@heavybit/pendoadmin-shared-lib 1.6.0 → 1.7.0

package/dist/nestjs/permission.guard.js

@@ -10,7 +10,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import { Injectable, ForbiddenException, } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { PERMISSIONS_KEY, REQUIRE_ALL_KEY, ROLES_KEY, } from './permission.decorator.js';
-import { IS_PUBLIC_KEY } from './auth.guard.js';
+import { IS_PUBLIC_KEY, GATEWAY_VERIFIED_FLAG } from './auth.guard.js';
 /**
  * NestJS Guard: checks permissions/roles from decorators.
  * Must be used after AuthGuard so that request.user is populated.
@@ -37,9 +37,10 @@ let PermissionGuard = class PermissionGuard {
         if (user.isSuperAdmin)
             return true;
         // M2M / gateway-authenticated clients: the gateway already verified the JWT
-        // and injected headers. Requiring human roles on top of scoped permissions
-        // is overly restrictive for API access.
-        const isGatewayAuth = request.headers?.['x-gateway-auth'] === 'verified';
+        // and signed the injected headers (AuthGuard checked the signature).
+        // Requiring human roles on top of scoped permissions is overly restrictive
+        // for API access.
+        const isGatewayAuth = request[GATEWAY_VERIFIED_FLAG] === true;
         // Check permissions first — they are the primary authorization mechanism
         const requiredPermissions = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [context.getHandler(), context.getClass()]);
         const requireAll = this.reflector.getAllAndOverride(REQUIRE_ALL_KEY, [context.getHandler(), context.getClass()]);

package/dist/nestjs/permission.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.guard.js","sourceRoot":"","sources":["../../src/nestjs/permission.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,UAAU,EAGV,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD;;;GAGG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IACN;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,WAAW,CAAC,OAAyB;QACnC,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,aAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAA0B,OAAO,CAAC,IAAI,CAAC;QAEjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAEnC,4EAA4E;QAC5E,2EAA2E;QAC3E,wCAAwC;QACxC,MAAM,aAAa,GACjB,OAAO,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;QAErD,yEAAyE;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1D,eAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,eAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,sBAAsB,GAAG,IAAI,CAAC;QAClC,IAAI,mBAAmB,EAAE,MAAM,EAAE,CAAC;YAChC,sBAAsB,GAAG,UAAU;gBACjC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,gEAAgE;YAChE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,sBAAsB,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3D,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnEY,eAAe;IAD3B,UAAU,EAAE;qCAEoB,SAAS;GAD7B,eAAe,CAmE3B"}
+{"version":3,"file":"permission.guard.js","sourceRoot":"","sources":["../../src/nestjs/permission.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EACL,UAAU,EAGV,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,eAAe,EACf,eAAe,EACf,SAAS,GACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGvE;;;GAGG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IACN;IAApB,YAAoB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAE5C,WAAW,CAAC,OAAyB;QACnC,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,aAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,GAA0B,OAAO,CAAC,IAAI,CAAC;QAEjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAEnC,4EAA4E;QAC5E,qEAAqE;QACrE,2EAA2E;QAC3E,kBAAkB;QAClB,MAAM,aAAa,GAAG,OAAO,CAAC,qBAAqB,CAAC,KAAK,IAAI,CAAC;QAE9D,yEAAyE;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1D,eAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACjD,eAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,sBAAsB,GAAG,IAAI,CAAC;QAClC,IAAI,mBAAmB,EAAE,MAAM,EAAE,CAAC;YAChC,sBAAsB,GAAG,UAAU;gBACjC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,oEAAoE;QACpE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,SAAS,EACT,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,aAAa,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,gEAAgE;YAChE,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,aAAa,IAAI,sBAAsB,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,EAAE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3D,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnEY,eAAe;IAD3B,UAAU,EAAE;qCAEoB,SAAS;GAD7B,eAAe,CAmE3B"}

