@heyatom/bastion-client 0.1.0

package/dist/cjs/nest/bastion-jwks.service.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var BastionJwksService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BastionJwksService = void 0;
+const common_1 = require("@nestjs/common");
+const jwks_verifier_js_1 = require("../core/jwks-verifier.js");
+const errors_js_1 = require("../core/errors.js");
+const options_js_1 = require("./options.js");
+const nest_logger_js_1 = require("./nest-logger.js");
+/** Verifies inbound Bastion tokens against the cached JWKS. Throws `UnauthorizedException` on any failure. */
+let BastionJwksService = BastionJwksService_1 = class BastionJwksService {
+    verifier;
+    constructor(options) {
+        this.verifier = new jwks_verifier_js_1.JwksVerifier({
+            baseUrl: options.baseUrl,
+            ttlMs: options.jwksTtlMs,
+            issuer: options.issuer,
+            logger: (0, nest_logger_js_1.nestLogger)(BastionJwksService_1.name),
+        });
+    }
+    async verify(token) {
+        try {
+            return await this.verifier.verify(token);
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.BastionTokenError)
+                throw new common_1.UnauthorizedException(err.message);
+            throw err;
+        }
+    }
+};
+exports.BastionJwksService = BastionJwksService;
+exports.BastionJwksService = BastionJwksService = BastionJwksService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(options_js_1.BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], BastionJwksService);

package/dist/cjs/nest/bastion.module.d.ts

@@ -0,0 +1,20 @@
+import { DynamicModule } from '@nestjs/common';
+import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './options.js';
+/**
+ * ```ts
+ * BastionModule.forRootAsync({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     baseUrl: config.getOrThrow('BASTION_URL'),
+ *     serviceSlug: config.getOrThrow('BASTION_APP_SLUG'),
+ *     apiKey: config.get('BASTION_CLIENT_API_KEY'),
+ *   }),
+ * })
+ * ```
+ * Global: import once in `AppModule`, inject anywhere.
+ */
+export declare class BastionModule {
+    static forRoot(options: BastionModuleOptions): DynamicModule;
+    static forRootAsync(options: BastionModuleAsyncOptions): DynamicModule;
+    private static build;
+}

package/dist/cjs/nest/bastion.module.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var BastionModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BastionModule = void 0;
+const common_1 = require("@nestjs/common");
+const options_js_1 = require("./options.js");
+const bastion_jwks_service_js_1 = require("./bastion-jwks.service.js");
+const bastion_service_js_1 = require("./bastion.service.js");
+const bastion_audit_service_js_1 = require("./bastion-audit.service.js");
+const service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard.js");
+const bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
+const audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
+const PROVIDERS = [
+    bastion_jwks_service_js_1.BastionJwksService,
+    bastion_service_js_1.BastionService,
+    bastion_audit_service_js_1.BastionAuditService,
+    service_client_jwt_guard_js_1.ServiceClientJwtGuard,
+    bastion_user_guard_js_1.BastionUserGuard,
+    audit_interceptor_js_1.AuditInterceptor,
+];
+/**
+ * ```ts
+ * BastionModule.forRootAsync({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     baseUrl: config.getOrThrow('BASTION_URL'),
+ *     serviceSlug: config.getOrThrow('BASTION_APP_SLUG'),
+ *     apiKey: config.get('BASTION_CLIENT_API_KEY'),
+ *   }),
+ * })
+ * ```
+ * Global: import once in `AppModule`, inject anywhere.
+ */
+let BastionModule = BastionModule_1 = class BastionModule {
+    static forRoot(options) {
+        return this.build({ provide: options_js_1.BASTION_OPTIONS, useValue: options });
+    }
+    static forRootAsync(options) {
+        return this.build({ provide: options_js_1.BASTION_OPTIONS, useFactory: options.useFactory, inject: options.inject }, options.imports);
+    }
+    static build(optionsProvider, imports = []) {
+        return {
+            module: BastionModule_1,
+            imports,
+            providers: [optionsProvider, ...PROVIDERS],
+            exports: [options_js_1.BASTION_OPTIONS, ...PROVIDERS],
+        };
+    }
+};
+exports.BastionModule = BastionModule;
+exports.BastionModule = BastionModule = BastionModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], BastionModule);

