@heyatom/bastion-client 0.7.2 → 0.9.0

package/dist/esm/nest/bastion.module.d.ts

@@ -1,4 +1,4 @@
-import { DynamicModule } from '@nestjs/common';
+import { DynamicModule, type MiddlewareConsumer, type NestModule } from '@nestjs/common';
 import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './options.js';
 /**
  * ```ts
@@ -11,9 +11,11 @@ import { type BastionModuleAsyncOptions, type BastionModuleOptions } from './opt
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
-export declare class BastionModule {
+export declare class BastionModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
     static forRoot(options: BastionModuleOptions): DynamicModule;
     static forRootAsync(options: BastionModuleAsyncOptions): DynamicModule;
     private static build;

package/dist/esm/nest/bastion.module.js

@@ -5,7 +5,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var BastionModule_1;
-import { Global, Module } from '@nestjs/common';
+import { Global, Module, RequestMethod, } from '@nestjs/common';
 import { BASTION_OPTIONS } from './options.js';
 import { BastionJwksService } from './bastion-jwks.service.js';
 import { BastionService } from './bastion.service.js';
@@ -14,12 +14,15 @@ import { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 import { BastionUserGuard } from './guards/bastion-user.guard.js';
 import { AuditInterceptor } from './interceptors/audit.interceptor.js';
 import { BastionApiClientProvider } from './bastion-api-client.provider.js';
+import { AppUserGuard } from './guards/app-user.guard.js';
+import { requestContextMiddleware } from './request-context.js';
 const PROVIDERS = [
     BastionJwksService,
     BastionService,
     BastionAuditService,
     ServiceClientJwtGuard,
     BastionUserGuard,
+    AppUserGuard,
     AuditInterceptor,
     BastionApiClientProvider,
 ];
@@ -34,9 +37,13 @@ const PROVIDERS = [
  *   }),
  * })
  * ```
- * Global: import once in `AppModule`, inject anywhere.
+ * Global: import once in `AppModule`, inject anywhere. Every route gets a
+ * middleware that tracks the request, so outbound calls carry its `X-Request-Id`.
  */
 let BastionModule = BastionModule_1 = class BastionModule {
+    configure(consumer) {
+        consumer.apply(requestContextMiddleware).forRoutes({ path: '{*splat}', method: RequestMethod.ALL });
+    }
     static forRoot(options) {
         return this.build({ provide: BASTION_OPTIONS, useValue: options });
     }

package/dist/esm/nest/bastion.service.d.ts

@@ -2,7 +2,7 @@ import { type BastionRequestInit } from '../core/bastion-http.js';
 import { NestBastionHttp } from './bastion-http-exception.js';
 import type { AuditEventInput, TokenResponse } from '../core/types.js';
 import { type BastionModuleOptions } from './options.js';
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 export declare class BastionService {
     private readonly options;
     readonly http: NestBastionHttp;

package/dist/esm/nest/bastion.service.js

@@ -13,13 +13,18 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 import { Inject, Injectable } from '@nestjs/common';
 import { NestBastionHttp } from './bastion-http-exception.js';
 import { BASTION_OPTIONS } from './options.js';
-/** Outbound HTTP to Bastion. A failure surfaces as `BastionHttpException` (an `HttpException` with Bastion's status, a stable `code` and the upstream message). */
+import { currentRequestId } from './request-context.js';
+/** Outbound HTTP to Bastion, `X-Request-Id` included. A failure surfaces as `BastionHttpException` (4xx as Bastion's, 5xx as 502/503 with a generic message). */
 let BastionService = class BastionService {
     options;
     http;
     constructor(options) {
         this.options = options;
-        this.http = new NestBastionHttp({ baseUrl: options.baseUrl, timeoutMs: options.timeoutMs });
+        this.http = new NestBastionHttp({
+            baseUrl: options.baseUrl,
+            timeoutMs: options.timeoutMs,
+            requestId: options.requestId ?? currentRequestId,
+        });
     }
     call(method, path, body, init) {
         return this.http.call(method, path, body, init);

package/dist/esm/nest/decorators/current-user.decorator.d.ts

@@ -2,3 +2,5 @@
 export declare const CurrentClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
 /** The user payload set by `BastionUserGuard`. */
 export declare const CurrentAdminUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** The app user's payload set by `AppUserGuard`. */
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/esm/nest/decorators/current-user.decorator.js