package/dist/rate-limit/create-rate-limiter.d.ts

@@ -10,7 +10,7 @@ export interface RateLimitConfig {
     keyPrefix?: string;
     /** Optional Redis client — falls back to in-memory if omitted */
     redisClient?: Redis | null;
-    /** Extract the rate-limit key from the request. Default: X-User-Id header → IP → "unknown" */
+    /** Extract the rate-limit key from the request. Default: signed gateway user id → IP → "unknown" */
     keyExtractor?: (req: Request) => string;
 }
 export interface RateLimitResult {
@@ -20,4 +20,10 @@ export interface RateLimitResult {
     middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 }
 export declare function createRateLimiter(cfg?: RateLimitConfig): RateLimitResult;
+/**
+ * The gateway user id only when its signature verifies — an unsigned
+ * x-user-id is caller-controlled, and a fresh value per request would get a
+ * fresh budget. Otherwise the client IP.
+ */
+export declare function defaultKeyExtractor(req: Request): string;
 //# sourceMappingURL=create-rate-limiter.d.ts.map

package/dist/rate-limit/create-rate-limiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/rate-limit/create-rate-limiter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAuC,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAIjC,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,WAAW,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IAC3B,8FAA8F;IAC9F,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,yBAAyB;IACzB,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAID,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,eAAoB,GAAG,eAAe,CAmE5E"}
+{"version":3,"file":"create-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/rate-limit/create-rate-limiter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAuC,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjG,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAKjC,MAAM,WAAW,eAAe;IAC9B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,WAAW,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IAC3B,oGAAoG;IACpG,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,OAAO,EAAE,mBAAmB,CAAC;IAC7B,yBAAyB;IACzB,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChF;AAID,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,eAAoB,GAAG,eAAe,CAmE5E;AAID;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMxD"}

package/dist/rate-limit/create-rate-limiter.js

@@ -3,6 +3,7 @@
 // Factory that creates a dual-layer (Redis + memory fallback) rate limiter.
 // Available for any Express-based service.
 import { RateLimiterRedis, RateLimiterMemory } from "rate-limiter-flexible";
+import { isTrustedGatewayIdentity } from "../common/gateway-signature.js";
 // ─── Factory ────────────────────────────────────────────
 export function createRateLimiter(cfg = {}) {
     const { maxRequests = 100, windowMs = 60_000, keyPrefix = "rl:service", redisClient = null, keyExtractor = defaultKeyExtractor, } = cfg;
@@ -54,7 +55,16 @@ export function createRateLimiter(cfg = {}) {
     return { limiter, middleware };
 }
 // ─── Defaults ───────────────────────────────────────────
-function defaultKeyExtractor(req) {
-    return req.headers["x-user-id"] || req.ip || "unknown";
+/**
+ * The gateway user id only when its signature verifies — an unsigned
+ * x-user-id is caller-controlled, and a fresh value per request would get a
+ * fresh budget. Otherwise the client IP.
+ */
+export function defaultKeyExtractor(req) {
+    const userId = req.headers["x-user-id"];
+    if (typeof userId === "string" && userId && isTrustedGatewayIdentity(req.headers)) {
+        return `user:${userId}`;
+    }
+    return `ip:${req.ip || "unknown"}`;
 }
 //# sourceMappingURL=create-rate-limiter.js.map

