@heyatom/bastion-client 0.7.2 → 0.8.0

package/dist/cjs/core/jwt.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwt = decodeJwt;
+exports.importRs256Jwk = importRs256Jwk;
+exports.verifyRs256 = verifyRs256;
+const node_crypto_1 = require("node:crypto");
+/** Header and payload of a compact JWS, unverified. Throws on anything that isn't one. */
+function decodeJwt(token) {
+    const parts = token.split('.');
+    // Strict alphabet: Buffer's base64url decoder skips padding and junk, which would let one token have many spellings.
+    if (parts.length !== 3 || !parts.every((part) => /^[A-Za-z0-9_-]*$/.test(part)))
+        throw new Error('not a compact JWS');
+    const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    if (!isObject(header) || !isObject(payload))
+        throw new Error('header or payload not an object');
+    return { header, payload };
+}
+/** An RS256 verification key from a JWKS entry; RSA ≥ 2048 bits only. */
+function importRs256Jwk(jwk) {
+    if (jwk.kty !== 'RSA' || (jwk.alg !== undefined && jwk.alg !== 'RS256') || (jwk.use !== undefined && jwk.use !== 'sig')) {
+        throw new Error('not an RS256 signing key');
+    }
+    const key = (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+    if ((key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+        throw new Error('RSA key shorter than 2048 bits');
+    return key;
+}
+/**
+ * RS256 signature, `exp`/`nbf`, optional `iss`. What `jose.jwtVerify` checked for us,
+ * in node:crypto so the CJS build has no ESM-only dependency. Throws on any failure.
+ */
+function verifyRs256(token, key, issuer, now = Date.now()) {
+    const { header, payload } = decodeJwt(token);
+    if (header.alg !== 'RS256')
+        throw new Error('alg not RS256');
+    if (header.crit !== undefined)
+        throw new Error('unsupported crit header');
+    const [h, p, s] = token.split('.');
+    if (!(0, node_crypto_1.verify)('RSA-SHA256', Buffer.from(`${h}.${p}`), key, Buffer.from(s, 'base64url')))
+        throw new Error('bad signature');
+    const seconds = Math.floor(now / 1000);
+    if (typeof payload.exp !== 'number' || payload.exp <= seconds)
+        throw new Error('expired');
+    if (payload.nbf !== undefined && (typeof payload.nbf !== 'number' || payload.nbf > seconds))
+        throw new Error('not yet valid');
+    if (payload.iat !== undefined && typeof payload.iat !== 'number')
+        throw new Error('bad iat');
+    if (issuer && payload.iss !== issuer)
+        throw new Error('wrong issuer');
+    return payload;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/cjs/core/service-token-provider.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceTokenProvider = void 0;
-const jose_1 = require("jose");
+const jwt_js_1 = require("./jwt.js");
 const types_js_1 = require("./types.js");
 const REFRESH_MARGIN_MS = 5 * 60 * 1000;
 const FALLBACK_TTL_MS = 60 * 60 * 1000;
@@ -62,7 +62,7 @@ class ServiceTokenProvider {
         if (!credential?.apiKey)
             throw new Error(`Bastion service client for "${serviceSlug}" not configured`);
         const { accessToken } = await this.http.clientAuth(credential);
-        const { exp, tenantId } = (0, jose_1.decodeJwt)(accessToken);
+        const { exp, tenantId } = (0, jwt_js_1.decodeJwt)(accessToken).payload;
         this.cache.set(serviceSlug, {
             token: accessToken,
             expiresAt: exp ? exp * 1000 : Date.now() + FALLBACK_TTL_MS,

package/dist/cjs/nest/bastion-api-client.provider.d.ts

@@ -4,8 +4,9 @@ import { type BastionModuleOptions } from './options.js';
 /**
  * `BastionApiClient` bound to this app (`serviceSlug` as `appSlug`,
  * `tenantSlug`), sharing `BastionService.http`. Inject it in an app backend
- * that proxies its users' login/refresh/account flows; a pure service
- * (Herald, Beacon) never needs it. Failures are `BastionHttpException`s:
+ * that proxies its users' login/refresh/account flows, or one that reads
+ * its users' Bastion data with their token (Beacon: `listSocialAccounts`);
+ * a pure machine service (Herald) never needs it. Failures are `BastionHttpException`s:
  * an `HttpException` with Bastion's status plus `code`/`upstreamMessage`.
