@heyatom/bastion-client 0.7.2 → 0.9.0

package/dist/cjs/core/jwks-verifier.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwksVerifier = void 0;
-const jose_1 = require("jose");
+const jwt_js_1 = require("./jwt.js");
 const errors_js_1 = require("./errors.js");
 const types_js_1 = require("./types.js");
 /**
@@ -12,7 +12,7 @@ const types_js_1 = require("./types.js");
  */
 const UNKNOWN_KID_REFETCH_COOLDOWN_MS = 30_000;
 /**
- * The canonical consumer of Bastion's JWKS (docs/BASTION_INTEGRATION.md):
+ * The canonical consumer of Bastion's JWKS (docs/integrations/bastion.md in the platform repo):
  * keys cached and indexed by `kid`, refetch on an unknown kid with a
  * cooldown, stale cache served when a refetch fails. Second safety net only:
  * Bastion publishes a key before signing with it (publish-before-use), so a
@@ -39,12 +39,12 @@ class JwksVerifier {
     async verify(token) {
         let kid;
         try {
-            ({ kid } = (0, jose_1.decodeProtectedHeader)(token));
+            kid = (0, jwt_js_1.decodeJwt)(token).header.kid;
         }
         catch {
             throw new errors_js_1.BastionTokenError('malformed', 'Malformed token');
         }
-        if (!kid)
+        if (typeof kid !== 'string' || !kid)
             throw new errors_js_1.BastionTokenError('missing_kid', 'Missing kid in JWT header');
         await this.ensureFresh();
         let key = this.keys.get(kid);
@@ -57,11 +57,7 @@ class JwksVerifier {
             throw new errors_js_1.BastionTokenError('unknown_kid', 'Unknown or expired kid');
         }
         try {
-            const { payload } = await (0, jose_1.jwtVerify)(token, key, {
-                algorithms: ['RS256'],
-                ...(this.issuer ? { issuer: this.issuer } : {}),
-            });
-            return payload;
+            return (0, jwt_js_1.verifyRs256)(token, key, this.issuer);
         }
         catch {
             throw new errors_js_1.BastionTokenError('invalid', 'Invalid token');
@@ -79,7 +75,12 @@ class JwksVerifier {
                 for (const jwk of keys) {
                     if (!jwk.kid)
                         continue;
-                    next.set(jwk.kid, await (0, jose_1.importJWK)(jwk, 'RS256'));
+                    try {
+                        next.set(jwk.kid, (0, jwt_js_1.importRs256Jwk)(jwk));
+                    }
+                    catch (err) {
+                        this.logger.warn(`JWKS: skipping kid=${jwk.kid}: ${err.message}`);
+                    }
                 }
                 this.keys = next;
                 this.fetchedAt = Date.now();

package/dist/cjs/core/jwt.d.ts

@@ -0,0 +1,13 @@
+import { type KeyObject } from 'node:crypto';
+/** Header and payload of a compact JWS, unverified. Throws on anything that isn't one. */
+export declare function decodeJwt(token: string): {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+};
+/** An RS256 verification key from a JWKS entry; RSA ≥ 2048 bits only. */
+export declare function importRs256Jwk(jwk: JsonWebKey): KeyObject;
+/**
+ * RS256 signature, `exp`/`nbf`, optional `iss`. What `jose.jwtVerify` checked for us,
+ * in node:crypto so the CJS build has no ESM-only dependency. Throws on any failure.
+ */
+export declare function verifyRs256(token: string, key: KeyObject, issuer: string | null, now?: number): Record<string, unknown>;

