@govish/shared-services 1.4.0 → 1.6.0

package/dist/services/auditService.js

@@ -39,6 +39,16 @@ var AuditEventType;
     AuditEventType["ENDPOINT_ACCESSED"] = "endpoint_accessed";
     AuditEventType["UNAUTHORIZED_ACCESS"] = "unauthorized_access";
     AuditEventType["FORBIDDEN_ACCESS"] = "forbidden_access";
+    // IPRS events
+    AuditEventType["IPRS_PERSON_SEARCHED"] = "iprs_person_searched";
+    AuditEventType["IPRS_PERSON_FETCHED_FROM_VPS"] = "iprs_person_fetched_from_vps";
+    AuditEventType["IPRS_PERSON_STORED"] = "iprs_person_stored";
+    AuditEventType["IPRS_PERSON_UPDATED"] = "iprs_person_updated";
+    // Vehicle events
+    AuditEventType["VEHICLE_SEARCHED"] = "vehicle_searched";
+    AuditEventType["VEHICLE_FETCHED_FROM_IPRS"] = "vehicle_fetched_from_iprs";
+    AuditEventType["VEHICLE_STORED"] = "vehicle_stored";
+    AuditEventType["VEHICLE_UPDATED"] = "vehicle_updated";
 })(AuditEventType || (exports.AuditEventType = AuditEventType = {}));
 class AuditService {
     constructor(deps) {
@@ -294,6 +304,7 @@ class AuditService {
                 const officer = req.officer; // Use officer directly, as it has all the properties
                 const device = req.device;
                 const apiKey = req.apiKey;
+                console.log('🔑 [Audit] API Key:', apiKey);
                 const authenticatedMicroservice = req.microservice;
                 // Get microservice name from environment or default
                 const microserviceName = this.serverName || 'Package Name';
@@ -303,9 +314,11 @@ class AuditService {
                     eventType = AuditService.determineEventType(req);
                 }
                 // Build audit payload - start with base fields
+                // Note: API key fields will be set later if API key is detected
+                // microservice should always be the receiving service (from SERVER_NAME), not the source microservice
                 const auditPayload = {
                     timestamp: new Date().toISOString(),
-                    microservice: authenticatedMicroservice || microserviceName,
+                    microservice: microserviceName, // Always use receiving service name from SERVER_NAME
                     event_type: eventType,
                     endpoint: req.originalUrl || req.url,
                     method: req.method,
@@ -313,6 +326,12 @@ class AuditService {
                     query_params: Object.keys(req.query).length > 0 ? req.query : undefined,
                     ip_address,
                     user_agent,
+                    api_key_id: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                    api_key_name: apiKey === null || apiKey === void 0 ? void 0 : apiKey.description,
+                    api_key_description: apiKey === null || apiKey === void 0 ? void 0 : apiKey.description,
+                    api_key_preview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : undefined,
+                    source_microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
+                    authenticated_microservice: apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice,
                 };
                 // Add officer information if authenticated
                 if (officer) {
@@ -336,25 +355,92 @@ class AuditService {
                     auditPayload.device_device_id = device.device_id;
                 }
                 // Set user type and add API Key / Microservice information
-                if (authType === 'api_key' || authType === 'microservice') {
-                    auditPayload.user_type = 'microservice';
-                    auditPayload.authenticated_microservice = authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice);
-                    auditPayload.api_key_id = apiKey === null || apiKey === void 0 ? void 0 : apiKey.id;
-                    // Set microservice name in the main microservice field
-                    if (authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice)) {
-                        auditPayload.microservice = authenticatedMicroservice || apiKey.microservice;
+                // IMPORTANT: Always check for API key presence regardless of authType, as API key might be present
+                // even when authType is set to 'officer' or 'both' due to priority logic
+                const hasApiKey = !!(apiKey || authenticatedMicroservice);
+                const sourceMicroservice = (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice) || authenticatedMicroservice;
+                // Always include API key information if present
+                if (hasApiKey) {
+                    // Include API key object fields only if apiKey object exists
+                    if (apiKey) {
+                        auditPayload.api_key_id = apiKey.id;
+                        auditPayload.api_key_name = apiKey.description || undefined; // API key name (from description field)
+                        auditPayload.api_key_description = apiKey.description || undefined; // Keep description for backward compatibility