package/dist/rate-limit/create-rate-limiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-rate-limiter.js","sourceRoot":"","sources":["../../src/rate-limit/create-rate-limiter.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,4EAA4E;AAC5E,2CAA2C;AAG3C,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAuB,MAAM,uBAAuB,CAAC;AAyBjG,2DAA2D;AAE3D,MAAM,UAAU,iBAAiB,CAAC,MAAuB,EAAE;IACzD,MAAM,EACJ,WAAW,GAAG,GAAG,EACjB,QAAQ,GAAG,MAAM,EACjB,SAAS,GAAG,YAAY,EACxB,WAAW,GAAG,IAAI,EAClB,YAAY,GAAG,mBAAmB,GACnC,GAAG,GAAG,CAAC;IAER,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;IAE9D,MAAM,aAAa,GAAG,IAAI,iBAAiB,CAAC;QAC1C,SAAS;QACT,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,IAAI,OAA4B,CAAC;IAEjC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,GAAG,IAAI,gBAAgB,CAAC;YAC7B,WAAW,EAAE,WAAW;YACxB,SAAS;YACT,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,YAAY;YACtB,aAAa,EAAE,CAAC;YAChB,gBAAgB,EAAE,aAAa;SAChC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,CAAC;IAC1B,CAAC;IAED,wDAAwD;IAExD,KAAK,UAAU,UAAU,CACvB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAE1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CACX,mBAAmB,EACnB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CACzD,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,MAAW,EAAE,CAAC;YACrB,iDAAiD;YACjD,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,cAAc,SAAS,qBAAqB,EAAE,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC;gBACvF,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,2DAA2D;AAE3D,SAAS,mBAAmB,CAAC,GAAY;IACvC,OAAQ,GAAG,CAAC,OAAO,CAAC,WAAW,CAAY,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;AACrE,CAAC"}
+{"version":3,"file":"create-rate-limiter.js","sourceRoot":"","sources":["../../src/rate-limit/create-rate-limiter.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,4EAA4E;AAC5E,2CAA2C;AAG3C,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAuB,MAAM,uBAAuB,CAAC;AAEjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAwB1E,2DAA2D;AAE3D,MAAM,UAAU,iBAAiB,CAAC,MAAuB,EAAE;IACzD,MAAM,EACJ,WAAW,GAAG,GAAG,EACjB,QAAQ,GAAG,MAAM,EACjB,SAAS,GAAG,YAAY,EACxB,WAAW,GAAG,IAAI,EAClB,YAAY,GAAG,mBAAmB,GACnC,GAAG,GAAG,CAAC;IAER,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC;IAE9D,MAAM,aAAa,GAAG,IAAI,iBAAiB,CAAC;QAC1C,SAAS;QACT,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAC;IAEH,IAAI,OAA4B,CAAC;IAEjC,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,GAAG,IAAI,gBAAgB,CAAC;YAC7B,WAAW,EAAE,WAAW;YACxB,SAAS;YACT,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,YAAY;YACtB,aAAa,EAAE,CAAC;YAChB,gBAAgB,EAAE,aAAa;SAChC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,CAAC;IAC1B,CAAC;IAED,wDAAwD;IAExD,KAAK,UAAU,UAAU,CACvB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAE1C,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CACX,mBAAmB,EACnB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CACzD,CAAC;YACF,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,MAAW,EAAE,CAAC;YACrB,iDAAiD;YACjD,IAAI,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,cAAc,SAAS,qBAAqB,EAAE,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC;gBACvF,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YAChD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC;AAED,2DAA2D;AAE3D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,OAAO,QAAQ,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,EAAE,IAAI,SAAS,EAAE,CAAC;AACrC,CAAC"}

package/dist/rate-limit/index.d.ts

@@ -1,3 +1,3 @@
-export { createRateLimiter } from "./create-rate-limiter.js";
+export { createRateLimiter, defaultKeyExtractor } from "./create-rate-limiter.js";
 export type { RateLimitConfig, RateLimitResult } from "./create-rate-limiter.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/rate-limit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAClF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/rate-limit/index.js

@@ -1,2 +1,2 @@
-export { createRateLimiter } from "./create-rate-limiter.js";
+export { createRateLimiter, defaultKeyExtractor } from "./create-rate-limiter.js";
 //# sourceMappingURL=index.js.map

package/dist/rate-limit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/types/index.d.ts

