(AccountRole || (exports.AccountRole = AccountRole = {}));

package/dist/enums/permissions.types.d.ts

@@ -1,12 +0,0 @@
-export declare enum GlobalPermission {
-    MANAGE_SYSTEM = "manage_system",
-    MANAGE_ALL_ORGS = "manage_all_orgs",
-    MANAGE_USERS = "manage_users",
-    VIEW_SYSTEM_LOGS = "view_system_logs",
-    SUPPORT_ACTIONS = "support_actions",
-    MODERATE_CONTENT = "moderate_content"
-}
-export declare enum OrgPermission {
-    MANAGE_ORG = "manage_org",
-    MANAGE_MEMBERS = "manage_members"
-}

package/dist/enums/permissions.types.js

@@ -1,17 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrgPermission = exports.GlobalPermission = void 0;
-var GlobalPermission;
-(function (GlobalPermission) {
-    GlobalPermission["MANAGE_SYSTEM"] = "manage_system";
-    GlobalPermission["MANAGE_ALL_ORGS"] = "manage_all_orgs";
-    GlobalPermission["MANAGE_USERS"] = "manage_users";
-    GlobalPermission["VIEW_SYSTEM_LOGS"] = "view_system_logs";
-    GlobalPermission["SUPPORT_ACTIONS"] = "support_actions";
-    GlobalPermission["MODERATE_CONTENT"] = "moderate_content";
-})(GlobalPermission || (exports.GlobalPermission = GlobalPermission = {}));
-var OrgPermission;
-(function (OrgPermission) {
-    OrgPermission["MANAGE_ORG"] = "manage_org";
-    OrgPermission["MANAGE_MEMBERS"] = "manage_members";
-})(OrgPermission || (exports.OrgPermission = OrgPermission = {}));

package/dist/enums/user-service.enums.d.ts

@@ -1,32 +0,0 @@
-export declare enum OrganizationRole {
-    OWNER = "OWNER",
-    ADMIN = "ADMIN",
-    EDITOR = "EDITOR",
-    VIEWER = "VIEWER"
-}
-export declare enum UserStatus {
-    ACTIVE = "ACTIVE",
-    SUSPENDED = "SUSPENDED",
-    DELETED = "DELETED"
-}
-export declare enum OrganizationStatus {
-    ACTIVE = "ACTIVE",
-    SUSPENDED = "SUSPENDED",
-    CLOSED = "CLOSED"
-}
-export declare enum MembershipStatus {
-    ACTIVE = "ACTIVE",
-    INVITED = "INVITED",
-    SUSPENDED = "SUSPENDED"
-}
-export declare enum Theme {
-    LIGHT = "LIGHT",
-    DARK = "DARK",
-    SYSTEM = "SYSTEM"
-}
-export declare enum Currency {
-    USD = "USD",
-    EUR = "EUR",
-    GBP = "GBP",
-    INR = "INR"
-}

package/dist/enums/user-service.enums.js

@@ -1,41 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Currency = exports.Theme = exports.MembershipStatus = exports.OrganizationStatus = exports.UserStatus = exports.OrganizationRole = void 0;
-var OrganizationRole;
-(function (OrganizationRole) {
-    OrganizationRole["OWNER"] = "OWNER";
-    OrganizationRole["ADMIN"] = "ADMIN";
-    OrganizationRole["EDITOR"] = "EDITOR";
-    OrganizationRole["VIEWER"] = "VIEWER";
-})(OrganizationRole || (exports.OrganizationRole = OrganizationRole = {}));
-var UserStatus;
-(function (UserStatus) {
-    UserStatus["ACTIVE"] = "ACTIVE";
-    UserStatus["SUSPENDED"] = "SUSPENDED";
-    UserStatus["DELETED"] = "DELETED";
-})(UserStatus || (exports.UserStatus = UserStatus = {}));
-var OrganizationStatus;
-(function (OrganizationStatus) {
-    OrganizationStatus["ACTIVE"] = "ACTIVE";
-    OrganizationStatus["SUSPENDED"] = "SUSPENDED";
-    OrganizationStatus["CLOSED"] = "CLOSED";
-})(OrganizationStatus || (exports.OrganizationStatus = OrganizationStatus = {}));
-var MembershipStatus;
-(function (MembershipStatus) {
-    MembershipStatus["ACTIVE"] = "ACTIVE";
-    MembershipStatus["INVITED"] = "INVITED";
-    MembershipStatus["SUSPENDED"] = "SUSPENDED";
-})(MembershipStatus || (exports.MembershipStatus = MembershipStatus = {}));
-var Theme;
-(function (Theme) {
-    Theme["LIGHT"] = "LIGHT";
-    Theme["DARK"] = "DARK";
-    Theme["SYSTEM"] = "SYSTEM";
-})(Theme || (exports.Theme = Theme = {}));
-var Currency;
-(function (Currency) {
-    Currency["USD"] = "USD";
-    Currency["EUR"] = "EUR";
-    Currency["GBP"] = "GBP";
-    Currency["INR"] = "INR";
-})(Currency || (exports.Currency = Currency = {}));