package/dist/cjs/core/jwt.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwt = decodeJwt;
+exports.importRs256Jwk = importRs256Jwk;
+exports.verifyRs256 = verifyRs256;
+const node_crypto_1 = require("node:crypto");
+/** Header and payload of a compact JWS, unverified. Throws on anything that isn't one. */
+function decodeJwt(token) {
+    const parts = token.split('.');
+    // Strict alphabet: Buffer's base64url decoder skips padding and junk, which would let one token have many spellings.
+    if (parts.length !== 3 || !parts.every((part) => /^[A-Za-z0-9_-]*$/.test(part)))
+        throw new Error('not a compact JWS');
+    const header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+    const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    if (!isObject(header) || !isObject(payload))
+        throw new Error('header or payload not an object');
+    return { header, payload };
+}
+/** An RS256 verification key from a JWKS entry; RSA ≥ 2048 bits only. */
+function importRs256Jwk(jwk) {
+    if (jwk.kty !== 'RSA' || (jwk.alg !== undefined && jwk.alg !== 'RS256') || (jwk.use !== undefined && jwk.use !== 'sig')) {
+        throw new Error('not an RS256 signing key');
+    }
+    const key = (0, node_crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+    if ((key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+        throw new Error('RSA key shorter than 2048 bits');
+    return key;
+}
+/**
+ * RS256 signature, `exp`/`nbf`, optional `iss`. What `jose.jwtVerify` checked for us,
+ * in node:crypto so the CJS build has no ESM-only dependency. Throws on any failure.
+ */
+function verifyRs256(token, key, issuer, now = Date.now()) {
+    const { header, payload } = decodeJwt(token);
+    if (header.alg !== 'RS256')
+        throw new Error('alg not RS256');
+    if (header.crit !== undefined)
+        throw new Error('unsupported crit header');
+    const [h, p, s] = token.split('.');
+    if (!(0, node_crypto_1.verify)('RSA-SHA256', Buffer.from(`${h}.${p}`), key, Buffer.from(s, 'base64url')))
+        throw new Error('bad signature');
+    const seconds = Math.floor(now / 1000);
+    if (typeof payload.exp !== 'number' || payload.exp <= seconds)
+        throw new Error('expired');
+    if (payload.nbf !== undefined && (typeof payload.nbf !== 'number' || payload.nbf > seconds))
+        throw new Error('not yet valid');
+    if (payload.iat !== undefined && typeof payload.iat !== 'number')
+        throw new Error('bad iat');
+    if (issuer && payload.iss !== issuer)
+        throw new Error('wrong issuer');
+    return payload;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/cjs/core/service-token-provider.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceTokenProvider = void 0;
-const jose_1 = require("jose");
+const jwt_js_1 = require("./jwt.js");
 const types_js_1 = require("./types.js");
 const REFRESH_MARGIN_MS = 5 * 60 * 1000;
 const FALLBACK_TTL_MS = 60 * 60 * 1000;
@@ -62,7 +62,7 @@ class ServiceTokenProvider {
         if (!credential?.apiKey)
             throw new Error(`Bastion service client for "${serviceSlug}" not configured`);
         const { accessToken } = await this.http.clientAuth(credential);
-        const { exp, tenantId } = (0, jose_1.decodeJwt)(accessToken);
+        const { exp, tenantId } = (0, jwt_js_1.decodeJwt)(accessToken).payload;
         this.cache.set(serviceSlug, {
             token: accessToken,
             expiresAt: exp ? exp * 1000 : Date.now() + FALLBACK_TTL_MS,

package/dist/cjs/nest/bastion-api-client.provider.d.ts

@@ -4,8 +4,9 @@ import { type BastionModuleOptions } from './options.js';
 /**
  * `BastionApiClient` bound to this app (`serviceSlug` as `appSlug`,
  * `tenantSlug`), sharing `BastionService.http`. Inject it in an app backend
- * that proxies its users' login/refresh/account flows; a pure service
- * (Herald, Beacon) never needs it. Failures are `BastionHttpException`s:
+ * that proxies its users' login/refresh/account flows, or one that reads
+ * its users' Bastion data with their token (Beacon: `listSocialAccounts`);
+ * a pure machine service (Herald) never needs it. Failures are `BastionHttpException`s:
  * an `HttpException` with Bastion's status plus `code`/`upstreamMessage`.
  */
 export declare class BastionApiClientProvider extends BastionApiClient {

