@govish/shared-services 1.4.0 → 1.6.0

package/dist/middleware/authenticateDevice.js

@@ -20,7 +20,7 @@ const deviceService_1 = require("../services/deviceService");
 const officerService_1 = require("../services/officerService");
 const logMode_1 = require("../utils/logMode");
 /**
- * Middleware to authenticate either a device, an officer, or a microservice (via API key)
+ * Middleware to authenticate either a device, an officer, a microservice (via API key), or combinations thereof
  * Checks JWT token and validates against Device or Officer table
  * Also checks for API keys for microservice authentication
  *
@@ -29,7 +29,18 @@ const logMode_1 = require("../utils/logMode");
  * - Device-Token: <device_jwt_token> (for device authentication)
  * - Authorization: Bearer <user_jwt_token> (for officer/user authentication)
  *
- * Priority: API Key > Device Token > Authorization Token
+ * Supports combined authentication:
+ * - API Key + Officer: X-API-Key + Authorization header (sets authType: 'api_key_and_officer')
+ * - Device + Officer: Device-Token + Authorization header (sets authType: 'both')
+ *
+ * Authentication Priority/Combination Logic:
+ * 1. API Key + Officer (if both headers present) -> authType: 'api_key_and_officer'
+ * 2. API Key only (if only X-API-Key present) -> authType: 'api_key'
+ * 3. Device + Officer (if both headers present) -> authType: 'both'
+ * 4. Device only (if only Device-Token present) -> authType: 'device'
+ * 5. Officer only (if only Authorization present) -> authType: 'officer'
+ *
+ * At least one authentication method must succeed for the request to proceed.
  */
 const createAuthenticateDeviceOrOfficer = (deps) => {
     const apiKeyService = new apiKeyService_1.ApiKeyService(deps);
@@ -69,32 +80,122 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
     // Always initialize so we can log to console/logger even if Kafka is not available
     const auditService = new auditService_1.AuditService(deps);
     return (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         try {
-            // First, check for API key (for microservice authentication)
-            const apiKeyHeader = req.headers['x-api-key'];
+            // Track authentication attempts and failures
+            const authAttempts = [];
+            const authFailures = [];
+            // Step 1: Check for API key (for microservice authentication)
+            // Check both normalized headers and rawHeaders to handle case variations
+            let apiKeyHeader;
+            // Check normalized headers first (Express normalizes to lowercase)
+            apiKeyHeader = req.headers['x-api-key'];
+            // If not found, check rawHeaders (case-insensitive search)
+            if (!apiKeyHeader && req.rawHeaders) {
+                const index = req.rawHeaders.findIndex((h) => h.toLowerCase() === 'x-api-key');
+                if (index >= 0 && index < req.rawHeaders.length - 1) {
+                    apiKeyHeader = req.rawHeaders[index + 1];
+                }
+            }
+            let apiKeyAuthenticated = false;
+            let apiKeyFailureReason = null;
             if (apiKeyHeader) {
-                const apiKey = yield apiKeyService.validateApiKey(apiKeyHeader);
-                if (apiKey) {
-                    // Attach API key info to request
-                    req.apiKey = apiKey;
-                    req.microservice = apiKey.microservice;
-                    req.authType = 'api_key';
-                    // Log audit event
-                    if (auditService) {
-                        auditService.logAuditEvent(req, {
-                        // Event type will be determined automatically
-                        }).catch((err) => {
-                            logger.error('Failed to log audit event', { error: err.message });
+                authAttempts.push('api_key');
+                debugLog('[Authentication Flow] Step 1: X-API-Key header detected, starting API key validation');
+                console.log('🔑 [Authentication Flow] Step 1: X-API-Key header detected, starting API key validation', {
+                    headerLength: apiKeyHeader.length,
+                    headerPreview: apiKeyHeader.substring(0, 15) + '...',
+                    endpoint: req.originalUrl || req.url
+                });
+                logger.info('[Authentication Flow] Step 1: X-API-Key header detected', {
+                    endpoint: req.originalUrl || req.url,
+                    method: req.method,
+                    apiKeyPreview: apiKeyHeader.substring(0, 10) + '...',
+                    headerLength: apiKeyHeader.length
+                });
+                try {
+                    const apiKey = yield apiKeyService.validateApiKey(apiKeyHeader);
+                    if (apiKey) {
+                        apiKeyAuthenticated = true;