+                        auditPayload.api_key_preview = apiKey.key ? apiKey.key.substring(0, 15) + '...' : undefined;
+                    }
+                    // ALWAYS include microservice information if authenticatedMicroservice is detected
+                    // This works even if apiKey object is not attached
+                    // Note: microservice field should always be the receiving service (from SERVER_NAME)
+                    // source_microservice and authenticated_microservice are the API key's microservice
+                    if (sourceMicroservice) {
+                        auditPayload.source_microservice = sourceMicroservice;
+                        auditPayload.authenticated_microservice = sourceMicroservice;
+                        // Do NOT overwrite microservice - it should always be the receiving service
+                    }
+                    else if (authenticatedMicroservice) {
+                        // Fallback: use authenticatedMicroservice directly if sourceMicroservice is not set
+                        auditPayload.source_microservice = authenticatedMicroservice;
+                        auditPayload.authenticated_microservice = authenticatedMicroservice;
+                        // Do NOT overwrite microservice - it should always be the receiving service
                     }
-                    // For microservice authentication, we don't have a user_id
+                    // Log API key presence with full details
+                    this.debugLog('API Key Detected', {
+                        apiKeyId: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.id) || 'N/A',
+                        apiKeyName: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.description) || sourceMicroservice || authenticatedMicroservice || 'N/A',
+                        apiKeyPreview: (apiKey === null || apiKey === void 0 ? void 0 : apiKey.key) ? apiKey.key.substring(0, 15) + '...' : 'N/A',
+                        sourceMicroservice: sourceMicroservice || authenticatedMicroservice,
+                        hasApiKeyObject: !!apiKey,
+                        endpoint: auditPayload.endpoint
+                    });
+                }
+                // Now set user_type based on authType and what's actually present
+                if (authType === 'api_key_and_officer') {
+                    // API Key + Officer authentication (may also have device)
+                    auditPayload.user_type = 'api_key_and_officer';
+                    // Include officer information (officer is already set above)
+                    if (officer) {
+                        auditPayload.user_id = officer.id;
+                        auditPayload.officer_id = officer.id;
+                        auditPayload.officer_name = officer.name || undefined;
+                        auditPayload.officer_service_number = officer.service_number || undefined;
+                        auditPayload.officer_email = officer.email || undefined;
+                    }
+                    // Explicitly preserve device information if present (device info was added earlier, but ensure it's preserved)
+                    if (device) {
+                        const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                        if (!isNaN(deviceId)) {
+                            auditPayload.device_id = deviceId;
+                        }
+                        auditPayload.device_device_id = device.device_id;
+                    }
+                }
+                else if (authType === 'api_key' || authType === 'microservice') {
+                    auditPayload.user_type = 'microservice';
+                    // For microservice authentication, we don't have a user_id unless device is present
+                    // (device info is already set above if present)
                 }
                 else if (authType === 'both') {
-                    auditPayload.user_type = 'both';
+                    // Device + Officer - but check if API key is also present
+                    if (hasApiKey) {
+                        // All three: API Key + Device + Officer
+                        auditPayload.user_type = 'api_key_and_officer'; // Upgrade to api_key_and_officer since API key is present
+                    }
+                    else {
+                        auditPayload.user_type = 'both';
+                    }
                     // When both are authenticated, prioritize officer as user_id
                     if (officer) {
                         auditPayload.user_id = officer.id;
                     }
                 }
                 else if (authType === 'device') {
-                    auditPayload.user_type = 'device';
+                    // Device only - but check if API key is also present
+                    if (hasApiKey) {
+                        auditPayload.user_type = 'api_key'; // Upgrade to api_key since API key is present
+                    }