package/dist/cjs/nest/bastion.service.d.ts

@@ -0,0 +1,18 @@
+import { BastionHttp } from '../core/bastion-http.js';
+import type { AuditEventInput, TokenResponse } from '../core/types.js';
+import { type BastionModuleOptions } from './options.js';
+/** Outbound HTTP to Bastion. A non-2xx answer surfaces as `HttpException` with Bastion's status. */
+export declare class BastionService {
+    private readonly options;
+    readonly http: BastionHttp;
+    constructor(options: BastionModuleOptions);
+    call<T>(method: string, path: string, body?: unknown, init?: {
+        token?: string;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+    clientAuth(): Promise<TokenResponse>;
+    writeAuditEvent(token: string, data: AuditEventInput): Promise<{
+        id: string;
+        createdAt: string;
+    }>;
+}

package/dist/cjs/nest/bastion.service.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BastionService = void 0;
+const common_1 = require("@nestjs/common");
+const bastion_http_js_1 = require("../core/bastion-http.js");
+const errors_js_1 = require("../core/errors.js");
+const options_js_1 = require("./options.js");
+/** Outbound HTTP to Bastion. A non-2xx answer surfaces as `HttpException` with Bastion's status. */
+let BastionService = class BastionService {
+    options;
+    http;
+    constructor(options) {
+        this.options = options;
+        this.http = new bastion_http_js_1.BastionHttp({ baseUrl: options.baseUrl });
+    }
+    async call(method, path, body, init) {
+        try {
+            return await this.http.call(method, path, body, init);
+        }
+        catch (err) {
+            if (err instanceof errors_js_1.BastionHttpError)
+                throw new common_1.HttpException(err.message, err.status);
+            throw err;
+        }
+    }
+    clientAuth() {
+        if (!this.options.apiKey) {
+            throw new Error('BastionModule: apiKey is required for clientAuth()');
+        }
+        return this.call('POST', '/auth/client', {
+            apiKey: this.options.apiKey,
+            serviceSlug: this.options.serviceSlug,
+            ...(this.options.tenantSlug ? { tenantSlug: this.options.tenantSlug } : {}),
+        });
+    }
+    writeAuditEvent(token, data) {
+        return this.call('POST', '/events', data, { token });
+    }
+};
+exports.BastionService = BastionService;
+exports.BastionService = BastionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(options_js_1.BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], BastionService);

package/dist/cjs/nest/decorators/audit.decorator.d.ts

@@ -0,0 +1,15 @@
+export declare const AUDIT_EVENT_KEY = "bastion:auditEvent";
+export interface AuditRequest {
+    params: Record<string, string>;
+    body: unknown;
+}
+export interface AuditOptions {
+    /** Builds the metadata from the handler's result and the request. Errors here are logged, never propagated. */
+    metadata?: (result: unknown, req: AuditRequest) => Record<string, unknown>;
+}
+export interface AuditDescriptor {
+    event: string;
+    options: AuditOptions;
+}
+/** Writes `event` (attributed to the admin user on the request) after the handler succeeds. Needs `AuditInterceptor`. */
+export declare const Audit: (event: string, options?: AuditOptions) => import("@nestjs/common").CustomDecorator<string>;

package/dist/cjs/nest/decorators/audit.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Audit = exports.AUDIT_EVENT_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.AUDIT_EVENT_KEY = 'bastion:auditEvent';
+/** Writes `event` (attributed to the admin user on the request) after the handler succeeds. Needs `AuditInterceptor`. */
+const Audit = (event, options = {}) => (0, common_1.SetMetadata)(exports.AUDIT_EVENT_KEY, { event, options });
+exports.Audit = Audit;