  */
 export declare class BastionApiClientProvider extends BastionApiClient {

package/dist/cjs/nest/bastion-api-client.provider.js

@@ -21,8 +21,9 @@ const nest_logger_js_1 = require("./nest-logger.js");
 /**
  * `BastionApiClient` bound to this app (`serviceSlug` as `appSlug`,
  * `tenantSlug`), sharing `BastionService.http`. Inject it in an app backend
- * that proxies its users' login/refresh/account flows; a pure service
- * (Herald, Beacon) never needs it. Failures are `BastionHttpException`s:
+ * that proxies its users' login/refresh/account flows, or one that reads
+ * its users' Bastion data with their token (Beacon: `listSocialAccounts`);
+ * a pure machine service (Herald) never needs it. Failures are `BastionHttpException`s:
  * an `HttpException` with Bastion's status plus `code`/`upstreamMessage`.
  */
 let BastionApiClientProvider = class BastionApiClientProvider extends api_client_js_1.BastionApiClient {

package/dist/cjs/nest/bastion-http-exception.d.ts

@@ -1,16 +1,26 @@
 import { HttpException } from '@nestjs/common';
 import { BastionHttp, type BastionRequestInit } from '../core/bastion-http.js';
-import { BastionHttpError, type BastionErrorCode } from '../core/errors.js';
+import { BastionErrorCode, BastionHttpError } from '../core/errors.js';
 /**
- * The Nest face of a Bastion error: an `HttpException` carrying Bastion's
- * status, so the global filter answers with it unchanged, plus the stable
- * `code` and the upstream message for the handlers that branch on them.
- * `getResponse()` is `{ code, message }`.
+ * The Nest face of a Bastion error, so the global filter answers the browser
+ * per api.md §3/§14:
+ * - 4xx: Bastion's status, `code`, message and `errors` (field errors of a 400). A 4xx the
+ *   package can't classify keeps Bastion's own code (`PASSWORD_TOO_SHORT`) or the status
+ *   default (`NOT_FOUND`), never `UPSTREAM`;
+ * - Bastion down, timed out or answering 503: 503 `UNAVAILABLE`, generic message;
+ * - any other 5xx: 502 `UPSTREAM`, generic message.
+ *
+ * `getResponse()` is `{ code, message, errors? }`. `upstreamStatus` and
+ * `upstreamMessage` keep Bastion's own for logs and branching; `message`
+ * carries them too, so the filter's 5xx log line says what Bastion answered.
  */
 export declare class BastionHttpException extends HttpException {
     readonly code: BastionErrorCode;
     readonly upstreamMessage: string;
-    constructor(code: BastionErrorCode, status: number, upstreamMessage: string);
+    readonly errors?: string[] | undefined;
+    readonly upstreamCode?: string | undefined;
+    readonly upstreamStatus: number;
+    constructor(code: BastionErrorCode, status: number, upstreamMessage: string, errors?: string[] | undefined, upstreamCode?: string | undefined);
     static from(err: BastionHttpError): BastionHttpException;
 }
 /** `BastionHttp` whose failures are `BastionHttpException`s — what `BastionService.http` is. */

package/dist/cjs/nest/bastion-http-exception.js

@@ -5,24 +5,55 @@ const common_1 = require("@nestjs/common");
 const bastion_http_js_1 = require("../core/bastion-http.js");
 const errors_js_1 = require("../core/errors.js");
 /**
- * The Nest face of a Bastion error: an `HttpException` carrying Bastion's
- * status, so the global filter answers with it unchanged, plus the stable
- * `code` and the upstream message for the handlers that branch on them.
- * `getResponse()` is `{ code, message }`.
