@futdevpro/nts-dynamo 1.15.154 → 1.15.156

package/build/_modules/admin-auth/_models/admin-api-key-config.interface.d.ts

@@ -1,32 +1,32 @@
-/**
- * Config a `DyNTS_AdminApiKey_AuthService.configure(...)`-hoz.
- *
- * Minden mezo opcionalis — a default-ok megfelelnek a tipikus hasznalat-eset
- * elvarasanak (DYNTS_ADMIN_API_KEY env var + x-admin-api-key header +
- * Bearer fallback).
- */
-export interface DyNTS_AdminApiKey_Config {
-    /**
-     * Env var nev, ahonnan az admin API key olvasodik.
-     * Default: `DYNTS_ADMIN_API_KEY`.
-     *
-     * Override-olhato pl. multi-tenant deploy-okhoz vagy ha a host app
-     * mas konvenciot kovet (`MY_APP_ADMIN_KEY`, stb.).
-     */
-    envVarName?: string;
-    /**
-     * HTTP header nev (case-insensitive — Express normalizalja lowercase-re).
-     * Default: `x-admin-api-key`.
-     */
-    headerName?: string;
-    /**
-     * Engedi-e az `Authorization: Bearer <key>` fallback-et a primer header
-     * helyett. Default: `true`.
-     *
-     * Hasznos amikor a kliens egy generikus HTTP klienst hasznal ami csak
-     * az Authorization header-t allitja, vagy amikor proxy-k strippelik
-     * a custom header-eket.
-     */
-    allowAuthorizationBearer?: boolean;
-}
+/**
+ * Config a `DyNTS_AdminApiKey_AuthService.configure(...)`-hoz.
+ *
+ * Minden mezo opcionalis — a default-ok megfelelnek a tipikus hasznalat-eset
+ * elvarasanak (DYNTS_ADMIN_API_KEY env var + x-admin-api-key header +
+ * Bearer fallback).
+ */
+export interface DyNTS_AdminApiKey_Config {
+    /**
+     * Env var nev, ahonnan az admin API key olvasodik.
+     * Default: `DYNTS_ADMIN_API_KEY`.
+     *
+     * Override-olhato pl. multi-tenant deploy-okhoz vagy ha a host app
+     * mas konvenciot kovet (`MY_APP_ADMIN_KEY`, stb.).
+     */
+    envVarName?: string;
+    /**
+     * HTTP header nev (case-insensitive — Express normalizalja lowercase-re).
+     * Default: `x-admin-api-key`.
+     */
+    headerName?: string;
+    /**
+     * Engedi-e az `Authorization: Bearer <key>` fallback-et a primer header
+     * helyett. Default: `true`.
+     *
+     * Hasznos amikor a kliens egy generikus HTTP klienst hasznal ami csak
+     * az Authorization header-t allitja, vagy amikor proxy-k strippelik
+     * a custom header-eket.
+     */
+    allowAuthorizationBearer?: boolean;
+}
 //# sourceMappingURL=admin-api-key-config.interface.d.ts.map

package/build/_modules/admin-auth/_models/admin-api-key-config.interface.js

@@ -1,3 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=admin-api-key-config.interface.js.map

package/build/_modules/admin-auth/admin-api-key.auth-service.d.ts

@@ -1,90 +1,90 @@
-import { Request, Response } from 'express';
-import { DyNTS_SingletonServiceBase } from '../../_services/base/singleton.service-base';
-import { DyNTS_AdminApiKey_Config } from './_models/admin-api-key-config.interface';
-/**
- * Admin API key auth service — opt-in HTTP guard a meglevo `DyNTS_Endpoint_Params.preProcesses`
- * mechanizmushoz. Egy env var-ban tarolt fix kulccsal valid-alja a bejovo kerest.
