@discover-cloud/shared 1.3.0 → 1.4.0

package/dist/messaging/rabbitmq.client.js

@@ -35,12 +35,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RabbitMQClient = void 0;
 const amqplib = __importStar(require("amqplib"));
+const logger_util_1 = require("../utils/logger.util");
 class RabbitMQClient {
-    constructor(url) {
+    constructor(url, logger = logger_util_1.consoleLogger) {
         this.connection = null;
         this.channel = null;
         this.exchangeName = 'discovercloud.topic';
         this.url = url;
+        this.logger = logger;
     }
     async connect() {
         if (this.connection && this.channel) {
@@ -49,21 +51,23 @@ class RabbitMQClient {
         try {
             this.connection = await amqplib.connect(this.url);
             this.connection.on('error', (err) => {
-                console.error('RabbitMQ Connection Error:', err);
+                this.logger.error(err, 'RabbitMQ Connection Error');
             });
             this.connection.on('close', () => {
-                console.warn('RabbitMQ Connection Closed. Reconnecting...');
+                this.logger.warn('RabbitMQ Connection Closed. Reconnecting...');
                 this.connection = null;
                 this.channel = null;
                 setTimeout(() => this.connect(), 5000);
             });
             this.channel = await this.connection.createChannel();
             // Ensure the main topic exchange exists
-            await this.channel.assertExchange(this.exchangeName, 'topic', { durable: true });
-            console.log('✅ Connected to RabbitMQ');
+            await this.channel.assertExchange(this.exchangeName, 'topic', {
+                durable: true,
+            });
+            this.logger.info('✅ Connected to RabbitMQ');
         }
         catch (error) {
-            console.error('❌ Failed to connect to RabbitMQ:', error);
+            this.logger.error(error, '❌ Failed to connect to RabbitMQ');
             setTimeout(() => this.connect(), 5000);
         }
     }
@@ -104,15 +108,17 @@ class RabbitMQClient {
             try {
                 const payload = JSON.parse(msg.content.toString());
                 await handler(payload);
-                this.channel.ack(msg);
+                // Fix: Use optional chaining instead of non-null assertion (!)
+                this.channel?.ack(msg);
             }
             catch (error) {
-                console.error(`Error processing message from ${queueName}:`, error);
+                this.logger.error(error, `Error processing message from ${queueName}`);
+                // Fix: Use optional chaining instead of non-null assertion (!)
                 // Nack the message and don't requeue, so it goes to the DLX
-                this.channel.nack(msg, false, false);
+                this.channel?.nack(msg, false, false);
             }
         });
-        console.log(`📡 Subscribed to queue [${queueName}] with routing key [${routingKey}]`);
+        this.logger.info(`📡 Subscribed to queue [${queueName}] with routing key [${routingKey}]`);
     }
     async close() {
         if (this.channel) {
@@ -121,7 +127,7 @@ class RabbitMQClient {
         if (this.connection) {
             await this.connection.close();
         }
-        console.log('RabbitMQ connection closed.');
+        this.logger.info('RabbitMQ connection closed.');
     }
 }
 exports.RabbitMQClient = RabbitMQClient;

package/dist/middleware/error-handler.middleware.d.ts

@@ -2,8 +2,8 @@
  * @file error-handler.middleware.ts
  * @description Central Express error handler. Register as the final middleware.
  */
-import { ErrorRequestHandler } from "express";
-import { ILogger } from "../utils";
+import { ErrorRequestHandler } from 'express';
+import { ILogger } from '../utils';
 /**
  * Creates global Express error middleware.
  */