package/dist/cjs/nest/decorators/current-user.decorator.d.ts

@@ -0,0 +1,4 @@
+/** The machine token payload set by `ServiceClientJwtGuard`. */
+export declare const CurrentClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** The user payload set by `BastionUserGuard`. */
+export declare const CurrentAdminUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/cjs/nest/decorators/current-user.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentAdminUser = exports.CurrentClient = void 0;
+const common_1 = require("@nestjs/common");
+/** The machine token payload set by `ServiceClientJwtGuard`. */
+exports.CurrentClient = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().user);
+/** The user payload set by `BastionUserGuard`. */
+exports.CurrentAdminUser = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().adminUser);

package/dist/cjs/nest/decorators/public.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const IS_PUBLIC_KEY = "isPublic";
+/** Exempts a route (or a whole controller) from `ServiceClientJwtGuard`. */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/cjs/nest/decorators/public.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.IS_PUBLIC_KEY = 'isPublic';
+/** Exempts a route (or a whole controller) from `ServiceClientJwtGuard`. */
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;

package/dist/cjs/nest/decorators/require-scope.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const REQUIRED_SCOPES_KEY = "bastion:requiredScopes";
+/** Scopes the machine token must carry to reach this route (all of them). Checked by `ServiceClientJwtGuard`. */
+export declare const RequireScope: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;

package/dist/cjs/nest/decorators/require-scope.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequireScope = exports.REQUIRED_SCOPES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.REQUIRED_SCOPES_KEY = 'bastion:requiredScopes';
+/** Scopes the machine token must carry to reach this route (all of them). Checked by `ServiceClientJwtGuard`. */
+const RequireScope = (...scopes) => (0, common_1.SetMetadata)(exports.REQUIRED_SCOPES_KEY, scopes);
+exports.RequireScope = RequireScope;

package/dist/cjs/nest/guards/bastion-user.guard.d.ts

@@ -0,0 +1,20 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { BastionAuditService } from '../bastion-audit.service.js';
+import { type BastionModuleOptions } from '../options.js';
+/**
+ * Admin-surface guard: accepts a *user* token from one of `acceptedAppSlugs`
+ * (the console, typically) with one of `acceptedRoles`. Sets `req.adminUser`.
+ * A denial is audited as `admin.access_denied`, rate-limited per (app, reason)
+ * so a misconfigured console cannot flood the log.
+ */
+export declare class BastionUserGuard implements CanActivate {
+    private readonly jwks;
+    private readonly audit;
+    private readonly acceptedAppSlugs;
+    private readonly acceptedRoles;
+    private readonly reportedAt;
+    constructor(jwks: BastionJwksService, audit: BastionAuditService, options: BastionModuleOptions);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+    private reportAccessDenied;
+}