+                    else {
+                        auditPayload.user_type = 'device';
+                    }
                     // Use device id as user_id when only device is authenticated
                     if (device) {
                         const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
@@ -364,12 +450,85 @@ class AuditService {
                     }
                 }
                 else if (authType === 'officer') {
-                    auditPayload.user_type = 'officer';
+                    // Officer only - but check if API key is also present
+                    if (hasApiKey) {
+                        auditPayload.user_type = 'api_key_and_officer'; // Upgrade to api_key_and_officer since API key is present
+                        this.debugLog('Upgraded user_type from "officer" to "api_key_and_officer" because API key detected', {
+                            sourceMicroservice: sourceMicroservice,
+                            apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                            hasApiKeyObject: !!apiKey
+                        });
+                        // Explicitly preserve device information if present when upgrading from officer to api_key_and_officer
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                    else {
+                        auditPayload.user_type = 'officer';
+                    }
                     // Use officer id as user_id when only officer is authenticated
                     if (officer) {
                         auditPayload.user_id = officer.id;
                     }
                 }
+                // Log when API key is present but wasn't reflected in authType
+                if (hasApiKey && authType !== 'api_key' && authType !== 'api_key_and_officer' && authType !== 'microservice') {
+                    this.debugLog('API Key detected but authType was different', {
+                        authType,
+                        apiKeyId: apiKey === null || apiKey === void 0 ? void 0 : apiKey.id,
+                        sourceMicroservice: sourceMicroservice,
+                        finalUserType: auditPayload.user_type,
+                        hasApiKeyObject: !!apiKey,
+                        authenticatedMicroservice: authenticatedMicroservice
+                    });
+                }
+                // Final check: Ensure user_type matches what we actually have
+                if (hasApiKey && officer && auditPayload.user_type !== 'api_key_and_officer') {
+                    this.debugLog('Force upgrading user_type to api_key_and_officer (final check)', {
+                        currentUserType: auditPayload.user_type,
+                        hasApiKey: hasApiKey,
+                        hasOfficer: !!officer,
+                        sourceMicroservice: sourceMicroservice
+                    });
+                    auditPayload.user_type = 'api_key_and_officer';
+                    // Explicitly preserve device information when force upgrading to api_key_and_officer
+                    if (device) {
+                        const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                        if (!isNaN(deviceId)) {
+                            auditPayload.device_id = deviceId;
+                        }
+                        auditPayload.device_device_id = device.device_id;
+                    }
+                }
+                // Final validation: Ensure API key information is included if payload.microservice was provided
+                // This is a safety check in case payload parameter contained microservice info that wasn't processed
+                // Note: auditPayload.microservice should always be microserviceName (receiving service) at this point
+                if (payload.microservice && payload.microservice !== microserviceName && !auditPayload.source_microservice) {
+                    // Payload contained a microservice different from receiving service, use it as source
+                    auditPayload.source_microservice = payload.microservice;
+                    auditPayload.authenticated_microservice = payload.microservice;
+                    // Upgrade user_type if officer is present
+                    if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('Final safety check: Upgraded user_type to api_key_and_officer', {
+                            microservice: auditPayload.microservice,
+                            receivingMicroservice: microserviceName,
+                            officerId: auditPayload.officer_id
+                        });
+                        // Explicitly preserve device information when upgrading from officer to api_key_and_officer in final validation
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                }
                 // Extract arrest-specific information from request body or response
                 this.addArrestInformation(req, auditPayload, payload);
                 // Merge custom keys from payload