package/dist/cjs/nest/bastion-api-client.provider.js

@@ -21,8 +21,9 @@ const nest_logger_js_1 = require("./nest-logger.js");
 /**
  * `BastionApiClient` bound to this app (`serviceSlug` as `appSlug`,
  * `tenantSlug`), sharing `BastionService.http`. Inject it in an app backend
- * that proxies its users' login/refresh/account flows; a pure service
- * (Herald, Beacon) never needs it. Failures are `BastionHttpException`s:
+ * that proxies its users' login/refresh/account flows, or one that reads
+ * its users' Bastion data with their token (Beacon: `listSocialAccounts`);
+ * a pure machine service (Herald) never needs it. Failures are `BastionHttpException`s:
  * an `HttpException` with Bastion's status plus `code`/`upstreamMessage`.
  */
 let BastionApiClientProvider = class BastionApiClientProvider extends api_client_js_1.BastionApiClient {

package/dist/cjs/nest/bastion-http-exception.d.ts

@@ -1,16 +1,26 @@
 import { HttpException } from '@nestjs/common';
 import { BastionHttp, type BastionRequestInit } from '../core/bastion-http.js';
-import { BastionHttpError, type BastionErrorCode } from '../core/errors.js';
+import { BastionErrorCode, BastionHttpError } from '../core/errors.js';
 /**
- * The Nest face of a Bastion error: an `HttpException` carrying Bastion's
- * status, so the global filter answers with it unchanged, plus the stable
- * `code` and the upstream message for the handlers that branch on them.
- * `getResponse()` is `{ code, message }`.
+ * The Nest face of a Bastion error, so the global filter answers the browser
+ * per api.md §3/§14:
+ * - 4xx: Bastion's status, `code`, message and `errors` (field errors of a 400). A 4xx the
+ *   package can't classify keeps Bastion's own code (`PASSWORD_TOO_SHORT`) or the status
+ *   default (`NOT_FOUND`), never `UPSTREAM`;
+ * - Bastion down, timed out or answering 503: 503 `UNAVAILABLE`, generic message;
+ * - any other 5xx: 502 `UPSTREAM`, generic message.
+ *
+ * `getResponse()` is `{ code, message, errors? }`. `upstreamStatus` and
+ * `upstreamMessage` keep Bastion's own for logs and branching; `message`
+ * carries them too, so the filter's 5xx log line says what Bastion answered.
  */
 export declare class BastionHttpException extends HttpException {
     readonly code: BastionErrorCode;
     readonly upstreamMessage: string;
-    constructor(code: BastionErrorCode, status: number, upstreamMessage: string);
+    readonly errors?: string[] | undefined;
+    readonly upstreamCode?: string | undefined;
+    readonly upstreamStatus: number;
+    constructor(code: BastionErrorCode, status: number, upstreamMessage: string, errors?: string[] | undefined, upstreamCode?: string | undefined);
     static from(err: BastionHttpError): BastionHttpException;
 }
 /** `BastionHttp` whose failures are `BastionHttpException`s — what `BastionService.http` is. */