+ * The Nest face of a Bastion error, so the global filter answers the browser
+ * per api.md §3/§14:
+ * - 4xx: Bastion's status, `code`, message and `errors` (field errors of a 400). A 4xx the
+ *   package can't classify keeps Bastion's own code (`PASSWORD_TOO_SHORT`) or the status
+ *   default (`NOT_FOUND`), never `UPSTREAM`;
+ * - Bastion down, timed out or answering 503: 503 `UNAVAILABLE`, generic message;
+ * - any other 5xx: 502 `UPSTREAM`, generic message.
+ *
+ * `getResponse()` is `{ code, message, errors? }`. `upstreamStatus` and
+ * `upstreamMessage` keep Bastion's own for logs and branching; `message`
+ * carries them too, so the filter's 5xx log line says what Bastion answered.
  */
 class BastionHttpException extends common_1.HttpException {
     code;
     upstreamMessage;
-    constructor(code, status, upstreamMessage) {
-        super({ code, message: upstreamMessage }, status);
+    errors;
+    upstreamCode;
+    upstreamStatus;
+    constructor(code, status, upstreamMessage, errors, upstreamCode) {
+        const publicCode = code === errors_js_1.BastionErrorCode.UPSTREAM ? (upstreamCode ?? statusCode(status)) : code;
+        const unavailable = code === errors_js_1.BastionErrorCode.UNAVAILABLE || status === 503;
+        const publicStatus = status < 500 ? status : unavailable ? 503 : 502;
+        const body = status < 500
+            ? { code: publicCode, message: upstreamMessage, ...(errors?.length ? { errors } : {}) }
+            : unavailable
+                ? { code: errors_js_1.BastionErrorCode.UNAVAILABLE, message: 'Upstream service unavailable' }
+                : { code: errors_js_1.BastionErrorCode.UPSTREAM, message: 'Upstream service error' };
+        super(body, publicStatus);
         this.code = code;
         this.upstreamMessage = upstreamMessage;
+        this.errors = errors;
+        this.upstreamCode = upstreamCode;
+        this.upstreamStatus = status;
+        if (status >= 500)
+            this.message = `Bastion ${status}: ${upstreamMessage}`;
     }
     static from(err) {
-        return new BastionHttpException(err.code, err.status, err.message);
+        return new BastionHttpException(err.code, err.status, err.message, err.errors, err.upstreamCode);
     }
 }
 exports.BastionHttpException = BastionHttpException;
+/** api.md §3 default code of a 4xx: `NOT_FOUND`, `UNPROCESSABLE`, `RATE_LIMITED`, … */
+function statusCode(status) {
+    if (status === 422)
+        return 'UNPROCESSABLE';
+    if (status === 429)
+        return 'RATE_LIMITED';
+    return common_1.HttpStatus[status] ?? 'BAD_REQUEST';
+}
 /** `BastionHttp` whose failures are `BastionHttpException`s — what `BastionService.http` is. */
 class NestBastionHttp extends bastion_http_js_1.BastionHttp {
     async call(method, path, body, init) {

package/dist/cjs/nest/bastion.module.d.ts

@@ -1,4 +1,4 @@
-import { DynamicModule } from '@nestjs/common';
+import { DynamicModule, type MiddlewareConsumer, type NestModule } from '@nestjs/common';
 import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './options.js';
 /**
  * ```ts
@@ -11,9 +11,11 @@ import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './opt
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
-export declare class BastionModule {
+export declare class BastionModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
     static forRoot(options: BastionModuleOptions): DynamicModule;
     static forRootAsync(options: BastionModuleAsyncOptions): DynamicModule;
     private static build;

package/dist/cjs/nest/bastion.module.js

@@ -17,12 +17,15 @@ const service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard
 const bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
 const audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
 const bastion_api_client_provider_js_1 = require("./bastion-api-client.provider.js");
+const app_user_guard_js_1 = require("./guards/app-user.guard.js");
+const request_context_js_1 = require("./request-context.js");
 const PROVIDERS = [
     bastion_jwks_service_js_1.BastionJwksService,
     bastion_service_js_1.BastionService,
     bastion_audit_service_js_1.BastionAuditService,
     service_client_jwt_guard_js_1.ServiceClientJwtGuard,
     bastion_user_guard_js_1.BastionUserGuard,
+    app_user_guard_js_1.AppUserGuard,
     audit_interceptor_js_1.AuditInterceptor,
     bastion_api_client_provider_js_1.BastionApiClientProvider,
 ];
@@ -37,9 +40,13 @@ const PROVIDERS = [
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
 let BastionModule = BastionModule_1 = class BastionModule {