package/dist/middleware/error-handler.middleware.js

@@ -13,9 +13,9 @@ const utils_1 = require("../utils");
  */
 function isMalformedJsonError(err) {
     return (err instanceof SyntaxError &&
-        "status" in err &&
-        typeof err.status === "number" &&
-        "body" in err);
+        'status' in err &&
+        typeof err.status === 'number' &&
+        'body' in err);
 }
 /**
  * Converts any thrown value into Error.
@@ -24,7 +24,7 @@ function normalizeError(err) {
     if (err instanceof Error) {
         return err;
     }
-    if (typeof err === "string") {
+    if (typeof err === 'string') {
         return new Error(err);
     }
     return new Error(JSON.stringify(err));
@@ -40,16 +40,16 @@ function createGlobalErrorHandler(logger = utils_1.noopLogger) {
          * Malformed JSON
          */
         if (isMalformedJsonError(err) && err.status === 400) {
-            logger.warn({ requestId, err: error }, "Malformed JSON payload");
-            (0, utils_1.failure)(res, req, "Invalid JSON payload", "BAD_REQUEST", 400);
+            logger.warn({ requestId, err: error }, 'Malformed JSON payload');
+            (0, utils_1.failure)(res, req, 'Invalid JSON payload', 'BAD_REQUEST', 400);
             return;
         }
         /**
          * Validation failures
          */
         if (err instanceof zod_1.ZodError) {
-            logger.warn({ requestId, err: error }, "Request validation failed");
-            (0, utils_1.failure)(res, req, "Validation failed", "VALIDATION_ERROR", 400, err.flatten());
+            logger.warn({ requestId, err: error }, 'Request validation failed');
+            (0, utils_1.failure)(res, req, 'Validation failed', 'VALIDATION_ERROR', 400, err.flatten());
             return;
         }
         /**
@@ -73,7 +73,7 @@ function createGlobalErrorHandler(logger = utils_1.noopLogger) {
         /**
          * Unknown crashes
          */
-        logger.error({ requestId, err: error }, "Unhandled exception");
-        (0, utils_1.failure)(res, req, "Internal Server Error", "INTERNAL_SERVER_ERROR", 500);
+        logger.error({ requestId, err: error }, 'Unhandled exception');
+        (0, utils_1.failure)(res, req, 'Internal Server Error', 'INTERNAL_SERVER_ERROR', 500);
     };
 }

package/dist/middleware/index.d.ts

@@ -1,10 +1,10 @@
-export * from "./error-handler.middleware";
-export * from "./validate.middleware";
-export * from "./request-context.middleware";
-export * from "./require-machine.middleware";
-export * from "./require-auth.middleware";
-export * from "./require-user.middleware";
-export * from "./require-org-permission.middleware";
-export * from "./require-workspace-permission.middleware";
-export * from "./require-platform-permission.middleware";
-export * from "./require-org-permission-from-body.middleware";
+export * from './error-handler.middleware';
+export * from './validate.middleware';
+export * from './request-context.middleware';
+export * from './require-machine.middleware';
+export * from './require-auth.middleware';
+export * from './require-user.middleware';
+export * from './require-org-permission.middleware';
+export * from './require-workspace-permission.middleware';
+export * from './require-platform-permission.middleware';
+export * from './require-org-permission-from-body.middleware';

package/dist/middleware/request-context.middleware.d.ts

@@ -2,16 +2,5 @@
  * @file request-context.middleware.ts
  * @description Express middleware to assign request tracing and audit metadata context.
  */
-import { Request, Response, NextFunction } from "express";
-/**
- * Attaches request metadata used for:
- * - distributed tracing
- * - audit logs
- * - debugging correlation
- *
- * @param {Request}      req  - Express request object.
- * @param {Response}     res  - Express response object.
- * @param {NextFunction} next - Express next middleware function.
- * @returns {void}
- */
+import { Request, Response, NextFunction } from 'express';
 export declare const requestContext: (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/request-context.middleware.js