@@ -382,6 +541,69 @@ class AuditService {
                         auditPayload[key] = payload[key];
                     }
                 });
+                // CRITICAL: Final check AFTER payload merge to ensure API key detection is not overridden
+                // If microservice indicates API key usage but user_type doesn't reflect it, fix it
+                // Check if API key was used by checking if authenticatedMicroservice or apiKey exists
+                // This works regardless of SERVER_NAME configuration
+                const finalHasApiKey = !!(apiKey || authenticatedMicroservice || auditPayload.source_microservice);
+                const finalSourceMicroservice = sourceMicroservice || auditPayload.source_microservice || auditPayload.microservice;
+                // CRITICAL: Preserve device information after payload merge (in case payload merge cleared it)
+                // Device information should always be preserved if device was authenticated
+                if (device) {
+                    const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                    if (!isNaN(deviceId)) {
+                        auditPayload.device_id = deviceId;
+                    }
+                    auditPayload.device_device_id = device.device_id;
+                }
+                if (finalHasApiKey && (authenticatedMicroservice || apiKey)) {
+                    // ALWAYS set microservice fields when API key is detected
+                    // Don't check if they already exist - ensure they're set (in case payload merge cleared them)
+                    // Note: microservice field should always be the receiving service (from SERVER_NAME)
+                    auditPayload.source_microservice = finalSourceMicroservice;
+                    auditPayload.authenticated_microservice = finalSourceMicroservice;
+                    // Do NOT overwrite microservice - it should always be the receiving service
+                    // Include API key object fields if available
+                    if (apiKey) {
+                        // Always set these if apiKey exists, even if already set (in case payload merge cleared them)
+                        auditPayload.api_key_id = apiKey.id;
+                        auditPayload.api_key_name = apiKey.description || undefined;
+                        auditPayload.api_key_description = apiKey.description || undefined;
+                        auditPayload.api_key_preview = apiKey.key ? apiKey.key.substring(0, 15) + '...' : undefined;
+                    }
+                    // ALWAYS upgrade user_type when API key is detected and officer is present
+                    if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type to api_key_and_officer after payload merge', {
+                            microservice: auditPayload.microservice,
+                            receivingMicroservice: microserviceName,
+                            officerId: auditPayload.officer_id,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                        // Explicitly preserve device information when upgrading from officer to api_key_and_officer after payload merge
+                        if (device) {
+                            const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                            if (!isNaN(deviceId)) {
+                                auditPayload.device_id = deviceId;
+                            }
+                            auditPayload.device_device_id = device.device_id;
+                        }
+                    }
+                    else if (auditPayload.user_type === 'both' && finalHasApiKey) {
+                        auditPayload.user_type = 'api_key_and_officer';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type from "both" to "api_key_and_officer" after payload merge', {
+                            microservice: auditPayload.microservice,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                    }
+                    else if (!auditPayload.officer_id && auditPayload.user_type === 'device' && finalHasApiKey) {
+                        auditPayload.user_type = 'api_key';
+                        this.debugLog('🔧 [FINAL] Upgraded user_type from "device" to "api_key" after payload merge', {
+                            microservice: auditPayload.microservice,
+                            sourceMicroservice: finalSourceMicroservice
+                        });
+                    }
+                }
                 // Build user info string for logging
                 const userInfo = auditPayload.officer_name
                     ? `${auditPayload.officer_name} (Officer ID: ${auditPayload.officer_id})`
@@ -460,6 +682,31 @@ class AuditService {
                         return;
                     }
                     this.debugLog('All checks passed - proceeding to send');
+                    // Final safety check: If microservice indicates API key but fields are missing, add them
