@innvoid/getmarket-sdk 0.1.4 → 0.1.6

package/dist/middlewares/index.cjs

@@ -33,28 +33,16 @@ __export(middlewares_exports, {
   internalAuth: () => internalAuth,
   parseHeaders: () => parseHeaders,
   requestId: () => requestId,
+  requireAnyPermission: () => requireAnyPermission,
   requireAuthContext: () => requireAuthContext,
   requirePermissions: () => requirePermissions,
   requireRoles: () => requireRoles,
+  requireRolesOrAnyPermission: () => requireRolesOrAnyPermission,
   sendError: () => sendError,
   sendOk: () => sendOk
 });
 module.exports = __toCommonJS(middlewares_exports);
 
-// src/middlewares/requestId.ts
-var import_crypto = require("crypto");
-var REQUEST_ID_HEADER = "x-request-id";
-var REQUEST_ID_HEADER_ALT = "x-requestid";
-var RESPONSE_REQUEST_ID_HEADER = "X-Request-Id";
-function requestId(req, res, next) {
-  const headerId = req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT];
-  const id = headerId?.trim() || (0, import_crypto.randomUUID)();
-  req.requestId = id;
-  res.locals.requestId = id;
-  res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);
-  next();
-}
-
 // src/headers/constants.ts
 var HEADER_REQUEST_ID = "x-request-id";
 var HEADER_COMPANY_UID = "x-company";
@@ -63,28 +51,43 @@ var HEADER_EMPLOYEE_UID = "x-employee-uid";
 var HEADER_INTERNAL_API_KEY = "x-internal-api-key";
 
 // src/headers/parse.ts
-function asString(v) {
+function normalizeHeaderValue(v) {
   if (typeof v !== "string") return null;
   const s = v.trim();
-  return s ? s : null;
+  if (!s) return null;
+  if (s.startsWith("{") || s.startsWith("[") || s.includes('"')) return null;
+  if (s.length < 6) return null;
+  return s;
+}
+function h(headers, key) {
+  return headers[key] ?? headers[key.toLowerCase()] ?? headers[key.toUpperCase()];
 }
 function getRequestContextFromHeaders(headers) {
   return {
-    requestId: asString(headers[HEADER_REQUEST_ID]) ?? null,
-    company_uid: asString(headers[HEADER_COMPANY_UID]) ?? null,
-    branch_uid: asString(headers[HEADER_BRANCH_UID]) ?? null,
-    employee_uid: asString(headers[HEADER_EMPLOYEE_UID]) ?? null
+    requestId: normalizeHeaderValue(h(headers, HEADER_REQUEST_ID)) ?? null,
+    company_uid: normalizeHeaderValue(h(headers, HEADER_COMPANY_UID)) ?? null,
+    branch_uid: normalizeHeaderValue(h(headers, HEADER_BRANCH_UID)) ?? null,
+    employee_uid: normalizeHeaderValue(h(headers, HEADER_EMPLOYEE_UID)) ?? null
   };
 }
 
 // src/middlewares/parseHeaders.ts
 function parseHeaders(req, _res, next) {
-  const context = getRequestContextFromHeaders(req.headers);
-  req.context = context;
-  const auth = req.auth ?? (req.auth = {});
-  if (context.company_uid) auth.company_uid = context.company_uid;
-  if (context.branch_uid) auth.branch_uid = context.branch_uid;
-  if (context.employee_uid) auth.employee_uid = context.employee_uid;
+  req.context = getRequestContextFromHeaders(req.headers);
+  next();
+}
+
+// src/middlewares/requestId.ts
+var import_crypto = require("crypto");
+var REQUEST_ID_HEADER = "x-request-id";
+var REQUEST_ID_HEADER_ALT = "x-requestid";
+var RESPONSE_REQUEST_ID_HEADER = "X-Request-Id";
+function requestId(req, res, next) {
+  const headerId = req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT];
+  const id = headerId?.trim() || (0, import_crypto.randomUUID)();
+  req.requestId = id;
+  res.locals.requestId = id;
+  res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);
   next();
 }
 
@@ -156,10 +159,32 @@ function internalAuth(req, res, next) {
   return next();
 }
 