package/dist/cjs/nest/guards/bastion-user.guard.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BastionUserGuard = void 0;
+const common_1 = require("@nestjs/common");
+const types_js_1 = require("../../core/types.js");
+const bastion_jwks_service_js_1 = require("../bastion-jwks.service.js");
+const bastion_audit_service_js_1 = require("../bastion-audit.service.js");
+const options_js_1 = require("../options.js");
+const ACCESS_DENIED_COOLDOWN_MS = 5 * 60 * 1000;
+const ACCESS_DENIED_MAX_KEYS = 50;
+const DEFAULT_ACCEPTED_APP_SLUGS = ['meridian'];
+const DEFAULT_ACCEPTED_ROLES = ['ADMIN', 'OWNER', 'SUPER_ADMIN'];
+/**
+ * Admin-surface guard: accepts a *user* token from one of `acceptedAppSlugs`
+ * (the console, typically) with one of `acceptedRoles`. Sets `req.adminUser`.
+ * A denial is audited as `admin.access_denied`, rate-limited per (app, reason)
+ * so a misconfigured console cannot flood the log.
+ */
+let BastionUserGuard = class BastionUserGuard {
+    jwks;
+    audit;
+    acceptedAppSlugs;
+    acceptedRoles;
+    reportedAt = new Map();
+    constructor(jwks, audit, options) {
+        this.jwks = jwks;
+        this.audit = audit;
+        this.acceptedAppSlugs = options.acceptedAppSlugs ?? DEFAULT_ACCEPTED_APP_SLUGS;
+        this.acceptedRoles = options.acceptedRoles ?? DEFAULT_ACCEPTED_ROLES;
+    }
+    async canActivate(ctx) {
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new common_1.UnauthorizedException('Missing token');
+        const payload = await this.jwks.verify(auth.slice(7));
+        if ((0, types_js_1.isServiceClientToken)(payload))
+            throw new common_1.UnauthorizedException('Service client token not allowed');
+        if (!this.acceptedAppSlugs.includes(payload.appSlug)) {
+            this.reportAccessDenied('app_not_allowed', payload, req);
+            throw new common_1.ForbiddenException('App not allowed');
+        }
+        if (!this.acceptedRoles.includes(payload.role ?? '')) {
+            this.reportAccessDenied('role_insufficient', payload, req);
+            throw new common_1.ForbiddenException('Insufficient role');
+        }
+        req.adminUser = payload;
+        return true;
+    }
+    reportAccessDenied(reason, user, req) {
+        const key = `${user.appSlug}:${reason}`;
+        const now = Date.now();
+        const last = this.reportedAt.get(key);
+        if (last !== undefined && now - last < ACCESS_DENIED_COOLDOWN_MS)
+            return;
+        if (this.reportedAt.size >= ACCESS_DENIED_MAX_KEYS)
+            this.reportedAt.clear();
+        this.reportedAt.set(key, now);
+        void this.audit.write('admin.access_denied', {
+            metadata: {
+                reason,
+                appSlug: user.appSlug,
+                role: user.role ?? 'none',
+                path: req.originalUrl ?? req.url ?? 'unknown',
+            },
+        });
+    }
+};
+exports.BastionUserGuard = BastionUserGuard;
+exports.BastionUserGuard = BastionUserGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(options_js_1.BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [bastion_jwks_service_js_1.BastionJwksService,
+        bastion_audit_service_js_1.BastionAuditService, Object])
+], BastionUserGuard);

package/dist/cjs/nest/guards/service-client-jwt.guard.d.ts

@@ -0,0 +1,17 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { type BastionModuleOptions } from '../options.js';
+/**
+ * Machine-to-machine guard, meant as the global `APP_GUARD`: every route needs
+ * a `service_client` token issued for this service (`serviceSlug` from the
+ * module options, never hard-coded) unless it carries `@Public()`.
+ * `@RequireScope()` adds a per-route scope check. The payload lands on `req.user`.
+ */
+export declare class ServiceClientJwtGuard implements CanActivate {
+    private readonly jwks;
+    private readonly reflector;
+    private readonly options;
+    constructor(jwks: BastionJwksService, reflector: Reflector, options: BastionModuleOptions);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+}

package/dist/cjs/nest/guards/service-client-jwt.guard.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceClientJwtGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const types_js_1 = require("../../core/types.js");
+const bastion_jwks_service_js_1 = require("../bastion-jwks.service.js");
+const options_js_1 = require("../options.js");
+const public_decorator_js_1 = require("../decorators/public.decorator.js");
+const require_scope_decorator_js_1 = require("../decorators/require-scope.decorator.js");
+/**
+ * Machine-to-machine guard, meant as the global `APP_GUARD`: every route needs
+ * a `service_client` token issued for this service (`serviceSlug` from the
+ * module options, never hard-coded) unless it carries `@Public()`.
+ * `@RequireScope()` adds a per-route scope check. The payload lands on `req.user`.
+ */
+let ServiceClientJwtGuard = class ServiceClientJwtGuard {
+    jwks;
+    reflector;
+    options;
+    constructor(jwks, reflector, options) {
+        this.jwks = jwks;
+        this.reflector = reflector;
+        this.options = options;
+    }
+    async canActivate(ctx) {
+        const targets = [ctx.getHandler(), ctx.getClass()];
+        if (this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, targets))
+            return true;
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new common_1.UnauthorizedException('Missing token');
+        const payload = await this.jwks.verify(auth.slice(7));
+        if (!(0, types_js_1.isServiceClientToken)(payload))
+            throw new common_1.UnauthorizedException('Not a service client token');
+        if (payload.serviceSlug !== this.options.serviceSlug) {
+            throw new common_1.ForbiddenException('Token not issued for this service');
+        }
+        const required = this.reflector.getAllAndOverride(require_scope_decorator_js_1.REQUIRED_SCOPES_KEY, targets) ?? [];
+        const missing = required.filter((s) => !payload.scopes?.includes(s));
+        if (missing.length)
+            throw new common_1.ForbiddenException(`Missing scope: ${missing.join(', ')}`);
+        req.user = payload;
+        return true;
+    }
+};
+exports.ServiceClientJwtGuard = ServiceClientJwtGuard;
+exports.ServiceClientJwtGuard = ServiceClientJwtGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(options_js_1.BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [bastion_jwks_service_js_1.BastionJwksService,
+        core_1.Reflector, Object])
+], ServiceClientJwtGuard);