+    configure(consumer) {
+        consumer.apply(request_context_js_1.requestContextMiddleware).forRoutes({ path: '{*splat}', method: common_1.RequestMethod.ALL });
+    }
     static forRoot(options) {
         return this.build({ provide: options_js_1.BASTION_OPTIONS, useValue: options });
     }

package/dist/cjs/nest/bastion.service.d.ts

@@ -2,7 +2,7 @@ import { type BastionRequestInit } from '../core/bastion-http.js';
 import { NestBastionHttp } from './bastion-http-exception.js';
 import type { AuditEventInput, TokenResponse } from '../core/types.js';
 import { type BastionModuleOptions } from './options.js';
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 export declare class BastionService {
     private readonly options;
     readonly http: NestBastionHttp;

package/dist/cjs/nest/bastion.service.js

@@ -16,13 +16,18 @@ exports.BastionService = void 0;
 const common_1 = require("@nestjs/common");
 const bastion_http_exception_js_1 = require("./bastion-http-exception.js");
 const options_js_1 = require("./options.js");
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+const request_context_js_1 = require("./request-context.js");
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 let BastionService = class BastionService {
     options;
     http;
     constructor(options) {
         this.options = options;
-        this.http = new bastion_http_exception_js_1.NestBastionHttp({ baseUrl: options.baseUrl, timeoutMs: options.timeoutMs });
+        this.http = new bastion_http_exception_js_1.NestBastionHttp({
+            baseUrl: options.baseUrl,
+            timeoutMs: options.timeoutMs,
+            requestId: options.requestId ?? request_context_js_1.currentRequestId,
+        });
     }
     call(method, path, body, init) {
         return this.http.call(method, path, body, init);

package/dist/cjs/nest/decorators/current-user.decorator.d.ts

@@ -2,3 +2,5 @@
 export declare const CurrentClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
 /** The user payload set by `BastionUserGuard`. */
 export declare const CurrentAdminUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** The app user's payload set by `AppUserGuard`. */
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/cjs/nest/decorators/current-user.decorator.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CurrentAdminUser = exports.CurrentClient = void 0;
+exports.CurrentUser = exports.CurrentAdminUser = exports.CurrentClient = void 0;
 const common_1 = require("@nestjs/common");
 /** The machine token payload set by `ServiceClientJwtGuard`. */
 exports.CurrentClient = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().user);
 /** The user payload set by `BastionUserGuard`. */
 exports.CurrentAdminUser = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().adminUser);
+/** The app user's payload set by `AppUserGuard`. */
+exports.CurrentUser = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().user);

package/dist/cjs/nest/guards/app-user.guard.d.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+export declare class AppUserGuard implements CanActivate {
+    private readonly jwks;
+    private readonly reflector;
+    constructor(jwks: BastionJwksService, reflector: Reflector);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+}

package/dist/cjs/nest/guards/app-user.guard.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppUserGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const bastion_jwks_service_js_1 = require("../bastion-jwks.service.js");
+const public_decorator_js_1 = require("../decorators/public.decorator.js");
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+let AppUserGuard = class AppUserGuard {
+    jwks;
+    reflector;
+    constructor(jwks, reflector) {
+        this.jwks = jwks;
+        this.reflector = reflector;
+    }
+    async canActivate(ctx) {
+        if (this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [ctx.getHandler(), ctx.getClass()]))
+            return true;
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new common_1.UnauthorizedException('Missing token');
+        req.user = await this.jwks.verifyUserToken(auth.slice(7));
+        return true;
+    }
+};
+exports.AppUserGuard = AppUserGuard;
+exports.AppUserGuard = AppUserGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [bastion_jwks_service_js_1.BastionJwksService,
+        core_1.Reflector])
+], AppUserGuard);

package/dist/cjs/nest/index.d.ts

@@ -8,9 +8,11 @@ export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.