-// src/middlewares/autorization.ts
+// src/middlewares/authorization.ts
 function getAuth(req) {
   return req.auth ?? {};
 }
+function normalizeCode(v) {
+  if (!v) return null;
+  if (typeof v === "string") return v;
+  if (typeof v === "object") return v.code || v.name || null;
+  return null;
+}
+function rolesSet(auth) {
+  const out = /* @__PURE__ */ new Set();
+  for (const r of auth.roles || []) {
+    const c = normalizeCode(r);
+    if (c) out.add(c);
+  }
+  return out;
+}
+function permsSet(list) {
+  const out = /* @__PURE__ */ new Set();
+  for (const p of list || []) {
+    const c = normalizeCode(p);
+    if (c) out.add(c);
+  }
+  return out;
+}
 function requireAuthContext() {
   return (req, res, next) => {
     if (!req.auth) {
@@ -168,29 +193,100 @@ function requireAuthContext() {
     return next();
   };
 }
-function requirePermissions(...perms) {
+function isSysAdmin(auth, sysAdminRole) {
+  const have = rolesSet(auth);
+  return have.has(sysAdminRole);
+}
+function requirePermissions(perms, options) {
+  const sysAdminBypass = options?.sysAdminBypass !== false;
+  const sysAdminRole = options?.sysAdminRole || "SYS_ADMIN";
   return (req, res, next) => {
     const auth = getAuth(req);
-    const allow = new Set(auth.permissions ?? []);
-    const deny = new Set(auth.denied_permissions ?? []);
+    if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();
+    const allow = permsSet(auth.permissions);
+    const deny = permsSet(auth.denied_permissions);
     for (const p of perms) {
       if (deny.has(p)) {
-        return sendError(req, res, 403, "FORBIDDEN", `Denied: ${p}`);
+        return sendError(req, res, 403, "FORBIDDEN", `Denied permission: ${p}`, {
+          denied: p
+        });
       }
     }
     const missing = perms.filter((p) => !allow.has(p));
     if (missing.length) {
-      return sendError(req, res, 403, "FORBIDDEN", "Missing permissions", { missing });
+      return sendError(req, res, 403, "FORBIDDEN", "Missing permissions", {
+        missing,
+        mode: "ALL"
+      });
     }
     return next();
   };
 }
-function requireRoles(...roles) {
+function requireAnyPermission(perms, options) {
+  const sysAdminBypass = options?.sysAdminBypass !== false;
+  const sysAdminRole = options?.sysAdminRole || "SYS_ADMIN";
   return (req, res, next) => {
     const auth = getAuth(req);
-    const have = new Set(auth.roles ?? []);
+    if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();
+    const allow = permsSet(auth.permissions);
+    const deny = permsSet(auth.denied_permissions);
+    for (const p of perms) {
+      if (deny.has(p)) {
+        return sendError(req, res, 403, "FORBIDDEN", `Denied permission: ${p}`, {
+          denied: p
+        });
+      }
+    }
+    const ok = perms.some((p) => allow.has(p));
+    if (!ok) {
+      return sendError(req, res, 403, "FORBIDDEN", "Permission denied", {
+        required: perms,
+        mode: "ANY"
+      });
+    }
+    return next();
+  };
+}
+function requireRoles(roles, options) {
+  const sysAdminBypass = options?.sysAdminBypass !== false;
+  const sysAdminRole = options?.sysAdminRole || "SYS_ADMIN";
+  return (req, res, next) => {
+    const auth = getAuth(req);
+    if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();
+    const have = rolesSet(auth);
     if (!roles.some((r) => have.has(r))) {
-      return sendError(req, res, 403, "FORBIDDEN", "Role not allowed", { required: roles });
+      return sendError(req, res, 403, "FORBIDDEN", "Role not allowed", {
+        required: roles,
+        mode: "ANY"
+      });
+    }
+    return next();
+  };
+}
+function requireRolesOrAnyPermission(roles, perms, options) {
+  const sysAdminBypass = options?.sysAdminBypass !== false;
+  const sysAdminRole = options?.sysAdminRole || "SYS_ADMIN";
+  return (req, res, next) => {
+    const auth = getAuth(req);
+    if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();
+    const haveRoles = rolesSet(auth);
+    const allow = permsSet(auth.permissions);
+    const deny = permsSet(auth.denied_permissions);
+    for (const p of perms) {
+      if (deny.has(p)) {
+        return sendError(req, res, 403, "FORBIDDEN", `Denied permission: ${p}`, {
+          denied: p
+        });
+      }
+    }
+    const okRole = roles.some((r) => haveRoles.has(r));
+    const okPerm = perms.some((p) => allow.has(p));
+    if (!okRole && !okPerm) {
+      return sendError(req, res, 403, "FORBIDDEN", "Access denied", {
+        roles,
+        permissions: perms,
+        mode: "ROLES_OR_PERMS_ANY"
+      });
     }
     return next();
   };
@@ -200,9 +296,11 @@ function requireRoles(...roles) {
   internalAuth,
   parseHeaders,
   requestId,
+  requireAnyPermission,
   requireAuthContext,
   requirePermissions,
   requireRoles,
+  requireRolesOrAnyPermission,
   sendError,
   sendOk
 });