@@ -213,5 +213,7 @@ export declare const GATEWAY_HEADERS: {
     readonly IS_SUPERADMIN: "x-is-superadmin";
     readonly CORRELATION_ID: "x-correlation-id";
     readonly SERVICE_NAME: "x-service-name";
+    readonly GATEWAY_SIGNATURE: "x-gateway-signature";
+    readonly GATEWAY_TIMESTAMP: "x-gateway-ts";
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,MAAM,CAKR;AAED,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,yCAAyC,CAAC;AAE5E,8FAA8F;AAC9F,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,cAAc,CAAC,GAAG,IAAI,GAC1D,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,cAAc,CAAC,EACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,MAAM,GAAG,SAAS,CAIpB;AAMD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,IAAI,EAAE,eAAe,CAAC;CACvB;AAMD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD,eAAO,MAAM,eAAe;;;;;;;;;CASlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,0BAA0B,EAAE,OAAO,CAAC;IACpC,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3B,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,EACf,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,MAAM,CAKR;AAED,oDAAoD;AACpD,eAAO,MAAM,qBAAqB,yCAAyC,CAAC;AAE5E,8FAA8F;AAC9F,wBAAgB,qBAAqB,CACnC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,cAAc,CAAC,GAAG,IAAI,GAC1D,OAAO,CAET;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,GAAG,cAAc,CAAC,EACnD,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,GACjC,MAAM,GAAG,SAAS,CAIpB;AAMD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,IAAI,EAAE,eAAe,CAAC;CACvB;AAMD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAMD,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD,eAAO,MAAM,eAAe;;;;;;;;;;;CAWlB,CAAC"}

package/dist/types/index.js

@@ -48,5 +48,7 @@ export const GATEWAY_HEADERS = {
     IS_SUPERADMIN: 'x-is-superadmin',
     CORRELATION_ID: 'x-correlation-id',
     SERVICE_NAME: 'x-service-name',
+    GATEWAY_SIGNATURE: 'x-gateway-signature',
+    GATEWAY_TIMESTAMP: 'x-gateway-ts',
 };
 //# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,oBAAoB;AACpB,iDAAiD;AA2EjD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAe,EACf,kBAAkC;IAElC,IAAI,IAAI,CAAC,YAAY,IAAI,kBAAkB,EAAE,CAAC;QAC5C,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;AACxB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CACnC,IAA2D;IAE3D,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAmD,EACnD,kBAAkC;IAElC,IAAI,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,kBAAkB,IAAI,SAAS,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC,SAAS,CAAC;AACxB,CAAC;AAwJD,iDAAiD;AACjD,uBAAuB;AACvB,iDAAiD;AAEjD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,gBAAgB;CACtB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,oBAAoB;AACpB,iDAAiD;AA2EjD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAe,EACf,kBAAkC;IAElC,IAAI,IAAI,CAAC,YAAY,IAAI,kBAAkB,EAAE,CAAC;QAC5C,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;AACxB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,sCAAsC,CAAC;AAE5E,8FAA8F;AAC9F,MAAM,UAAU,qBAAqB,CACnC,IAA2D;IAE3D,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AACnF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAmD,EACnD,kBAAkC;IAElC,IAAI,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,kBAAkB,IAAI,SAAS,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,OAAO,IAAI,CAAC,SAAS,CAAC;AACxB,CAAC;AAwJD,iDAAiD;AACjD,uBAAuB;AACvB,iDAAiD;AAEjD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,gBAAgB;IAC9B,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,cAAc;CACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heavybit/pendoadmin-shared-lib",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Shared library for PendoAdmin microservices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -29,7 +29,7 @@
     "build": "tsc",
     "dev": "tsc --watch",
     "clean": "rm -rf dist",
-    "test": "npm run build && node --test tests/"
+    "test": "npm run build && node --test tests/*.test.mjs"
   },
   "exports": {
     ".": "./dist/index.js",