 export { BastionAuditService, type AuditActor } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AppUserGuard } from './guards/app-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';
 export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
 export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
 export { Audit, AUDIT_EVENT_KEY, type AuditOptions, type AuditRequest, type AuditDescriptor } from './decorators/audit.decorator.js';
-export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { CurrentClient, CurrentAdminUser, CurrentUser } from './decorators/current-user.decorator.js';
+export { currentRequestId } from './request-context.js';
 export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/cjs/nest/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CROSS_TENANT_ROLE = exports.resolveTenantScope = exports.CurrentAdminUser = exports.CurrentClient = exports.AUDIT_EVENT_KEY = exports.Audit = exports.REQUIRED_SCOPES_KEY = exports.RequireScope = exports.IS_PUBLIC_KEY = exports.Public = exports.AuditInterceptor = exports.BastionUserGuard = exports.ServiceClientJwtGuard = exports.BastionAuditService = exports.NestBastionHttp = exports.BastionHttpException = exports.BastionApiClientProvider = exports.BastionService = exports.BastionJwksService = exports.BASTION_OPTIONS = exports.BastionModule = void 0;
+exports.CROSS_TENANT_ROLE = exports.resolveTenantScope = exports.currentRequestId = exports.CurrentUser = exports.CurrentAdminUser = exports.CurrentClient = exports.AUDIT_EVENT_KEY = exports.Audit = exports.REQUIRED_SCOPES_KEY = exports.RequireScope = exports.IS_PUBLIC_KEY = exports.Public = exports.AuditInterceptor = exports.AppUserGuard = exports.BastionUserGuard = exports.ServiceClientJwtGuard = exports.BastionAuditService = exports.NestBastionHttp = exports.BastionHttpException = exports.BastionApiClientProvider = exports.BastionService = exports.BastionJwksService = exports.BASTION_OPTIONS = exports.BastionModule = void 0;
 __exportStar(require("../core/index.js"), exports);
 var bastion_module_js_1 = require("./bastion.module.js");
 Object.defineProperty(exports, "BastionModule", { enumerable: true, get: function () { return bastion_module_js_1.BastionModule; } });
@@ -35,6 +35,8 @@ var service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard.j
 Object.defineProperty(exports, "ServiceClientJwtGuard", { enumerable: true, get: function () { return service_client_jwt_guard_js_1.ServiceClientJwtGuard; } });
 var bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
 Object.defineProperty(exports, "BastionUserGuard", { enumerable: true, get: function () { return bastion_user_guard_js_1.BastionUserGuard; } });
+var app_user_guard_js_1 = require("./guards/app-user.guard.js");
+Object.defineProperty(exports, "AppUserGuard", { enumerable: true, get: function () { return app_user_guard_js_1.AppUserGuard; } });
 var audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
 Object.defineProperty(exports, "AuditInterceptor", { enumerable: true, get: function () { return audit_interceptor_js_1.AuditInterceptor; } });
 var public_decorator_js_1 = require("./decorators/public.decorator.js");
@@ -49,6 +51,9 @@ Object.defineProperty(exports, "AUDIT_EVENT_KEY", { enumerable: true, get: funct
 var current_user_decorator_js_1 = require("./decorators/current-user.decorator.js");
 Object.defineProperty(exports, "CurrentClient", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentClient; } });
 Object.defineProperty(exports, "CurrentAdminUser", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentAdminUser; } });
+Object.defineProperty(exports, "CurrentUser", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentUser; } });
+var request_context_js_1 = require("./request-context.js");
+Object.defineProperty(exports, "currentRequestId", { enumerable: true, get: function () { return request_context_js_1.currentRequestId; } });
 var tenant_scope_js_1 = require("./tenant-scope.js");
 Object.defineProperty(exports, "resolveTenantScope", { enumerable: true, get: function () { return tenant_scope_js_1.resolveTenantScope; } });
 Object.defineProperty(exports, "CROSS_TENANT_ROLE", { enumerable: true, get: function () { return tenant_scope_js_1.CROSS_TENANT_ROLE; } });

package/dist/cjs/nest/options.d.ts

@@ -15,6 +15,13 @@ export interface BastionModuleOptions {
     jwksTtlMs?: number;
     /** Expected `iss`. Default `'bastion'`; `null` disables the check. */
     issuer?: string | null;
+    /**
+     * Id sent as `X-Request-Id` on calls to Bastion. Default: `req.id` of the request
+     * being served (pino-http / nest-common `genReqId`), tracked by the module's middleware.
