@discover-cloud/shared 1.2.9 → 1.4.0

package/dist/jwt/internal-jwt-verifier.js

@@ -1,185 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.InternalJwtVerifier = void 0;
-const jose = __importStar(require("jose"));
-/**
- * INTERNAL JWT VERIFIER  (@discover-cloud/shared)
- * ──────────────────────────────────────────────────
- * Verifies the internal JWT minted by the API Gateway, resolves permissions
- * from Redis, and builds the AccessContext attached to req.accessContext.
- *
- * Key source:
- *   Remote JWKS — fetched from the Gateway at startup and cached for 10 minutes.
- *   Requests made during a JWKS cache miss are blocked until the fetch completes
- *   (jose handles this internally with a deduplication lock).
- *
- * Token flow per request:
- *   1. Extract Bearer token from Authorization header (caller's responsibility)
- *   2. Verify JWT signature, iss, aud, exp, nbf, typ   → verifyInternal()
- *   3. Guard typ === "internal"                         (token confusion protection)
- *   4. For human tokens: resolve perms from Redis       (derive from role on miss)
- *   5. Build and return AccessContext                   → buildAccessContext()
- *
- * Token kinds:
- *   - Human  (isMachine: false) — carries accountId, accountRole, perms
- *   - Machine (isMachine: true) — carries serviceId only; no perms
- *
- * Static helpers:
- *   InternalJwtVerifier.hasPermission / requirePermission / hasRole / requireRole
- *   are pure functions over AccessContext — safe to call anywhere after
- *   auth middleware has run and populated req.accessContext.
- */
-const CLOCK_TOLERANCE_SECONDS = 30;
-const JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; // 10 minutes
-const JWKS_FETCH_TIMEOUT_MS = 5000;
-class InternalJwtVerifier {
-    constructor(permissionCache) {
-        this.permissionCache = permissionCache;
-        const gatewayJwksUri = process.env["GATEWAY_JWKS_URI"] ?? "http://api-gateway:3000/.well-known/jwks.json";
-        this.issuer = process.env["INTERNAL_JWT_ISSUER"] ?? "discover-cloud:api-gateway";
-        this.audience = process.env["INTERNAL_JWT_AUDIENCE"] ?? "discover-cloud:internal";
-        this.jwks = jose.createRemoteJWKSet(new URL(gatewayJwksUri), {
-            cacheMaxAge: JWKS_CACHE_MAX_AGE_MS,
-            timeoutDuration: JWKS_FETCH_TIMEOUT_MS,
-        });
-    }
-    /* ----------------------------------------------------------------
-       verifyInternal
-       Full cryptographic verification + typ guard + clock skew tolerance.
-       Returns the raw verified payload.
-  
-       Use this directly when you need raw JWT claims (e.g. jti for
-       blacklisting). For all other cases, use buildAccessContext() which
-       layers permission resolution on top.
-    ---------------------------------------------------------------- */
-    async verifyInternal(token) {
-        const { payload } = await jose.jwtVerify(token, this.jwks, {
-            issuer: this.issuer,
-            audience: this.audience,
-            algorithms: ["RS256"],
-            clockTolerance: CLOCK_TOLERANCE_SECONDS,
-        });
-        // Explicit typ guard — rejects external tokens (e.g. user-facing access
-        // tokens) that were accidentally forwarded past the gateway. This is a
-        // token confusion defence: even if an external token passes signature
-        // verification (same key pair), it will be rejected here.
-        if (payload.typ !== "internal") {
-            throw new jose.errors.JWTClaimValidationFailed(`Token type mismatch: expected "internal", got "${String(payload.typ)}". ` +
-                `Ensure clients are not forwarding external tokens past the gateway.`, payload, "typ", "check_failed");
-        }
-        return payload;