package/dist/internal/index.d.ts

@@ -1,4 +0,0 @@
-export * from "./internal-jwt.service";
-export * from "./registry";
-export * from "./internal-jwt.types";
-export * from "./internal-key-manager";

package/dist/internal/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./internal-jwt.service"), exports);
-__exportStar(require("./registry"), exports);
-__exportStar(require("./internal-jwt.types"), exports);
-__exportStar(require("./internal-key-manager"), exports);

package/dist/internal/internal-jwt.service.d.ts

@@ -1,13 +0,0 @@
-import { InternalKeyManager } from "./internal-key-manager";
-import { InternalJwtPayload } from "./internal-jwt.types";
-export declare class InternalJwtService {
-    private readonly keyManager;
-    private readonly serviceName;
-    private jwksCache;
-    constructor(keyManager: InternalKeyManager);
-    sign(payload: {
-        requestId: string;
-    }, targetService: string): Promise<string>;
-    verify(token: string): Promise<InternalJwtPayload>;
-    private getRemoteJWKS;
-}

package/dist/internal/internal-jwt.service.js

@@ -1,88 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InternalJwtService = void 0;
-const jose = __importStar(require("jose"));
-class InternalJwtService {
-    constructor(keyManager) {
-        this.keyManager = keyManager;
-        this.jwksCache = new Map();
-        this.serviceName = process.env.SERVICE_NAME || "unknown-service";
-    }
-    async sign(payload, targetService) {
-        const signer = this.keyManager.getPrivateKey();
-        const kid = this.keyManager.getKid();
-        return new jose.SignJWT({
-            ...payload,
-            typ: "internal"
-        })
-            .setProtectedHeader({ alg: "RS256", kid })
-            .setIssuer(this.serviceName)
-            .setAudience(targetService)
-            .setIssuedAt()
-            .setExpirationTime("1m")
-            .sign(signer);
-    }
-    async verify(token) {
-        const unverified = jose.decodeJwt(token);
-        if (!unverified.iss)
-            throw new Error("Missing issuer");
-        if (unverified.typ !== "internal")
-            throw new Error("Invalid token type");
-        const jwks = this.getRemoteJWKS(unverified.iss);
-        const { payload } = await jose.jwtVerify(token, jwks, {
-            algorithms: ["RS256"],
-            audience: this.serviceName,
-            issuer: unverified.iss
-        });
-        return payload;
-    }
-    getRemoteJWKS(issuer) {
-        const envKey = `${issuer.replace(/-/g, "_").toUpperCase()}_URL`;
-        const baseUrl = process.env[envKey];
-        const url = baseUrl
-            ? `${baseUrl}/internal/jwks`
-            : `http://${issuer}/internal/jwks`;
-        if (!this.jwksCache.has(url)) {
-            console.log(`[InternalJwt] Caching JWKS for ${issuer} at ${url}`);
-            this.jwksCache.set(url, jose.createRemoteJWKSet(new URL(url), {
-                cacheMaxAge: 600000,
-                cooldownDuration: 30000
-            }));
-        }
-        return this.jwksCache.get(url);
-    }
-}
-exports.InternalJwtService = InternalJwtService;

package/dist/internal/internal-jwt.types.d.ts

@@ -1,7 +0,0 @@
-import { JWTPayload } from "jose";
-export interface InternalJwtPayload extends JWTPayload {
-    iss: string;
-    aud: string;
-    typ: "internal";
-    requestId: string;
-}

package/dist/internal/internal-jwt.types.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/internal/internal-key-manager.d.ts