package/dist/cjs/nest/bastion-http-exception.js

@@ -5,24 +5,55 @@ const common_1 = require("@nestjs/common");
 const bastion_http_js_1 = require("../core/bastion-http.js");
 const errors_js_1 = require("../core/errors.js");
 /**
- * The Nest face of a Bastion error: an `HttpException` carrying Bastion's
- * status, so the global filter answers with it unchanged, plus the stable
- * `code` and the upstream message for the handlers that branch on them.
- * `getResponse()` is `{ code, message }`.
+ * The Nest face of a Bastion error, so the global filter answers the browser
+ * per api.md §3/§14:
+ * - 4xx: Bastion's status, `code`, message and `errors` (field errors of a 400). A 4xx the
+ *   package can't classify keeps Bastion's own code (`PASSWORD_TOO_SHORT`) or the status
+ *   default (`NOT_FOUND`), never `UPSTREAM`;
+ * - Bastion down, timed out or answering 503: 503 `UNAVAILABLE`, generic message;
+ * - any other 5xx: 502 `UPSTREAM`, generic message.
+ *
+ * `getResponse()` is `{ code, message, errors? }`. `upstreamStatus` and
+ * `upstreamMessage` keep Bastion's own for logs and branching; `message`
+ * carries them too, so the filter's 5xx log line says what Bastion answered.
  */
 class BastionHttpException extends common_1.HttpException {
     code;
     upstreamMessage;
-    constructor(code, status, upstreamMessage) {
-        super({ code, message: upstreamMessage }, status);
+    errors;
+    upstreamCode;
+    upstreamStatus;
+    constructor(code, status, upstreamMessage, errors, upstreamCode) {
+        const publicCode = code === errors_js_1.BastionErrorCode.UPSTREAM ? (upstreamCode ?? statusCode(status)) : code;
+        const unavailable = code === errors_js_1.BastionErrorCode.UNAVAILABLE || status === 503;
+        const publicStatus = status < 500 ? status : unavailable ? 503 : 502;
+        const body = status < 500
+            ? { code: publicCode, message: upstreamMessage, ...(errors?.length ? { errors } : {}) }
+            : unavailable
+                ? { code: errors_js_1.BastionErrorCode.UNAVAILABLE, message: 'Upstream service unavailable' }
+                : { code: errors_js_1.BastionErrorCode.UPSTREAM, message: 'Upstream service error' };
+        super(body, publicStatus);
         this.code = code;
         this.upstreamMessage = upstreamMessage;
+        this.errors = errors;
+        this.upstreamCode = upstreamCode;
+        this.upstreamStatus = status;
+        if (status >= 500)
+            this.message = `Bastion ${status}: ${upstreamMessage}`;
     }
     static from(err) {
-        return new BastionHttpException(err.code, err.status, err.message);
+        return new BastionHttpException(err.code, err.status, err.message, err.errors, err.upstreamCode);
     }
 }
 exports.BastionHttpException = BastionHttpException;
+/** api.md §3 default code of a 4xx: `NOT_FOUND`, `UNPROCESSABLE`, `RATE_LIMITED`, … */
+function statusCode(status) {
+    if (status === 422)
+        return 'UNPROCESSABLE';
+    if (status === 429)
+        return 'RATE_LIMITED';
+    return common_1.HttpStatus[status] ?? 'BAD_REQUEST';
+}
 /** `BastionHttp` whose failures are `BastionHttpException`s — what `BastionService.http` is. */
 class NestBastionHttp extends bastion_http_js_1.BastionHttp {
     async call(method, path, body, init) {