@@ -6,68 +6,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.requestContext = void 0;
 const crypto_1 = require("crypto");
-/**
- * Normalizes IPv4-mapped IPv6 addresses.
- *
- * @param {string | null} ip - Raw IP.
- * @returns {string | null} Normalized IP.
- */
+const request_context_storage_1 = require("../context/request-context.storage");
 function normalizeIp(ip) {
-    if (!ip) {
+    if (!ip)
         return null;
+    if (ip === '::1') {
+        return '127.0.0.1';
     }
-    if (ip === "::1") {
-        return "127.0.0.1";
-    }
-    if (ip.startsWith("::ffff:")) {
+    if (ip.startsWith('::ffff:')) {
         return ip.substring(7);
     }
     return ip;
 }
-/**
- * Resolves original client IP forwarded by the API Gateway.
- *
- * Priority:
- * 1. x-forwarded-for
- * 2. x-real-ip
- * 3. socket fallback (local development only)
- *
- * @param {Request} req - Express request object.
- * @returns {string | null} Client IP address.
- */
 function resolveClientIp(req) {
-    const forwarded = req.headers["x-forwarded-for"];
+    const forwarded = req.headers['x-forwarded-for'];
     if (forwarded) {
         const value = Array.isArray(forwarded) ? forwarded[0] : forwarded;
-        return normalizeIp(value.split(",")[0].trim());
+        return normalizeIp(value.split(',')[0].trim());
     }
-    const realIp = req.headers["x-real-ip"];
+    const realIp = req.headers['x-real-ip'];
     if (realIp) {
         return normalizeIp(Array.isArray(realIp) ? realIp[0] : realIp);
     }
     return normalizeIp(req.socket.remoteAddress ?? null);
 }
-/**
- * Attaches request metadata used for:
- * - distributed tracing
- * - audit logs
- * - debugging correlation
- *
- * @param {Request}      req  - Express request object.
- * @param {Response}     res  - Express response object.
- * @param {NextFunction} next - Express next middleware function.
- * @returns {void}
- */
 const requestContext = (req, res, next) => {
-    const upstream = req.headers["x-request-id"];
+    const upstream = req.headers['x-request-id'];
     const requestId = Array.isArray(upstream) ? upstream[0] : (upstream ?? (0, crypto_1.randomUUID)());
-    req.id = requestId;
-    req.requestContext = {
+    // Explicitly type this as AuditRequestContext so TS knows it's mutable
+    // and allows the `.actor` property to be assigned by the auth middlewares later.
+    const context = {
         requestId,
         ipAddress: resolveClientIp(req),
-        userAgent: req.headers["user-agent"] ?? null,
+        userAgent: req.headers['user-agent'] ?? null,
     };
-    res.setHeader("x-request-id", requestId);
-    next();
+    req.id = requestId;
+    req.requestContext = context;
+    res.setHeader('x-request-id', requestId);
+    request_context_storage_1.requestContextStorage.run(context, () => next());
 };
 exports.requestContext = requestContext;

package/dist/middleware/require-auth.middleware.d.ts

@@ -3,29 +3,13 @@
  * @description Authentication boundary middleware. Verifies the internal gateway JWT,
  * builds the auth context, and gates endpoints.
  */
-import { Request, Response, NextFunction } from "express";
-import { ILogger } from "../utils";
-import { UserJwtVerifier } from "../jwt/user-jwt-verifier";
-/**
- * Middleware handling authentication validation.
- * Extracts the JWT, verifies it via UserJwtVerifier, and attaches the AuthContext.
- */
+import { Request, Response, NextFunction } from 'express';
+import { ILogger } from '../utils';
+import { UserJwtVerifier } from '../jwt/user-jwt-verifier';
 export declare class RequireAuthMiddleware {
     private readonly verifier;
     private readonly logger;
-    /**
-     * @param {UserJwtVerifier} verifier - The token verification engine.
-     * @param {ILogger}             [logger] - Optional logger instance.
-     */
     constructor(verifier: UserJwtVerifier, logger?: ILogger);
-    /**
-     * Core Express middleware handler for authenticating requests.
-     *
-     * @param {Request}      req  - Express request object.
-     * @param {Response}     res  - Express response object.
-     * @param {NextFunction} next - Express next function.
-     * @returns {Promise<void>}
-     */
     handle: (req: Request, res: Response, next: NextFunction) => Promise<void>;
     private extractBearer;
     private handleJwtError;