package/dist/middlewares/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/middlewares/index.ts","../../src/middlewares/requestId.ts","../../src/headers/constants.ts","../../src/headers/parse.ts","../../src/middlewares/parseHeaders.ts","../../src/middlewares/internalAuth.ts","../../src/middlewares/respond.ts","../../src/middlewares/autorization.ts"],"sourcesContent":["export {default as requestId} from \"./requestId\";\nexport {default as parseHeaders} from \"./parseHeaders\";\nexport {default as internalAuth} from \"./internalAuth\";\nexport * from \"./autorization\";\nexport * from \"./respond\";\n","// middlewares/requestId.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {randomUUID, randomBytes} from \"crypto\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\nexport const REQUEST_ID_HEADER_ALT = \"x-requestid\";\nexport const RESPONSE_REQUEST_ID_HEADER = \"X-Request-Id\";\n\n// Si quieres IDs más cortos (opcional). Por defecto usamos UUID.\nfunction nanoidLike(len = 21) {\n    return randomBytes(16).toString(\"base64url\").slice(0, len);\n}\n\nexport default function requestId(req: Request, res: Response, next: NextFunction) {\n    const headerId = (req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT]) as\n        | string\n        | undefined;\n\n    // ✅ estándar único: usa UUID (o cambia a nanoidLike() si prefieres corto)\n    const id = headerId?.trim() || randomUUID();\n\n    // ✅ estándar único (no legacy)\n    (req as any).requestId = id;\n    res.locals.requestId = id;\n\n    // ✅ respuesta\n    res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);\n\n    next();\n}\n","export const HEADER_REQUEST_ID = \"x-request-id\";\n\nexport const HEADER_COMPANY_UID = \"x-company\";\nexport const HEADER_BRANCH_UID = \"x-branch\";\nexport const HEADER_EMPLOYEE_UID = \"x-employee-uid\";\n\nexport const HEADER_INTERNAL_API_KEY = \"x-internal-api-key\";\nexport const HEADER_AUTHORIZATION = \"authorization\";\n","import {\n    HEADER_BRANCH_UID,\n    HEADER_COMPANY_UID,\n    HEADER_EMPLOYEE_UID,\n    HEADER_REQUEST_ID,\n} from \"./constants\";\n\nexport type RequestContext = {\n    requestId?: string | null;\n\n    company_uid?: string | null;\n    branch_uid?: string | null;\n    employee_uid?: string | null;\n};\n\nfunction asString(v: unknown): string | null {\n    if (typeof v !== \"string\") return null;\n    const s = v.trim();\n    return s ? s : null;\n}\n\n/**\n * ✅ NO-LEGACY:\n * - x-company: <UID>\n * - x-branch: <UID>\n * - x-employee-uid: <UID> (opcional)\n * - x-request-id: string (opcional)\n *\n * 🚫 No JSON, no _id, no objetos.\n */\nexport function getRequestContextFromHeaders(headers: Record<string, any>): RequestContext {\n    return {\n        requestId: asString(headers[HEADER_REQUEST_ID]) ?? null,\n        company_uid: asString(headers[HEADER_COMPANY_UID]) ?? null,\n        branch_uid: asString(headers[HEADER_BRANCH_UID]) ?? null,\n        employee_uid: asString(headers[HEADER_EMPLOYEE_UID]) ?? null,\n    };\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport {getRequestContextFromHeaders} from \"../headers\";\n\n/**\n * ✅ NO-LEGACY:\n * - solo setea UIDs\n * - no crea objetos company/branch\n * - no copia provider\n */\nexport default function parseHeaders(req: Request, _res: Response, next: NextFunction) {\n    const context = getRequestContextFromHeaders(req.headers as any);\n\n    (req as any).context = context;\n\n    const auth: any = (req as any).auth ?? ((req as any).auth = {});\n    if (context.company_uid) auth.company_uid = context.company_uid;\n    if (context.branch_uid) auth.branch_uid = context.branch_uid;\n    if (context.employee_uid) auth.employee_uid = context.employee_uid;\n\n    next();\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport fs from \"fs\";\nimport crypto from \"crypto\";\nimport {sendError} from \"./respond\";\nimport {HEADER_INTERNAL_API_KEY} from \"../headers\";\n\nfunction readSecretFile(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\nfunction splitKeys(v?: string | null): string[] {\n    if (!v) return [];\n    return v.split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\nfunction getExpectedKeys(): string[] {\n    const fileKey = readSecretFile(process.env.INTERNAL_API_KEY_FILE);\n    const envKey = (process.env.INTERNAL_API_KEY || \"\").trim();\n    const raw = fileKey || envKey;\n    return splitKeys(raw);\n}\n\nfunction extractToken(req: Request): string | null {\n    const apiKey = (req.header(HEADER_INTERNAL_API_KEY) || \"\").trim();\n    return apiKey || null;\n}\n\nfunction safeEquals(a: string, b: string): boolean {\n    const aa = Buffer.from(a);\n    const bb = Buffer.from(b);\n    if (aa.length !== bb.length) return false;\n    return crypto.timingSafeEqual(aa, bb);\n}\n\nexport default function internalAuth(req: Request, res: Response, next: NextFunction) {\n    const token = extractToken(req);\n\n    if (!token) {\n        return sendError(req, res, 401, \"UNAUTHORIZED\", `Missing internal api key (${HEADER_INTERNAL_API_KEY})`);\n    }\n\n    const expectedKeys = getExpectedKeys();\n    if (expectedKeys.length === 0) {\n        return sendError(\n            req,\n            res,\n            500,\n            \"MISCONFIGURED_INTERNAL_AUTH\",\n            \"Internal api key not configured (INTERNAL_API_KEY or INTERNAL_API_KEY_FILE)\"\n        );\n    }\n\n    const ok = expectedKeys.some((k) => safeEquals(token, k));\n    if (!ok) {\n        return sendError(req, res, 403, \"FORBIDDEN\", \"Invalid internal api key\");\n    }\n\n    return next();\n}\n","import type {Request, Response} from \"express\";\n\nexport function sendOk<T>(_req: Request, res: Response, data: T, statusCode = 200) {\n    return res.status(statusCode).json({ok: true, data, requestId: res.locals?.requestId ?? null});\n}\n\nexport function sendError(\n    _req: Request,\n    res: Response,\n    statusCode: number,\n    code: string,\n    message: string,\n    details?: any\n) {\n    return res.status(statusCode).json({\n        ok: false,\n        error: {code, message, ...(details !== undefined ? {details} : {})},\n        requestId: res.locals?.requestId ?? null,\n    });\n}\n","// packages/sdk/src/middlewares/authorization.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {sendError} from \"./respond\";\n\ntype AuthShape = {\n    roles?: string[];\n    permissions?: string[];\n    denied_permissions?: string[];\n};\n\nfunction getAuth(req: Request): AuthShape {\n    return ((req as any).auth ?? {}) as AuthShape;\n}\n\n/**\n * 401 si no existe req.auth (contexto auth).\n * Útil para proteger rutas internas donde SIEMPRE debe existir auth.\n */\nexport function requireAuthContext() {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (!(req as any).auth) {\n            return sendError(req, res, 401, \"UNAUTHORIZED\", \"Missing auth context\");\n        }\n        return next();\n    };\n}\n\n/**\n * Requiere TODOS los permisos indicados.\n * Regla: denied_permissions siempre gana sobre permissions.