-    }
-    /* ----------------------------------------------------------------
-       buildAccessContext
-       Primary method — called by RequireAuthMiddleware on every request.
-       Verifies the token, resolves permissions, returns payload + context.
-  
-       Usage in auth middleware:
-         const token = extractBearer(req);
-         const { payload, context } = await verifier.buildAccessContext(token);
-         req.internalAuth  = payload;
-         req.accessContext = context;
-    ---------------------------------------------------------------- */
-    async buildAccessContext(token) {
-        const payload = await this.verifyInternal(token);
-        // Machine token — no user context, no permission cache lookup.
-        // Machine services are authorised by their serviceId + X-Internal-Secret,
-        // not by role-based permissions.
-        if (payload.isMachine === true) {
-            const machinePayload = payload;
-            const context = {
-                kind: "machine",
-                serviceId: machinePayload.serviceId,
-            };
-            return { payload, context };
-        }
-        // Human token — resolve permissions from Redis.
-        // On a cache miss, permissions are derived from the static role map
-        // (no DB call — the role is already verified in the JWT payload).
-        const humanPayload = payload;
-        const perms = await this.permissionCache.resolve(humanPayload.accountId, humanPayload.accountRole);
-        const context = {
-            kind: "human",
-            accountId: humanPayload.accountId,
-            accountRole: humanPayload.accountRole,
-            perms, // always from cache — never read from the JWT directly
-        };
-        return { payload, context };
-    }
-    /* ----------------------------------------------------------------
-       Static helpers — call on req.accessContext after auth middleware runs.
-       These are pure functions; they do not touch Redis or the JWT verifier.
-    ---------------------------------------------------------------- */
-    /**
-     * hasPermission
-     * Returns true if the context carries the given GlobalPermission.
-     * Machine contexts always return false — they carry no user permissions.
-     */
-    static hasPermission(ctx, permission) {
-        return ctx.kind === "human" && ctx.perms.includes(permission);
-    }
-    /**
-     * requirePermission
-     * Throws JWTClaimValidationFailed if the permission is absent.
-     * Use in middleware for a one-liner gate:
-     *   InternalJwtVerifier.requirePermission(ctx, GlobalPermission.MANAGE_ACCOUNTS);
-     */
-    static requirePermission(ctx, permission) {
-        if (!InternalJwtVerifier.hasPermission(ctx, permission)) {
-            throw new jose.errors.JWTClaimValidationFailed(`Missing required permission: ${permission}`, {}, "perms", "check_failed");
-        }
-    }
-    /**
-     * hasRole
-     * Returns true if the context carries the given AccountRole.
-     * Machine contexts always return false.
-     */
-    static hasRole(ctx, role) {
-        return ctx.kind === "human" && ctx.accountRole === role;
-    }
-    /**
-     * requireRole
-     * Throws JWTClaimValidationFailed if the role doesn't match.
-     * Prefer requirePermission() for most gates — role checks are for the rare
-     * cases where a specific role (not just a permission) must be enforced.
-     */
-    static requireRole(ctx, role) {
-        if (!InternalJwtVerifier.hasRole(ctx, role)) {
-            throw new jose.errors.JWTClaimValidationFailed(`Missing required role: ${role}`, {}, "role", "check_failed");
-        }
-    }
-}
-exports.InternalJwtVerifier = InternalJwtVerifier;