- *
- * **Hasznalat (host app):**
- * ```ts
- * const adminAuth = DyNTS_AdminApiKey_AuthService.getInstance();
- * // opcionalis konfig:
- * // adminAuth.configure({ envVarName: 'MY_KEY', headerName: 'x-my-key' });
- *
- * new DyNTS_Endpoint_Params({
- *   ...,
- *   preProcesses: [adminAuth.verify, ...other],
- * });
- *
- * // vagy a logs routing module-on at
- * DyNTS_getLogsRoutingModule({ authPreProcess: adminAuth.verify });
- * ```
- *
- * **Viselkedes:**
- * - env var beallitva ES helyes header → silent pass
- * - env var beallitva, header hianyzik / rossz → 401 DyFM_Error
- * - env var NINCS beallitva → 500 DyFM_Error (fail-closed; NEM silent allow)
- *
- * **Header lookup:**
- * 1. `x-admin-api-key` (default canonical header)
- * 2. `Authorization: Bearer <key>` (fallback ha `allowAuthorizationBearer === true`)
- *
- * **Timing-safe:** `crypto.timingSafeEqual` Buffer-konvertalassal. Length-mismatch
- * eseten dummy compare-rel azonos idő, hogy a kulcs-hossz ne szivarogjon ki.
- *
- * **Env var read-on-each-call:** a `verify()` minden hivasnal olvassa az env-et,
- * nem cache-eli. Igy a host az env-et utolagosan is allithatja (pl. config
- * loader az auth.service.install() utan).
- *
- * **Singleton:** `getInstance()`-szel hivd. A `.verify` mezo binding-elve van
- * `this`-re, igy direkt atadhato `preProcesses`-be ujracsomagolas nelkul.
- */
-export declare class DyNTS_AdminApiKey_AuthService extends DyNTS_SingletonServiceBase {
-    static getInstance(): DyNTS_AdminApiKey_AuthService;
-    private envVarName;
-    private headerName;
-    private allowAuthorizationBearer;
-    /**
-     * Konfig override. Hianyzo mezok a default-okat orzik.
-     * Hivhato barmikor — a `verify()` a friss config-ot olvassa.
-     */
-    configure(config: DyNTS_AdminApiKey_Config): void;
-    /**
-     * Aktualis konfig olvasasa (test/diagnosztika celokra).
-     */
-    getConfig(): Required<DyNTS_AdminApiKey_Config>;
-    /**
-     * Pre-process function — atadhato `DyNTS_Endpoint_Params.preProcesses`-be,
-     * vagy `DyNTS_getLogsRoutingModule({ authPreProcess: ... })`-be.
-     *
-     * Throws:
-     *   - 500 ha az env var nincs beallitva (vagy ures string)
-     *   - 401 ha a header hianyzik vagy nem egyezik
-     *
-     * A `req`/`res` parametereket NEM modositja (a kerest tovabb engedi a tovabbi
-     * preProcess-eknek; csak hiba eseten throw-ol).
-     */
-    readonly verify: (req: Request, _res: Response) => Promise<void>;
-    /**
-     * Header lookup — elobb a primer header, aztan opcionalisan az Authorization Bearer.
-     * Az ures string is "hianyzo"-nak szamit (a Buffer.from('') es timingSafeEqual
-     * konzisztencia miatt).
-     */
-    private extractKeyFromRequest;
-    /**
-     * Timing-safe compare ket string kozott. Length-mismatch eseten egy dummy
-     * compare-rel azonos idot kenyszeritunk (a kulcs-hossz nem szivaroghat ki
-     * timing-attackal).
-     *
-     * crypto.timingSafeEqual KOTELEZOEN azonos Buffer-hosszt var — kulonbozo
-     * hosszra throw-ol, ezert vizsgaljuk elobb a length-et es csak utana
-     * compare-elunk.
-     */
-    private timingSafeEquals;
-    /**
-     * Test-only: visszaallitja a default config-ot, hogy a specfajlok ne szivarogjak
-     * at egymas state-jet. Production code NE hivja.