+                        console.log('✅ [Authentication Flow] Step 1a: API key validation successful');
+                        console.log('   📋 API Key Details:', {
+                            id: apiKey.id,
+                            microservice: apiKey.microservice,
+                            keyPreview: apiKey.key ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                            isActive: apiKey.is_active,
+                            expiresAt: apiKey.expires_at ? new Date(apiKey.expires_at).toISOString() : 'Never'
+                        });
+                        logger.info('[Authentication Flow] Step 1a: API key validation successful', {
+                            apiKeyId: apiKey.id,
+                            microservice: apiKey.microservice,
+                            keyPreview: apiKey.key ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                            isActive: apiKey.is_active,
+                            expiresAt: apiKey.expires_at,
+                            endpoint: req.originalUrl || req.url
                         });
+                        // Attach API key info to request
+                        req.apiKey = apiKey;
+                        req.microservice = apiKey.microservice;
+                        // Don't set authType yet - wait to see if officer is also authenticated
+                        // This allows API key + officer authentication (similar to device + officer)
+                        // Log debug info
+                        debugLog('API Key authentication successful', {
+                            apiKeyId: apiKey.id,
+                            microservice: apiKey.microservice,
+                            endpoint: req.originalUrl || req.url,
+                            method: req.method
+                        });
+                        console.log('[Authentication Flow] Step 1b: API key attached to request, continuing to check for officer authentication');
+                        console.log('   🔍 Checking for Bearer token (Authorization header) to authenticate officer...');
+                        logger.info('[Authentication Flow] Step 1b: API key attached to request, continuing to check for officer authentication');
+                        // Continue to check for officer authentication (similar to device authentication)
+                        // Don't return early - let it go through the same flow as device + officer
+                    }
+                    else {
+                        apiKeyFailureReason = 'Invalid, expired, inactive, or not found';
+                        authFailures.push({ method: 'api_key', reason: apiKeyFailureReason });
+                        console.error('❌ [Authentication Flow] Step 1a: API key validation failed', {
+                            reason: apiKeyFailureReason,
+                            endpoint: req.originalUrl || req.url,
+                            method: req.method,
+                            apiKeyPreview: apiKeyHeader.substring(0, 10) + '...'
+                        });
+                        logger.warn('[Authentication Flow] Step 1a: API key validation failed', {
+                            reason: apiKeyFailureReason,
+                            endpoint: req.originalUrl || req.url,
+                            method: req.method,
+                            apiKeyPreview: apiKeyHeader.substring(0, 10) + '...'
+                        });
+                        // Don't return 401 yet - continue to check Bearer token
                     }
-                    return next();
                 }
-                else {
-                    return res.status(401).json({
-                        message: 'Invalid, expired, or inactive API key'
+                catch (apiKeyError) {
+                    const errorMessage = apiKeyError instanceof Error ? apiKeyError.message : 'Unknown error';
+                    const errorStack = apiKeyError instanceof Error ? apiKeyError.stack : undefined;
+                    apiKeyFailureReason = `Network or validation error: ${errorMessage}`;
+                    authFailures.push({ method: 'api_key', reason: apiKeyFailureReason });
+                    console.error('❌ [Authentication Flow] Step 1a: API key validation error', {
+                        error: errorMessage,
+                        errorStack,
+                        endpoint: req.originalUrl || req.url,
+                        apiKeyPreview: apiKeyHeader.substring(0, 10) + '...'
+                    });
+                    logger.error('[Authentication Flow] Step 1a: API key validation error', {
+                        error: errorMessage,
+                        errorStack,
+                        endpoint: req.originalUrl || req.url,
+                        apiKeyPreview: apiKeyHeader.substring(0, 10) + '...'