package/dist/jwt/jwt-verifier.d.ts

@@ -1,9 +0,0 @@
-import { InternalJwtPayload } from "../types";
-export declare class JwtVerifier {
-    private remoteJWKS;
-    private getJWKS;
-    /**
-     * Verifies the Internal JWT sent by the Gateway.
-     */
-    verifyAccessToken(token: string): Promise<InternalJwtPayload>;
-}

package/dist/jwt/jwt-verifier.js

@@ -1,36 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwtVerifier = void 0;
-const jose_1 = require("jose");
-const errors_1 = require("../errors");
-class JwtVerifier {
-    constructor() {
-        this.remoteJWKS = null;
-    }
-    async getJWKS() {
-        if (!this.remoteJWKS) {
-            const base = process.env.API_GATEWAY_URL;
-            this.remoteJWKS = (0, jose_1.createRemoteJWKSet)(new URL(`${base}/.well-known/jwks.json`));
-        }
-        return this.remoteJWKS;
-    }
-    /**
-     * Verifies the Internal JWT sent by the Gateway.
-     */
-    async verifyAccessToken(token) {
-        try {
-            const JWKS = await this.getJWKS();
-            const { payload } = await (0, jose_1.jwtVerify)(token, JWKS, {
-                issuer: process.env.INTERNAL_JWT_ISSUER,
-                audience: process.env.INTERNAL_JWT_AUDIENCE,
-            });
-            // Cast to our internal payload which includes the jti
-            return payload;
-        }
-        catch (err) {
-            console.error("[JwtVerifier] Internal Token Validation Failed:", err);
-            throw new errors_1.UnauthorizedError("Invalid or expired internal token");
-        }
-    }
-}
-exports.JwtVerifier = JwtVerifier;

package/dist/jwt/service-client.d.ts

@@ -1,7 +0,0 @@
-import { AxiosInstance } from "axios";
-export declare class ServiceClient {
-    readonly http: AxiosInstance;
-    constructor();
-    private setupRetry;
-    private setupInterceptors;
-}

package/dist/jwt/service-client.js

@@ -1,87 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceClient = void 0;
-const axios_1 = __importStar(require("axios"));
-const axios_retry_1 = __importDefault(require("axios-retry"));
-class ServiceClient {
-    constructor() {
-        this.http = axios_1.default.create({
-            timeout: 8000,
-            validateStatus: () => true
-        });
-        this.setupRetry();
-        this.setupInterceptors();
-    }
-    setupRetry() {
-        (0, axios_retry_1.default)(this.http, {
-            retries: 3,
-            retryDelay: axios_retry_1.default.exponentialDelay,
-            retryCondition: (err) => {
-                if (axios_retry_1.default.isNetworkError(err))
-                    return true;
-                return (err.response?.status ?? 0) >= 500;
-            }
-        });
-    }
-    setupInterceptors() {
-        this.http.interceptors.request.use(async (config) => {
-            if (!config.headers)
-                config.headers = new axios_1.AxiosHeaders();
-            // Ensure every request has a tracing ID.
-            // If the caller passed one down from the incoming Express request, use it.
-            // Otherwise, generate a new one.
-            const reqId = config.headers["x-request-id"] ||
-                `req_${Math.random().toString(36).slice(2)}`;
-            config.headers["x-request-id"] = reqId;
-            return config;
-        });
-        this.http.interceptors.response.use((res) => {
-            // Pass through successful responses cleanly
-            if (res.status >= 200 && res.status < 300)
-                return res;
-            // Standardize error throwing for downstream microservice failures
-            throw {
-                status: res.status,
-                message: res.data?.error?.message ?? "Downstream Service Error",
-                details: res.data
-            };
-        });
-    }
-}
-exports.ServiceClient = ServiceClient;

package/dist/middleware/authorize.d.ts

@@ -1,3 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { GlobalPermission } from "../enums";
-export declare const authorize: (permission: GlobalPermission) => (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;

package/dist/middleware/authorize.js

@@ -1,24 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorize = void 0;
-const security_1 = require("../security");
-const authorize = (permission) => {
-    return (req, res, next) => {
-        // 1. Ensure the RequireAuthMiddleware has already run
-        if (!req.accessContext) {
-            return res.status(401).json({
-                success: false,
-                error: { message: "Unauthorized: No access context", code: "UNAUTHORIZED" }
-            });
-        }
-        // 2. Check if the Role in the accessContext has the required Permission
-        if (!(0, security_1.isAllowed)(req.accessContext, permission)) {
-            return res.status(403).json({
-                success: false,
-                error: { message: `Forbidden: Missing permission ${permission}`, code: "FORBIDDEN" }
-            });
-        }
-        next();
-    };
-};
-exports.authorize = authorize;