@@ -1,16 +0,0 @@
-import { JWK } from "jose";
-import { KeyObject } from "crypto";
-export declare class InternalKeyManager {
-    private privateKey;
-    private publicKey;
-    private jwks;
-    private readonly serviceName;
-    private readonly keyPath;
-    constructor();
-    private init;
-    getPrivateKey(): CryptoKey | KeyObject;
-    getPublicJwks(): {
-        keys: JWK[];
-    };
-    getKid(): string;
-}

package/dist/internal/internal-key-manager.js

@@ -1,67 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InternalKeyManager = void 0;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const jose_1 = require("jose");
-class InternalKeyManager {
-    constructor() {
-        this.jwks = [];
-        this.serviceName = process.env.SERVICE_NAME || "unknown-service";
-        this.keyPath = (() => {
-            const envPath = process.env.INTERNAL_KEYS_PATH;
-            if (!envPath) {
-                console.warn("[InternalKeyManager] INTERNAL_KEYS_PATH not set. Using default: src/keys/internal");
-                return path_1.default.join(process.cwd(), "src/keys/internal");
-            }
-            return path_1.default.isAbsolute(envPath) ? envPath : path_1.default.join(process.cwd(), envPath);
-        })();
-        this.init();
-    }
-    async init() {
-        try {
-            if (!fs_1.default.existsSync(this.keyPath)) {
-                console.error(`[InternalKeyManager] Missing keys directory: ${this.keyPath}`);
-                return;
-            }
-            const privPath = path_1.default.join(this.keyPath, "/private/private.pem");
-            if (fs_1.default.existsSync(privPath)) {
-                const privPem = fs_1.default.readFileSync(privPath, "utf8");
-                this.privateKey = await (0, jose_1.importPKCS8)(privPem, "RS256");
-            }
-            const pubPath = path_1.default.join(this.keyPath, "/public/public.pem");
-            if (fs_1.default.existsSync(pubPath)) {
-                const pubPem = fs_1.default.readFileSync(pubPath, "utf8");
-                this.publicKey = await (0, jose_1.importSPKI)(pubPem, "RS256");
-                const jwk = await (0, jose_1.exportJWK)(this.publicKey);
-                this.jwks = [{
-                        ...jwk,
-                        kid: `${this.serviceName}-internal`,
-                        use: "sig",
-                        alg: "RS256"
-                    }];
-            }
-            console.log(`[InternalKeyManager] Loaded keys for: ${this.serviceName}`);
-        }
-        catch (error) {
-            console.error("[InternalKeyManager] Failed to load keys.", error);
-            if (process.env.NODE_ENV === "production")
-                process.exit(1);
-        }
-    }
-    getPrivateKey() {
-        if (!this.privateKey)
-            throw new Error("Private key not loaded");
-        return this.privateKey;
-    }
-    getPublicJwks() {
-        return { keys: this.jwks };
-    }
-    getKid() {
-        return `${this.serviceName}-internal`;
-    }
-}
-exports.InternalKeyManager = InternalKeyManager;

package/dist/internal/registry.d.ts

@@ -1,8 +0,0 @@
-export declare const SERVICE_REGISTRY: {
-    readonly auth: "auth-service";
-    readonly user: "user-service";
-    readonly billing: "billing-service";
-    readonly notifications: "notification-service";
-};
-export type ServiceName = typeof SERVICE_REGISTRY[keyof typeof SERVICE_REGISTRY];
-export declare const extractServiceName: (url?: string) => ServiceName | null;

package/dist/internal/registry.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractServiceName = exports.SERVICE_REGISTRY = void 0;
-exports.SERVICE_REGISTRY = {
-    auth: "auth-service",
-    user: "user-service",
-    billing: "billing-service",
-    notifications: "notification-service"
-};
-const extractServiceName = (url) => {
-    if (!url)
-        return null;
-    try {
-        const u = new URL(url);
-        // If localhost, infer by port
-        switch (u.port) {
-            case "3001": return "auth-service";
-            case "3002": return "user-service";
-            case "3003": return "billing-service";
-            case "3004": return "notification-service";
-            default: break;
-        }
-        // Docker/K8s case: hostname is service name
-        const host = u.hostname.split(".")[0];
-        if (Object.values(exports.SERVICE_REGISTRY).includes(host)) {
-            return host;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-};
-exports.extractServiceName = extractServiceName;