package/src/common/gateway-signature.ts

@@ -0,0 +1,124 @@
+import crypto from 'node:crypto';
+
+/**
+ * Signed gateway identity.
+ *
+ * The api-gateway (and any internal service forwarding a caller's identity)
+ * signs the identity headers it injects with GATEWAY_SIGNING_SECRET. Downstream
+ * services verify the signature before trusting x-user-id / x-is-superadmin /
+ * x-user-permissions, so a request that reaches a service port directly, or
+ * slips past the gateway with its own headers, cannot impersonate anyone.
+ *
+ * The api-gateway keeps its own copy of the signer
+ * (api-gateway/src/utils/gateway-signature.ts). Any change to the canonical
+ * string below must be made in both places — the shared test vector in both
+ * test suites pins the format.
+ */
+
+export const GATEWAY_SIGNATURE_HEADER = 'x-gateway-signature';
+export const GATEWAY_TIMESTAMP_HEADER = 'x-gateway-ts';
+const SIGNATURE_VERSION = 'v1';
+
+/** Identity headers covered by the signature, in canonical order. */
+export const GATEWAY_IDENTITY_HEADERS = [
+  'x-user-id',
+  'x-user-email',
+  'x-company-id',
+  'x-company-slug',
+  'x-user-roles',
+  'x-user-permissions',
+  'x-is-superadmin',
+  'x-otp-verified',
+] as const;
+
+/** Default allowed clock skew between signer and verifier. */
+export const GATEWAY_SIGNATURE_MAX_SKEW_SECONDS = 60;
+
+type HeaderBag = Record<string, string | string[] | undefined>;
+
+function headerValue(headers: HeaderBag, name: string): string {
+  const value = headers[name];
+  return (Array.isArray(value) ? value[0] : value) ?? '';
+}
+
+function canonicalString(headers: HeaderBag, timestamp: string): string {
+  return [
+    SIGNATURE_VERSION,
+    timestamp,
+    headerValue(headers, 'x-correlation-id'),
+    ...GATEWAY_IDENTITY_HEADERS.map((name) => headerValue(headers, name)),
+  ].join('\n');
+}
+
+function hmac(secret: string, payload: string): string {
+  return crypto.createHmac('sha256', secret).update(payload).digest('hex');
+}
+
+/**
+ * Signature headers for the identity headers already present in `headers`
+ * (lower-case names). Merge the result into the outgoing request headers.
+ */
+export function signGatewayIdentity(
+  headers: HeaderBag,
+  secret: string,
+  nowMs: number = Date.now(),
+): Record<typeof GATEWAY_SIGNATURE_HEADER | typeof GATEWAY_TIMESTAMP_HEADER, string> {
+  const timestamp = String(Math.floor(nowMs / 1000));
+  return {
+    [GATEWAY_SIGNATURE_HEADER]: hmac(secret, canonicalString(headers, timestamp)),
+    [GATEWAY_TIMESTAMP_HEADER]: timestamp,
+  };
+}
+
+export interface VerifyGatewayIdentityOptions {
+  maxSkewSeconds?: number;
+  nowMs?: number;
+}
+
+/** True when the identity headers carry a valid, fresh signature from `secret`. */
+export function verifyGatewayIdentity(
+  headers: HeaderBag,
+  secret: string,
+  options: VerifyGatewayIdentityOptions = {},
+): boolean {
+  if (!secret) return false;
+  const { maxSkewSeconds = GATEWAY_SIGNATURE_MAX_SKEW_SECONDS, nowMs = Date.now() } = options;
+
+  const timestamp = headerValue(headers, GATEWAY_TIMESTAMP_HEADER);
+  const signature = headerValue(headers, GATEWAY_SIGNATURE_HEADER);
+  if (!/^\d+$/.test(timestamp) || !/^[0-9a-f]{64}$/.test(signature)) return false;
+  if (Math.abs(nowMs / 1000 - Number(timestamp)) > maxSkewSeconds) return false;
+
+  const expected = Buffer.from(hmac(secret, canonicalString(headers, timestamp)), 'hex');
+  const provided = Buffer.from(signature, 'hex');
+  return expected.length === provided.length && crypto.timingSafeEqual(expected, provided);
+}
+
+/**
+ * The secret services sign and verify gateway identity with. Unset means
+ * unsigned identity is accepted only outside production (see
+ * isUnsignedGatewayIdentityAllowed).
+ */
+export function gatewaySigningSecret(): string {
+  return process.env.GATEWAY_SIGNING_SECRET || '';
+}
+
+/** Local development may run services without a signing secret; production never trusts unsigned identity. */
+export function isUnsignedGatewayIdentityAllowed(): boolean {
+  return !gatewaySigningSecret() && process.env.NODE_ENV !== 'production';
+}
+
+/**
+ * Whether a request's gateway identity headers can be trusted: a valid
+ * signature when a secret is configured, otherwise only outside production.
+ */
+export function isTrustedGatewayIdentity(headers: HeaderBag): boolean {
+  const secret = gatewaySigningSecret();
+  if (secret) return verifyGatewayIdentity(headers, secret);
+  return isUnsignedGatewayIdentityAllowed();
+}
+
+/** Direct JWT validation is a development convenience only; production requests must come through the gateway. */
+export function isDirectJwtFallbackAllowed(): boolean {
+  return process.env.NODE_ENV !== 'production';
+}