-     */
-    _resetForTesting(): void;
-}
+import { Request, Response } from 'express';
+import { DyNTS_SingletonServiceBase } from '../../_services/base/singleton.service-base';
+import { DyNTS_AdminApiKey_Config } from './_models/admin-api-key-config.interface';
+/**
+ * Admin API key auth service — opt-in HTTP guard a meglevo `DyNTS_Endpoint_Params.preProcesses`
+ * mechanizmushoz. Egy env var-ban tarolt fix kulccsal valid-alja a bejovo kerest.
+ *
+ * **Hasznalat (host app):**
+ * ```ts
+ * const adminAuth = DyNTS_AdminApiKey_AuthService.getInstance();
+ * // opcionalis konfig:
+ * // adminAuth.configure({ envVarName: 'MY_KEY', headerName: 'x-my-key' });
+ *
+ * new DyNTS_Endpoint_Params({
+ *   ...,
+ *   preProcesses: [adminAuth.verify, ...other],
+ * });
+ *
+ * // vagy a logs routing module-on at
+ * DyNTS_getLogsRoutingModule({ authPreProcess: adminAuth.verify });
+ * ```
+ *
+ * **Viselkedes:**
+ * - env var beallitva ES helyes header → silent pass
+ * - env var beallitva, header hianyzik / rossz → 401 DyFM_Error
+ * - env var NINCS beallitva → 500 DyFM_Error (fail-closed; NEM silent allow)
+ *
+ * **Header lookup:**
+ * 1. `x-admin-api-key` (default canonical header)
+ * 2. `Authorization: Bearer <key>` (fallback ha `allowAuthorizationBearer === true`)
+ *
+ * **Timing-safe:** `crypto.timingSafeEqual` Buffer-konvertalassal. Length-mismatch
+ * eseten dummy compare-rel azonos idő, hogy a kulcs-hossz ne szivarogjon ki.
+ *
+ * **Env var read-on-each-call:** a `verify()` minden hivasnal olvassa az env-et,
+ * nem cache-eli. Igy a host az env-et utolagosan is allithatja (pl. config
+ * loader az auth.service.install() utan).
+ *
+ * **Singleton:** `getInstance()`-szel hivd. A `.verify` mezo binding-elve van
+ * `this`-re, igy direkt atadhato `preProcesses`-be ujracsomagolas nelkul.
+ */
+export declare class DyNTS_AdminApiKey_AuthService extends DyNTS_SingletonServiceBase {
+    static getInstance(): DyNTS_AdminApiKey_AuthService;
+    private envVarName;
+    private headerName;
+    private allowAuthorizationBearer;
+    /**
+     * Konfig override. Hianyzo mezok a default-okat orzik.
+     * Hivhato barmikor — a `verify()` a friss config-ot olvassa.
+     */
+    configure(config: DyNTS_AdminApiKey_Config): void;
+    /**
+     * Aktualis konfig olvasasa (test/diagnosztika celokra).
+     */
+    getConfig(): Required<DyNTS_AdminApiKey_Config>;
+    /**
+     * Pre-process function — atadhato `DyNTS_Endpoint_Params.preProcesses`-be,
+     * vagy `DyNTS_getLogsRoutingModule({ authPreProcess: ... })`-be.
+     *
+     * Throws:
+     *   - 500 ha az env var nincs beallitva (vagy ures string)
+     *   - 401 ha a header hianyzik vagy nem egyezik
+     *
+     * A `req`/`res` parametereket NEM modositja (a kerest tovabb engedi a tovabbi
+     * preProcess-eknek; csak hiba eseten throw-ol).
+     */
+    readonly verify: (req: Request, _res: Response) => Promise<void>;
+    /**
+     * Header lookup — elobb a primer header, aztan opcionalisan az Authorization Bearer.
+     * Az ures string is "hianyzo"-nak szamit (a Buffer.from('') es timingSafeEqual
+     * konzisztencia miatt).