package/dist/middleware/require-auth.middleware.js

@@ -8,41 +8,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RequireAuthMiddleware = void 0;
 const jose_1 = require("jose");
 const utils_1 = require("../utils");
-/**
- * Middleware handling authentication validation.
- * Extracts the JWT, verifies it via UserJwtVerifier, and attaches the AuthContext.
- */
+const request_context_storage_1 = require("../context/request-context.storage");
 class RequireAuthMiddleware {
-    /**
-     * @param {UserJwtVerifier} verifier - The token verification engine.
-     * @param {ILogger}             [logger] - Optional logger instance.
-     */
     constructor(verifier, logger = utils_1.noopLogger) {
         this.verifier = verifier;
         this.logger = logger;
-        /**
-         * Core Express middleware handler for authenticating requests.
-         *
-         * @param {Request}      req  - Express request object.
-         * @param {Response}     res  - Express response object.
-         * @param {NextFunction} next - Express next function.
-         * @returns {Promise<void>}
-         */
         this.handle = async (req, res, next) => {
             const token = this.extractBearer(req);
             if (!token) {
-                (0, utils_1.failure)(res, req, "Missing Authorization header", "UNAUTHORIZED", 401);
+                (0, utils_1.failure)(res, req, 'Missing Authorization header', 'UNAUTHORIZED', 401);
                 return;
             }
             try {
                 const { payload, context } = await this.verifier.buildAccessContext(token);
                 req.authPayload = payload;
                 req.authContext = context;
+                // Attach audit context. Will throw if requestContextStorage is not initialized.
+                request_context_storage_1.RequestContextProvider.setActor(context);
                 this.logger.debug({
                     requestId: req.id,
                     identity: context.accountId,
                     type: context.type,
-                }, "Request authenticated");
+                }, 'Request authenticated');
                 next();
             }
             catch (err) {
@@ -55,29 +42,33 @@ class RequireAuthMiddleware {
     --------------------------------------------------------------------------- */
     extractBearer(req) {
         const header = req.headers.authorization;
-        if (!header) {
+        if (!header)
             return null;
-        }
         const [scheme, token] = header.trim().split(/\s+/);
-        if (scheme !== "Bearer" || !token) {
+        if (scheme !== 'Bearer' || !token)
             return null;
-        }
         return token;
     }
     handleJwtError(err, req, res) {
         if (err instanceof jose_1.errors.JWTExpired) {
-            (0, utils_1.failure)(res, req, "Your session has expired. Please log in again.", "TOKEN_EXPIRED", 401);
+            (0, utils_1.failure)(res, req, 'Your session has expired. Please log in again.', 'TOKEN_EXPIRED', 401);
             return;
         }
         if (err instanceof jose_1.errors.JWTClaimValidationFailed ||
             err instanceof jose_1.errors.JWSSignatureVerificationFailed ||
             err instanceof jose_1.errors.JWSInvalid ||
             err instanceof jose_1.errors.JWTInvalid) {
-            (0, utils_1.failure)(res, req, "Token is invalid or has been tampered with.", "INVALID_TOKEN", 401);
+            (0, utils_1.failure)(res, req, 'Token is invalid or has been tampered with.', 'INVALID_TOKEN', 401);
+            return;
+        }
+        // Catch the specific Developer Error from RequestContextProvider
+        if (err instanceof Error && err.message.includes('AuditRequestContext')) {
+            this.logger.error({ err, requestId: req.id }, 'CRITICAL: RequireAuthMiddleware failed because requestContextStorage is not initialized. Check your middleware order.');
+            (0, utils_1.failure)(res, req, 'Internal server configuration error.', 'INTERNAL_SERVER_ERROR', 500);
             return;
         }
-        this.logger.error({ err, requestId: req.id }, "RequireAuthMiddleware: unexpected error during JWT verification");
-        (0, utils_1.failure)(res, req, "Authentication service is temporarily unavailable.", "SERVICE_UNAVAILABLE", 503);
+        this.logger.error({ err, requestId: req.id }, 'RequireAuthMiddleware: unexpected error during JWT verification');
+        (0, utils_1.failure)(res, req, 'Authentication service is temporarily unavailable.', 'SERVICE_UNAVAILABLE', 503);
     }
 }
 exports.RequireAuthMiddleware = RequireAuthMiddleware;