package/src/common/index.ts

@@ -5,3 +5,4 @@ export * from './uuid.utils.js';
 export * from './response.utils.js';
 export * from './timezone.utils.js';
 export * from './permission.utils.js';
+export * from './gateway-signature.js';

package/src/express/auth.middleware.ts

@@ -1,5 +1,6 @@
 import type { Request, Response, NextFunction } from 'express';
 import { verifyToken, extractBearerToken } from '../common/jwt.utils.js';
+import { isTrustedGatewayIdentity, isDirectJwtFallbackAllowed } from '../common/gateway-signature.js';
 import { GATEWAY_HEADERS, type IAuthUser } from '../types/index.js';
 
 /** Parse a header value that may be a JSON array string or comma-separated. */
@@ -21,83 +22,64 @@ declare global {
   }
 }
 
+/** The caller from signed gateway headers, or null when absent or unsigned/forged. */
+function userFromGatewayHeaders(req: Request): IAuthUser | null {
+  const userId = req.headers[GATEWAY_HEADERS.USER_ID] as string;
+  if (!userId || !isTrustedGatewayIdentity(req.headers)) return null;
+  return {
+    id: userId,
+    email: req.headers[GATEWAY_HEADERS.USER_EMAIL] as string || '',
+    companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] as string || '',
+    roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES] as string),
+    permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS] as string),
+    isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
+  };
+}
+
+/** The caller from a bearer JWT — development only (direct service access). */
+function userFromBearerToken(req: Request, jwtSecret?: string): IAuthUser | null {
+  if (!jwtSecret || !isDirectJwtFallbackAllowed()) return null;
+  const token = extractBearerToken(req.headers.authorization);
+  if (!token) return null;
+  try {
+    const payload = verifyToken(token, jwtSecret);
+    return {
+      id: payload.sub,
+      email: payload.email,
+      companyId: payload.companyId,
+      roles: payload.roles || [],
+      permissions: payload.permissions || [],
+      isSuperAdmin: payload.isSuperAdmin || false,
+    };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Auth middleware for downstream services (behind API gateway).
- * Reads user context from gateway-injected headers.
- * Falls back to JWT validation if headers are missing (direct access).
+ * Reads user context from gateway-injected headers, trusted only with a valid
+ * gateway signature (GATEWAY_SIGNING_SECRET). Outside production it falls back
+ * to direct JWT validation for local development.
  */
 export function authenticateFromGateway(jwtSecret?: string) {
-  return (req: Request, _res: Response, next: NextFunction): void => {
-    // Method 1: Read gateway-injected headers
-    const userId = req.headers[GATEWAY_HEADERS.USER_ID] as string;
-    if (userId) {
-      req.user = {
-        id: userId,
-        email: req.headers[GATEWAY_HEADERS.USER_EMAIL] as string || '',
-        companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] as string || '',
-        roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES] as string),
-        permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS] as string),
-        isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
-      };
+  return (req: Request, res: Response, next: NextFunction): void => {
+    const user = userFromGatewayHeaders(req) ?? userFromBearerToken(req, jwtSecret);
+    if (user) {
+      req.user = user;
       return next();
     }
-
-    // Method 2: Direct JWT validation (for development / direct access)
-    if (jwtSecret) {
-      const token = extractBearerToken(req.headers.authorization);
-      if (token) {
-        try {
-          const payload = verifyToken(token, jwtSecret);
-          req.user = {
-            id: payload.sub,
-            email: payload.email,
-            companyId: payload.companyId,
-            roles: payload.roles || [],
-            permissions: payload.permissions || [],
-            isSuperAdmin: payload.isSuperAdmin || false,
-          };
-          return next();
-        } catch {
-          // Fall through to 401
-        }
-      }
-    }
-
-    _res.status(401).json({ success: false, message: 'Authentication required' });
+    res.status(401).json({ success: false, message: 'Authentication required' });
   };
 }
 