+     * Express only: under Fastify the middleware sees the raw request, which has no `id`,
+     * so pass a getter here (e.g. from nestjs-cls).
+     */
+    requestId?: () => string | undefined;
     /** `BastionUserGuard`: which apps' user tokens are accepted. Default `['meridian']`. */
     acceptedAppSlugs?: string[];
     /** `BastionUserGuard`: which roles are accepted. Default `['ADMIN', 'OWNER', 'SUPER_ADMIN']`. */

package/dist/cjs/nest/request-context.d.ts

@@ -0,0 +1,10 @@
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+export declare function requestContextMiddleware(req: {
+    id?: unknown;
+}, _res: unknown, next: () => void): void;
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+export declare function currentRequestId(): string | undefined;

package/dist/cjs/nest/request-context.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestContextMiddleware = requestContextMiddleware;
+exports.currentRequestId = currentRequestId;
+const node_async_hooks_1 = require("node:async_hooks");
+const store = new node_async_hooks_1.AsyncLocalStorage();
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+function requestContextMiddleware(req, _res, next) {
+    store.run(req, next);
+}
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+function currentRequestId() {
+    const id = store.getStore()?.id;
+    return typeof id === 'string' ? id : undefined;
+}

package/dist/cjs/webhooks/index.d.ts

@@ -29,7 +29,8 @@ export interface VerifyWebhookOptions {
      * Accept the legacy body-only `X-Bastion-Signature` when v2 is absent.
      * Default `false`: legacy carries no timestamp or delivery id, so accepting
      * it lets anyone holding an old delivery replay it by stripping the v2
-     * header. Opt in only while migrating a consumer that cannot see v2 yet.
+     * header. Bastion no longer sends the legacy header, so there is nothing
+     * left to migrate: leave it off.
      */
     allowLegacySignature?: boolean;
     /** Max age of `t` on a v2 signature, default 300 s. */

package/dist/esm/core/api-client.d.ts

@@ -51,12 +51,23 @@ export declare class BastionApiClient {
         message: string;
     }>;
     /**
-     * Trades the one-time OAuth code for tokens. `state` is the value the app put
-     * on the initiate URL, read back from its own cookie/session (never from the
-     * callback query): Bastion refuses a code minted under a different one, which
-     * is what stops an attacker's code from being redeemed in a victim's browser.
+     * Starts an OAuth login: the provider's Bastion initiate URL with a fresh
+     * `state` on it, or `null` for a provider the app doesn't offer. Keep `state`
+     * in an httpOnly `SameSite=Lax` cookie scoped to the callback path, redirect
+     * the browser to `url`, then pass the cookie's value to `exchange`.
      */
-    exchange(code: string, ctx?: BastionClientContext, state?: string): Promise<BastionLoginResult>;
+    oauthStart(provider: string): Promise<{
+        url: string;
+        state: string;
+    } | null>;
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value from
+     * `oauthStart`, read back from the app's own cookie (never from the callback
+     * query): Bastion refuses a code minted under a different one, which is what
+     * stops an attacker's code from being redeemed in a victim's browser (login CSRF).