package/dist/internal/service-client.d.ts

@@ -1,9 +0,0 @@
-import { AxiosInstance } from "axios";
-import { InternalJwtService } from "./internal-jwt.service";
-export declare class ServiceClient {
-    private readonly internalJwt;
-    readonly http: AxiosInstance;
-    constructor(internalJwt: InternalJwtService);
-    private setupRetry;
-    private setupInterceptors;
-}

package/dist/internal/service-client.js

@@ -1,94 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceClient = void 0;
-const axios_1 = __importStar(require("axios"));
-const axios_retry_1 = __importDefault(require("axios-retry"));
-const registry_1 = require("./registry");
-class ServiceClient {
-    constructor(internalJwt) {
-        this.internalJwt = internalJwt;
-        this.http = axios_1.default.create({
-            timeout: 8000,
-            validateStatus: () => true
-        });
-        this.setupRetry();
-        this.setupInterceptors();
-    }
-    setupRetry() {
-        (0, axios_retry_1.default)(this.http, {
-            retries: 3,
-            retryDelay: axios_retry_1.default.exponentialDelay,
-            retryCondition: (err) => {
-                if (axios_retry_1.default.isNetworkError(err))
-                    return true;
-                return (err.response?.status ?? 0) >= 500;
-            }
-        });
-    }
-    setupInterceptors() {
-        this.http.interceptors.request.use(async (config) => {
-            if (!config.headers)
-                config.headers = new axios_1.AxiosHeaders();
-            const reqId = config.headers["x-request-id"] ||
-                `req_${Math.random().toString(36).slice(2)}`;
-            config.headers["x-request-id"] = reqId;
-            const fullUrl = config.url?.startsWith("http")
-                ? config.url
-                : config.baseURL;
-            if (!fullUrl)
-                throw new Error("Missing baseURL or absolute URL for internal service request");
-            const target = (0, registry_1.extractServiceName)(fullUrl);
-            if (!target)
-                throw new Error(`Cannot extract serviceName from ${fullUrl}`);
-            const token = await this.internalJwt.sign({ requestId: reqId }, target);
-            config.headers["x-internal-jwt"] = token;
-            return config;
-        });
-        this.http.interceptors.response.use((res) => {
-            if (res.status >= 200 && res.status < 300)
-                return res;
-            throw {
-                status: res.status,
-                message: res.data?.error?.message ?? "Service Error",
-                details: res.data
-            };
-        });
-    }
-}
-exports.ServiceClient = ServiceClient;

package/dist/jwt/internal-jwt-verifier.d.ts

@@ -1,41 +0,0 @@
-import { AccountRole, GlobalPermission } from "../enums";
-import { InternalJwtPayload, AccessContext } from "../types";
-import { PermissionCacheService } from "../authorization";
-export declare class InternalJwtVerifier {
-    private readonly permissionCache;
-    private readonly jwks;
-    private readonly issuer;
-    private readonly audience;
-    constructor(permissionCache: PermissionCacheService);
-    verifyInternal(token: string): Promise<InternalJwtPayload>;
-    buildAccessContext(token: string): Promise<{
-        payload: InternalJwtPayload;
-        context: AccessContext;
-    }>;
-    /**
-     * hasPermission
-     * Returns true if the context carries the given GlobalPermission.
-     * Machine contexts always return false — they carry no user permissions.
-     */
-    static hasPermission(ctx: AccessContext, permission: GlobalPermission): boolean;
-    /**
-     * requirePermission
-     * Throws JWTClaimValidationFailed if the permission is absent.
-     * Use in middleware for a one-liner gate:
-     *   InternalJwtVerifier.requirePermission(ctx, GlobalPermission.MANAGE_ACCOUNTS);
-     */
-    static requirePermission(ctx: AccessContext, permission: GlobalPermission): void;
-    /**
-     * hasRole
-     * Returns true if the context carries the given AccountRole.
-     * Machine contexts always return false.
-     */
-    static hasRole(ctx: AccessContext, role: AccountRole): boolean;
-    /**
-     * requireRole
-     * Throws JWTClaimValidationFailed if the role doesn't match.
-     * Prefer requirePermission() for most gates — role checks are for the rare
-     * cases where a specific role (not just a permission) must be enforced.
-     */
-    static requireRole(ctx: AccessContext, role: AccountRole): void;
-}