+     */
+    private extractKeyFromRequest;
+    /**
+     * Timing-safe compare ket string kozott. Length-mismatch eseten egy dummy
+     * compare-rel azonos idot kenyszeritunk (a kulcs-hossz nem szivaroghat ki
+     * timing-attackal).
+     *
+     * crypto.timingSafeEqual KOTELEZOEN azonos Buffer-hosszt var — kulonbozo
+     * hosszra throw-ol, ezert vizsgaljuk elobb a length-et es csak utana
+     * compare-elunk.
+     */
+    private timingSafeEquals;
+    /**
+     * Test-only: visszaallitja a default config-ot, hogy a specfajlok ne szivarogjak
+     * at egymas state-jet. Production code NE hivja.
+     */
+    _resetForTesting(): void;
+}
 //# sourceMappingURL=admin-api-key.auth-service.d.ts.map

package/build/_modules/admin-auth/admin-api-key.auth-service.js

@@ -1,195 +1,195 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DyNTS_AdminApiKey_AuthService = void 0;
-const tslib_1 = require("tslib");
-const crypto = tslib_1.__importStar(require("crypto"));
-const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
-const singleton_service_base_1 = require("../../_services/base/singleton.service-base");
-const global_settings_const_1 = require("../../_collections/global-settings.const");
-/** Default env var nev az admin API key-hez. */
-const DEFAULT_ENV_VAR_NAME = 'DYNTS_ADMIN_API_KEY';
-/** Default header nev (Express lowercase-re normalizalja az osszes header-t). */
-const DEFAULT_HEADER_NAME = 'x-admin-api-key';
-/** Default Bearer fallback engedelyezve van. */
-const DEFAULT_ALLOW_BEARER = true;
-/** Service-nev az error-okhoz. */
-const SERVICE_NAME = 'DyNTS_AdminApiKey_AuthService';
-/** ErrorCode prefix — system shortcode + saját kod. */
-const buildErrorCode = (subcode) => {
-    const sys = global_settings_const_1.DyNTS_global_settings.systemShortCodeName ?? 'DyNTS';
-    return `${sys}|DyNTS-AAK-${subcode}`;
-};
-/**
- * Admin API key auth service — opt-in HTTP guard a meglevo `DyNTS_Endpoint_Params.preProcesses`
- * mechanizmushoz. Egy env var-ban tarolt fix kulccsal valid-alja a bejovo kerest.
- *
- * **Hasznalat (host app):**
- * ```ts
- * const adminAuth = DyNTS_AdminApiKey_AuthService.getInstance();
- * // opcionalis konfig:
- * // adminAuth.configure({ envVarName: 'MY_KEY', headerName: 'x-my-key' });
- *
- * new DyNTS_Endpoint_Params({
- *   ...,
- *   preProcesses: [adminAuth.verify, ...other],
- * });
- *
- * // vagy a logs routing module-on at
- * DyNTS_getLogsRoutingModule({ authPreProcess: adminAuth.verify });
- * ```
- *
- * **Viselkedes:**
- * - env var beallitva ES helyes header → silent pass
- * - env var beallitva, header hianyzik / rossz → 401 DyFM_Error
- * - env var NINCS beallitva → 500 DyFM_Error (fail-closed; NEM silent allow)
- *
- * **Header lookup:**
- * 1. `x-admin-api-key` (default canonical header)
- * 2. `Authorization: Bearer <key>` (fallback ha `allowAuthorizationBearer === true`)
- *
- * **Timing-safe:** `crypto.timingSafeEqual` Buffer-konvertalassal. Length-mismatch
- * eseten dummy compare-rel azonos idő, hogy a kulcs-hossz ne szivarogjon ki.
- *
- * **Env var read-on-each-call:** a `verify()` minden hivasnal olvassa az env-et,
- * nem cache-eli. Igy a host az env-et utolagosan is allithatja (pl. config
- * loader az auth.service.install() utan).
- *
- * **Singleton:** `getInstance()`-szel hivd. A `.verify` mezo binding-elve van
- * `this`-re, igy direkt atadhato `preProcesses`-be ujracsomagolas nelkul.
