@heavybit/pendoadmin-shared-lib 1.6.0 → 1.7.0

package/dist/common/gateway-signature.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Signed gateway identity.
+ *
+ * The api-gateway (and any internal service forwarding a caller's identity)
+ * signs the identity headers it injects with GATEWAY_SIGNING_SECRET. Downstream
+ * services verify the signature before trusting x-user-id / x-is-superadmin /
+ * x-user-permissions, so a request that reaches a service port directly, or
+ * slips past the gateway with its own headers, cannot impersonate anyone.
+ *
+ * The api-gateway keeps its own copy of the signer
+ * (api-gateway/src/utils/gateway-signature.ts). Any change to the canonical
+ * string below must be made in both places — the shared test vector in both
+ * test suites pins the format.
+ */
+export declare const GATEWAY_SIGNATURE_HEADER = "x-gateway-signature";
+export declare const GATEWAY_TIMESTAMP_HEADER = "x-gateway-ts";
+/** Identity headers covered by the signature, in canonical order. */
+export declare const GATEWAY_IDENTITY_HEADERS: readonly ["x-user-id", "x-user-email", "x-company-id", "x-company-slug", "x-user-roles", "x-user-permissions", "x-is-superadmin", "x-otp-verified"];
+/** Default allowed clock skew between signer and verifier. */
+export declare const GATEWAY_SIGNATURE_MAX_SKEW_SECONDS = 60;
+type HeaderBag = Record<string, string | string[] | undefined>;
+/**
+ * Signature headers for the identity headers already present in `headers`
+ * (lower-case names). Merge the result into the outgoing request headers.
+ */
+export declare function signGatewayIdentity(headers: HeaderBag, secret: string, nowMs?: number): Record<typeof GATEWAY_SIGNATURE_HEADER | typeof GATEWAY_TIMESTAMP_HEADER, string>;
+export interface VerifyGatewayIdentityOptions {
+    maxSkewSeconds?: number;
+    nowMs?: number;
+}
+/** True when the identity headers carry a valid, fresh signature from `secret`. */
+export declare function verifyGatewayIdentity(headers: HeaderBag, secret: string, options?: VerifyGatewayIdentityOptions): boolean;
+/**
+ * The secret services sign and verify gateway identity with. Unset means
+ * unsigned identity is accepted only outside production (see
+ * isUnsignedGatewayIdentityAllowed).
+ */
+export declare function gatewaySigningSecret(): string;
+/** Local development may run services without a signing secret; production never trusts unsigned identity. */
+export declare function isUnsignedGatewayIdentityAllowed(): boolean;
+/**
+ * Whether a request's gateway identity headers can be trusted: a valid
+ * signature when a secret is configured, otherwise only outside production.
+ */
+export declare function isTrustedGatewayIdentity(headers: HeaderBag): boolean;
+/** Direct JWT validation is a development convenience only; production requests must come through the gateway. */
+export declare function isDirectJwtFallbackAllowed(): boolean;
+export {};
+//# sourceMappingURL=gateway-signature.d.ts.map

package/dist/common/gateway-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-signature.d.ts","sourceRoot":"","sources":["../../src/common/gateway-signature.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAGvD,qEAAqE;AACrE,eAAO,MAAM,wBAAwB,qJAS3B,CAAC;AAEX,8DAA8D;AAC9D,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAoB/D;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,EAClB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAmB,GACzB,MAAM,CAAC,OAAO,wBAAwB,GAAG,OAAO,wBAAwB,EAAE,MAAM,CAAC,CAMnF;AAED,MAAM,WAAW,4BAA4B;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAYT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,8GAA8G;AAC9G,wBAAgB,gCAAgC,IAAI,OAAO,CAE1D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,CAIpE;AAED,kHAAkH;AAClH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD"}