                     });
+                    // Don't return 401 yet - continue to check Bearer token
                 }
             }
+            else {
+                // Log when API key header is not present (for debugging)
+                debugLog('[Authentication Flow] Step 1: No X-API-Key header found', {
+                    availableHeaders: Object.keys(req.headers).filter(h => h.toLowerCase().includes('api') || h.toLowerCase().includes('key')),
+                    endpoint: req.originalUrl || req.url
+                });
+            }
             // Check for device-token header (case-insensitive)
             // Express normalizes headers to lowercase, but check multiple variations
             // Also check rawHeaders in case Express hasn't normalized it
@@ -110,7 +211,6 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
                     deviceTokenHeader = req.rawHeaders[index + 1];
                 }
             }
-            const authHeader = req.headers.authorization;
             let deviceAuthenticated = false;
             let officerAuthenticated = false;
             // Authenticate device if Device-Token header is present
@@ -156,6 +256,14 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
                     // Attach device to request
                     req.device = device;
                     deviceAuthenticated = true;
+                    // Log debug info
+                    debugLog('Device authentication successful', {
+                        deviceId: device.id,
+                        deviceDeviceId: device.device_id,
+                        deviceName: device.device_name,
+                        endpoint: req.originalUrl || req.url,
+                        method: req.method
+                    });
                 }
                 catch (error) {
                     // Log audit event for invalid device token
@@ -173,101 +281,471 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
                     return res.status(401).json({ message: 'Invalid or expired device token' });
                 }
             }
-            // Authenticate officer if Authorization header is present
+            // Step 2: Authenticate officer if Authorization header is present
+            let bearerTokenFailureReason = null;
+            const authHeader = req.headers.authorization;
             if (authHeader && authHeader.startsWith('Bearer ')) {
+                authAttempts.push('bearer_token');
+                console.log('🔐 [Authentication Flow] Step 2: Authorization (Bearer) header detected, starting officer authentication');
+                logger.info('[Authentication Flow] Step 2: Authorization header detected, starting officer authentication', {
+                    endpoint: req.originalUrl || req.url,
+                    method: req.method,
+                    hasApiKey: apiKeyAuthenticated,
+                    hasDevice: deviceAuthenticated,
+                    apiKeyFailed: !!apiKeyFailureReason
+                });
                 const token = authHeader.substring(7); // Remove 'Bearer ' prefix
                 try {
+                    console.log('[Authentication Flow] Step 2a: Verifying JWT token');
+                    logger.info('[Authentication Flow] Step 2a: Verifying JWT token');
                     const decoded = jsonwebtoken_1.default.verify(token, jwtConfig.secret, {
                         issuer: jwtConfig.issuer,
                         audience: jwtConfig.audience,
                     });
+                    console.log('✅ [Authentication Flow] Step 2b: JWT token verified successfully', {
+                        tokenType: decoded.type,
+                        hasId: !!decoded.id,
+                        hasSub: !!decoded.sub
+                    });
+                    logger.info('[Authentication Flow] Step 2b: JWT token verified successfully', {
+                        tokenType: decoded.type,
+                        hasId: !!decoded.id,
+                        hasSub: !!decoded.sub
+                    });
                     // Skip if this is a device token (should use Device-Token header instead)
                     if (decoded.type === 'device') {
+                        bearerTokenFailureReason = 'Token is a device token, should use Device-Token header';
+                        authFailures.push({ method: 'bearer_token', reason: bearerTokenFailureReason });
+                        console.warn('⚠️ [Authentication Flow] Step 2c: Token is a device token, should use Device-Token header');
+                        logger.warn('[Authentication Flow] Step 2c: Token is a device token, should use Device-Token header');
                         if (!deviceAuthenticated) {
-                            return res.status(401).json({ message: 'Device tokens should use Device-Token header' });
+                            // Don't return 401 yet - check if we have other valid auth
+                            // Will be handled in final check
+                        }
+                        else {
+                            // If device already authenticated via Device-Token, continue
+                            console.log('[Authentication Flow] Step 2c: Device already authenticated via Device-Token header, continuing');
+                            logger.info('[Authentication Flow] Step 2c: Device already authenticated via Device-Token header, continuing');
                         }
-                        // If device already authenticated via Device-Token, continue
                     }
                     else {
-                        // Authenticate as officer
+                        // Step 2d: Authenticate as officer
+                        console.log('[Authentication Flow] Step 2d: Processing as officer token');