package/dist/middleware/authorize.middleware.d.ts

@@ -1,54 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { GlobalPermission } from "../enums";
-/**
- * AUTHORIZE MIDDLEWARE  (@discover-cloud/shared)
- * ───────────────────────────────────────────────
- * Permission-gates a route. Must run AFTER requireAuth middleware, which
- * populates req.accessContext from the verified internal JWT + Redis cache.
- *
- * Uses InternalJwtVerifier.hasPermission — permissions come from the Redis
- * permission cache loaded by RequireAuthMiddleware, never from the JWT itself.
- *
- * All error responses go through the shared failure() util to ensure a
- * consistent ApiErrorResponse shape across every service. The error is
- * returned directly (not passed to next()) because these are deterministic
- * middleware guards — there is nothing to recover from downstream.
- *
- * Usage:
- *   router.delete(
- *     "/accounts/:id",
- *     requireAuth,
- *     authorize(GlobalPermission.DELETE_ACCOUNT),
- *     controller.delete,
- *   );
- */
-export declare const authorize: (permission: GlobalPermission) => (req: Request, res: Response, next: NextFunction) => void;
-/**
- * authorizeAny
- * Passes if the context has AT LEAST ONE of the provided permissions.
- * Useful for routes accessible by multiple roles (e.g. SUPPORT_VIEW or VIEW_ANY_ACCOUNT).
- *
- * Usage:
- *   router.get(
- *     "/accounts/:id",
- *     requireAuth,
- *     authorizeAny(GlobalPermission.VIEW_ANY_ACCOUNT, GlobalPermission.SUPPORT_VIEW),
- *     controller.getById,
- *   );
- */
-export declare const authorizeAny: (...permissions: GlobalPermission[]) => (req: Request, res: Response, next: NextFunction) => void;
-/**
- * authorizeAll
- * Passes only if the context has ALL of the provided permissions.
- * Use for routes that require a conjunction of permissions (rare — prefer
- * composing authorize() calls in series if the permissions are independent).
- *
- * Usage:
- *   router.post(
- *     "/accounts/:id/impersonate",
- *     requireAuth,
- *     authorizeAll(GlobalPermission.IMPERSONATE_ACCOUNT, GlobalPermission.MANAGE_ACCOUNTS),
- *     controller.impersonate,
- *   );
- */
-export declare const authorizeAll: (...permissions: GlobalPermission[]) => (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/authorize.middleware.js