package/dist/cjs/nest/index.d.ts

@@ -0,0 +1,14 @@
+export * from '../core/index.js';
+export { BastionModule } from './bastion.module.js';
+export { BASTION_OPTIONS, type BastionModuleOptions, type BastionModuleAsyncOptions } from './options.js';
+export { BastionJwksService } from './bastion-jwks.service.js';
+export { BastionService } from './bastion.service.js';
+export { BastionAuditService } from './bastion-audit.service.js';
+export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
+export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AuditInterceptor } from './interceptors/audit.interceptor.js';
+export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
+export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
+export { Audit, AUDIT_EVENT_KEY, type AuditOptions, type AuditRequest, type AuditDescriptor } from './decorators/audit.decorator.js';
+export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/cjs/nest/index.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CROSS_TENANT_ROLE = exports.resolveTenantScope = exports.CurrentAdminUser = exports.CurrentClient = exports.AUDIT_EVENT_KEY = exports.Audit = exports.REQUIRED_SCOPES_KEY = exports.RequireScope = exports.IS_PUBLIC_KEY = exports.Public = exports.AuditInterceptor = exports.BastionUserGuard = exports.ServiceClientJwtGuard = exports.BastionAuditService = exports.BastionService = exports.BastionJwksService = exports.BASTION_OPTIONS = exports.BastionModule = void 0;
+__exportStar(require("../core/index.js"), exports);
+var bastion_module_js_1 = require("./bastion.module.js");
+Object.defineProperty(exports, "BastionModule", { enumerable: true, get: function () { return bastion_module_js_1.BastionModule; } });
+var options_js_1 = require("./options.js");
+Object.defineProperty(exports, "BASTION_OPTIONS", { enumerable: true, get: function () { return options_js_1.BASTION_OPTIONS; } });
+var bastion_jwks_service_js_1 = require("./bastion-jwks.service.js");
+Object.defineProperty(exports, "BastionJwksService", { enumerable: true, get: function () { return bastion_jwks_service_js_1.BastionJwksService; } });
+var bastion_service_js_1 = require("./bastion.service.js");
+Object.defineProperty(exports, "BastionService", { enumerable: true, get: function () { return bastion_service_js_1.BastionService; } });
+var bastion_audit_service_js_1 = require("./bastion-audit.service.js");
+Object.defineProperty(exports, "BastionAuditService", { enumerable: true, get: function () { return bastion_audit_service_js_1.BastionAuditService; } });
+var service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard.js");
+Object.defineProperty(exports, "ServiceClientJwtGuard", { enumerable: true, get: function () { return service_client_jwt_guard_js_1.ServiceClientJwtGuard; } });
+var bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
+Object.defineProperty(exports, "BastionUserGuard", { enumerable: true, get: function () { return bastion_user_guard_js_1.BastionUserGuard; } });
+var audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
+Object.defineProperty(exports, "AuditInterceptor", { enumerable: true, get: function () { return audit_interceptor_js_1.AuditInterceptor; } });
+var public_decorator_js_1 = require("./decorators/public.decorator.js");
+Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return public_decorator_js_1.Public; } });
+Object.defineProperty(exports, "IS_PUBLIC_KEY", { enumerable: true, get: function () { return public_decorator_js_1.IS_PUBLIC_KEY; } });
+var require_scope_decorator_js_1 = require("./decorators/require-scope.decorator.js");
+Object.defineProperty(exports, "RequireScope", { enumerable: true, get: function () { return require_scope_decorator_js_1.RequireScope; } });
+Object.defineProperty(exports, "REQUIRED_SCOPES_KEY", { enumerable: true, get: function () { return require_scope_decorator_js_1.REQUIRED_SCOPES_KEY; } });
+var audit_decorator_js_1 = require("./decorators/audit.decorator.js");
+Object.defineProperty(exports, "Audit", { enumerable: true, get: function () { return audit_decorator_js_1.Audit; } });
+Object.defineProperty(exports, "AUDIT_EVENT_KEY", { enumerable: true, get: function () { return audit_decorator_js_1.AUDIT_EVENT_KEY; } });
+var current_user_decorator_js_1 = require("./decorators/current-user.decorator.js");
+Object.defineProperty(exports, "CurrentClient", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentClient; } });
+Object.defineProperty(exports, "CurrentAdminUser", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentAdminUser; } });
+var tenant_scope_js_1 = require("./tenant-scope.js");
+Object.defineProperty(exports, "resolveTenantScope", { enumerable: true, get: function () { return tenant_scope_js_1.resolveTenantScope; } });
+Object.defineProperty(exports, "CROSS_TENANT_ROLE", { enumerable: true, get: function () { return tenant_scope_js_1.CROSS_TENANT_ROLE; } });