package/dist/common/gateway-signature.js

@@ -0,0 +1,99 @@
+import crypto from 'node:crypto';
+/**
+ * Signed gateway identity.
+ *
+ * The api-gateway (and any internal service forwarding a caller's identity)
+ * signs the identity headers it injects with GATEWAY_SIGNING_SECRET. Downstream
+ * services verify the signature before trusting x-user-id / x-is-superadmin /
+ * x-user-permissions, so a request that reaches a service port directly, or
+ * slips past the gateway with its own headers, cannot impersonate anyone.
+ *
+ * The api-gateway keeps its own copy of the signer
+ * (api-gateway/src/utils/gateway-signature.ts). Any change to the canonical
+ * string below must be made in both places — the shared test vector in both
+ * test suites pins the format.
+ */
+export const GATEWAY_SIGNATURE_HEADER = 'x-gateway-signature';
+export const GATEWAY_TIMESTAMP_HEADER = 'x-gateway-ts';
+const SIGNATURE_VERSION = 'v1';
+/** Identity headers covered by the signature, in canonical order. */
+export const GATEWAY_IDENTITY_HEADERS = [
+    'x-user-id',
+    'x-user-email',
+    'x-company-id',
+    'x-company-slug',
+    'x-user-roles',
+    'x-user-permissions',
+    'x-is-superadmin',
+    'x-otp-verified',
+];
+/** Default allowed clock skew between signer and verifier. */
+export const GATEWAY_SIGNATURE_MAX_SKEW_SECONDS = 60;
+function headerValue(headers, name) {
+    const value = headers[name];
+    return (Array.isArray(value) ? value[0] : value) ?? '';
+}
+function canonicalString(headers, timestamp) {
+    return [
+        SIGNATURE_VERSION,
+        timestamp,
+        headerValue(headers, 'x-correlation-id'),
+        ...GATEWAY_IDENTITY_HEADERS.map((name) => headerValue(headers, name)),
+    ].join('\n');
+}
+function hmac(secret, payload) {
+    return crypto.createHmac('sha256', secret).update(payload).digest('hex');
+}
+/**
+ * Signature headers for the identity headers already present in `headers`
+ * (lower-case names). Merge the result into the outgoing request headers.
+ */
+export function signGatewayIdentity(headers, secret, nowMs = Date.now()) {
+    const timestamp = String(Math.floor(nowMs / 1000));
+    return {
+        [GATEWAY_SIGNATURE_HEADER]: hmac(secret, canonicalString(headers, timestamp)),
+        [GATEWAY_TIMESTAMP_HEADER]: timestamp,
+    };
+}
+/** True when the identity headers carry a valid, fresh signature from `secret`. */
+export function verifyGatewayIdentity(headers, secret, options = {}) {
+    if (!secret)
+        return false;
+    const { maxSkewSeconds = GATEWAY_SIGNATURE_MAX_SKEW_SECONDS, nowMs = Date.now() } = options;
+    const timestamp = headerValue(headers, GATEWAY_TIMESTAMP_HEADER);
+    const signature = headerValue(headers, GATEWAY_SIGNATURE_HEADER);
+    if (!/^\d+$/.test(timestamp) || !/^[0-9a-f]{64}$/.test(signature))
+        return false;
+    if (Math.abs(nowMs / 1000 - Number(timestamp)) > maxSkewSeconds)
+        return false;
+    const expected = Buffer.from(hmac(secret, canonicalString(headers, timestamp)), 'hex');
+    const provided = Buffer.from(signature, 'hex');
+    return expected.length === provided.length && crypto.timingSafeEqual(expected, provided);
+}
+/**
+ * The secret services sign and verify gateway identity with. Unset means
+ * unsigned identity is accepted only outside production (see
+ * isUnsignedGatewayIdentityAllowed).
+ */
+export function gatewaySigningSecret() {
+    return process.env.GATEWAY_SIGNING_SECRET || '';
+}
+/** Local development may run services without a signing secret; production never trusts unsigned identity. */
+export function isUnsignedGatewayIdentityAllowed() {
+    return !gatewaySigningSecret() && process.env.NODE_ENV !== 'production';
+}
+/**
+ * Whether a request's gateway identity headers can be trusted: a valid
+ * signature when a secret is configured, otherwise only outside production.
+ */
+export function isTrustedGatewayIdentity(headers) {
+    const secret = gatewaySigningSecret();
+    if (secret)
+        return verifyGatewayIdentity(headers, secret);
+    return isUnsignedGatewayIdentityAllowed();
+}
+/** Direct JWT validation is a development convenience only; production requests must come through the gateway. */
+export function isDirectJwtFallbackAllowed() {
+    return process.env.NODE_ENV !== 'production';
+}
+//# sourceMappingURL=gateway-signature.js.map