+                        logger.info('[Authentication Flow] Step 2d: Processing as officer token');
                         const officerId = decoded.id || decoded.sub;
                         if (!officerId) {
-                            return res.status(401).json({ message: 'Invalid token payload' });
+                            bearerTokenFailureReason = 'Invalid token payload - no officer ID found';
+                            authFailures.push({ method: 'bearer_token', reason: bearerTokenFailureReason });
+                            console.error('❌ [Authentication Flow] Step 2d: Invalid token payload - no officer ID found');
+                            logger.warn('[Authentication Flow] Step 2d: Invalid token payload - no officer ID found');
+                            // Don't return 401 yet - will be handled in final check
                         }
-                        // Get officer from service (uses Redis cache with auth service fallback)
-                        const officer = yield officerService.getOfficerById(officerId);
-                        if (!officer) {
-                            // Log audit event for officer not found
-                            if (auditService) {
-                                req.authType = 'officer';
-                                auditService.logAuditEvent(req, {
-                                    event_type: undefined, // Will be determined automatically
-                                    response_status: 401,
-                                    error_message: 'Officer not found',
-                                    error_code: 'OFFICER_NOT_FOUND',
-                                }).catch((err) => {
-                                    logger.debug('Failed to log audit event', { error: err.message });
+                        else {
+                            console.log('[Authentication Flow] Step 2e: Fetching officer from service', {
+                                officerId
+                            });
+                            logger.info('[Authentication Flow] Step 2e: Fetching officer from service', {
+                                officerId
+                            });
+                            // Get officer from service (uses Redis cache with auth service fallback)
+                            const officer = yield officerService.getOfficerById(officerId);
+                            if (!officer) {
+                                bearerTokenFailureReason = 'Officer not found';
+                                authFailures.push({ method: 'bearer_token', reason: bearerTokenFailureReason });
+                                console.error('❌ [Authentication Flow] Step 2e: Officer not found', { officerId });
+                                logger.warn('[Authentication Flow] Step 2e: Officer not found', { officerId });
+                                // Don't return 401 yet - will be handled in final check
+                            }
+                            else {
+                                console.log('✅ [Authentication Flow] Step 2f: Officer found and authenticated', {
+                                    officerId: officer.id,
+                                    officerName: officer.name,
+                                    serviceNumber: officer.service_number
+                                });
+                                logger.info('[Authentication Flow] Step 2f: Officer found and authenticated', {
+                                    officerId: officer.id,
+                                    officerName: officer.name,
+                                    serviceNumber: officer.service_number
+                                });
+                                // Attach officer to request
+                                req.officer = officer;
+                                req.user = officer;
+                                officerAuthenticated = true;
+                                // Log debug info
+                                const hasApiKey = !!req.apiKey;
+                                debugLog('Officer authentication successful', {
+                                    officerId: officer.id,
+                                    officerName: officer.name,
+                                    serviceNumber: officer.service_number,
+                                    endpoint: req.originalUrl || req.url,
+                                    method: req.method,
+                                    combinedWithApiKey: hasApiKey,
+                                    apiKeyMicroservice: hasApiKey ? req.apiKey.microservice : undefined
+                                });
+                                console.log('[Authentication Flow] Step 2g: Officer attached to request', {
+                                    officerId: officer.id,
+                                    officerName: officer.name,
+                                    serviceNumber: officer.service_number,
+                                    combinedWithApiKey: hasApiKey,
+                                    combinedWithDevice: deviceAuthenticated
+                                });
+                                // Enhanced logging when officer is authenticated with API key
+                                if (hasApiKey) {
+                                    console.log('═══════════════════════════════════════════════════════════');
+                                    console.log('✅ API KEY + OFFICER AUTHENTICATION SUCCESSFUL:');
+                                    console.log('   🔑 API Key:', {
+                                        id: req.apiKey.id,
+                                        microservice: req.apiKey.microservice,