package/dist/middleware/require-machine.middleware.d.ts

@@ -3,36 +3,11 @@
  * @description Express middleware enforcing auth-service issued machine JWT verification
  * for service-to-service communication endpoints.
  */
-import { RequestHandler } from "express";
-import { ILogger } from "../utils/logger.util";
-/**
- * Configuration options for machine authentication middleware.
- */
+import { RequestHandler } from 'express';
+import { ILogger } from '../utils/logger.util';
 export interface RequireMachineOptions {
-    /**
-     * Auth-service JWKS endpoint used to verify machine JWT signatures.
-     */
     authServiceJwksUri?: string;
-    /**
-     * Service identifiers allowed to access this endpoint.
-     */
     allowedServices?: string[];
-    /**
-     * Optional structured logger.
-     */
     logger?: ILogger;
 }
-/**
- * Creates middleware requiring a valid machine JWT.
- *
- * Flow:
- * - Extract Bearer token
- * - Verify RS256 signature using auth-service JWKS
- * - Validate machine token claims
- * - Apply service allowlist
- * - Attach MachineContext
- *
- * @param {RequireMachineOptions} [options] - Middleware configuration options.
- * @returns {RequestHandler} Express middleware handler.
- */
 export declare function requireMachine(options?: RequireMachineOptions): RequestHandler;