package/dist/common/gateway-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-signature.js","sourceRoot":"","sources":["../../src/common/gateway-signature.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,qEAAqE;AACrE,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,WAAW;IACX,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAEX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAIrD,SAAS,WAAW,CAAC,OAAkB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB,EAAE,SAAiB;IAC5D,OAAO;QACL,iBAAiB;QACjB,SAAS;QACT,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACxC,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe;IAC3C,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAkB,EAClB,MAAc,EACd,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACnD,OAAO;QACL,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7E,CAAC,wBAAwB,CAAC,EAAE,SAAS;KACtC,CAAC;AACJ,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CACnC,OAAkB,EAClB,MAAc,EACd,UAAwC,EAAE;IAE1C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,cAAc,GAAG,kCAAkC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAE5F,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,cAAc;QAAE,OAAO,KAAK,CAAC;IAE9E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,oBAAoB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAkB;IACzD,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,gCAAgC,EAAE,CAAC;AAC5C,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,0BAA0B;IACxC,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC"}

package/dist/common/index.d.ts

@@ -5,4 +5,5 @@ export * from './uuid.utils.js';
 export * from './response.utils.js';
 export * from './timezone.utils.js';
 export * from './permission.utils.js';
+export * from './gateway-signature.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/common/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/common/index.js

@@ -5,4 +5,5 @@ export * from './uuid.utils.js';
 export * from './response.utils.js';
 export * from './timezone.utils.js';
 export * from './permission.utils.js';
+export * from './gateway-signature.js';
 //# sourceMappingURL=index.js.map

package/dist/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/express/auth.middleware.d.ts

@@ -9,12 +9,13 @@ declare global {
 }
 /**
  * Auth middleware for downstream services (behind API gateway).
- * Reads user context from gateway-injected headers.
- * Falls back to JWT validation if headers are missing (direct access).
+ * Reads user context from gateway-injected headers, trusted only with a valid
+ * gateway signature (GATEWAY_SIGNING_SECRET). Outside production it falls back
+ * to direct JWT validation for local development.
  */
-export declare function authenticateFromGateway(jwtSecret?: string): (req: Request, _res: Response, next: NextFunction) => void;
+export declare function authenticateFromGateway(jwtSecret?: string): (req: Request, res: Response, next: NextFunction) => void;
 /**
- * Optional auth — attaches user if present, continues if not.
+ * Optional auth — attaches user if present (and trusted), continues if not.
  */
 export declare function optionalAuthFromGateway(jwtSecret?: string): (req: Request, _res: Response, next: NextFunction) => void;
 //# sourceMappingURL=auth.middleware.d.ts.map

package/dist/express/auth.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../src/express/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE/D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAapE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,SAAS,CAAC;SAClB;KACF;CACF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,IAChD,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAsChE;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,IAChD,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CA6BhE"}
+{"version":3,"file":"auth.middleware.d.ts","sourceRoot":"","sources":["../../src/express/auth.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAapE,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,SAAS,CAAC;SAClB;KACF;CACF;AAoCD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,IAChD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAQ/D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,IAChD,KAAK,OAAO,EAAE,MAAM,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAKhE"}