+                    // This catches any edge cases where fields might have been cleared
+                    if (auditPayload.microservice &&
+                        auditPayload.microservice !== microserviceName &&
+                        (!auditPayload.source_microservice || !auditPayload.authenticated_microservice)) {
+                        auditPayload.source_microservice = auditPayload.microservice;
+                        auditPayload.authenticated_microservice = auditPayload.microservice;
+                        // Upgrade user_type if needed
+                        if (auditPayload.officer_id && auditPayload.user_type === 'officer') {
+                            auditPayload.user_type = 'api_key_and_officer';
+                            this.debugLog('🔧 [PRE-SEND] Final safety check: Upgraded user_type to api_key_and_officer', {
+                                microservice: auditPayload.microservice,
+                                receivingMicroservice: microserviceName,
+                                officerId: auditPayload.officer_id
+                            });
+                            // Explicitly preserve device information when upgrading from officer to api_key_and_officer in pre-send check
+                            if (device) {
+                                const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                                if (!isNaN(deviceId)) {
+                                    auditPayload.device_id = deviceId;
+                                }
+                                auditPayload.device_device_id = device.device_id;
+                            }
+                        }
+                    }
                     const topic = this.auditTopic || 'audit-log';
                     const kafkaMessage = {
                         key: `${auditPayload.method}-${auditPayload.endpoint}-${Date.now()}`,
@@ -654,6 +901,36 @@ class AuditService {
                 return AuditEventType.ARRESTS_LISTED;
             }
         }
+        // IPRS events
+        if (fullPath.includes('/iprs') || path.includes('/iprs')) {
+            if (method === 'POST' && (fullPath.includes('/search') || path.includes('/search'))) {
+                return AuditEventType.IPRS_PERSON_SEARCHED;
+            }
+            else if (method === 'GET' && (fullPath.includes('/fetch') || path.includes('/fetch'))) {
+                return AuditEventType.IPRS_PERSON_FETCHED_FROM_VPS;
+            }
+            else if (method === 'POST' && (fullPath.includes('/store') || path.includes('/store'))) {
+                return AuditEventType.IPRS_PERSON_STORED;
+            }
+            else if (method === 'PUT') {
+                return AuditEventType.IPRS_PERSON_UPDATED;
+            }
+        }
+        // Vehicle events
+        if (fullPath.includes('/vehicle') || path.includes('/vehicles')) {
+            if (method === 'GET' && (fullPath.includes('/search') || path.includes('/search'))) {
+                return AuditEventType.VEHICLE_SEARCHED;
+            }
+            else if (method === 'GET' && (fullPath.includes('/fetch') || path.includes('/fetch'))) {
+                return AuditEventType.VEHICLE_FETCHED_FROM_IPRS;
+            }
+            else if (method === 'POST' && (fullPath.includes('/store') || path.includes('/store'))) {
+                return AuditEventType.VEHICLE_STORED;
+            }
+            else if (method === 'PUT') {
+                return AuditEventType.VEHICLE_UPDATED;
+            }
+        }
         // Default to endpoint accessed
         return AuditEventType.ENDPOINT_ACCESSED;
     }

package/dist/utils/rollingCache.d.ts

@@ -0,0 +1,34 @@
+export type RollingCacheTtl = number | {
+    days: number;
+};
+export type RollingCacheOptions = {
+    redisClient: any;
+    /** If omitted, uses createSafeRedisGet(redisClient). */
+    safeRedisGet?: (key: string) => Promise<string | null>;
+    /** Env var name for enable flag; default ROLLING_CACHE_ENABLED. Also reads CACHE_ENABLED if unset. */
+    enableEnvKey?: string;
+    logWarn?: (message: string, meta?: Record<string, unknown>) => void;
+};
+export type RollingCacheInstance = {
+    buildKey: (entity: string, ...parts: (string | number)[]) => string;
+    isCacheEnabled: () => boolean;
+    get: <T = unknown>(key: string) => Promise<T | null>;
+    set: (key: string, value: unknown, ttl?: RollingCacheTtl) => Promise<boolean>;
+    getOrSet: <T>(key: string, ttl: RollingCacheTtl | undefined, loader: () => Promise<T>) => Promise<T>;
+    invalidate: (key: string) => Promise<void>;
+    invalidateByPrefix: (prefix: string) => Promise<number>;
+    recordAccess: (zsetKey: string, member: string, incrementBy?: number) => Promise<void>;
+    getDefaultListTtl: () => {
+        days: number;
+    };
+    getDefaultItemTtl: () => {
+        days: number;
+    };
+};
+/**
+ * Factory for list/item rolling cache (Redis string keys + JSON values).
+ * Pass the same redis client used by the host app. Optional safeRedisGet for custom wiring.