 /**
- * Optional auth — attaches user if present, continues if not.
+ * Optional auth — attaches user if present (and trusted), continues if not.
  */
 export function optionalAuthFromGateway(jwtSecret?: string) {
   return (req: Request, _res: Response, next: NextFunction): void => {
-    const userId = req.headers[GATEWAY_HEADERS.USER_ID] as string;
-    if (userId) {
-      req.user = {
-        id: userId,
-        email: req.headers[GATEWAY_HEADERS.USER_EMAIL] as string || '',
-        companyId: req.headers[GATEWAY_HEADERS.COMPANY_ID] as string || '',
-        roles: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_ROLES] as string),
-        permissions: parseArrayHeader(req.headers[GATEWAY_HEADERS.USER_PERMISSIONS] as string),
-        isSuperAdmin: req.headers[GATEWAY_HEADERS.IS_SUPERADMIN] === 'true',
-      };
-    } else if (jwtSecret) {
-      const token = extractBearerToken(req.headers.authorization);
-      if (token) {
-        try {
-          const payload = verifyToken(token, jwtSecret);
-          req.user = {
-            id: payload.sub,
-            email: payload.email,
-            companyId: payload.companyId,
-            roles: payload.roles || [],
-            permissions: payload.permissions || [],
-            isSuperAdmin: payload.isSuperAdmin || false,
-          };
-        } catch { /* ignore */ }
-      }
-    }
+    const user = userFromGatewayHeaders(req) ?? userFromBearerToken(req, jwtSecret);
+    if (user) req.user = user;
     next();
   };
 }

package/src/logging/index.ts

@@ -2,6 +2,9 @@ import winston from 'winston';
 import DailyRotateFile from 'winston-daily-rotate-file';
 import { mkdirSync } from 'fs';
 import { resolve } from 'path';
+import { redactFormat } from './redact.js';
+
+export { redactFormat, redactSensitive, isSensitiveKey, REDACTED } from './redact.js';
 
 const { combine, timestamp, json, errors, colorize, printf, splat } = winston.format;
 
@@ -118,7 +121,8 @@ export function createLogger(service: string, level?: string): winston.Logger {
   return winston.createLogger({
     level: resolvedLevel,
     defaultMeta: { service },
-    format: combine(errors({ stack: true }), splat(), timestamp()),
+    // redactFormat runs after splat so metadata passed as extra arguments is covered too.
+    format: combine(errors({ stack: true }), splat(), redactFormat(), timestamp()),
     transports,
   });
 }
@@ -137,7 +141,7 @@ export function createAuditLogger(service: string): winston.Logger {
   return winston.createLogger({
     level: 'info',
     defaultMeta: { service, type: 'audit' },
-    format: combine(splat(), timestamp(), json()),
+    format: combine(splat(), redactFormat(), timestamp(), json()),
     transports,
   });
 }