package/dist/express/auth.middleware.js

@@ -1,4 +1,5 @@
 import { verifyToken, extractBearerToken } from '../common/jwt.utils.js';
+import { isTrustedGatewayIdentity, isDirectJwtFallbackAllowed } from '../common/gateway-signature.js';
 import { GATEWAY_HEADERS } from '../types/index.js';
 /** Parse a header value that may be a JSON array string or comma-separated. */
 function parseArrayHeader(value) {
@@ -13,83 +14,66 @@ function parseArrayHeader(value) {
     }
     return trimmed.split(',').filter(Boolean);
 }
+/** The caller from signed gateway headers, or null when absent or unsigned/forged. */
+function userFromGatewayHeaders(req) {
+    const userId = req.headers[GATEWAY_HEADERS.USER_ID];
+    if (!userId || !isTrustedGatewayIdentity(req.headers))
+        return null;
+    return {
+        id: userId,
+        email: req.headers[GATEWAY_HEADERS.USER_EMAIL] || '',
+        companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] || '',
+        roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES]),
+        permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS]),
+        isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
+    };
+}
+/** The caller from a bearer JWT — development only (direct service access). */
+function userFromBearerToken(req, jwtSecret) {
+    if (!jwtSecret || !isDirectJwtFallbackAllowed())
+        return null;
+    const token = extractBearerToken(req.headers.authorization);
+    if (!token)
+        return null;
+    try {
+        const payload = verifyToken(token, jwtSecret);
+        return {
+            id: payload.sub,
+            email: payload.email,
+            companyId: payload.companyId,
+            roles: payload.roles || [],
+            permissions: payload.permissions || [],
+            isSuperAdmin: payload.isSuperAdmin || false,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Auth middleware for downstream services (behind API gateway).
- * Reads user context from gateway-injected headers.
- * Falls back to JWT validation if headers are missing (direct access).
+ * Reads user context from gateway-injected headers, trusted only with a valid
+ * gateway signature (GATEWAY_SIGNING_SECRET). Outside production it falls back
+ * to direct JWT validation for local development.
  */
 export function authenticateFromGateway(jwtSecret) {
-    return (req, _res, next) => {
-        // Method 1: Read gateway-injected headers
-        const userId = req.headers[GATEWAY_HEADERS.USER_ID];
-        if (userId) {
-            req.user = {
-                id: userId,
-                email: req.headers[GATEWAY_HEADERS.USER_EMAIL] || '',
-                companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] || '',
-                roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES]),
-                permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS]),
-                isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
-            };
+    return (req, res, next) => {
+        const user = userFromGatewayHeaders(req) ?? userFromBearerToken(req, jwtSecret);
+        if (user) {
+            req.user = user;
             return next();
         }
-        // Method 2: Direct JWT validation (for development / direct access)
-        if (jwtSecret) {
-            const token = extractBearerToken(req.headers.authorization);
-            if (token) {
-                try {
-                    const payload = verifyToken(token, jwtSecret);
-                    req.user = {
-                        id: payload.sub,
-                        email: payload.email,
-                        companyId: payload.companyId,
-                        roles: payload.roles || [],
-                        permissions: payload.permissions || [],
-                        isSuperAdmin: payload.isSuperAdmin || false,
-                    };
-                    return next();
-                }
-                catch {
-                    // Fall through to 401
-                }
-            }
-        }
-        _res.status(401).json({ success: false, message: 'Authentication required' });
+        res.status(401).json({ success: false, message: 'Authentication required' });
     };
 }
 /**
- * Optional auth — attaches user if present, continues if not.
+ * Optional auth — attaches user if present (and trusted), continues if not.
  */
 export function optionalAuthFromGateway(jwtSecret) {
     return (req, _res, next) => {
-        const userId = req.headers[GATEWAY_HEADERS.USER_ID];
-        if (userId) {
-            req.user = {
-                id: userId,
-                email: req.headers[GATEWAY_HEADERS.USER_EMAIL] || '',
-                companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] || '',
-                roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES]),
-                permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS]),
-                isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
-            };
-        }
-        else if (jwtSecret) {
-            const token = extractBearerToken(req.headers.authorization);
-            if (token) {
-                try {
-                    const payload = verifyToken(token, jwtSecret);
-                    req.user = {
-                        id: payload.sub,
-                        email: payload.email,
-                        companyId: payload.companyId,
-                        roles: payload.roles || [],
-                        permissions: payload.permissions || [],
-                        isSuperAdmin: payload.isSuperAdmin || false,
-                    };
-                }
-                catch { /* ignore */ }
-            }
-        }
+        const user = userFromGatewayHeaders(req) ?? userFromBearerToken(req, jwtSecret);
+        if (user)
+            req.user = user;
         next();
     };
 }