+ */
+export declare function createRollingCache(options: RollingCacheOptions): RollingCacheInstance;
+/** Key segment separator used by buildKey (exported for invalidation helpers). */
+export declare const ROLLING_CACHE_SEP = "|";

package/dist/utils/rollingCache.js

@@ -0,0 +1,203 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLLING_CACHE_SEP = void 0;
+exports.createRollingCache = createRollingCache;
+const redis_1 = require("./redis");
+const SEP = '|';
+const DEFAULT_LIST_DAYS = 7;
+const DEFAULT_ITEM_DAYS = 30;
+const DEFAULT_ENABLE_ENV = 'ROLLING_CACHE_ENABLED';
+function ensureConnected(redisClient) {
+    return new Promise((resolve) => {
+        var _a;
+        if (redisClient === null || redisClient === void 0 ? void 0 : redisClient.isOpen) {
+            resolve(true);
+            return;
+        }
+        (_a = redisClient === null || redisClient === void 0 ? void 0 : redisClient.connect) === null || _a === void 0 ? void 0 : _a.call(redisClient).then(() => resolve(true)).catch(() => resolve(false));
+    });
+}
+function normalizePart(part) {
+    if (part === null || part === undefined)
+        return '';
+    const s = String(part).trim();
+    return s.replace(/\|/g, '_').replace(/:/g, '_');
+}
+function ttlSeconds(ttl) {
+    if (ttl == null)
+        return undefined;
+    if (typeof ttl === 'number')
+        return ttl > 0 ? ttl : undefined;
+    if (ttl.days > 0)
+        return ttl.days * 86400;
+    return undefined;
+}
+function getCacheDaysList() {
+    const v = process.env.CACHE_DAYS_LIST;
+    if (v != null && v !== '') {
+        const n = parseInt(v, 10);
+        if (!Number.isNaN(n) && n > 0)
+            return n;
+    }
+    return DEFAULT_LIST_DAYS;
+}
+function getCacheDaysItem() {
+    const v = process.env.CACHE_DAYS_ITEM;
+    if (v != null && v !== '') {
+        const n = parseInt(v, 10);
+        if (!Number.isNaN(n) && n > 0)
+            return n;
+    }
+    return DEFAULT_ITEM_DAYS;
+}
+const SCAN_COUNT = 100;
+/**
+ * Factory for list/item rolling cache (Redis string keys + JSON values).
+ * Pass the same redis client used by the host app. Optional safeRedisGet for custom wiring.
+ */
+function createRollingCache(options) {
+    var _a;
+    const { redisClient, enableEnvKey = DEFAULT_ENABLE_ENV, logWarn } = options;
+    const safeRedisGet = (_a = options.safeRedisGet) !== null && _a !== void 0 ? _a : (0, redis_1.createSafeRedisGet)(redisClient);
+    const warn = (message, meta) => {
+        if (logWarn)
+            logWarn(message, meta);
+        else
+            console.warn(`[RollingCache] ${message}`, meta !== null && meta !== void 0 ? meta : '');
+    };
+    const isCacheEnabled = () => {
+        var _a, _b;
+        const v = (_b = (_a = process.env[enableEnvKey]) !== null && _a !== void 0 ? _a : process.env.CACHE_ENABLED) !== null && _b !== void 0 ? _b : '';
+        const s = String(v).trim().toLowerCase();
+        return s === '1' || s === 'true' || s === 'yes';
+    };
+    const buildKey = (entity, ...parts) => {
+        const normalized = parts.map(normalizePart);
+        return [entity, ...normalized].join(SEP);
+    };
+    const get = (key) => __awaiter(this, void 0, void 0, function* () {
+        if (!isCacheEnabled())
+            return null;
+        try {
+            const raw = yield safeRedisGet(key);
+            if (raw == null)
+                return null;
+            return JSON.parse(raw);
+        }
+        catch (e) {
+            warn('get parse error', { key, error: e instanceof Error ? e.message : String(e) });
+            return null;
+        }
+    });
+    const set = (key, value, ttl) => __awaiter(this, void 0, void 0, function* () {
+        if (!isCacheEnabled())
+            return true;
+        try {
+            const str = JSON.stringify(value);
+            const sec = ttlSeconds(ttl);
+            const ok = yield ensureConnected(redisClient);
+            if (!ok)
+                return false;
+            if (sec != null) {
+                yield redisClient.setEx(key, sec, str);
+            }