- */
-class DyNTS_AdminApiKey_AuthService extends singleton_service_base_1.DyNTS_SingletonServiceBase {
-    static getInstance() {
-        return DyNTS_AdminApiKey_AuthService.getSingletonInstance();
-    }
-    envVarName = DEFAULT_ENV_VAR_NAME;
-    headerName = DEFAULT_HEADER_NAME;
-    allowAuthorizationBearer = DEFAULT_ALLOW_BEARER;
-    /**
-     * Konfig override. Hianyzo mezok a default-okat orzik.
-     * Hivhato barmikor — a `verify()` a friss config-ot olvassa.
-     */
-    configure(config) {
-        if (config.envVarName !== undefined) {
-            this.envVarName = config.envVarName;
-        }
-        if (config.headerName !== undefined) {
-            // Express lowercase-re normalizal — itt is lowercase-eljuk a konzisztenciaert
-            this.headerName = config.headerName.toLowerCase();
-        }
-        if (config.allowAuthorizationBearer !== undefined) {
-            this.allowAuthorizationBearer = config.allowAuthorizationBearer;
-        }
-    }
-    /**
-     * Aktualis konfig olvasasa (test/diagnosztika celokra).
-     */
-    getConfig() {
-        return {
-            envVarName: this.envVarName,
-            headerName: this.headerName,
-            allowAuthorizationBearer: this.allowAuthorizationBearer,
-        };
-    }
-    /**
-     * Pre-process function — atadhato `DyNTS_Endpoint_Params.preProcesses`-be,
-     * vagy `DyNTS_getLogsRoutingModule({ authPreProcess: ... })`-be.
-     *
-     * Throws:
-     *   - 500 ha az env var nincs beallitva (vagy ures string)
-     *   - 401 ha a header hianyzik vagy nem egyezik
-     *
-     * A `req`/`res` parametereket NEM modositja (a kerest tovabb engedi a tovabbi
-     * preProcess-eknek; csak hiba eseten throw-ol).
-     */
-    verify = async (req, _res) => {
-        const expectedKey = process.env[this.envVarName] ?? '';
-        if (expectedKey.length === 0) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                status: 500,
-                errorCode: buildErrorCode('CONFIG'),
-                addECToUserMsg: true,
-                message: `Admin API key not configured: env var ${this.envVarName} is not set or empty`,
-                userMessage: 'Server configuration error',
-                issuerService: SERVICE_NAME,
-            });
-        }
-        const providedKey = this.extractKeyFromRequest(req);
-        if (providedKey === null) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                status: 401,
-                errorCode: buildErrorCode('MISSING'),
-                addECToUserMsg: true,
-                message: `Admin API key required (expected header: ${this.headerName})`,
-                userMessage: 'Admin API key required',
-                issuerService: SERVICE_NAME,
-            });
-        }
-        if (!this.timingSafeEquals(providedKey, expectedKey)) {
-            throw new fsm_dynamo_1.DyFM_Error({
-                status: 401,
-                errorCode: buildErrorCode('INVALID'),
-                addECToUserMsg: true,
-                message: 'Admin API key invalid',
-                userMessage: 'Admin API key invalid',
-                issuerService: SERVICE_NAME,
-            });
-        }
-        // Silent pass — return resolved promise
-    };
-    /**
-     * Header lookup — elobb a primer header, aztan opcionalisan az Authorization Bearer.
-     * Az ures string is "hianyzo"-nak szamit (a Buffer.from('') es timingSafeEqual
-     * konzisztencia miatt).