@@ -1,104 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.authorizeAll = exports.authorizeAny = exports.authorize = void 0;
-const internal_jwt_verifier_1 = require("../jwt/internal-jwt-verifier");
-const utils_1 = require("../utils");
-/**
- * AUTHORIZE MIDDLEWARE  (@discover-cloud/shared)
- * ───────────────────────────────────────────────
- * Permission-gates a route. Must run AFTER requireAuth middleware, which
- * populates req.accessContext from the verified internal JWT + Redis cache.
- *
- * Uses InternalJwtVerifier.hasPermission — permissions come from the Redis
- * permission cache loaded by RequireAuthMiddleware, never from the JWT itself.
- *
- * All error responses go through the shared failure() util to ensure a
- * consistent ApiErrorResponse shape across every service. The error is
- * returned directly (not passed to next()) because these are deterministic
- * middleware guards — there is nothing to recover from downstream.
- *
- * Usage:
- *   router.delete(
- *     "/accounts/:id",
- *     requireAuth,
- *     authorize(GlobalPermission.DELETE_ACCOUNT),
- *     controller.delete,
- *   );
- */
-const authorize = (permission) => {
-    return (req, res, next) => {
-        // Ensure RequireAuthMiddleware has already run and populated accessContext.
-        // This is a programming error (wrong middleware order), not a client error,
-        // but we surface it as 401 so it doesn't silently pass through.
-        if (!req.accessContext) {
-            (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
-            return;
-        }
-        // Check permission against accessContext.perms (populated from Redis cache).
-        if (!internal_jwt_verifier_1.InternalJwtVerifier.hasPermission(req.accessContext, permission)) {
-            (0, utils_1.failure)(res, req, `Forbidden: Missing permission ${permission}`, "FORBIDDEN", 403);
-            return;
-        }
-        next();
-    };
-};
-exports.authorize = authorize;
-/**
- * authorizeAny
- * Passes if the context has AT LEAST ONE of the provided permissions.
- * Useful for routes accessible by multiple roles (e.g. SUPPORT_VIEW or VIEW_ANY_ACCOUNT).
- *
- * Usage:
- *   router.get(
- *     "/accounts/:id",
- *     requireAuth,
- *     authorizeAny(GlobalPermission.VIEW_ANY_ACCOUNT, GlobalPermission.SUPPORT_VIEW),
- *     controller.getById,
- *   );
- */
-const authorizeAny = (...permissions) => {
-    return (req, res, next) => {
-        const ctx = req.accessContext;
-        if (!ctx) {
-            (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
-            return;
-        }
-        const hasAny = permissions.some((p) => internal_jwt_verifier_1.InternalJwtVerifier.hasPermission(ctx, p));
-        if (!hasAny) {
-            (0, utils_1.failure)(res, req, `Forbidden: Missing one of [${permissions.join(", ")}]`, "FORBIDDEN", 403);
-            return;
-        }
-        next();
-    };
-};
-exports.authorizeAny = authorizeAny;
-/**
- * authorizeAll
- * Passes only if the context has ALL of the provided permissions.
- * Use for routes that require a conjunction of permissions (rare — prefer
- * composing authorize() calls in series if the permissions are independent).
- *
- * Usage:
- *   router.post(
- *     "/accounts/:id/impersonate",
- *     requireAuth,
- *     authorizeAll(GlobalPermission.IMPERSONATE_ACCOUNT, GlobalPermission.MANAGE_ACCOUNTS),
- *     controller.impersonate,
- *   );
- */
-const authorizeAll = (...permissions) => {
-    return (req, res, next) => {
-        const ctx = req.accessContext;
-        if (!ctx) {
-            (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
-            return;
-        }
-        const missingPermissions = permissions.filter((p) => !internal_jwt_verifier_1.InternalJwtVerifier.hasPermission(ctx, p));
-        if (missingPermissions.length > 0) {
-            (0, utils_1.failure)(res, req, `Forbidden: Missing permissions [${missingPermissions.join(", ")}]`, "FORBIDDEN", 403);
-            return;
-        }
-        next();
-    };
-};
-exports.authorizeAll = authorizeAll;

package/dist/middleware/error-handler.d.ts

@@ -1,4 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-export declare class GlobalErrorHandler {
-    static handle(err: unknown, req: Request, res: Response, _next: NextFunction): Response<any, Record<string, any>>;
-}

package/dist/middleware/error-handler.js

@@ -1,23 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GlobalErrorHandler = void 0;
-const zod_1 = require("zod");
-const utils_1 = require("../utils");
-class GlobalErrorHandler {
-    static handle(err, req, res, _next) {
-        // Standardized logging using req.id from your requestId middleware
-        console.error(`[req ${req.id}]`, err);
-        // 1. Zod Validation Errors
-        if (err instanceof zod_1.ZodError) {
-            return (0, utils_1.failure)(res, "Validation failed", 400, err.flatten());
-        }
-        // 2. Custom App Errors (instanceof checks for BadRequestError, etc.)
-        const custom = err;
-        if (custom.statusCode) {
-            return (0, utils_1.failure)(res, custom.message ?? "Error", custom.statusCode, custom.details);
-        }
-        // 3. Fallback: Internal Server Error
-        return (0, utils_1.failure)(res, "Internal Server Error", 500);
-    }
-}
-exports.GlobalErrorHandler = GlobalErrorHandler;

package/dist/middleware/request-id.d.ts

@@ -1,2 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-export declare const requestId: (req: Request, _res: Response, next: NextFunction) => void;

package/dist/middleware/request-id.js

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestId = void 0;
-const crypto_1 = require("crypto");
-const requestId = (req, _res, next) => {
-    req.id = (0, crypto_1.randomUUID)();
-    next();
-};
-exports.requestId = requestId;