\n */\nexport function requirePermissions(...perms: string[]) {\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        const allow = new Set<string>(auth.permissions ?? []);\n        const deny = new Set<string>(auth.denied_permissions ?? []);\n\n        // deny gana siempre\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied: ${p}`);\n            }\n        }\n\n        const missing = perms.filter((p) => !allow.has(p));\n        if (missing.length) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions\", {missing});\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere al menos 1 de los roles indicados.\n */\nexport function requireRoles(...roles: string[]) {\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n        const have = new Set<string>(auth.roles ?? []);\n\n        if (!roles.some((r) => have.has(r))) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Role not allowed\", {required: roles});\n        }\n\n        return next();\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEA,oBAAsC;AAE/B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AAO3B,SAAR,UAA2B,KAAc,KAAe,MAAoB;AAC/E,QAAM,WAAY,IAAI,QAAQ,iBAAiB,KAAK,IAAI,QAAQ,qBAAqB;AAKrF,QAAM,KAAK,UAAU,KAAK,SAAK,0BAAW;AAG1C,EAAC,IAAY,YAAY;AACzB,MAAI,OAAO,YAAY;AAGvB,MAAI,UAAU,4BAA4B,EAAE;AAE5C,OAAK;AACT;;;AC7BO,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAE5B,IAAM,0BAA0B;;;ACSvC,SAAS,SAAS,GAA2B;AACzC,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,IAAI,EAAE,KAAK;AACjB,SAAO,IAAI,IAAI;AACnB;AAWO,SAAS,6BAA6B,SAA8C;AACvF,SAAO;AAAA,IACH,WAAW,SAAS,QAAQ,iBAAiB,CAAC,KAAK;AAAA,IACnD,aAAa,SAAS,QAAQ,kBAAkB,CAAC,KAAK;AAAA,IACtD,YAAY,SAAS,QAAQ,iBAAiB,CAAC,KAAK;AAAA,IACpD,cAAc,SAAS,QAAQ,mBAAmB,CAAC,KAAK;AAAA,EAC5D;AACJ;;;AC5Be,SAAR,aAA8B,KAAc,MAAgB,MAAoB;AACnF,QAAM,UAAU,6BAA6B,IAAI,OAAc;AAE/D,EAAC,IAAY,UAAU;AAEvB,QAAM,OAAa,IAAY,SAAU,IAAY,OAAO,CAAC;AAC7D,MAAI,QAAQ,YAAa,MAAK,cAAc,QAAQ;AACpD,MAAI,QAAQ,WAAY,MAAK,aAAa,QAAQ;AAClD,MAAI,QAAQ,aAAc,MAAK,eAAe,QAAQ;AAEtD,OAAK;AACT;;;ACnBA,gBAAe;AACf,IAAAA,iBAAmB;;;ACAZ,SAAS,OAAU,MAAe,KAAe,MAAS,aAAa,KAAK;AAC/E,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK,EAAC,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,aAAa,KAAI,CAAC;AACjG;AAEO,SAAS,UACZ,MACA,KACA,YACA,MACA,SACA,SACF;AACE,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK;AAAA,IAC/B,IAAI;AAAA,IACJ,OAAO,EAAC,MAAM,SAAS,GAAI,YAAY,SAAY,EAAC,QAAO,IAAI,CAAC,EAAE;AAAA,IAClE,WAAW,IAAI,QAAQ,aAAa;AAAA,EACxC,CAAC;AACL;;;ADbA,SAAS,eAAe,MAA8B;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,UAAAC,QAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,SAAS,UAAU,GAA6B;AAC5C,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC3D;AAEA,SAAS,kBAA4B;AACjC,QAAM,UAAU,eAAe,QAAQ,IAAI,qBAAqB;AAChE,QAAM,UAAU,QAAQ,IAAI,oBAAoB,IAAI,KAAK;AACzD,QAAM,MAAM,WAAW;AACvB,SAAO,UAAU,GAAG;AACxB;AAEA,SAAS,aAAa,KAA6B;AAC/C,QAAM,UAAU,IAAI,OAAO,uBAAuB,KAAK,IAAI,KAAK;AAChE,SAAO,UAAU;AACrB;AAEA,SAAS,WAAW,GAAW,GAAoB;AAC/C,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,MAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,SAAO,eAAAC,QAAO,gBAAgB,IAAI,EAAE;AACxC;AAEe,SAAR,aAA8B,KAAc,KAAe,MAAoB;AAClF,QAAM,QAAQ,aAAa,GAAG;AAE9B,MAAI,CAAC,OAAO;AACR,WAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,6BAA6B,uBAAuB,GAAG;AAAA,EAC3G;AAEA,QAAM,eAAe,gBAAgB;AACrC,MAAI,aAAa,WAAW,GAAG;AAC3B,WAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,KAAK,aAAa,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,CAAC;AACxD,MAAI,CAAC,IAAI;AACL,WAAO,UAAU,KAAK,KAAK,KAAK,aAAa,0BAA0B;AAAA,EAC3E;AAEA,SAAO,KAAK;AAChB;;;AEtDA,SAAS,QAAQ,KAAyB;AACtC,SAAS,IAAY,QAAQ,CAAC;AAClC;AAMO,SAAS,qBAAqB;AACjC,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,CAAE,IAAY,MAAM;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,sBAAsB;AAAA,IAC1E;AACA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,sBAAsB,OAAiB;AACnD,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,UAAM,QAAQ,IAAI,IAAY,KAAK,eAAe,CAAC,CAAC;AACpD,UAAM,OAAO,IAAI,IAAY,KAAK,sBAAsB,CAAC,CAAC;AAG1D,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,WAAW,CAAC,EAAE;AAAA,MAC/D;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACjD,QAAI,QAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,uBAAuB,EAAC,QAAO,CAAC;AAAA,IACjF;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAKO,SAAS,gBAAgB,OAAiB;AAC7C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AACxB,UAAM,OAAO,IAAI,IAAY,KAAK,SAAS,CAAC,CAAC;AAE7C,QAAI,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG;AACjC,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,oBAAoB,EAAC,UAAU,MAAK,CAAC;AAAA,IACtF;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;","names":["import_crypto","fs","crypto"]}
+{"version":3,"sources":["../../src/middlewares/index.ts","../../src/headers/constants.ts","../../src/headers/parse.ts","../../src/middlewares/parseHeaders.ts","../../src/middlewares/requestId.ts","../../src/middlewares/internalAuth.ts","../../src/middlewares/respond.ts","../../src/middlewares/authorization.ts"],"sourcesContent":["// packages/sdk/src/middlewares/index.ts\nexport {default as parseHeaders} from \"./parseHeaders\";\nexport {default as requestId} from \"./requestId\";\nexport {default as internalAuth} from \"./internalAuth\";\nexport {sendOk, sendError} from \"./respond\";\n\n// authorization helpers\nexport * from \"./authorization\";\n","export const HEADER_REQUEST_ID = \"x-request-id\";\n\nexport const HEADER_COMPANY_UID = \"x-company\";\nexport const HEADER_BRANCH_UID = \"x-branch\";\nexport const HEADER_EMPLOYEE_UID = \"x-employee-uid\";\n\nexport const HEADER_INTERNAL_API_KEY = \"x-internal-api-key\";\nexport const HEADER_AUTHORIZATION = \"authorization\";\n","import {\n    HEADER_BRANCH_UID,\n    HEADER_COMPANY_UID,\n    HEADER_EMPLOYEE_UID,\n    HEADER_REQUEST_ID,\n} from \"./constants\";\n\nexport type RequestContext = {\n    requestId?: string | null;\n    company_uid?: string | null;\n    branch_uid?: string | null;\n    employee_uid?: string | null;\n};\n\nfunction normalizeHeaderValue(v: unknown): string | null {\n    if (typeof v !== \"string\") return null;\n    const s = v.trim();\n    if (!s) return null;\n\n    // ✅ NO-LEGACY: bloquea JSON en headers\n    if (s.startsWith(\"{\") || s.startsWith(\"[\") || s.includes('\"')) return null;\n\n    // Evitar valores demasiado cortos (basura)\n    if (s.length < 6) return null;\n\n    return s;\n}\n\n/**\n * Lee header aunque venga en mayúsculas/minúsculas (Express suele bajar a lower-case).\n */\nfunction h(headers: Record<string, any>, key: string): unknown {\n    return headers[key] ?? headers[key.toLowerCase()] ?? headers[key.toUpperCase()];\n}\n\n/**\n * ✅ NO-LEGACY:\n * - x-company: <UID>\n * - x-branch: <UID>\n * - x-employee-uid: <UID> (opcional; NO reemplaza JWT)\n * - x-request-id: string (opcional)\n */\nexport function getRequestContextFromHeaders(headers: Record<string, any>): RequestContext {\n    return {\n        requestId: normalizeHeaderValue(h(headers, HEADER_REQUEST_ID)) ?? null,\n        company_uid: normalizeHeaderValue(h(headers, HEADER_COMPANY_UID)) ?? null,\n        branch_uid: normalizeHeaderValue(h(headers, HEADER_BRANCH_UID)) ?? null,\n        employee_uid: normalizeHeaderValue(h(headers, HEADER_EMPLOYEE_UID)) ?? null,\n    };\n}\n","// sdk/src/middlewares/parseHeaders.