-     */
-    extractKeyFromRequest(req) {
-        // Primer header
-        const primary = req.headers[this.headerName];
-        const primaryStr = Array.isArray(primary) ? primary[0] ?? '' : (typeof primary === 'string' ? primary : '');
-        if (primaryStr.length > 0) {
-            return primaryStr;
-        }
-        // Authorization Bearer fallback
-        if (this.allowAuthorizationBearer) {
-            const authHeader = req.headers['authorization'];
-            const authStr = Array.isArray(authHeader) ? authHeader[0] ?? '' : (typeof authHeader === 'string' ? authHeader : '');
-            if (authStr.toLowerCase().startsWith('bearer ')) {
-                const token = authStr.substring(7).trim();
-                if (token.length > 0) {
-                    return token;
-                }
-            }
-        }
-        return null;
-    }
-    /**
-     * Timing-safe compare ket string kozott. Length-mismatch eseten egy dummy
-     * compare-rel azonos idot kenyszeritunk (a kulcs-hossz nem szivaroghat ki
-     * timing-attackal).
-     *
-     * crypto.timingSafeEqual KOTELEZOEN azonos Buffer-hosszt var — kulonbozo
-     * hosszra throw-ol, ezert vizsgaljuk elobb a length-et es csak utana
-     * compare-elunk.
-     */
-    timingSafeEquals(a, b) {
-        const aBuf = Buffer.from(a, 'utf-8');
-        const bBuf = Buffer.from(b, 'utf-8');
-        if (aBuf.length !== bBuf.length) {
-            // Dummy compare ugyanazzal a string-gel: konstans ideju mukodest biztosit
-            // mielott visszaternenk false-szal — igy a length-mismatch nem szivaroghat ki.
-            crypto.timingSafeEqual(bBuf, bBuf);
-            return false;
-        }
-        return crypto.timingSafeEqual(aBuf, bBuf);
-    }
-    /**
-     * Test-only: visszaallitja a default config-ot, hogy a specfajlok ne szivarogjak
-     * at egymas state-jet. Production code NE hivja.
-     */
-    _resetForTesting() {
-        this.envVarName = DEFAULT_ENV_VAR_NAME;
-        this.headerName = DEFAULT_HEADER_NAME;
-        this.allowAuthorizationBearer = DEFAULT_ALLOW_BEARER;
-    }
-}
-exports.DyNTS_AdminApiKey_AuthService = DyNTS_AdminApiKey_AuthService;
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyNTS_AdminApiKey_AuthService = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const fsm_dynamo_1 = require("@futdevpro/fsm-dynamo");
+const singleton_service_base_1 = require("../../_services/base/singleton.service-base");
+const global_settings_const_1 = require("../../_collections/global-settings.const");
+/** Default env var nev az admin API key-hez. */
+const DEFAULT_ENV_VAR_NAME = 'DYNTS_ADMIN_API_KEY';
+/** Default header nev (Express lowercase-re normalizalja az osszes header-t). */
+const DEFAULT_HEADER_NAME = 'x-admin-api-key';
+/** Default Bearer fallback engedelyezve van. */
+const DEFAULT_ALLOW_BEARER = true;
+/** Service-nev az error-okhoz. */
+const SERVICE_NAME = 'DyNTS_AdminApiKey_AuthService';
+/** ErrorCode prefix — system shortcode + saját kod. */
+const buildErrorCode = (subcode) => {
+    const sys = global_settings_const_1.DyNTS_global_settings.systemShortCodeName ?? 'DyNTS';
+    return `${sys}|DyNTS-AAK-${subcode}`;
+};
+/**
+ * Admin API key auth service — opt-in HTTP guard a meglevo `DyNTS_Endpoint_Params.preProcesses`
+ * mechanizmushoz. Egy env var-ban tarolt fix kulccsal valid-alja a bejovo kerest.