@@ -3,3 +3,5 @@ import { createParamDecorator } from '@nestjs/common';
 export const CurrentClient = createParamDecorator((_, ctx) => ctx.switchToHttp().getRequest().user);
 /** The user payload set by `BastionUserGuard`. */
 export const CurrentAdminUser = createParamDecorator((_, ctx) => ctx.switchToHttp().getRequest().adminUser);
+/** The app user's payload set by `AppUserGuard`. */
+export const CurrentUser = createParamDecorator((_, ctx) => ctx.switchToHttp().getRequest().user);

package/dist/esm/nest/guards/app-user.guard.d.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+export declare class AppUserGuard implements CanActivate {
+    private readonly jwks;
+    private readonly reflector;
+    constructor(jwks: BastionJwksService, reflector: Reflector);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+}

package/dist/esm/nest/guards/app-user.guard.js

@@ -0,0 +1,44 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator.js';
+/**
+ * Guard for an app backend's own users, meant as the global `APP_GUARD`: every
+ * route needs a Bastion *user* token minted for this app (`serviceSlug` is the
+ * app's slug) unless it carries `@Public()`. Machine tokens and other apps'
+ * tokens are refused. The payload lands on `req.user`, read with `@CurrentUser()`.
+ * Suspension, age gate and roles stay the app's business: stack its own guard after this one.
+ */
+let AppUserGuard = class AppUserGuard {
+    jwks;
+    reflector;
+    constructor(jwks, reflector) {
+        this.jwks = jwks;
+        this.reflector = reflector;
+    }
+    async canActivate(ctx) {
+        if (this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [ctx.getHandler(), ctx.getClass()]))
+            return true;
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new UnauthorizedException('Missing token');
+        req.user = await this.jwks.verifyUserToken(auth.slice(7));
+        return true;
+    }
+};
+AppUserGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [BastionJwksService,
+        Reflector])
+], AppUserGuard);
+export { AppUserGuard };

package/dist/esm/nest/index.d.ts

@@ -8,9 +8,11 @@ export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.
 export { BastionAuditService, type AuditActor } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AppUserGuard } from './guards/app-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';
 export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
 export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
 export { Audit, AUDIT_EVENT_KEY, type AuditOptions, type AuditRequest, type AuditDescriptor } from './decorators/audit.decorator.js';
-export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { CurrentClient, CurrentAdminUser, CurrentUser } from './decorators/current-user.decorator.js';
+export { currentRequestId } from './request-context.js';
 export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/esm/nest/index.js

@@ -8,9 +8,11 @@ export { BastionHttpException, NestBastionHttp } from './bastion-http-exception.
 export { BastionAuditService } from './bastion-audit.service.js';
 export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
 export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AppUserGuard } from './guards/app-user.guard.js';
 export { AuditInterceptor } from './interceptors/audit.interceptor.js';
 export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
 export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
 export { Audit, AUDIT_EVENT_KEY } from './decorators/audit.decorator.js';
-export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { CurrentClient, CurrentAdminUser, CurrentUser } from './decorators/current-user.decorator.js';
+export { currentRequestId } from './request-context.js';
 export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/esm/nest/options.d.ts

@@ -15,6 +15,13 @@ export interface BastionModuleOptions {
     jwksTtlMs?: number;
     /** Expected `iss`. Default `'bastion'`; `null` disables the check. */
     issuer?: string | null;
+    /**
+     * Id sent as `X-Request-Id` on calls to Bastion. Default: `req.id` of the request
+     * being served (pino-http / nest-common `genReqId`), tracked by the module's middleware.
+     * Express only: under Fastify the middleware sees the raw request, which has no `id`,
+     * so pass a getter here (e.g. from nestjs-cls).
+     */
+    requestId?: () => string | undefined;
     /** `BastionUserGuard`: which apps' user tokens are accepted. Default `['meridian']`. */
     acceptedAppSlugs?: string[];
     /** `BastionUserGuard`: which roles are accepted. Default `['ADMIN', 'OWNER', 'SUPER_ADMIN']`. */

package/dist/esm/nest/request-context.d.ts

@@ -0,0 +1,10 @@
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+export declare function requestContextMiddleware(req: {
+    id?: unknown;
+}, _res: unknown, next: () => void): void;
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+export declare function currentRequestId(): string | undefined;