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {getRequestContextFromHeaders} from \"../headers\";\n\n/**\n * ✅ NO-LEGACY / ESTÁNDAR:\n * - Lee SOLO x-company y x-branch (UIDs planos)\n * - Setea req.context = { company_uid, branch_uid }\n * - NO toca req.auth (auth lo setea authentication/requireAuth)\n */\nexport default function parseHeaders(req: Request, _res: Response, next: NextFunction) {\n    (req as any).context = getRequestContextFromHeaders(req.headers as any);\n    next();\n}\n","// middlewares/requestId.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {randomUUID, randomBytes} from \"crypto\";\n\nexport const REQUEST_ID_HEADER = \"x-request-id\";\nexport const REQUEST_ID_HEADER_ALT = \"x-requestid\";\nexport const RESPONSE_REQUEST_ID_HEADER = \"X-Request-Id\";\n\n// Si quieres IDs más cortos (opcional). Por defecto usamos UUID.\nfunction nanoidLike(len = 21) {\n    return randomBytes(16).toString(\"base64url\").slice(0, len);\n}\n\nexport default function requestId(req: Request, res: Response, next: NextFunction) {\n    const headerId = (req.headers[REQUEST_ID_HEADER] || req.headers[REQUEST_ID_HEADER_ALT]) as\n        | string\n        | undefined;\n\n    // ✅ estándar único: usa UUID (o cambia a nanoidLike() si prefieres corto)\n    const id = headerId?.trim() || randomUUID();\n\n    // ✅ estándar único (no legacy)\n    (req as any).requestId = id;\n    res.locals.requestId = id;\n\n    // ✅ respuesta\n    res.setHeader(RESPONSE_REQUEST_ID_HEADER, id);\n\n    next();\n}\n","import type {Request, Response, NextFunction} from \"express\";\nimport fs from \"fs\";\nimport crypto from \"crypto\";\nimport {sendError} from \"./respond\";\nimport {HEADER_INTERNAL_API_KEY} from \"../headers\";\n\nfunction readSecretFile(path?: string): string | null {\n    if (!path) return null;\n    try {\n        const v = fs.readFileSync(path, \"utf8\").trim();\n        return v.length ? v : null;\n    } catch {\n        return null;\n    }\n}\n\nfunction splitKeys(v?: string | null): string[] {\n    if (!v) return [];\n    return v.split(\",\").map((s) => s.trim()).filter(Boolean);\n}\n\nfunction getExpectedKeys(): string[] {\n    const fileKey = readSecretFile(process.env.INTERNAL_API_KEY_FILE);\n    const envKey = (process.env.INTERNAL_API_KEY || \"\").trim();\n    const raw = fileKey || envKey;\n    return splitKeys(raw);\n}\n\nfunction extractToken(req: Request): string | null {\n    const apiKey = (req.header(HEADER_INTERNAL_API_KEY) || \"\").trim();\n    return apiKey || null;\n}\n\nfunction safeEquals(a: string, b: string): boolean {\n    const aa = Buffer.from(a);\n    const bb = Buffer.from(b);\n    if (aa.length !== bb.length) return false;\n    return crypto.timingSafeEqual(aa, bb);\n}\n\nexport default function internalAuth(req: Request, res: Response, next: NextFunction) {\n    const token = extractToken(req);\n\n    if (!token) {\n        return sendError(req, res, 401, \"UNAUTHORIZED\", `Missing internal api key (${HEADER_INTERNAL_API_KEY})`);\n    }\n\n    const expectedKeys = getExpectedKeys();\n    if (expectedKeys.length === 0) {\n        return sendError(\n            req,\n            res,\n            500,\n            \"MISCONFIGURED_INTERNAL_AUTH\",\n            \"Internal api key not configured (INTERNAL_API_KEY or INTERNAL_API_KEY_FILE)\"\n        );\n    }\n\n    const ok = expectedKeys.some((k) => safeEquals(token, k));\n    if (!ok) {\n        return sendError(req, res, 403, \"FORBIDDEN\", \"Invalid internal api key\");\n    }\n\n    return next();\n}\n","import type {Request, Response} from \"express\";\n\nexport function sendOk<T>(_req: Request, res: Response, data: T, statusCode = 200) {\n    return res.status(statusCode).json({ok: true, data, requestId: res.locals?.requestId ?? null});\n}\n\nexport function sendError(\n    _req: Request,\n    res: Response,\n    statusCode: number,\n    code: string,\n    message: string,\n    details?: any\n) {\n    return res.status(statusCode).json({\n        ok: false,\n        error: {code, message, ...(details !== undefined ? {details} : {})},\n        requestId: res.locals?.requestId ?? null,\n    });\n}\n","// packages/sdk/src/middlewares/authorization.ts\nimport type {Request, Response, NextFunction} from \"express\";\nimport {sendError} from \"./respond\";\n\ntype AuthRole = string | { code?: string; name?: string };\ntype AuthPermission = string | { code?: string; name?: string };\n\ntype AuthShape = {\n    roles?: AuthRole[];\n    permissions?: AuthPermission[];\n    denied_permissions?: AuthPermission[];\n};\n\nfunction getAuth(req: Request): AuthShape {\n    return ((req as any).auth ?? {}) as AuthShape;\n}\n\nfunction normalizeCode(v: any): string | null {\n    if (!v) return null;\n    if (typeof v === \"string\") return v;\n    if (typeof v === \"object\") return v.code || v.name || null;\n    return null;\n}\n\nfunction rolesSet(auth: AuthShape): Set<string> {\n    const out = new Set<string>();\n    for (const r of auth.roles || []) {\n        const c = normalizeCode(r);\n        if (c) out.add(c);\n    }\n    return out;\n}\n\nfunction permsSet(list?: AuthPermission[]): Set<string> {\n    const out = new Set<string>();\n    for (const p of list || []) {\n        const c = normalizeCode(p);\n        if (c) out.add(c);\n    }\n    return out;\n}\n\n/**\n * 401 si no existe req.auth (contexto auth).\n * Útil para proteger rutas donde SIEMPRE debe existir auth.\n */\nexport function requireAuthContext() {\n    return (req: Request, res: Response, next: NextFunction) => {\n        if (!(req as any).auth) {\n            return sendError(req, res, 401, \"UNAUTHORIZED\", \"Missing auth context\");\n        }\n        return next();\n    };\n}\n\n/**\n * Helper: SYS_ADMIN bypass (por defecto activo)\n */\nfunction isSysAdmin(auth: AuthShape, sysAdminRole: string) {\n    const have = rolesSet(auth);\n    return have.has(sysAdminRole);\n}\n\n/**\n * Requiere TODOS los permisos indicados.\n * Regla: denied_permissions siempre gana sobre permissions.\n *\n * options:\n *  - sysAdminBypass: default true\n *  - sysAdminRole: default \"SYS_ADMIN\"\n */\nexport function requirePermissions(\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const missing = perms.filter((p) => !allow.has(p));\n        if (missing.length) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Missing permissions\", {\n                missing,\n                mode: \"ALL\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere AL MENOS 1 permiso de la lista (ANY/OR).\n * Regla: denied_permissions siempre gana.\n */\nexport function requireAnyPermission(\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre (si alguno requerido está denegado explícitamente)\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const ok = perms.some((p) => allow.has(p));\n        if (!ok) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Permission denied\", {\n                required: perms,\n                mode: \"ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere al menos 1 rol (ANY/OR).