+ *
+ * **Hasznalat (host app):**
+ * ```ts
+ * const adminAuth = DyNTS_AdminApiKey_AuthService.getInstance();
+ * // opcionalis konfig:
+ * // adminAuth.configure({ envVarName: 'MY_KEY', headerName: 'x-my-key' });
+ *
+ * new DyNTS_Endpoint_Params({
+ *   ...,
+ *   preProcesses: [adminAuth.verify, ...other],
+ * });
+ *
+ * // vagy a logs routing module-on at
+ * DyNTS_getLogsRoutingModule({ authPreProcess: adminAuth.verify });
+ * ```
+ *
+ * **Viselkedes:**
+ * - env var beallitva ES helyes header → silent pass
+ * - env var beallitva, header hianyzik / rossz → 401 DyFM_Error
+ * - env var NINCS beallitva → 500 DyFM_Error (fail-closed; NEM silent allow)
+ *
+ * **Header lookup:**
+ * 1. `x-admin-api-key` (default canonical header)
+ * 2. `Authorization: Bearer <key>` (fallback ha `allowAuthorizationBearer === true`)
+ *
+ * **Timing-safe:** `crypto.timingSafeEqual` Buffer-konvertalassal. Length-mismatch
+ * eseten dummy compare-rel azonos idő, hogy a kulcs-hossz ne szivarogjon ki.
+ *
+ * **Env var read-on-each-call:** a `verify()` minden hivasnal olvassa az env-et,
+ * nem cache-eli. Igy a host az env-et utolagosan is allithatja (pl. config
+ * loader az auth.service.install() utan).
+ *
+ * **Singleton:** `getInstance()`-szel hivd. A `.verify` mezo binding-elve van
+ * `this`-re, igy direkt atadhato `preProcesses`-be ujracsomagolas nelkul.
+ */
+class DyNTS_AdminApiKey_AuthService extends singleton_service_base_1.DyNTS_SingletonServiceBase {
+    static getInstance() {
+        return DyNTS_AdminApiKey_AuthService.getSingletonInstance();
+    }
+    envVarName = DEFAULT_ENV_VAR_NAME;
+    headerName = DEFAULT_HEADER_NAME;
+    allowAuthorizationBearer = DEFAULT_ALLOW_BEARER;
+    /**
+     * Konfig override. Hianyzo mezok a default-okat orzik.
+     * Hivhato barmikor — a `verify()` a friss config-ot olvassa.
+     */
+    configure(config) {
+        if (config.envVarName !== undefined) {
+            this.envVarName = config.envVarName;
+        }
+        if (config.headerName !== undefined) {
+            // Express lowercase-re normalizal — itt is lowercase-eljuk a konzisztenciaert
+            this.headerName = config.headerName.toLowerCase();
+        }
+        if (config.allowAuthorizationBearer !== undefined) {
+            this.allowAuthorizationBearer = config.allowAuthorizationBearer;
+        }
+    }
+    /**
+     * Aktualis konfig olvasasa (test/diagnosztika celokra).
+     */
+    getConfig() {
+        return {
+            envVarName: this.envVarName,
+            headerName: this.headerName,
+            allowAuthorizationBearer: this.allowAuthorizationBearer,
+        };
+    }
+    /**
+     * Pre-process function — atadhato `DyNTS_Endpoint_Params.preProcesses`-be,
+     * vagy `DyNTS_getLogsRoutingModule({ authPreProcess: ... })`-be.
+     *
+     * Throws:
+     *   - 500 ha az env var nincs beallitva (vagy ures string)
+     *   - 401 ha a header hianyzik vagy nem egyezik
+     *
+     * A `req`/`res` parametereket NEM modositja (a kerest tovabb engedi a tovabbi
+     * preProcess-eknek; csak hiba eseten throw-ol).
