@heyatom/bastion-client 0.3.0 → 0.3.1

package/README.md

@@ -6,7 +6,7 @@ Replaces the `src/modules/bastion/` boilerplate every service used to copy by ha
 - `@heyatom/bastion-client` — framework-free core: `JwksVerifier` (kid-indexed cache, unknown-kid refetch with cooldown, stale-on-error), `BastionHttp` (`POST /auth/client`, `POST /events`, any other route), `ServiceTokenProvider` (single-flight refresh ahead of `exp`), payload types.
 - `@heyatom/bastion-client` also carries Bastion's user-API contract: `BastionApiClient` (login, register, OAuth exchange, 2FA, single-flight refresh, logout, sessions, `/me`, profile, social accounts, email/password flows, export, delete), its types (`BastionMe`, `BastionTokenPair`, …) and `BastionErrorCode` (a stable code on every `BastionHttpError`).
 - `@heyatom/bastion-client/webhooks` — `verifyWebhookSignature` (`X-Bastion-Signature-V2` with timestamp + delivery id, legacy fallback, secret rotation on both sides), header constants, payload type.
-- `@heyatom/bastion-client/nest` — NestJS: `BastionModule`, `ServiceClientJwtGuard`, `BastionUserGuard`, `BastionAuditService`, `AuditInterceptor`, `@Public()`, `@RequireScope()`, `@Audit()`, `@CurrentClient()`, `@CurrentAdminUser()`.
+- `@heyatom/bastion-client/nest` — NestJS: `BastionModule`, `ServiceClientJwtGuard`, `BastionUserGuard`, `BastionAuditService`, `AuditInterceptor` (attributes to `req.adminUser`, any `AuditActor` shape: `sub` plus optional `tenantId`/`tenantSlug`/`role`/`appSlug`), `@Public()`, `@RequireScope()`, `@Audit()`, `@CurrentClient()`, `@CurrentAdminUser()`.
 
 Ships CJS and ESM. `jose` v6 is ESM-only, so the CJS build relies on Node's `require(esm)` — Node ≥ 20.19 / 22.12. Peer deps: `jose` (always), `@nestjs/common`, `@nestjs/core`, `rxjs`, `reflect-metadata` (for `/nest`).
 

package/dist/cjs/nest/bastion-audit.service.d.ts

@@ -1,7 +1,17 @@
 import { OnModuleInit } from '@nestjs/common';
-import type { UserJwtPayload } from '../core/types.js';
 import { BastionService } from './bastion.service.js';
 import { type BastionModuleOptions } from './options.js';
+/**
+ * The fields `writeAsAdmin` reads from an actor. A `UserJwtPayload` fits, and
+ * so does a consumer's own admin payload that carries extra fields.
+ */
+export interface AuditActor {
+    sub: string;
+    tenantId?: string;
+    tenantSlug?: string;
+    role?: string;
+    appSlug?: string;
+}
 /**
  * Fire-and-forget audit writes to `POST /events` under this service's own
  * machine token. Never throws: a failed write is logged, the request that
@@ -12,6 +22,7 @@ export declare class BastionAuditService implements OnModuleInit {
     private readonly logger;
     private readonly tokens;
     private tenantMismatchWarned;
+    private noApiKeyWarned;
     constructor(bastion: BastionService, options: BastionModuleOptions);
     onModuleInit(): Promise<void>;
     /** Tenant of this service's machine token, once known. */
@@ -25,5 +36,5 @@ export declare class BastionAuditService implements OnModuleInit {
      * belongs to the same tenant as this service's token — Bastion rejects a
      * foreign userId silently — otherwise the actor goes into `metadata`.
      */
-    writeAsAdmin(event: string, actor: UserJwtPayload | undefined, metadata?: Record<string, unknown>): Promise<void>;
+    writeAsAdmin(event: string, actor: AuditActor | undefined, metadata?: Record<string, unknown>): Promise<void>;
 }