\n * options:\n *  - sysAdminBypass: default true\n *  - sysAdminRole: default \"SYS_ADMIN\"\n */\nexport function requireRoles(\n    roles: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        // SYS_ADMIN bypass aplica también aquí\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const have = rolesSet(auth);\n        if (!roles.some((r) => have.has(r))) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Role not allowed\", {\n                required: roles,\n                mode: \"ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n\n/**\n * Requiere (roles ANY) OR (permissions ANY).\n * deny_permissions siempre gana sobre permissions.\n */\nexport function requireRolesOrAnyPermission(\n    roles: string[],\n    perms: string[],\n    options?: { sysAdminBypass?: boolean; sysAdminRole?: string }\n) {\n    const sysAdminBypass = options?.sysAdminBypass !== false;\n    const sysAdminRole = options?.sysAdminRole || \"SYS_ADMIN\";\n\n    return (req: Request, res: Response, next: NextFunction) => {\n        const auth = getAuth(req);\n\n        if (sysAdminBypass && isSysAdmin(auth, sysAdminRole)) return next();\n\n        const haveRoles = rolesSet(auth);\n        const allow = permsSet(auth.permissions);\n        const deny = permsSet(auth.denied_permissions);\n\n        // deny gana siempre (si cualquiera de los permisos evaluados está denegado explícitamente)\n        for (const p of perms) {\n            if (deny.has(p)) {\n                return sendError(req, res, 403, \"FORBIDDEN\", `Denied permission: ${p}`, {\n                    denied: p,\n                });\n            }\n        }\n\n        const okRole = roles.some((r) => haveRoles.has(r));\n        const okPerm = perms.some((p) => allow.has(p));\n\n        if (!okRole && !okPerm) {\n            return sendError(req, res, 403, \"FORBIDDEN\", \"Access denied\", {\n                roles,\n                permissions: perms,\n                mode: \"ROLES_OR_PERMS_ANY\",\n            });\n        }\n\n        return next();\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAE5B,IAAM,0BAA0B;;;ACQvC,SAAS,qBAAqB,GAA2B;AACrD,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,QAAM,IAAI,EAAE,KAAK;AACjB,MAAI,CAAC,EAAG,QAAO;AAGf,MAAI,EAAE,WAAW,GAAG,KAAK,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,EAAG,QAAO;AAGtE,MAAI,EAAE,SAAS,EAAG,QAAO;AAEzB,SAAO;AACX;AAKA,SAAS,EAAE,SAA8B,KAAsB;AAC3D,SAAO,QAAQ,GAAG,KAAK,QAAQ,IAAI,YAAY,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC;AAClF;AASO,SAAS,6BAA6B,SAA8C;AACvF,SAAO;AAAA,IACH,WAAW,qBAAqB,EAAE,SAAS,iBAAiB,CAAC,KAAK;AAAA,IAClE,aAAa,qBAAqB,EAAE,SAAS,kBAAkB,CAAC,KAAK;AAAA,IACrE,YAAY,qBAAqB,EAAE,SAAS,iBAAiB,CAAC,KAAK;AAAA,IACnE,cAAc,qBAAqB,EAAE,SAAS,mBAAmB,CAAC,KAAK;AAAA,EAC3E;AACJ;;;ACvCe,SAAR,aAA8B,KAAc,MAAgB,MAAoB;AACnF,EAAC,IAAY,UAAU,6BAA6B,IAAI,OAAc;AACtE,OAAK;AACT;;;ACXA,oBAAsC;AAE/B,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,6BAA6B;AAO3B,SAAR,UAA2B,KAAc,KAAe,MAAoB;AAC/E,QAAM,WAAY,IAAI,QAAQ,iBAAiB,KAAK,IAAI,QAAQ,qBAAqB;AAKrF,QAAM,KAAK,UAAU,KAAK,SAAK,0BAAW;AAG1C,EAAC,IAAY,YAAY;AACzB,MAAI,OAAO,YAAY;AAGvB,MAAI,UAAU,4BAA4B,EAAE;AAE5C,OAAK;AACT;;;AC5BA,gBAAe;AACf,IAAAA,iBAAmB;;;ACAZ,SAAS,OAAU,MAAe,KAAe,MAAS,aAAa,KAAK;AAC/E,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK,EAAC,IAAI,MAAM,MAAM,WAAW,IAAI,QAAQ,aAAa,KAAI,CAAC;AACjG;AAEO,SAAS,UACZ,MACA,KACA,YACA,MACA,SACA,SACF;AACE,SAAO,IAAI,OAAO,UAAU,EAAE,KAAK;AAAA,IAC/B,IAAI;AAAA,IACJ,OAAO,EAAC,MAAM,SAAS,GAAI,YAAY,SAAY,EAAC,QAAO,IAAI,CAAC,EAAE;AAAA,IAClE,WAAW,IAAI,QAAQ,aAAa;AAAA,EACxC,CAAC;AACL;;;ADbA,SAAS,eAAe,MAA8B;AAClD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACA,UAAM,IAAI,UAAAC,QAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EAC1B,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;AAEA,SAAS,UAAU,GAA6B;AAC5C,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAC3D;AAEA,SAAS,kBAA4B;AACjC,QAAM,UAAU,eAAe,QAAQ,IAAI,qBAAqB;AAChE,QAAM,UAAU,QAAQ,IAAI,oBAAoB,IAAI,KAAK;AACzD,QAAM,MAAM,WAAW;AACvB,SAAO,UAAU,GAAG;AACxB;AAEA,SAAS,aAAa,KAA6B;AAC/C,QAAM,UAAU,IAAI,OAAO,uBAAuB,KAAK,IAAI,KAAK;AAChE,SAAO,UAAU;AACrB;AAEA,SAAS,WAAW,GAAW,GAAoB;AAC/C,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,QAAM,KAAK,OAAO,KAAK,CAAC;AACxB,MAAI,GAAG,WAAW,GAAG,OAAQ,QAAO;AACpC,SAAO,eAAAC,QAAO,gBAAgB,IAAI,EAAE;AACxC;AAEe,SAAR,aAA8B,KAAc,KAAe,MAAoB;AAClF,QAAM,QAAQ,aAAa,GAAG;AAE9B,MAAI,CAAC,OAAO;AACR,WAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,6BAA6B,uBAAuB,GAAG;AAAA,EAC3G;AAEA,QAAM,eAAe,gBAAgB;AACrC,MAAI,aAAa,WAAW,GAAG;AAC3B,WAAO;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAEA,QAAM,KAAK,aAAa,KAAK,CAAC,MAAM,WAAW,OAAO,CAAC,CAAC;AACxD,MAAI,CAAC,IAAI;AACL,WAAO,UAAU,KAAK,KAAK,KAAK,aAAa,0BAA0B;AAAA,EAC3E;AAEA,SAAO,KAAK;AAChB;;;AEnDA,SAAS,QAAQ,KAAyB;AACtC,SAAS,IAAY,QAAQ,CAAC;AAClC;AAEA,SAAS,cAAc,GAAuB;AAC1C,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,OAAO,MAAM,SAAU,QAAO,EAAE,QAAQ,EAAE,QAAQ;AACtD,SAAO;AACX;AAEA,SAAS,SAAS,MAA8B;AAC5C,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,KAAK,KAAK,SAAS,CAAC,GAAG;AAC9B,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,EAAG,KAAI,IAAI,CAAC;AAAA,EACpB;AACA,SAAO;AACX;AAEA,SAAS,SAAS,MAAsC;AACpD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,KAAK,QAAQ,CAAC,GAAG;AACxB,UAAM,IAAI,cAAc,CAAC;AACzB,QAAI,EAAG,KAAI,IAAI,CAAC;AAAA,EACpB;AACA,SAAO;AACX;AAMO,SAAS,qBAAqB;AACjC,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,QAAI,CAAE,IAAY,MAAM;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,gBAAgB,sBAAsB;AAAA,IAC1E;AACA,WAAO,KAAK;AAAA,EAChB;AACJ;AAKA,SAAS,WAAW,MAAiB,cAAsB;AACvD,QAAM,OAAO,SAAS,IAAI;AAC1B,SAAO,KAAK,IAAI,YAAY;AAChC;AAUO,SAAS,mBACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,UAAU,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AACjD,QAAI,QAAQ,QAAQ;AAChB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,uBAAuB;AAAA,QAChE;AAAA,QACA,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,qBACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,KAAK,MAAM,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AACzC,QAAI,CAAC,IAAI;AACL,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,qBAAqB;AAAA,QAC9D,UAAU;AAAA,QACV,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAQO,SAAS,aACZ,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAGxB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,OAAO,SAAS,IAAI;AAC1B,QAAI,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,GAAG;AACjC,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,oBAAoB;AAAA,QAC7D,UAAU;AAAA,QACV,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;AAMO,SAAS,4BACZ,OACA,OACA,SACF;AACE,QAAM,iBAAiB,SAAS,mBAAmB;AACnD,QAAM,eAAe,SAAS,gBAAgB;AAE9C,SAAO,CAAC,KAAc,KAAe,SAAuB;AACxD,UAAM,OAAO,QAAQ,GAAG;AAExB,QAAI,kBAAkB,WAAW,MAAM,YAAY,EAAG,QAAO,KAAK;AAElE,UAAM,YAAY,SAAS,IAAI;AAC/B,UAAM,QAAQ,SAAS,KAAK,WAAW;AACvC,UAAM,OAAO,SAAS,KAAK,kBAAkB;AAG7C,eAAW,KAAK,OAAO;AACnB,UAAI,KAAK,IAAI,CAAC,GAAG;AACb,eAAO,UAAU,KAAK,KAAK,KAAK,aAAa,sBAAsB,CAAC,IAAI;AAAA,UACpE,QAAQ;AAAA,QACZ,CAAC;AAAA,MACL;AAAA,IACJ;AAEA,UAAM,SAAS,MAAM,KAAK,CAAC,MAAM,UAAU,IAAI,CAAC,CAAC;AACjD,UAAM,SAAS,MAAM,KAAK,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAE7C,QAAI,CAAC,UAAU,CAAC,QAAQ;AACpB,aAAO,UAAU,KAAK,KAAK,KAAK,aAAa,iBAAiB;AAAA,QAC1D;AAAA,QACA,aAAa;AAAA,QACb,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAEA,WAAO,KAAK;AAAA,EAChB;AACJ;","names":["import_crypto","fs","crypto"]}