package/dist/express/auth.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/express/auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,0CAA0C;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAW,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,GAAG;gBACT,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;gBAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;gBAClE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,CAAC;gBAC1E,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAW,CAAC;gBACtF,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,MAAM;aACpE,CAAC;YACF,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,oEAAoE;QACpE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBAC9C,GAAG,CAAC,IAAI,GAAG;wBACT,EAAE,EAAE,OAAO,CAAC,GAAG;wBACf,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;wBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;wBACtC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;qBAC5C,CAAC;oBACF,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAW,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,GAAG;gBACT,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;gBAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;gBAClE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,CAAC;gBAC1E,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAW,CAAC;gBACtF,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,MAAM;aACpE,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBAC9C,GAAG,CAAC,IAAI,GAAG;wBACT,EAAE,EAAE,OAAO,CAAC,GAAG;wBACf,KAAK,EAAE,OAAO,CAAC,KAAK;wBACpB,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;wBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;wBACtC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;qBAC5C,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.middleware.js","sourceRoot":"","sources":["../../src/express/auth.middleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAWD,sFAAsF;AACtF,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAW,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;QAC9D,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,IAAI,EAAE;QAClE,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,CAAC;QAC1E,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAW,CAAC;QACtF,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,MAAM;KACpE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,mBAAmB,CAAC,GAAY,EAAE,SAAkB;IAC3D,IAAI,CAAC,SAAS,IAAI,CAAC,0BAA0B,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;YACtC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;SAC5C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,IAAI,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAChB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAkB;IACxD,OAAO,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAQ,EAAE;QAChE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAC1B,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/logging/index.d.ts

@@ -1,4 +1,5 @@
 import winston from 'winston';
+export { redactFormat, redactSensitive, isSensitiveKey, REDACTED } from './redact.js';
 export declare function createLogger(service: string, level?: string): winston.Logger;
 export declare function createAuditLogger(service: string): winston.Logger;
 //# sourceMappingURL=index.d.ts.map

package/dist/logging/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAmG9B,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAwB5E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAiBjE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAM9B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAgGtF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAyB5E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAiBjE"}

package/dist/logging/index.js

@@ -2,6 +2,8 @@ import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
 import { mkdirSync } from 'fs';
 import { resolve } from 'path';
+import { redactFormat } from './redact.js';
+export { redactFormat, redactSensitive, isSensitiveKey, REDACTED } from './redact.js';
 const { combine, timestamp, json, errors, colorize, printf, splat } = winston.format;
 /**
  * Custom dev console format that renders meta cleanly and warns when callers
@@ -101,7 +103,8 @@ export function createLogger(service, level) {
     return winston.createLogger({
         level: resolvedLevel,
         defaultMeta: { service },
-        format: combine(errors({ stack: true }), splat(), timestamp()),
+        // redactFormat runs after splat so metadata passed as extra arguments is covered too.
+        format: combine(errors({ stack: true }), splat(), redactFormat(), timestamp()),
         transports,
     });
 }
@@ -118,7 +121,7 @@ export function createAuditLogger(service) {
     return winston.createLogger({
         level: 'info',
         defaultMeta: { service, type: 'audit' },
-        format: combine(splat(), timestamp(), json()),
+        format: combine(splat(), redactFormat(), timestamp(), json()),
         transports,
     });
 }