package/dist/cjs/nest/bastion-audit.service.js

@@ -29,6 +29,7 @@ let BastionAuditService = BastionAuditService_1 = class BastionAuditService {
     logger = new common_1.Logger(BastionAuditService_1.name);
     tokens;
     tenantMismatchWarned = false;
+    noApiKeyWarned = false;
     constructor(bastion, options) {
         this.bastion = bastion;
         this.tokens = options.apiKey
@@ -50,7 +51,12 @@ let BastionAuditService = BastionAuditService_1 = class BastionAuditService {
     }
     async write(event, opts = {}) {
         if (!this.tokens) {
-            this.logger.warn(`audit write skipped, no apiKey configured event=${event}`);
+            // Once, not per event: a consumer that verifies tokens but never writes
+            // audit (no apiKey on purpose) would otherwise log every skipped write.
+            if (!this.noApiKeyWarned) {
+                this.noApiKeyWarned = true;
+                this.logger.warn(`audit writes skipped, no apiKey configured (first event=${event})`);
+            }
             return;
         }
         let token;

package/dist/cjs/nest/index.d.ts

@@ -5,7 +5,7 @@ export { BastionJwksService } from './bastion-jwks.service.js';
 export { BastionService } from './bastion.service.js';
 export { BastionApiClientProvider } from './bastion-api-client.provider.js';
 export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.js';
-export { BastionAuditService } from './bastion-audit.service.js';
+export { BastionAuditService, type AuditActor } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';

package/dist/esm/nest/bastion-audit.service.d.ts

@@ -1,7 +1,17 @@
 import { OnModuleInit } from '@nestjs/common';
-import type { UserJwtPayload } from '../core/types.js';
 import { BastionService } from './bastion.service.js';
 import { type BastionModuleOptions } from './options.js';
+/**
+ * The fields `writeAsAdmin` reads from an actor. A `UserJwtPayload` fits, and
+ * so does a consumer's own admin payload that carries extra fields.
+ */
+export interface AuditActor {
+    sub: string;
+    tenantId?: string;
+    tenantSlug?: string;
+    role?: string;
+    appSlug?: string;
+}
 /**
  * Fire-and-forget audit writes to `POST /events` under this service's own
  * machine token. Never throws: a failed write is logged, the request that
@@ -12,6 +22,7 @@ export declare class BastionAuditService implements OnModuleInit {
     private readonly logger;
     private readonly tokens;
     private tenantMismatchWarned;
+    private noApiKeyWarned;
     constructor(bastion: BastionService, options: BastionModuleOptions);
     onModuleInit(): Promise<void>;
     /** Tenant of this service's machine token, once known. */
@@ -25,5 +36,5 @@ export declare class BastionAuditService implements OnModuleInit {
      * belongs to the same tenant as this service's token — Bastion rejects a
      * foreign userId silently — otherwise the actor goes into `metadata`.
      */
-    writeAsAdmin(event: string, actor: UserJwtPayload | undefined, metadata?: Record<string, unknown>): Promise<void>;
+    writeAsAdmin(event: string, actor: AuditActor | undefined, metadata?: Record<string, unknown>): Promise<void>;
 }

package/dist/esm/nest/bastion-audit.service.js

@@ -26,6 +26,7 @@ let BastionAuditService = BastionAuditService_1 = class BastionAuditService {
     logger = new Logger(BastionAuditService_1.name);
     tokens;
     tenantMismatchWarned = false;
+    noApiKeyWarned = false;
     constructor(bastion, options) {
         this.bastion = bastion;
         this.tokens = options.apiKey
@@ -47,7 +48,12 @@ let BastionAuditService = BastionAuditService_1 = class BastionAuditService {
     }
     async write(event, opts = {}) {
         if (!this.tokens) {
-            this.logger.warn(`audit write skipped, no apiKey configured event=${event}`);
+            // Once, not per event: a consumer that verifies tokens but never writes
+            // audit (no apiKey on purpose) would otherwise log every skipped write.
+            if (!this.noApiKeyWarned) {
+                this.noApiKeyWarned = true;
+                this.logger.warn(`audit writes skipped, no apiKey configured (first event=${event})`);
+            }
             return;
         }
         let token;

package/dist/esm/nest/index.d.ts

@@ -5,7 +5,7 @@ export { BastionJwksService } from './bastion-jwks.service.js';
 export { BastionService } from './bastion.service.js';
 export { BastionApiClientProvider } from './bastion-api-client.provider.js';
 export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.js';
-export { BastionAuditService } from './bastion-audit.service.js';
+export { BastionAuditService, type AuditActor } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",