package/dist/middlewares/index.d.cts

@@ -1,33 +1,62 @@
 import { Request, Response, NextFunction } from 'express';
 
-declare function requestId(req: Request, res: Response, next: NextFunction): void;
-
 /**
- * ✅ NO-LEGACY:
- * - solo setea UIDs
- * - no crea objetos company/branch
- * - no copia provider
+ * ✅ NO-LEGACY / ESTÁNDAR:
+ * - Lee SOLO x-company y x-branch (UIDs planos)
+ * - Setea req.context = { company_uid, branch_uid }
+ * - NO toca req.auth (auth lo setea authentication/requireAuth)
  */
 declare function parseHeaders(req: Request, _res: Response, next: NextFunction): void;
 
+declare function requestId(req: Request, res: Response, next: NextFunction): void;
+
 declare function internalAuth(req: Request, res: Response, next: NextFunction): void | Response<any, Record<string, any>>;
 
+declare function sendOk<T>(_req: Request, res: Response, data: T, statusCode?: number): Response<any, Record<string, any>>;
+declare function sendError(_req: Request, res: Response, statusCode: number, code: string, message: string, details?: any): Response<any, Record<string, any>>;
+
 /**
  * 401 si no existe req.auth (contexto auth).
- * Útil para proteger rutas internas donde SIEMPRE debe existir auth.
+ * Útil para proteger rutas donde SIEMPRE debe existir auth.
  */
 declare function requireAuthContext(): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 /**
  * Requiere TODOS los permisos indicados.
  * Regla: denied_permissions siempre gana sobre permissions.
+ *
+ * options:
+ *  - sysAdminBypass: default true
+ *  - sysAdminRole: default "SYS_ADMIN"
  */
-declare function requirePermissions(...perms: string[]): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+declare function requirePermissions(perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 /**
- * Requiere al menos 1 de los roles indicados.
+ * Requiere AL MENOS 1 permiso de la lista (ANY/OR).
+ * Regla: denied_permissions siempre gana.
  */
-declare function requireRoles(...roles: string[]): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
-
-declare function sendOk<T>(_req: Request, res: Response, data: T, statusCode?: number): Response<any, Record<string, any>>;
-declare function sendError(_req: Request, res: Response, statusCode: number, code: string, message: string, details?: any): Response<any, Record<string, any>>;
+declare function requireAnyPermission(perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+/**
+ * Requiere al menos 1 rol (ANY/OR).
+ * options:
+ *  - sysAdminBypass: default true
+ *  - sysAdminRole: default "SYS_ADMIN"
+ */
+declare function requireRoles(roles: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+/**
+ * Requiere (roles ANY) OR (permissions ANY).
+ * deny_permissions siempre gana sobre permissions.
+ */
+declare function requireRolesOrAnyPermission(roles: string[], perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 
-export { internalAuth, parseHeaders, requestId, requireAuthContext, requirePermissions, requireRoles, sendError, sendOk };
+export { internalAuth, parseHeaders, requestId, requireAnyPermission, requireAuthContext, requirePermissions, requireRoles, requireRolesOrAnyPermission, sendError, sendOk };

package/dist/middlewares/index.d.ts

@@ -1,33 +1,62 @@
 import { Request, Response, NextFunction } from 'express';
 