package/dist/esm/nest/request-context.js

@@ -0,0 +1,15 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+const store = new AsyncLocalStorage();
+/** Express/Fastify middleware: keeps the request reachable for the rest of its async chain. */
+export function requestContextMiddleware(req, _res, next) {
+    store.run(req, next);
+}
+/**
+ * The served request's own id, `req.id` as set by pino-http (`genReqId`, api.md §7):
+ * the default `requestId` of `BastionModule`. Read lazily, so the logger
+ * middleware may run before or after this one.
+ */
+export function currentRequestId() {
+    const id = store.getStore()?.id;
+    return typeof id === 'string' ? id : undefined;
+}

package/dist/esm/webhooks/index.d.ts

@@ -3,6 +3,10 @@ export declare const BASTION_SIGNATURE_HEADER = "x-bastion-signature";
 export declare const BASTION_SIGNATURE_V2_HEADER = "x-bastion-signature-v2";
 export declare const BASTION_EVENT_HEADER = "x-bastion-event";
 export declare const BASTION_DELIVERY_ID_HEADER = "x-bastion-delivery-id";
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export declare const WEBHOOK_ID_HEADER = "webhook-id";
+export declare const WEBHOOK_TIMESTAMP_HEADER = "webhook-timestamp";
+export declare const WEBHOOK_SIGNATURE_HEADER = "webhook-signature";
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export declare const BASTION_LIFECYCLE_EVENTS: readonly ["user.deleted", "user.expired_unverified", "user.deactivated"];
 export interface BastionWebhookPayload {
@@ -29,15 +33,21 @@ export interface VerifyWebhookOptions {
      * Accept the legacy body-only `X-Bastion-Signature` when v2 is absent.
      * Default `false`: legacy carries no timestamp or delivery id, so accepting
      * it lets anyone holding an old delivery replay it by stripping the v2
-     * header. Opt in only while migrating a consumer that cannot see v2 yet.
+     * header. Bastion no longer sends the legacy header, so there is nothing
+     * left to migrate: leave it off.
      */
     allowLegacySignature?: boolean;
-    /** Max age of `t` on a v2 signature, default 300 s. */
+    /** Max distance of the signed timestamp from now (Standard Webhooks and v2), default 300 s. */
     toleranceSeconds?: number;
     /** For tests. */
     now?: () => number;
 }
 export type VerifyWebhookResult = {
+    ok: true;
+    version: 'standard';
+    timestamp: number;
+    deliveryId: string;
+} | {
     ok: true;
     version: 'v2';
     timestamp: number;
@@ -50,12 +60,17 @@ export type VerifyWebhookResult = {
     reason: 'missing' | 'malformed' | 'stale' | 'mismatch';
 };
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export declare function verifyWebhookSignature(options: VerifyWebhookOptions): VerifyWebhookResult;