package/dist/middleware/require-machine.middleware.js

@@ -42,29 +42,20 @@ exports.requireMachine = requireMachine;
 const jose = __importStar(require("jose"));
 const logger_util_1 = require("../utils/logger.util");
 const machine_jwt_verifier_1 = require("../jwt/machine-jwt-verifier");
-/**
- * Creates middleware requiring a valid machine JWT.
- *
- * Flow:
- * - Extract Bearer token
- * - Verify RS256 signature using auth-service JWKS
- * - Validate machine token claims
- * - Apply service allowlist
- * - Attach MachineContext
- *
- * @param {RequireMachineOptions} [options] - Middleware configuration options.
- * @returns {RequestHandler} Express middleware handler.
- */
+const request_context_storage_1 = require("../context/request-context.storage");
 function requireMachine(options = {}) {
     const logger = options.logger ?? logger_util_1.noopLogger;
     const verifier = new machine_jwt_verifier_1.MachineJwtVerifier(options.authServiceJwksUri);
     const { allowedServices } = options;
     return async (req, res, next) => {
         const header = req.headers.authorization;
-        if (!header?.startsWith("Bearer ")) {
+        if (!header?.startsWith('Bearer ')) {
             res.status(401).json({
                 success: false,
-                error: { code: "UNAUTHORIZED", message: "Missing Authorization header" },
+                error: {
+                    code: 'UNAUTHORIZED',
+                    message: 'Missing Authorization header',
+                },
             });
             return;
         }
@@ -72,31 +63,33 @@ function requireMachine(options = {}) {
         try {
             const payload = await verifier.verify(token);
             if (allowedServices && !allowedServices.includes(payload.serviceId)) {
-                logger.warn({ requestId: req.id, serviceId: payload.serviceId }, "[requireMachine] Service rejected");
+                logger.warn({ requestId: req.id, serviceId: payload.serviceId }, '[requireMachine] Service rejected');
                 res.status(403).json({
                     success: false,
                     error: {
-                        code: "FORBIDDEN",
-                        message: "Service is not permitted to access this endpoint",
+                        code: 'FORBIDDEN',
+                        message: 'Service is not permitted to access this endpoint',
                     },
                 });
                 return;
             }
             const context = {
-                type: "machine",
+                type: 'machine',
                 serviceId: payload.serviceId,
                 scopes: payload.scopes,
             };
             req.authPayload = payload;
             req.authContext = context;
-            logger.debug({ requestId: req.id, serviceId: payload.serviceId, jti: payload.jti }, "[requireMachine] Machine authenticated");
+            // Attach audit context. Will throw if requestContextStorage is not initialized.
+            request_context_storage_1.RequestContextProvider.setActor(context);
+            logger.debug({ requestId: req.id, serviceId: payload.serviceId, jti: payload.jti }, '[requireMachine] Machine authenticated');
             next();
         }
         catch (err) {
             if (err instanceof jose.errors.JWTExpired) {
                 res.status(401).json({
                     success: false,
-                    error: { code: "TOKEN_EXPIRED", message: "Machine token expired" },
+                    error: { code: 'TOKEN_EXPIRED', message: 'Machine token expired' },
                 });
                 return;
             }
@@ -106,16 +99,28 @@ function requireMachine(options = {}) {
                 err instanceof jose.errors.JWTInvalid) {
                 res.status(401).json({
                     success: false,
-                    error: { code: "INVALID_TOKEN", message: "Invalid machine token" },
+                    error: { code: 'INVALID_TOKEN', message: 'Invalid machine token' },
+                });
+                return;
+            }
+            // Catch the specific Developer Error from RequestContextProvider
+            if (err instanceof Error && err.message.includes('AuditRequestContext')) {
+                logger.error({ err, requestId: req.id }, 'CRITICAL: [requireMachine] failed because requestContextStorage is not initialized. Check middleware order.');
+                res.status(500).json({
+                    success: false,
+                    error: {
+                        code: 'INTERNAL_SERVER_ERROR',
+                        message: 'Internal server configuration error',
+                    },
                 });
                 return;
             }
-            logger.error({ err, requestId: req.id }, "[requireMachine] Machine authentication failure");
+            logger.error({ err, requestId: req.id }, '[requireMachine] Machine authentication failure');
             res.status(503).json({
                 success: false,
                 error: {
-                    code: "SERVICE_UNAVAILABLE",
-                    message: "Machine authentication temporarily unavailable",
+                    code: 'SERVICE_UNAVAILABLE',
+                    message: 'Machine authentication temporarily unavailable',
                 },
             });
         }

package/dist/middleware/require-org-permission-from-body.middleware.js

@@ -9,8 +9,7 @@ exports.createRequireOrgPermissionFromBody = void 0;
 const createRequireOrgPermissionFromBody = (requireOrgPermission) => {
     const requireOrgPermissionFromBody = (permission) => {
         return async (req, res, next) => {
-            const organizationId = req.body?.organizationId ??
-                req.validated?.body?.organizationId;
+            const organizationId = req.body?.organizationId ?? req.validated?.body?.organizationId;
             if (!organizationId) {
                 return next();
             }

package/dist/middleware/require-org-permission.middleware.d.ts

@@ -2,9 +2,9 @@
  * @file require-org-permission.middleware.ts
  * @description Express middleware generator to enforce organization-scoped permission checks.
  */
-import { RequestHandler } from "express";
-import { Permission } from "../enums";
-import { PermissionCacheService } from "../authorization/permission-cache.service";
+import { RequestHandler } from 'express';
+import { Permission } from '../enums';
+import { PermissionCacheService } from '../authorization/permission-cache.service';
 /**
  * Creates requireOrgPermission middleware factory.
  *