package/src/logging/redact.ts

@@ -0,0 +1,84 @@
+import winston from 'winston';
+
+export const REDACTED = '[REDACTED]';
+
+// Exact keys (compared lower-cased, with '-' and '_' removed) and key fragments
+// whose values must never reach a log: credentials, tokens, OTPs, secrets.
+const EXACT_KEYS = new Set([
+  'authorization',
+  'proxyauthorization',
+  'cookie',
+  'setcookie',
+  'password',
+  'passwd',
+  'currentpassword',
+  'newpassword',
+  'apikey',
+  'otp',
+  'pin',
+  'smtppassword',
+  'encryptionkey',
+  'privatekey',
+  'xinternalservicesecret',
+  'xgatewaysignature',
+]);
+const KEY_FRAGMENTS = ['secret', 'password', 'passphrase', 'credential'];
+// accessToken, refresh_token, captchaToken… but not counters like promptTokens.
+const KEY_SUFFIXES = ['token'];
+
+const MAX_DEPTH = 8;
+
+/** True for keys whose values are redacted (case/separator-insensitive). */
+export function isSensitiveKey(key: string): boolean {
+  const normalized = key.toLowerCase().replace(/[-_]/g, '');
+  return EXACT_KEYS.has(normalized)
+    || KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment))
+    || KEY_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
+}
+
+// Bearer/Basic credentials embedded in free text (e.g. a logged header line or error message).
+const INLINE_CREDENTIAL = /\b(Bearer|Basic)\s+[A-Za-z0-9\-._~+/]+=*/g;
+
+function redactString(value: string): string {
+  return value.replace(INLINE_CREDENTIAL, `$1 ${REDACTED}`);
+}
+
+/**
+ * Deep copy of `value` with sensitive keys replaced by [REDACTED] and inline
+ * bearer/basic credentials masked. Errors keep their message and stack.
+ * Handles cycles and caps depth.
+ */
+export function redactSensitive(value: unknown, depth = 0, seen: WeakSet<object> = new WeakSet()): unknown {
+  if (typeof value === 'string') return redactString(value);
+  if (value === null || typeof value !== 'object') return value;
+  if (depth >= MAX_DEPTH) return '[Truncated]';
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (Array.isArray(value)) return value.map((item) => redactSensitive(item, depth + 1, seen));
+  if (value instanceof Date || Buffer.isBuffer(value)) return value;
+
+  const source = value as Record<string, unknown>;
+  const result: Record<string, unknown> = {};
+  if (value instanceof Error) {
+    result.name = value.name;
+    result.message = redactString(value.message);
+    if (value.stack) result.stack = redactString(value.stack);
+  }
+  for (const key of Object.keys(source)) {
+    result[key] = isSensitiveKey(key) ? REDACTED : redactSensitive(source[key], depth + 1, seen);
+  }
+  return result;
+}
+
+/**
+ * Winston format that redacts every log entry's message and metadata in place.
+ * Winston's internal Symbol keys (level/message/splat) are left untouched.
+ */
+export const redactFormat = winston.format((info) => {
+  for (const key of Object.keys(info)) {
+    if (key === 'level') continue;
+    info[key] = isSensitiveKey(key) ? REDACTED : redactSensitive(info[key]);
+  }
+  return info;
+});

package/src/nestjs/auth.guard.ts

@@ -6,6 +6,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { verifyToken } from '../common/jwt.utils.js';
+import { isTrustedGatewayIdentity, isDirectJwtFallbackAllowed } from '../common/gateway-signature.js';
 import { GATEWAY_HEADERS, type IAuthUser } from '../types/index.js';
 
 /** Parse a header value that may be a JSON array string or comma-separated. */
@@ -20,6 +21,9 @@ function parseArrayHeader(value: string | undefined): string[] {
 
 export const IS_PUBLIC_KEY = 'isPublic';
 
+/** Request property AuthGuard sets when the caller came from signed gateway headers. */
+export const GATEWAY_VERIFIED_FLAG = 'gatewayVerified';
+
 /**
  * NestJS Guard: validates JWT or trusts gateway-injected headers.
  */
@@ -36,9 +40,10 @@ export class AuthGuard implements CanActivate {
 
     const request = context.switchToHttp().getRequest();
 
-    // Trust gateway-injected headers first
+    // Trust gateway-injected headers only with a valid gateway signature
     const gatewayUserId = request.headers[GATEWAY_HEADERS.USER_ID];
-    if (gatewayUserId) {
+    if (gatewayUserId && isTrustedGatewayIdentity(request.headers)) {
+      request[GATEWAY_VERIFIED_FLAG] = true;
       request.user = {
         id: gatewayUserId,
         companyId: request.headers[GATEWAY_HEADERS.COMPANY_ID] || undefined,
@@ -51,7 +56,11 @@ export class AuthGuard implements CanActivate {
       return true;
     }
 
-    // Fallback to direct JWT validation
+    // Fallback to direct JWT validation — development only; production
+    // requests must arrive through the gateway.
+    if (!isDirectJwtFallbackAllowed()) {
+      throw new UnauthorizedException('Authentication required');
+    }
     const authHeader = request.headers.authorization;
     if (!authHeader?.startsWith('Bearer ')) {
       throw new UnauthorizedException('Missing authentication token');