+                                        keyPreview: req.apiKey.key ? req.apiKey.key.substring(0, 15) + '...' : 'N/A'
+                                    });
+                                    console.log('   👤 Officer:', {
+                                        id: officer.id,
+                                        name: officer.name,
+                                        serviceNumber: officer.service_number,
+                                        email: officer.email
+                                    });
+                                    console.log('═══════════════════════════════════════════════════════════');
+                                }
+                                logger.info('[Authentication Flow] Step 2g: Officer attached to request', {
+                                    officerId: officer.id,
+                                    officerName: officer.name,
+                                    serviceNumber: officer.service_number,
+                                    combinedWithApiKey: hasApiKey,
+                                    combinedWithDevice: deviceAuthenticated
                                 });
                             }
-                            return res.status(401).json({ message: 'Officer not found' });
                         }
-                        // Attach officer to request
-                        req.officer = officer;
-                        req.user = officer;
-                        officerAuthenticated = true;
                     }
                 }
                 catch (error) {
-                    // Log audit event for invalid authorization token
-                    if (auditService) {
-                        req.authType = 'officer';
-                        auditService.logAuditEvent(req, {
-                            event_type: undefined, // Will be determined automatically
-                            response_status: 401,
-                            error_message: error instanceof Error ? error.message : 'Invalid or expired authorization token',
-                            error_code: 'INVALID_AUTH_TOKEN',
-                        }).catch((err) => {
-                            logger.debug('Failed to log audit event', { error: err.message });
-                        });
-                    }
-                    return res.status(401).json({ message: 'Invalid or expired authorization token' });
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    bearerTokenFailureReason = `Invalid or expired token: ${errorMessage}`;
+                    authFailures.push({ method: 'bearer_token', reason: bearerTokenFailureReason });
+                    console.error('❌ [Authentication Flow] Step 2: Bearer token validation error', {
+                        error: errorMessage,
+                        errorStack: error instanceof Error ? error.stack : undefined,
+                        errorName: error instanceof Error ? error.name : undefined
+                    });
+                    logger.error('[Authentication Flow] Step 2: Bearer token validation error', {
+                        error: errorMessage,
+                        errorStack: error instanceof Error ? error.stack : undefined
+                    });
+                    // Don't return 401 yet - will be handled in final check
                 }
             }
+            // Step 3: Determine final authentication status
+            const finalApiKeyAuthenticated = !!req.apiKey;
+            console.log('[Authentication Flow] Step 3: Determining final authentication status', {
+                apiKeyAuthenticated: finalApiKeyAuthenticated,
+                deviceAuthenticated,
+                officerAuthenticated,
+                authAttempts,
+                authFailures: authFailures.length > 0 ? authFailures : 'None'
+            });
+            logger.info('[Authentication Flow] Step 3: Determining final authentication status', {
+                apiKeyAuthenticated: finalApiKeyAuthenticated,
+                deviceAuthenticated,
+                officerAuthenticated,
+                authAttempts,
+                authFailures
+            });
             // At least one authentication method must succeed
-            if (!deviceAuthenticated && !officerAuthenticated) {
+            if (!finalApiKeyAuthenticated && !deviceAuthenticated && !officerAuthenticated) {
+                // Build detailed error message
+                let errorMessage = 'Authentication failed';
+                const failedMethods = [];
+                if (apiKeyFailureReason) {
+                    failedMethods.push(`API key (${apiKeyFailureReason})`);
+                }
+                if (bearerTokenFailureReason) {
+                    failedMethods.push(`Bearer token (${bearerTokenFailureReason})`);
+                }
+                if (failedMethods.length > 0) {
+                    if (failedMethods.length === 1) {
+                        errorMessage = `Authentication failed: ${failedMethods[0]}`;
+                    }
+                    else {
+                        errorMessage = `Authentication failed: Both ${failedMethods.join(' and ')}`;
+                    }
+                }
+                else if (authAttempts.length === 0) {
+                    errorMessage = 'No valid authentication provided. Provide X-API-Key, Device-Token, or Authorization header';
+                }
+                else {
+                    errorMessage = 'All provided authentication methods failed';
+                }
+                console.error('❌ [Authentication Flow] Step 3a: No authentication method succeeded', {
+                    attemptedMethods: authAttempts,
+                    failedMethods: authFailures,
+                    errorMessage
+                });