+            else {
+                yield redisClient.set(key, str);
+            }
+            return true;
+        }
+        catch (e) {
+            warn('set error', { key, error: e instanceof Error ? e.message : String(e) });
+            return false;
+        }
+    });
+    const getOrSet = (key, ttl, loader) => __awaiter(this, void 0, void 0, function* () {
+        const hit = yield get(key);
+        if (hit !== null && hit !== undefined) {
+            return hit;
+        }
+        const v = yield loader();
+        yield set(key, v, ttl);
+        return v;
+    });
+    const invalidate = (key) => __awaiter(this, void 0, void 0, function* () {
+        if (!isCacheEnabled())
+            return;
+        try {
+            const ok = yield ensureConnected(redisClient);
+            if (!ok)
+                return;
+            yield redisClient.del(key);
+        }
+        catch (e) {
+            warn('invalidate error', { key, error: e instanceof Error ? e.message : String(e) });
+        }
+    });
+    const invalidateByPrefix = (prefix) => __awaiter(this, void 0, void 0, function* () {
+        if (!isCacheEnabled())
+            return 0;
+        let deleted = 0;
+        try {
+            const ok = yield ensureConnected(redisClient);
+            if (!ok)
+                return 0;
+            let cursor = 0;
+            for (;;) {
+                const scanResult = yield redisClient.scan(cursor, {
+                    MATCH: `${prefix}*`,
+                    COUNT: SCAN_COUNT,
+                });
+                const nextCursor = scanResult.cursor;
+                const keys = scanResult.keys;
+                if (keys.length > 0) {
+                    yield redisClient.del(keys);
+                    deleted += keys.length;
+                }
+                const c = typeof nextCursor === 'bigint' ? Number(nextCursor) : Number(nextCursor);
+                if (c === 0)
+                    break;
+                cursor = nextCursor;
+            }
+        }
+        catch (e) {
+            warn('invalidateByPrefix error', { prefix, error: e instanceof Error ? e.message : String(e) });
+        }
+        return deleted;
+    });
+    const recordAccess = (zsetKey_1, member_1, ...args_1) => __awaiter(this, [zsetKey_1, member_1, ...args_1], void 0, function* (zsetKey, member, incrementBy = 1) {
+        if (!isCacheEnabled())
+            return;
+        try {
+            const ok = yield ensureConnected(redisClient);
+            if (!ok)
+                return;
+            yield redisClient.zIncrBy(zsetKey, incrementBy, member);
+        }
+        catch (e) {
+            warn('recordAccess error', { zsetKey, error: e instanceof Error ? e.message : String(e) });
+        }
+    });
+    return {
+        buildKey,
+        isCacheEnabled,
+        get,
+        set,
+        getOrSet,
+        invalidate,
+        invalidateByPrefix,
+        recordAccess,
+        getDefaultListTtl: () => ({ days: getCacheDaysList() }),
+        getDefaultItemTtl: () => ({ days: getCacheDaysItem() }),
+    };
+}
+/** Key segment separator used by buildKey (exported for invalidation helpers). */
+exports.ROLLING_CACHE_SEP = SEP;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@govish/shared-services",
-  "version": "1.4.0",
-  "description": "Govish shared services package - officer, device, station, penal code, station-duty block, and rank leave days cache services; API key service; audit logging; authentication middleware",
+  "version": "1.6.0",
+  "description": "Govish shared services package - officer, device, station, penal code, station-duty block, and rank leave days cache services; API key service; audit logging; authentication middleware with support for API key + officer combined authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -23,6 +23,11 @@
     "audit",
     "authentication",
     "middleware",
+    "api-key",
+    "jwt",
+    "device-authentication",
+    "officer-authentication",
+    "microservice-authentication",
     "typescript"
   ],
   "author": "",