package/dist/cjs/nest/bastion.module.d.ts

@@ -1,4 +1,4 @@
-import { DynamicModule } from '@nestjs/common';
+import { DynamicModule, type MiddlewareConsumer, type NestModule } from '@nestjs/common';
 import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './options.js';
 /**
  * ```ts
@@ -11,9 +11,11 @@ import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './opt
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
-export declare class BastionModule {
+export declare class BastionModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
     static forRoot(options: BastionModuleOptions): DynamicModule;
     static forRootAsync(options: BastionModuleAsyncOptions): DynamicModule;
     private static build;

package/dist/cjs/nest/bastion.module.js

@@ -17,12 +17,15 @@ const service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard
 const bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
 const audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
 const bastion_api_client_provider_js_1 = require("./bastion-api-client.provider.js");
+const app_user_guard_js_1 = require("./guards/app-user.guard.js");
+const request_context_js_1 = require("./request-context.js");
 const PROVIDERS = [
     bastion_jwks_service_js_1.BastionJwksService,
     bastion_service_js_1.BastionService,
     bastion_audit_service_js_1.BastionAuditService,
     service_client_jwt_guard_js_1.ServiceClientJwtGuard,
     bastion_user_guard_js_1.BastionUserGuard,
+    app_user_guard_js_1.AppUserGuard,
     audit_interceptor_js_1.AuditInterceptor,
     bastion_api_client_provider_js_1.BastionApiClientProvider,
 ];
@@ -37,9 +40,13 @@ const PROVIDERS = [
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
 let BastionModule = BastionModule_1 = class BastionModule {
+    configure(consumer) {
+        consumer.apply(request_context_js_1.requestContextMiddleware).forRoutes({ path: '{*splat}', method: common_1.RequestMethod.ALL });
+    }
     static forRoot(options) {
         return this.build({ provide: options_js_1.BASTION_OPTIONS, useValue: options });
     }

package/dist/cjs/nest/bastion.service.d.ts

@@ -2,7 +2,7 @@ import { type BastionRequestInit } from '../core/bastion-http.js';
 import { NestBastionHttp } from './bastion-http-exception.js';
 import type { AuditEventInput, TokenResponse } from '../core/types.js';
 import { type BastionModuleOptions } from './options.js';
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 export declare class BastionService {
     private readonly options;
     readonly http: NestBastionHttp;

package/dist/cjs/nest/bastion.service.js

@@ -16,13 +16,18 @@ exports.BastionService = void 0;
 const common_1 = require("@nestjs/common");
 const bastion_http_exception_js_1 = require("./bastion-http-exception.js");
 const options_js_1 = require("./options.js");
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+const request_context_js_1 = require("./request-context.js");
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 let BastionService = class BastionService {
     options;
     http;
     constructor(options) {
         this.options = options;
-        this.http = new bastion_http_exception_js_1.NestBastionHttp({ baseUrl: options.baseUrl, timeoutMs: options.timeoutMs });
+        this.http = new bastion_http_exception_js_1.NestBastionHttp({
+            baseUrl: options.baseUrl,
+            timeoutMs: options.timeoutMs,
+            requestId: options.requestId ?? request_context_js_1.currentRequestId,
+        });
     }
     call(method, path, body, init) {
         return this.http.call(method, path, body, init);

package/dist/cjs/nest/decorators/current-user.decorator.d.ts

@@ -2,3 +2,5 @@
 export declare const CurrentClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
 /** The user payload set by `BastionUserGuard`. */
 export declare const CurrentAdminUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** The app user's payload set by `AppUserGuard`. */
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/cjs/nest/decorators/current-user.decorator.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CurrentAdminUser = exports.CurrentClient = void 0;
+exports.CurrentUser = exports.CurrentAdminUser = exports.CurrentClient = void 0;
 const common_1 = require("@nestjs/common");
 /** The machine token payload set by `ServiceClientJwtGuard`. */
 exports.CurrentClient = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().user);
 /** The user payload set by `BastionUserGuard`. */
 exports.CurrentAdminUser = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().adminUser);
+/** The app user's payload set by `AppUserGuard`. */
+exports.CurrentUser = (0, common_1.createParamDecorator)((_, ctx) => ctx.switchToHttp().getRequest().user);