package/dist/middleware/request-id.middleware.d.ts

@@ -1,22 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-/**
- * REQUEST ID MIDDLEWARE  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────
- * Attaches a unique request ID to req.id for distributed tracing.
- * Register early in the middleware stack — before any logger or handler
- * that needs to include the request ID in its output.
- *
- * Priority:
- *   1. x-request-id header forwarded by the API Gateway (or load balancer)
- *   2. Newly generated UUID v4 if no upstream header is present
- *
- * Why forward the upstream header?
- *   The gateway mints a requestId and stamps it on every internal request.
- *   If downstream services generate their own IDs, the same logical request
- *   carries different IDs in each service's logs, breaking cross-service
- *   log correlation. Forwarding the upstream ID keeps the trace consistent.
- *
- * The resolved ID is also echoed back on the response via x-request-id
- * so clients and proxies can correlate their own logs with the service's.
- */
-export declare const requestId: (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/request-id.middleware.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestId = void 0;
-const crypto_1 = require("crypto");
-/**
- * REQUEST ID MIDDLEWARE  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────
- * Attaches a unique request ID to req.id for distributed tracing.
- * Register early in the middleware stack — before any logger or handler
- * that needs to include the request ID in its output.
- *
- * Priority:
- *   1. x-request-id header forwarded by the API Gateway (or load balancer)
- *   2. Newly generated UUID v4 if no upstream header is present
- *
- * Why forward the upstream header?
- *   The gateway mints a requestId and stamps it on every internal request.
- *   If downstream services generate their own IDs, the same logical request
- *   carries different IDs in each service's logs, breaking cross-service
- *   log correlation. Forwarding the upstream ID keeps the trace consistent.
- *
- * The resolved ID is also echoed back on the response via x-request-id
- * so clients and proxies can correlate their own logs with the service's.
- */
-const requestId = (req, res, next) => {
-    const upstream = req.headers["x-request-id"];
-    // Header can be a string array (multi-value header) — take the first value.
-    const id = Array.isArray(upstream) ? upstream[0] : (upstream ?? (0, crypto_1.randomUUID)());
-    req.id = id;
-    // Echo back on the response for client-side and proxy-side correlation.
-    res.setHeader("x-request-id", id);
-    next();
-};
-exports.requestId = requestId;

package/dist/middleware/require-auth.d.ts

@@ -1,10 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { InternalJwtPayload } from "../types";
-export interface IJwtVerifier {
-    verifyAccessToken(token: string): Promise<InternalJwtPayload>;
-}
-export declare class RequireAuthMiddleware {
-    private readonly verifier;
-    constructor(verifier: IJwtVerifier);
-    handle: (req: Request, _res: Response, next: NextFunction) => Promise<void>;
-}

package/dist/middleware/require-auth.js

@@ -1,34 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RequireAuthMiddleware = void 0;
-const errors_1 = require("../errors");
-class RequireAuthMiddleware {
-    constructor(verifier) {
-        this.verifier = verifier;
-        this.handle = async (req, _res, next) => {
-            const header = req.headers.authorization;
-            if (!header?.startsWith("Bearer ")) {
-                return next(new errors_1.UnauthorizedError("Missing Authorization header"));
-            }
-            const token = header.slice(7);
-            try {
-                // 1. Verify against Gateway Public Keys
-                const payload = await this.verifier.verifyAccessToken(token);
-                // 2. Store the raw payload (Access to .jti for logouts/suspensions)
-                req.internalAuth = payload;
-                // 3. Build AccessContext if it's a human user
-                if (payload.accountId && payload.accountRole) {
-                    req.accessContext = {
-                        accountId: payload.accountId,
-                        accountRole: payload.accountRole,
-                    };
-                }
-                next();
-            }
-            catch (err) {
-                next(new errors_1.UnauthorizedError("Unauthorized: Token validation failed"));
-            }
-        };
-    }
-}
-exports.RequireAuthMiddleware = RequireAuthMiddleware;