package/dist/cjs/nest/interceptors/audit.interceptor.d.ts

@@ -0,0 +1,12 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Observable } from 'rxjs';
+import { BastionAuditService } from '../bastion-audit.service.js';
+/** Pairs with `@Audit()`: after a handler succeeds, writes the event attributed to `req.adminUser`. */
+export declare class AuditInterceptor implements NestInterceptor {
+    private readonly reflector;
+    private readonly audit;
+    private readonly logger;
+    constructor(reflector: Reflector, audit: BastionAuditService);
+    intercept(ctx: ExecutionContext, next: CallHandler): Observable<unknown>;
+}

package/dist/cjs/nest/interceptors/audit.interceptor.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuditInterceptor_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const rxjs_1 = require("rxjs");
+const bastion_audit_service_js_1 = require("../bastion-audit.service.js");
+const audit_decorator_js_1 = require("../decorators/audit.decorator.js");
+/** Pairs with `@Audit()`: after a handler succeeds, writes the event attributed to `req.adminUser`. */
+let AuditInterceptor = AuditInterceptor_1 = class AuditInterceptor {
+    reflector;
+    audit;
+    logger = new common_1.Logger(AuditInterceptor_1.name);
+    constructor(reflector, audit) {
+        this.reflector = reflector;
+        this.audit = audit;
+    }
+    intercept(ctx, next) {
+        const descriptor = this.reflector.get(audit_decorator_js_1.AUDIT_EVENT_KEY, ctx.getHandler());
+        if (!descriptor)
+            return next.handle();
+        const req = ctx.switchToHttp().getRequest();
+        return next.handle().pipe((0, rxjs_1.tap)((result) => {
+            let metadata;
+            try {
+                metadata = descriptor.options.metadata?.(result, req) ?? {};
+            }
+            catch (err) {
+                this.logger.warn(`audit metadata builder failed event=${descriptor.event}: ${err.message}`);
+                return;
+            }
+            void this.audit.writeAsAdmin(descriptor.event, req.adminUser, metadata);
+        }));
+    }
+};
+exports.AuditInterceptor = AuditInterceptor;
+exports.AuditInterceptor = AuditInterceptor = AuditInterceptor_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        bastion_audit_service_js_1.BastionAuditService])
+], AuditInterceptor);

package/dist/cjs/nest/nest-logger.d.ts

@@ -0,0 +1,2 @@
+import type { BastionLogger } from '../core/types.js';
+export declare function nestLogger(context: string): BastionLogger;

package/dist/cjs/nest/nest-logger.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nestLogger = nestLogger;
+const common_1 = require("@nestjs/common");
+function nestLogger(context) {
+    const logger = new common_1.Logger(context);
+    return {
+        warn: (m) => logger.warn(m),
+        error: (m) => logger.error(m),
+        log: (m) => logger.log(m),
+    };
+}