+                logger.warn('[Authentication Flow] Step 3a: No authentication method succeeded', {
+                    attemptedMethods: authAttempts,
+                    failedMethods: authFailures
+                });
                 // Log audit event for missing authentication
                 if (auditService) {
                     auditService.logAuditEvent(req, {
                         event_type: undefined, // Will be determined automatically
                         response_status: 401,
-                        error_message: 'No valid token provided. Provide either Device-Token or Authorization header',
-                        error_code: 'NO_AUTH_TOKEN',
+                        error_message: errorMessage,
+                        error_code: authAttempts.length === 0 ? 'NO_AUTH_TOKEN' : 'ALL_AUTH_FAILED',
                     }).catch((err) => {
                         logger.debug('Failed to log audit event', { error: err.message });
                     });
                 }
-                return res.status(401).json({ message: 'No valid token provided. Provide either Device-Token or Authorization header' });
+                return res.status(401).json({
+                    message: errorMessage,
+                    failedMethods: authFailures.map(f => f.method),
+                    attemptedMethods: authAttempts
+                });
+            }
+            // Step 3b: Set auth type based on what was authenticated
+            // Priority: API Key + Device + Officer > API Key + Officer > API Key + Device > API Key > Device + Officer > Device > Officer
+            console.log('[Authentication Flow] Step 3b: Setting authentication type');
+            logger.info('[Authentication Flow] Step 3b: Setting authentication type');
+            // Check for all combinations including device + API key
+            if (finalApiKeyAuthenticated && deviceAuthenticated && officerAuthenticated) {
+                // All three: API Key + Device + Officer
+                req.authType = 'api_key_and_officer'; // Use existing type, device info will be preserved
+                const apiKey = req.apiKey;
+                const device = req.device;
+                const officer = req.officer;
+                console.log('═══════════════════════════════════════════════════════════');
+                console.log('✅ [Authentication Flow] Step 3c: Authentication type set to api_key_and_officer (with device)');
+                console.log('   🔑 API Key Being Used:', {
+                    id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    isActive: apiKey === null || apiKey === void 0 ? void 0 : apiKey.is_active,
+                    expiresAt: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.expires_at) ? new Date(apiKey.expires_at).toISOString() : 'Never'
+                });
+                console.log('   📱 Device Being Used:', {
+                    id: device === null || device === void 0 ? void 0 : device.id,
+                    device_id: device === null || device === void 0 ? void 0 : device.device_id,
+                    device_name: device === null || device === void 0 ? void 0 : device.device_name
+                });
+                console.log('   👤 Officer Using This API Key:', {
+                    id: officer === null || officer === void 0 ? void 0 : officer.id,
+                    name: officer === null || officer === void 0 ? void 0 : officer.name,
+                    serviceNumber: officer === null || officer === void 0 ? void 0 : officer.service_number,
+                    email: officer === null || officer === void 0 ? void 0 : officer.email
+                });
+                console.log('═══════════════════════════════════════════════════════════');
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to api_key_and_officer (with device)', {
+                    apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    deviceId: device === null || device === void 0 ? void 0 : device.id,
+                    deviceDeviceId: device === null || device === void 0 ? void 0 : device.device_id,
+                    officerId: officer === null || officer === void 0 ? void 0 : officer.id,
+                    officerName: officer === null || officer === void 0 ? void 0 : officer.name,
+                    officerServiceNumber: officer === null || officer === void 0 ? void 0 : officer.service_number
+                });
+            }
+            else if (finalApiKeyAuthenticated && deviceAuthenticated) {
+                // API Key + Device (no officer)
+                req.authType = 'api_key'; // Use api_key type, device info will be preserved
+                const apiKey = req.apiKey;
+                const device = req.device;
+                console.log('═══════════════════════════════════════════════════════════');
+                console.log('✅ [Authentication Flow] Step 3c: Authentication type set to api_key (with device)');
+                console.log('   🔑 API Key Being Used:', {
+                    id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    isActive: apiKey === null || apiKey === void 0 ? void 0 : apiKey.is_active,
+                    expiresAt: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.expires_at) ? new Date(apiKey.expires_at).toISOString() : 'Never'
+                });
+                console.log('   📱 Device Being Used:', {
+                    id: device === null || device === void 0 ? void 0 : device.id,
+                    device_id: device === null || device === void 0 ? void 0 : device.device_id,
+                    device_name: device === null || device === void 0 ? void 0 : device.device_name
+                });
+                console.log('   ⚠️  No Officer Authenticated (API key + device only)');