+     */
+    verify = async (req, _res) => {
+        const expectedKey = process.env[this.envVarName] ?? '';
+        if (expectedKey.length === 0) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 500,
+                errorCode: buildErrorCode('CONFIG'),
+                addECToUserMsg: true,
+                message: `Admin API key not configured: env var ${this.envVarName} is not set or empty`,
+                userMessage: 'Server configuration error',
+                issuerService: SERVICE_NAME,
+            });
+        }
+        const providedKey = this.extractKeyFromRequest(req);
+        if (providedKey === null) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 401,
+                errorCode: buildErrorCode('MISSING'),
+                addECToUserMsg: true,
+                message: `Admin API key required (expected header: ${this.headerName})`,
+                userMessage: 'Admin API key required',
+                issuerService: SERVICE_NAME,
+            });
+        }
+        if (!this.timingSafeEquals(providedKey, expectedKey)) {
+            throw new fsm_dynamo_1.DyFM_Error({
+                status: 401,
+                errorCode: buildErrorCode('INVALID'),
+                addECToUserMsg: true,
+                message: 'Admin API key invalid',
+                userMessage: 'Admin API key invalid',
+                issuerService: SERVICE_NAME,
+            });
+        }
+        // Silent pass — return resolved promise
+    };
+    /**
+     * Header lookup — elobb a primer header, aztan opcionalisan az Authorization Bearer.
+     * Az ures string is "hianyzo"-nak szamit (a Buffer.from('') es timingSafeEqual
+     * konzisztencia miatt).
+     */
+    extractKeyFromRequest(req) {
+        // Primer header
+        const primary = req.headers[this.headerName];
+        const primaryStr = Array.isArray(primary) ? primary[0] ?? '' : (typeof primary === 'string' ? primary : '');
+        if (primaryStr.length > 0) {
+            return primaryStr;
+        }
+        // Authorization Bearer fallback
+        if (this.allowAuthorizationBearer) {
+            const authHeader = req.headers['authorization'];
+            const authStr = Array.isArray(authHeader) ? authHeader[0] ?? '' : (typeof authHeader === 'string' ? authHeader : '');
+            if (authStr.toLowerCase().startsWith('bearer ')) {
+                const token = authStr.substring(7).trim();
+                if (token.length > 0) {
+                    return token;
+                }
+            }
+        }
+        return null;
+    }
+    /**
+     * Timing-safe compare ket string kozott. Length-mismatch eseten egy dummy
+     * compare-rel azonos idot kenyszeritunk (a kulcs-hossz nem szivaroghat ki
+     * timing-attackal).
+     *
+     * crypto.timingSafeEqual KOTELEZOEN azonos Buffer-hosszt var — kulonbozo
+     * hosszra throw-ol, ezert vizsgaljuk elobb a length-et es csak utana
+     * compare-elunk.
+     */
+    timingSafeEquals(a, b) {
+        const aBuf = Buffer.from(a, 'utf-8');
+        const bBuf = Buffer.from(b, 'utf-8');
+        if (aBuf.length !== bBuf.length) {
+            // Dummy compare ugyanazzal a string-gel: konstans ideju mukodest biztosit
+            // mielott visszaternenk false-szal — igy a length-mismatch nem szivaroghat ki.
+            crypto.timingSafeEqual(bBuf, bBuf);
+            return false;
+        }
+        return crypto.timingSafeEqual(aBuf, bBuf);
+    }
+    /**
+     * Test-only: visszaallitja a default config-ot, hogy a specfajlok ne szivarogjak
+     * at egymas state-jet. Production code NE hivja.
+     */
+    _resetForTesting() {
+        this.envVarName = DEFAULT_ENV_VAR_NAME;
+        this.headerName = DEFAULT_HEADER_NAME;
+        this.allowAuthorizationBearer = DEFAULT_ALLOW_BEARER;
+    }
+}
+exports.DyNTS_AdminApiKey_AuthService = DyNTS_AdminApiKey_AuthService;
 //# sourceMappingURL=admin-api-key.auth-service.js.map

package/build/_modules/admin-auth/index.d.ts

@@ -1,3 +1,3 @@
-export { DyNTS_AdminApiKey_AuthService } from './admin-api-key.auth-service';
-export { DyNTS_AdminApiKey_Config } from './_models/admin-api-key-config.interface';
+export { DyNTS_AdminApiKey_AuthService } from './admin-api-key.auth-service';
+export { DyNTS_AdminApiKey_Config } from './_models/admin-api-key-config.interface';
 //# sourceMappingURL=index.d.ts.map