+     * Required: an empty `state` throws before calling Bastion.
+     */
+    exchange(code: string, ctx: BastionClientContext | undefined, state: string): Promise<BastionLoginResult>;
     completeTwoFactor(twoFactorToken: string, code: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     refresh(refreshToken: string, ctx?: BastionClientContext): Promise<BastionTokenPair>;
     /** Revokes the token and any successor issued through `refresh` within the memory window. Never throws. */

package/dist/esm/core/api-client.js

@@ -1,4 +1,4 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { silentLogger } from './types.js';
 const DEFAULT_REFRESH_MEMORY_MS = 60_000;
 const AUTH_METHODS_CACHE_MS = 5 * 60_000;
@@ -59,13 +59,31 @@ export class BastionApiClient {
         return this.call('POST', '/auth/register', { ...input, ...this.appContext }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
     /**
-     * Trades the one-time OAuth code for tokens. `state` is the value the app put
-     * on the initiate URL, read back from its own cookie/session (never from the
-     * callback query): Bastion refuses a code minted under a different one, which
-     * is what stops an attacker's code from being redeemed in a victim's browser.
+     * Starts an OAuth login: the provider's Bastion initiate URL with a fresh
+     * `state` on it, or `null` for a provider the app doesn't offer. Keep `state`
+     * in an httpOnly `SameSite=Lax` cookie scoped to the callback path, redirect
+     * the browser to `url`, then pass the cookie's value to `exchange`.
+     */
+    async oauthStart(provider) {
+        const method = (await this.getAuthMethods()).oauth.find((m) => m.provider === provider);
+        if (!method)
+            return null;
+        const state = randomBytes(32).toString('base64url');
+        const url = new URL(method.authorizeUrl);
+        url.searchParams.set('state', state);
+        return { url: url.toString(), state };
+    }
+    /**
+     * Trades the one-time OAuth code for tokens. `state` is the value from
+     * `oauthStart`, read back from the app's own cookie (never from the callback
+     * query): Bastion refuses a code minted under a different one, which is what
+     * stops an attacker's code from being redeemed in a victim's browser (login CSRF).
+     * Required: an empty `state` throws before calling Bastion.
      */
     exchange(code, ctx, state) {
-        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, ...(state !== undefined ? { state } : {}) }, { headers: BastionApiClient.clientHeaders(ctx) });
+        if (!state)
+            return Promise.reject(new Error('BastionApiClient.exchange: state is required (see oauthStart)'));
+        return this.call('POST', '/auth/exchange', { code, appSlug: this.appSlug, state }, { headers: BastionApiClient.clientHeaders(ctx) });
     }
     completeTwoFactor(twoFactorToken, code, ctx) {
         return this.call('POST', '/auth/2fa/authenticate', { twoFactorToken, code }, { headers: BastionApiClient.clientHeaders(ctx) });

package/dist/esm/core/bastion-http.d.ts

@@ -4,6 +4,12 @@ export interface BastionHttpOptions {
     /** Per-request timeout, default 8 000 ms. */
     timeoutMs?: number;
     fetch?: typeof fetch;
+    /**
+     * The id of the request being served, sent as `X-Request-Id` on every call
+     * (api.md §7) so Bastion logs it as `clientRequestId`. Read per call: back it
+     * with the framework's request context. A value outside `[A-Za-z0-9._-]{1,64}` is not sent.
+     */
+    requestId?: () => string | undefined;
 }
 export interface BastionRequestInit {
     token?: string;
@@ -26,6 +32,7 @@ export declare class BastionHttp {
     private readonly baseUrl;
     private readonly timeoutMs;
     private readonly fetchImpl;
+    private readonly requestId?;
     constructor(options: BastionHttpOptions);
     call<T>(method: string, path: string, body?: unknown, init?: BastionRequestInit): Promise<T>;
     clientAuth(input: ClientAuthInput): Promise<TokenResponse>;