package/dist/cjs/nest/guards/app-user.guard.d.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+export declare class AppUserGuard implements CanActivate {
+    private readonly jwks;
+    private readonly reflector;
+    constructor(jwks: BastionJwksService, reflector: Reflector);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+}

package/dist/cjs/nest/guards/app-user.guard.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppUserGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const bastion_jwks_service_js_1 = require("../bastion-jwks.service.js");
+const public_decorator_js_1 = require("../decorators/public.decorator.js");
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+let AppUserGuard = class AppUserGuard {
+    jwks;
+    reflector;
+    constructor(jwks, reflector) {
+        this.jwks = jwks;
+        this.reflector = reflector;
+    }
+    async canActivate(ctx) {
+        if (this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [ctx.getHandler(), ctx.getClass()]))
+            return true;
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new common_1.UnauthorizedException('Missing token');
+        req.user = await this.jwks.verifyUserToken(auth.slice(7));
+        return true;
+    }
+};
+exports.AppUserGuard = AppUserGuard;
+exports.AppUserGuard = AppUserGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [bastion_jwks_service_js_1.BastionJwksService,
+        core_1.Reflector])
+], AppUserGuard);

package/dist/cjs/nest/index.d.ts

@@ -8,9 +8,11 @@ export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.
 export { BastionAuditService, type AuditActor } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AppUserGuard } from './guards/app-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';
 export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
 export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
 export { Audit, AUDIT_EVENT_KEY, type AuditOptions, type AuditRequest, type AuditDescriptor } from './decorators/audit.decorator.js';
-export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { CurrentClient, CurrentAdminUser, CurrentUser } from './decorators/current-user.decorator.js';
+export { currentRequestId } from './request-context.js';
 export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/cjs/nest/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CROSS_TENANT_ROLE = exports.resolveTenantScope = exports.CurrentAdminUser = exports.CurrentClient = exports.AUDIT_EVENT_KEY = exports.Audit = exports.REQUIRED_SCOPES_KEY = exports.RequireScope = exports.IS_PUBLIC_KEY = exports.Public = exports.AuditInterceptor = exports.BastionUserGuard = exports.ServiceClientJwtGuard = exports.BastionAuditService = exports.NestBastionHttp = exports.BastionHttpException = exports.BastionApiClientProvider = exports.BastionService = exports.BastionJwksService = exports.BASTION_OPTIONS = exports.BastionModule = void 0;
+exports.CROSS_TENANT_ROLE = exports.resolveTenantScope = exports.currentRequestId = exports.CurrentUser = exports.CurrentAdminUser = exports.CurrentClient = exports.AUDIT_EVENT_KEY = exports.Audit = exports.REQUIRED_SCOPES_KEY = exports.RequireScope = exports.IS_PUBLIC_KEY = exports.Public = exports.AuditInterceptor = exports.AppUserGuard = exports.BastionUserGuard = exports.ServiceClientJwtGuard = exports.BastionAuditService = exports.NestBastionHttp = exports.BastionHttpException = exports.BastionApiClientProvider = exports.BastionService = exports.BastionJwksService = exports.BASTION_OPTIONS = exports.BastionModule = void 0;
 __exportStar(require("../core/index.js"), exports);
 var bastion_module_js_1 = require("./bastion.module.js");
 Object.defineProperty(exports, "BastionModule", { enumerable: true, get: function () { return bastion_module_js_1.BastionModule; } });
@@ -35,6 +35,8 @@ var service_client_jwt_guard_js_1 = require("./guards/service-client-jwt.guard.j
 Object.defineProperty(exports, "ServiceClientJwtGuard", { enumerable: true, get: function () { return service_client_jwt_guard_js_1.ServiceClientJwtGuard; } });
 var bastion_user_guard_js_1 = require("./guards/bastion-user.guard.js");
 Object.defineProperty(exports, "BastionUserGuard", { enumerable: true, get: function () { return bastion_user_guard_js_1.BastionUserGuard; } });
+var app_user_guard_js_1 = require("./guards/app-user.guard.js");
+Object.defineProperty(exports, "AppUserGuard", { enumerable: true, get: function () { return app_user_guard_js_1.AppUserGuard; } });
 var audit_interceptor_js_1 = require("./interceptors/audit.interceptor.js");
 Object.defineProperty(exports, "AuditInterceptor", { enumerable: true, get: function () { return audit_interceptor_js_1.AuditInterceptor; } });
 var public_decorator_js_1 = require("./decorators/public.decorator.js");
@@ -49,6 +51,9 @@ Object.defineProperty(exports, "AUDIT_EVENT_KEY", { enumerable: true, get: funct