+                console.log('═══════════════════════════════════════════════════════════');
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to api_key (with device)', {
+                    apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    deviceId: device === null || device === void 0 ? void 0 : device.id,
+                    deviceDeviceId: device === null || device === void 0 ? void 0 : device.device_id
+                });
+                // Clear officer if not authenticated
+                req.officer = null;
+                req.user = null;
+            }
+            else if (finalApiKeyAuthenticated && officerAuthenticated) {
+                req.authType = 'api_key_and_officer';
+                const apiKey = req.apiKey;
+                const officer = req.officer;
+                console.log('═══════════════════════════════════════════════════════════');
+                console.log('✅ [Authentication Flow] Step 3c: Authentication type set to api_key_and_officer');
+                console.log('   🔑 API Key Being Used:', {
+                    id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    isActive: apiKey === null || apiKey === void 0 ? void 0 : apiKey.is_active,
+                    expiresAt: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.expires_at) ? new Date(apiKey.expires_at).toISOString() : 'Never'
+                });
+                console.log('   👤 Officer Using This API Key:', {
+                    id: officer === null || officer === void 0 ? void 0 : officer.id,
+                    name: officer === null || officer === void 0 ? void 0 : officer.name,
+                    serviceNumber: officer === null || officer === void 0 ? void 0 : officer.service_number,
+                    email: officer === null || officer === void 0 ? void 0 : officer.email
+                });
+                console.log('═══════════════════════════════════════════════════════════');
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to api_key_and_officer', {
+                    apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    officerId: officer === null || officer === void 0 ? void 0 : officer.id,
+                    officerName: officer === null || officer === void 0 ? void 0 : officer.name,
+                    officerServiceNumber: officer === null || officer === void 0 ? void 0 : officer.service_number
+                });
+                // Officer info is already set from officer authentication above
             }
-            // Set auth type
-            if (deviceAuthenticated && officerAuthenticated) {
+            else if (finalApiKeyAuthenticated) {
+                req.authType = 'api_key';
+                const apiKey = req.apiKey;
+                console.log('═══════════════════════════════════════════════════════════');
+                console.log('✅ [Authentication Flow] Step 3c: Authentication type set to api_key');
+                console.log('   🔑 API Key Being Used:', {
+                    id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    isActive: apiKey === null || apiKey === void 0 ? void 0 : apiKey.is_active,
+                    expiresAt: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.expires_at) ? new Date(apiKey.expires_at).toISOString() : 'Never'
+                });
+                console.log('   ⚠️  No Officer Authenticated (API key only - service-to-service)');
+                console.log('═══════════════════════════════════════════════════════════');
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to api_key', {
+                    apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    keyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A'
+                });
+                // Clear officer if only API key is authenticated
+                req.officer = null;
+                req.user = null;
+            }
+            else if (deviceAuthenticated && officerAuthenticated) {
                 req.authType = 'both';
+                console.log('[Authentication Flow] Step 3c: Authentication type set to both (device + officer)', {
+                    deviceId: (_a = req.device) === null || _a === void 0 ? void 0 : _a.id,
+                    officerId: (_b = req.officer) === null || _b === void 0 ? void 0 : _b.id
+                });
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to both (device + officer)', {
+                    deviceId: (_c = req.device) === null || _c === void 0 ? void 0 : _c.id,
+                    officerId: (_d = req.officer) === null || _d === void 0 ? void 0 : _d.id
+                });
             }
             else if (deviceAuthenticated) {
                 req.authType = 'device';
+                console.log('[Authentication Flow] Step 3c: Authentication type set to device', {
+                    deviceId: (_e = req.device) === null || _e === void 0 ? void 0 : _e.id
+                });
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to device', {
+                    deviceId: (_f = req.device) === null || _f === void 0 ? void 0 : _f.id
+                });
                 req.user = null;
             }
             else {
                 req.authType = 'officer';
+                console.log('[Authentication Flow] Step 3c: Authentication type set to officer', {
+                    officerId: (_g = req.officer) === null || _g === void 0 ? void 0 : _g.id
+                });
+                logger.info('[Authentication Flow] Step 3c: Authentication type set to officer', {
+                    officerId: (_h = req.officer) === null || _h === void 0 ? void 0 : _h.id
+                });
                 req.device = null;
             }
-            (0, logMode_1.devLog)('Authentication successful', {