package/dist/logging/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,eAAe,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACvC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAMlE,CAAC;IAEF,mEAAmE;IACnE,IAAI,eAAuB,CAAC;IAC5B,IAAI,OAAO,IAAI,OAAQ,OAA8B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1E,eAAe,GAAG,8BAA8B,CAAC;IACnD,CAAC;SAAM,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;QACpC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IACpC,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3D,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC;IAEpD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,YAAY;QACzB,aAAa,EAAE,IAAI;QACnB,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;KACvE,CAAC;IAEF,OAAO;QACL,IAAI,eAAe,CAAC;YAClB,GAAG,MAAM;YACT,QAAQ,EAAE,GAAG,OAAO,sBAAsB;YAC1C,KAAK;SACN,CAAC;QACF,IAAI,eAAe,CAAC;YAClB,GAAG,MAAM;YACT,QAAQ,EAAE,GAAG,OAAO,mBAAmB;YACvC,KAAK,EAAE,OAAO;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAc;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC3D,MAAM,aAAa,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,CACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACvB,KAAK,EAAE,EACP,SAAS,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAC5C,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAC7E;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAE5G,OAAO,OAAO,CAAC,YAAY,CAAC;QAC1B,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC;QAC9D,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,OAAO,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhH,OAAO,OAAO,CAAC,YAAY,CAAC;QAC1B,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;QACvC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,UAAU;KACX,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,eAAe,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEtF,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACvC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAMlE,CAAC;IAEF,mEAAmE;IACnE,IAAI,eAAuB,CAAC;IAC5B,IAAI,OAAO,IAAI,OAAQ,OAA8B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1E,eAAe,GAAG,8BAA8B,CAAC;IACnD,CAAC;SAAM,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;QACpC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IACpC,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3D,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,8DAA8D;IAC9D,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AAC/E,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IACjD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC;IAEpD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;IAED,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,YAAY;QACzB,aAAa,EAAE,IAAI;QACnB,OAAO;QACP,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;KACvE,CAAC;IAEF,OAAO;QACL,IAAI,eAAe,CAAC;YAClB,GAAG,MAAM;YACT,QAAQ,EAAE,GAAG,OAAO,sBAAsB;YAC1C,KAAK;SACN,CAAC;QACF,IAAI,eAAe,CAAC;YAClB,GAAG,MAAM;YACT,QAAQ,EAAE,GAAG,OAAO,mBAAmB;YACvC,KAAK,EAAE,OAAO;SACf,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAc;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC3D,MAAM,aAAa,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,CACb,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EACvB,KAAK,EAAE,EACP,SAAS,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,EAC5C,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAC7E;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAE5G,OAAO,OAAO,CAAC,YAAY,CAAC;QAC1B,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,EAAE,OAAO,EAAE;QACxB,sFAAsF;QACtF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC;QAC9E,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;QACtD,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;KAC9C,CAAC,CAAC;IAEH,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,OAAO,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAEhH,OAAO,OAAO,CAAC,YAAY,CAAC;QAC1B,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;QACvC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7D,UAAU;KACX,CAAC,CAAC;AACL,CAAC"}

package/dist/logging/redact.d.ts

@@ -0,0 +1,16 @@
+import winston from 'winston';
+export declare const REDACTED = "[REDACTED]";
+/** True for keys whose values are redacted (case/separator-insensitive). */
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Deep copy of `value` with sensitive keys replaced by [REDACTED] and inline
+ * bearer/basic credentials masked. Errors keep their message and stack.
+ * Handles cycles and caps depth.
+ */
+export declare function redactSensitive(value: unknown, depth?: number, seen?: WeakSet<object>): unknown;
+/**
+ * Winston format that redacts every log entry's message and metadata in place.
+ * Winston's internal Symbol keys (level/message/splat) are left untouched.
+ */
+export declare const redactFormat: winston.Logform.FormatWrap;
+//# sourceMappingURL=redact.d.ts.map

package/dist/logging/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/logging/redact.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,eAAO,MAAM,QAAQ,eAAe,CAAC;AA4BrC,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKnD;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,EAAE,IAAI,GAAE,OAAO,CAAC,MAAM,CAAiB,GAAG,OAAO,CAqBzG;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,4BAMvB,CAAC"}