 var current_user_decorator_js_1 = require("./decorators/current-user.decorator.js");
 Object.defineProperty(exports, "CurrentClient", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentClient; } });
 Object.defineProperty(exports, "CurrentAdminUser", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentAdminUser; } });
+Object.defineProperty(exports, "CurrentUser", { enumerable: true, get: function () { return current_user_decorator_js_1.CurrentUser; } });
+var request_context_js_1 = require("./request-context.js");
+Object.defineProperty(exports, "currentRequestId", { enumerable: true, get: function () { return request_context_js_1.currentRequestId; } });
 var tenant_scope_js_1 = require("./tenant-scope.js");
 Object.defineProperty(exports, "resolveTenantScope", { enumerable: true, get: function () { return tenant_scope_js_1.resolveTenantScope; } });
 Object.defineProperty(exports, "CROSS_TENANT_ROLE", { enumerable: true, get: function () { return tenant_scope_js_1.CROSS_TENANT_ROLE; } });

package/dist/cjs/nest/options.d.ts

@@ -15,6 +15,13 @@ export interface BastionModuleOptions {
     jwksTtlMs?: number;
     /** Expected `iss`. Default `'bastion'`; `null` disables the check. */
     issuer?: string | null;
+    /**
+     * Id sent as `X-Request-Id` on calls to Bastion. Default: `req.id` of the request
+     * being served (pino-http / nest-common `genReqId`), tracked by the module's middleware.
+     * Express only: under Fastify the middleware sees the raw request, which has no `id`,
+     * so pass a getter here (e.g. from nestjs-cls).
+     */
+    requestId?: () => string | undefined;
     /** `BastionUserGuard`: which apps' user tokens are accepted. Default `['meridian']`. */
     acceptedAppSlugs?: string[];
     /** `BastionUserGuard`: which roles are accepted. Default `['ADMIN', 'OWNER', 'SUPER_ADMIN']`. */

package/dist/cjs/nest/request-context.d.ts

@@ -0,0 +1,10 @@
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+export declare function requestContextMiddleware(req: {
+    id?: unknown;
+}, _res: unknown, next: () => void): void;
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+export declare function currentRequestId(): string | undefined;

package/dist/cjs/nest/request-context.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestContextMiddleware = requestContextMiddleware;
+exports.currentRequestId = currentRequestId;
+const node_async_hooks_1 = require("node:async_hooks");
+const store = new node_async_hooks_1.AsyncLocalStorage();
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+function requestContextMiddleware(req, _res, next) {
+    store.run(req, next);
+}
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+function currentRequestId() {
+    const id = store.getStore()?.id;
+    return typeof id === 'string' ? id : undefined;
+}

package/dist/cjs/webhooks/index.d.ts

@@ -3,6 +3,10 @@ export declare const BASTION_SIGNATURE_HEADER = "x-bastion-signature";
 export declare const BASTION_SIGNATURE_V2_HEADER = "x-bastion-signature-v2";
 export declare const BASTION_EVENT_HEADER = "x-bastion-event";
 export declare const BASTION_DELIVERY_ID_HEADER = "x-bastion-delivery-id";
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export declare const WEBHOOK_ID_HEADER = "webhook-id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export declare const BASTION_LIFECYCLE_EVENTS: readonly ["user.deleted", "user.expired_unverified", "user.deactivated"];
 export interface BastionWebhookPayload {
@@ -29,15 +33,21 @@ export interface VerifyWebhookOptions {
      * Accept the legacy body-only `X-Bastion-Signature` when v2 is absent.
      * Default `false`: legacy carries no timestamp or delivery id, so accepting
      * it lets anyone holding an old delivery replay it by stripping the v2
-     * header. Opt in only while migrating a consumer that cannot see v2 yet.
+     * header. Bastion no longer sends the legacy header, so there is nothing
+     * left to migrate: leave it off.
      */
     allowLegacySignature?: boolean;
-    /** Max age of `t` on a v2 signature, default 300 s. */
+    /** Max distance of the signed timestamp from now (Standard Webhooks and v2), default 300 s. */
     toleranceSeconds?: number;
     /** For tests. */
     now?: () => number;
 }
 export type VerifyWebhookResult = {
+    ok: true;
+    version: 'standard';
+    timestamp: number;
+    deliveryId: string;
+} | {
     ok: true;
     version: 'v2';
     timestamp: number;
@@ -50,12 +60,17 @@ export type VerifyWebhookResult = {
     reason: 'missing' | 'malformed' | 'stale' | 'mismatch';
 };
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export declare function verifyWebhookSignature(options: VerifyWebhookOptions): VerifyWebhookResult;