package/dist/esm/webhooks/index.js

@@ -4,14 +4,18 @@ export const BASTION_SIGNATURE_HEADER = 'x-bastion-signature';
 export const BASTION_SIGNATURE_V2_HEADER = 'x-bastion-signature-v2';
 export const BASTION_EVENT_HEADER = 'x-bastion-event';
 export const BASTION_DELIVERY_ID_HEADER = 'x-bastion-delivery-id';
+/** Standard Webhooks (standardwebhooks.com) headers, sent alongside v2 during the migration. */
+export const WEBHOOK_ID_HEADER = 'webhook-id';
+export const WEBHOOK_TIMESTAMP_HEADER = 'webhook-timestamp';
+export const WEBHOOK_SIGNATURE_HEADER = 'webhook-signature';
 /** Sent to every app with a webhook URL, whether or not the user has a role in it. */
 export const BASTION_LIFECYCLE_EVENTS = ['user.deleted', 'user.expired_unverified', 'user.deactivated'];
 function header(headers, name) {
-    const direct = headers[name] ?? headers[name.toLowerCase()];
-    if (direct !== undefined)
-        return Array.isArray(direct) ? direct[0] : direct;
-    const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
-    const v = key ? headers[key] : undefined;
+    let v = headers[name];
+    if (v === undefined) {
+        const key = Object.keys(headers).find((k) => k.toLowerCase() === name);
+        v = key === undefined ? undefined : headers[key];
+    }
     return Array.isArray(v) ? v[0] : v;
 }
 function macEquals(hexA, hexB) {
@@ -19,20 +23,54 @@ function macEquals(hexA, hexB) {
     const b = Buffer.from(hexB, 'hex');
     return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
 }
+function isFresh(timestamp, options) {
+    const now = Math.floor((options.now ?? Date.now)() / 1000);
+    return Math.abs(now - timestamp) <= (options.toleranceSeconds ?? 300);
+}
 /**
- * Verifies a Bastion delivery. Prefers `X-Bastion-Signature-V2`
+ * Verifies a Bastion delivery. Prefers Standard Webhooks when any of `webhook-id`,
+ * `webhook-timestamp`, `webhook-signature` is present: `webhook-signature` is a
+ * space-separated list of `v1,<base64 HMAC-SHA256(secret, "<id>.<timestamp>.<body>")>`,
+ * keyed with the secret as UTF-8 (not a `whsec_` base64 key); `deliveryId` is `webhook-id`.
+ * Otherwise falls back to `X-Bastion-Signature-V2`
  * (`t=<unix>,id=<deliveryId>,v1=<hex>[,v1=<hex>]`, MAC over `"<t>.<id>.<body>"`),
  * which binds the timestamp and the delivery id so a stale or replayed
  * delivery is rejected without trusting any unsigned header. The legacy
  * `X-Bastion-Signature: sha256=<hex>` over the body alone is accepted only
- * when v2 is absent **and** `allowLegacySignature` is set. Any of the caller's `secrets` matching any `v1=` accepts:
+ * when both of the above are absent **and** `allowLegacySignature` is set. Any of the caller's
+ * `secrets` matching any `v1` entry accepts:
  * that is how a secret rotation stays zero-downtime on both sides.
  */
 export function verifyWebhookSignature(options) {
     const body = typeof options.rawBody === 'string' ? Buffer.from(options.rawBody, 'utf8') : options.rawBody;
-    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(Boolean);
+    const secrets = (Array.isArray(options.secrets) ? options.secrets : [options.secrets]).filter(
+    // A whitespace-only secret is a misconfiguration, never a key; the rest are used byte-exact.
+    (s) => typeof s === 'string' && s.trim() !== '');
     if (secrets.length === 0)
         return { ok: false, reason: 'missing' };
+    const stdId = header(options.headers, WEBHOOK_ID_HEADER);
+    const stdTs = header(options.headers, WEBHOOK_TIMESTAMP_HEADER);
+    const stdSig = header(options.headers, WEBHOOK_SIGNATURE_HEADER);
+    if (stdId || stdTs || stdSig) {
+        const macs = (stdSig ?? '')
+            .split(' ')
+            .map((entry) => entry.split(','))
+            .filter(([version, value]) => version === 'v1' && value)
+            .map(([, value]) => Buffer.from(value, 'base64'));
+        if (!stdId || !stdTs || !/^\d+$/.test(stdTs) || macs.length === 0)
+            return { ok: false, reason: 'malformed' };
+        const timestamp = Number(stdTs);
+        if (!isFresh(timestamp, options))
+            return { ok: false, reason: 'stale' };
+        const signed = Buffer.concat([Buffer.from(`${stdId}.${stdTs}.`, 'utf8'), body]);
+        for (const secret of secrets) {
+            const expected = createHmac('sha256', secret).update(signed).digest();
+            if (macs.some((mac) => mac.length === expected.length && timingSafeEqual(mac, expected))) {
+                return { ok: true, version: 'standard', timestamp, deliveryId: stdId };
+            }
+        }
+        return { ok: false, reason: 'mismatch' };
+    }
     const v2 = header(options.headers, BASTION_SIGNATURE_V2_HEADER);
     if (v2) {
         const parts = v2.split(',').map((p) => p.trim());
@@ -42,8 +80,7 @@ export function verifyWebhookSignature(options) {
         const timestamp = Number(t);
         if (!t || !id || macs.length === 0 || !Number.isFinite(timestamp))
             return { ok: false, reason: 'malformed' };
-        const now = Math.floor((options.now ?? Date.now)() / 1000);
-        if (Math.abs(now - timestamp) > (options.toleranceSeconds ?? 300))
+        if (!isFresh(timestamp, options))
             return { ok: false, reason: 'stale' };
         const signed = Buffer.concat([Buffer.from(`${timestamp}.${id}.`, 'utf8'), body]);
         for (const secret of secrets) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",
@@ -10,7 +10,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "main": "./dist/cjs/core/index.js",
   "module": "./dist/esm/core/index.js",
@@ -60,7 +61,6 @@
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
-    "jose": "^6.0.0",
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0"
   },