+            // Log authentication success with consistent format for all auth types
+            const authInfo = {
                 authType: req.authType,
-                device: req.device,
-                officer: req.officer,
-                apiKey: req.apiKey,
-                microservice: req.microservice,
-            });
+            };
+            // Enhanced API key logging
+            if (req.apiKey) {
+                const apiKey = req.apiKey;
+                authInfo.apiKey = {
+                    id: apiKey.id,
+                    microservice: apiKey.microservice,
+                    keyPreview: apiKey.key ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                    isActive: apiKey.is_active,
+                    expiresAt: apiKey.expires_at || 'Never'
+                };
+                authInfo.sourceMicroservice = apiKey.microservice;
+                // Prominent console log for API key usage
+                console.log('═══════════════════════════════════════════════════════════');
+                console.log('🔑 API KEY AUTHENTICATION DETAILS:');
+                console.log('   API Key ID:', apiKey.id);
+                console.log('   Microservice:', apiKey.microservice);
+                console.log('   API Key Preview:', apiKey.key ? apiKey.key.substring(0, 15) + '...' : 'N/A');
+                console.log('   Is Active:', apiKey.is_active);
+                console.log('   Expires At:', apiKey.expires_at ? new Date(apiKey.expires_at).toISOString() : 'Never');
+                if (req.device) {
+                    console.log('   📱 Device Also Authenticated:');
+                    console.log('      Device ID:', req.device.id);
+                    console.log('      Device Device ID:', req.device.device_id);
+                    console.log('      Device Name:', req.device.device_name);
+                }
+                if (req.officer) {
+                    console.log('   ✅ Officer Also Authenticated:');
+                    console.log('      Officer ID:', req.officer.id);
+                    console.log('      Officer Name:', req.officer.name);
+                    console.log('      Service Number:', req.officer.service_number);
+                }
+                else {
+                    console.log('   ⚠️  No Officer Authenticated (API key only)');
+                }
+                console.log('═══════════════════════════════════════════════════════════');
+            }
+            if (req.device) {
+                authInfo.device = {
+                    id: req.device.id,
+                    device_id: req.device.device_id,
+                    device_name: req.device.device_name,
+                };
+            }
+            if (req.officer) {
+                authInfo.officer = {
+                    id: req.officer.id,
+                    name: req.officer.name,
+                    service_number: req.officer.service_number,
+                };
+            }
+            (0, logMode_1.devLog)('Authentication successful', authInfo);
+            // Enhanced console logging for authentication summary
+            console.log('═══════════════════════════════════════════════════════════');
+            console.log('✅ AUTHENTICATION SUMMARY:');
+            console.log('   Auth Type:', req.authType);
+            console.log('   Endpoint:', req.originalUrl || req.url);
+            console.log('   Method:', req.method);
+            if (req.apiKey) {
+                console.log('   🔑 API Key:', {
+                    id: req.apiKey.id,
+                    microservice: req.apiKey.microservice,
+                    keyPreview: req.apiKey.key ? req.apiKey.key.substring(0, 15) + '...' : 'N/A'
+                });
+            }
+            if (req.device) {
+                console.log('   📱 Device:', {
+                    id: req.device.id,
+                    device_id: req.device.device_id,
+                    device_name: req.device.device_name
+                });
+            }
+            if (req.officer) {
+                console.log('   👤 Officer:', {
+                    id: req.officer.id,
+                    name: req.officer.name,
+                    service_number: req.officer.service_number,
+                    email: req.officer.email
+                });
+            }
+            else if (req.authType === 'api_key' || req.authType === 'api_key_and_officer') {
+                console.log('   ⚠️  No Officer Information (API key authentication only)');
+            }
+            console.log('═══════════════════════════════════════════════════════════');
             // Log audit event for endpoint access (non-blocking)
+            // This now handles ALL authentication types consistently: API Key, Device, Officer, or Both
             if (auditService) {
                 (0, logMode_1.devLog)('Calling audit service for endpoint access', {
                     path: req.path,
@@ -275,6 +753,9 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
                     baseUrl: req.baseUrl,
                     method: req.method,
                     authType: req.authType,
+                    hasApiKey: !!req.apiKey,
+                    hasDevice: !!req.device,
+                    hasOfficer: !!req.officer,
                 });
                 auditService.logAuditEvent(req, {
                     event_type: undefined, // Will be determined automatically
@@ -285,6 +766,7 @@ const createAuthenticateDeviceOrOfficer = (deps) => {
                         stack: err.stack,
                         path: req.path,
                         originalUrl: req.originalUrl,
+                        authType: req.authType,
                     });
                     (0, logMode_1.devError)('Audit logging failed', err);
                 });