package/dist/logging/redact.js

@@ -0,0 +1,83 @@
+import winston from 'winston';
+export const REDACTED = '[REDACTED]';
+// Exact keys (compared lower-cased, with '-' and '_' removed) and key fragments
+// whose values must never reach a log: credentials, tokens, OTPs, secrets.
+const EXACT_KEYS = new Set([
+    'authorization',
+    'proxyauthorization',
+    'cookie',
+    'setcookie',
+    'password',
+    'passwd',
+    'currentpassword',
+    'newpassword',
+    'apikey',
+    'otp',
+    'pin',
+    'smtppassword',
+    'encryptionkey',
+    'privatekey',
+    'xinternalservicesecret',
+    'xgatewaysignature',
+]);
+const KEY_FRAGMENTS = ['secret', 'password', 'passphrase', 'credential'];
+// accessToken, refresh_token, captchaToken… but not counters like promptTokens.
+const KEY_SUFFIXES = ['token'];
+const MAX_DEPTH = 8;
+/** True for keys whose values are redacted (case/separator-insensitive). */
+export function isSensitiveKey(key) {
+    const normalized = key.toLowerCase().replace(/[-_]/g, '');
+    return EXACT_KEYS.has(normalized)
+        || KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment))
+        || KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+}
+// Bearer/Basic credentials embedded in free text (e.g. a logged header line or error message).
+const INLINE_CREDENTIAL = /\b(Bearer|Basic)\s+[A-Za-z0-9\-._~+/]+=*/g;
+function redactString(value) {
+    return value.replace(INLINE_CREDENTIAL, `$1 ${REDACTED}`);
+}
+/**
+ * Deep copy of `value` with sensitive keys replaced by [REDACTED] and inline
+ * bearer/basic credentials masked. Errors keep their message and stack.
+ * Handles cycles and caps depth.
+ */
+export function redactSensitive(value, depth = 0, seen = new WeakSet()) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (depth >= MAX_DEPTH)
+        return '[Truncated]';
+    if (seen.has(value))
+        return '[Circular]';
+    seen.add(value);
+    if (Array.isArray(value))
+        return value.map((item) => redactSensitive(item, depth + 1, seen));
+    if (value instanceof Date || Buffer.isBuffer(value))
+        return value;
+    const source = value;
+    const result = {};
+    if (value instanceof Error) {
+        result.name = value.name;
+        result.message = redactString(value.message);
+        if (value.stack)
+            result.stack = redactString(value.stack);
+    }
+    for (const key of Object.keys(source)) {
+        result[key] = isSensitiveKey(key) ? REDACTED : redactSensitive(source[key], depth + 1, seen);
+    }
+    return result;
+}
+/**
+ * Winston format that redacts every log entry's message and metadata in place.
+ * Winston's internal Symbol keys (level/message/splat) are left untouched.
+ */
+export const redactFormat = winston.format((info) => {
+    for (const key of Object.keys(info)) {
+        if (key === 'level')
+            continue;
+        info[key] = isSensitiveKey(key) ? REDACTED : redactSensitive(info[key]);
+    }
+    return info;
+});
+//# sourceMappingURL=redact.js.map

package/dist/logging/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/logging/redact.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,eAAe;IACf,oBAAoB;IACpB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,QAAQ;IACR,iBAAiB;IACjB,aAAa;IACb,QAAQ;IACR,KAAK;IACL,KAAK;IACL,cAAc;IACd,eAAe;IACf,YAAY;IACZ,wBAAwB;IACxB,mBAAmB;CACpB,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AACzE,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC;AAE/B,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;WAC5B,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;WAC/D,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,+FAA+F;AAC/F,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;AAEtE,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAE,OAAwB,IAAI,OAAO,EAAE;IAC9F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,aAAa,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7F,IAAI,KAAK,YAAY,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAElE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,KAAK;YAAE,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAClD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC"}

package/dist/nestjs/auth.guard.d.ts

@@ -1,6 +1,8 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 export declare const IS_PUBLIC_KEY = "isPublic";
+/** Request property AuthGuard sets when the caller came from signed gateway headers. */
+export declare const GATEWAY_VERIFIED_FLAG = "gatewayVerified";
 /**
  * NestJS Guard: validates JWT or trusts gateway-injected headers.
  */

package/dist/nestjs/auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAczC,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC;;GAEG;AACH,qBACa,SAAU,YAAW,WAAW;IAC/B,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAElC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA8C/D"}
+{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../src/nestjs/auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAezC,eAAO,MAAM,aAAa,aAAa,CAAC;AAExC,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;GAEG;AACH,qBACa,SAAU,YAAW,WAAW;IAC/B,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAElC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmD/D"}

package/dist/nestjs/auth.guard.js

@@ -10,6 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import { Injectable, UnauthorizedException, } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { verifyToken } from '../common/jwt.utils.js';
+import { isTrustedGatewayIdentity, isDirectJwtFallbackAllowed } from '../common/gateway-signature.js';
 import { GATEWAY_HEADERS } from '../types/index.js';
 /** Parse a header value that may be a JSON array string or comma-separated. */
 function parseArrayHeader(value) {
@@ -25,6 +26,8 @@ function parseArrayHeader(value) {
     return trimmed.split(',').filter(Boolean);
 }
 export const IS_PUBLIC_KEY = 'isPublic';
+/** Request property AuthGuard sets when the caller came from signed gateway headers. */
+export const GATEWAY_VERIFIED_FLAG = 'gatewayVerified';
 /**
  * NestJS Guard: validates JWT or trusts gateway-injected headers.
  */
@@ -41,9 +44,10 @@ let AuthGuard = class AuthGuard {
         if (isPublic)
             return true;
         const request = context.switchToHttp().getRequest();
-        // Trust gateway-injected headers first
+        // Trust gateway-injected headers only with a valid gateway signature
         const gatewayUserId = request.headers[GATEWAY_HEADERS.USER_ID];
-        if (gatewayUserId) {
+        if (gatewayUserId && isTrustedGatewayIdentity(request.headers)) {
+            request[GATEWAY_VERIFIED_FLAG] = true;
             request.user = {
                 id: gatewayUserId,
                 companyId: request.headers[GATEWAY_HEADERS.COMPANY_ID] || undefined,
@@ -54,7 +58,11 @@ let AuthGuard = class AuthGuard {
             };
             return true;
         }
-        // Fallback to direct JWT validation
+        // Fallback to direct JWT validation — development only; production
+        // requests must arrive through the gateway.
+        if (!isDirectJwtFallbackAllowed()) {
+            throw new UnauthorizedException('Authentication required');
+        }
         const authHeader = request.headers.authorization;
         if (!authHeader?.startsWith('Bearer ')) {
             throw new UnauthorizedException('Missing authentication token');

package/dist/nestjs/auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../src/nestjs/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,UAAU,EAGV,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACA;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,aAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,uCAAuC;QACvC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,aAAa;gBACjB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;gBACnE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;gBAC/D,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,CAAC;gBAC9E,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAW,CAAC;gBAC1F,YAAY,EACV,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,MAAM;aAC/C,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oCAAoC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,OAAO,CAAC,GAAG;gBACf,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;gBACtC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;aAC/B,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAA;AAjDY,SAAS;IADrB,UAAU,EAAE;qCAEoB,SAAS;GAD7B,SAAS,CAiDrB"}
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../src/nestjs/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,UAAU,EAGV,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AACtG,OAAO,EAAE,eAAe,EAAkB,MAAM,mBAAmB,CAAC;AAEpE,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC,wFAAwF;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEvD;;GAEG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IACA;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,aAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,qEAAqE;QACrE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,aAAa,IAAI,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,aAAa;gBACjB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;gBACnE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS;gBAC/D,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,CAAW,CAAC;gBAC9E,WAAW,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,gBAAgB,CAAW,CAAC;gBAC1F,YAAY,EACV,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,KAAK,MAAM;aAC/C,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mEAAmE;QACnE,4CAA4C;QAC5C,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,UAAW,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,OAAO,CAAC,GAAG;gBACf,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC1B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;gBACtC,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;aAC/B,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAA;AAtDY,SAAS;IADrB,UAAU,EAAE;qCAEoB,SAAS;GAD7B,SAAS,CAsDrB"}