-declare function requestId(req: Request, res: Response, next: NextFunction): void;
-
 /**
- * ✅ NO-LEGACY:
- * - solo setea UIDs
- * - no crea objetos company/branch
- * - no copia provider
+ * ✅ NO-LEGACY / ESTÁNDAR:
+ * - Lee SOLO x-company y x-branch (UIDs planos)
+ * - Setea req.context = { company_uid, branch_uid }
+ * - NO toca req.auth (auth lo setea authentication/requireAuth)
  */
 declare function parseHeaders(req: Request, _res: Response, next: NextFunction): void;
 
+declare function requestId(req: Request, res: Response, next: NextFunction): void;
+
 declare function internalAuth(req: Request, res: Response, next: NextFunction): void | Response<any, Record<string, any>>;
 
+declare function sendOk<T>(_req: Request, res: Response, data: T, statusCode?: number): Response<any, Record<string, any>>;
+declare function sendError(_req: Request, res: Response, statusCode: number, code: string, message: string, details?: any): Response<any, Record<string, any>>;
+
 /**
  * 401 si no existe req.auth (contexto auth).
- * Útil para proteger rutas internas donde SIEMPRE debe existir auth.
+ * Útil para proteger rutas donde SIEMPRE debe existir auth.
  */
 declare function requireAuthContext(): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 /**
  * Requiere TODOS los permisos indicados.
  * Regla: denied_permissions siempre gana sobre permissions.
+ *
+ * options:
+ *  - sysAdminBypass: default true
+ *  - sysAdminRole: default "SYS_ADMIN"
  */
-declare function requirePermissions(...perms: string[]): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+declare function requirePermissions(perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 /**
- * Requiere al menos 1 de los roles indicados.
+ * Requiere AL MENOS 1 permiso de la lista (ANY/OR).
+ * Regla: denied_permissions siempre gana.
  */
-declare function requireRoles(...roles: string[]): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
-
-declare function sendOk<T>(_req: Request, res: Response, data: T, statusCode?: number): Response<any, Record<string, any>>;
-declare function sendError(_req: Request, res: Response, statusCode: number, code: string, message: string, details?: any): Response<any, Record<string, any>>;
+declare function requireAnyPermission(perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+/**
+ * Requiere al menos 1 rol (ANY/OR).
+ * options:
+ *  - sysAdminBypass: default true
+ *  - sysAdminRole: default "SYS_ADMIN"
+ */
+declare function requireRoles(roles: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
+/**
+ * Requiere (roles ANY) OR (permissions ANY).
+ * deny_permissions siempre gana sobre permissions.
+ */
+declare function requireRolesOrAnyPermission(roles: string[], perms: string[], options?: {
+    sysAdminBypass?: boolean;
+    sysAdminRole?: string;
+}): (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 
-export { internalAuth, parseHeaders, requestId, requireAuthContext, requirePermissions, requireRoles, sendError, sendOk };
+export { internalAuth, parseHeaders, requestId, requireAnyPermission, requireAuthContext, requirePermissions, requireRoles, requireRolesOrAnyPermission, sendError, sendOk };

package/dist/middlewares/index.js

@@ -1,22 +1,27 @@
 import {
   internalAuth,
   parseHeaders,
-  requestId,
+  requireAnyPermission,
   requireAuthContext,
   requirePermissions,
   requireRoles,
+  requireRolesOrAnyPermission,
   sendError,
   sendOk
-} from "../chunk-Y2JJLHAY.js";
-import "../chunk-65HACONF.js";
-import "../chunk-PZ5AY32C.js";
+} from "../chunk-JXOLNJ7J.js";
+import {
+  requestId
+} from "../chunk-KJ64O2EG.js";
+import "../chunk-P2U3MT2E.js";
 export {
   internalAuth,
   parseHeaders,
   requestId,
+  requireAnyPermission,
   requireAuthContext,
   requirePermissions,
   requireRoles,
+  requireRolesOrAnyPermission,
   sendError,
   sendOk
 };

package/dist/parse-C4vk-fmH.d.cts

@@ -0,0 +1,16 @@
+type RequestContext = {
+    requestId?: string | null;
+    company_uid?: string | null;
+    branch_uid?: string | null;
+    employee_uid?: string | null;
+};
+/**
+ * ✅ NO-LEGACY:
+ * - x-company: <UID>
+ * - x-branch: <UID>
+ * - x-employee-uid: <UID> (opcional; NO reemplaza JWT)
+ * - x-request-id: string (opcional)
+ */
+declare function getRequestContextFromHeaders(headers: Record<string, any>): RequestContext;
+
+export { type RequestContext as R, getRequestContextFromHeaders as g };

package/dist/parse-C4vk-fmH.d.ts

@@ -0,0 +1,16 @@
+type RequestContext = {
+    requestId?: string | null;
+    company_uid?: string | null;
+    branch_uid?: string | null;
+    employee_uid?: string | null;
+};
+/**
+ * ✅ NO-LEGACY:
+ * - x-company: <UID>
+ * - x-branch: <UID>
+ * - x-employee-uid: <UID> (opcional; NO reemplaza JWT)
+ * - x-request-id: string (opcional)
+ */
+declare function getRequestContextFromHeaders(headers: Record<string, any>): RequestContext;
+
+export { type RequestContext as R, getRequestContextFromHeaders as g };

package/dist/types-CRECQuHp.d.cts

@@ -0,0 +1,54 @@
+import { Request } from 'express';
+
+type AuthSubject = "employee" | "customer";
+type TokenType = "backend";
+type AuthSession = {
+    jti?: string;
+    device_id?: string;
+    expires_at?: number;
+};
+type AuthContext = {
+    tokenType: TokenType;
+    subject: AuthSubject;
+    employee?: any;
+    customer?: any;
+    company_uid?: string;
+    branch_uid?: string;
+    companies?: any[];
+    company?: any;
+    branch?: any;
+    roles?: string[];
+    permissions?: string[];
+    denied_permissions?: string[];
+    session?: AuthSession;
+    firebase?: any;
+};
+type HydrateInput = {
+    decoded: any;
+    req: Request;
+    subject: AuthSubject;
+    company_uid: string | null;
+    branch_uid: string | null;
+};
+type HydrateResult = Partial<Pick<AuthContext, "employee" | "customer" | "companies" | "company" | "branch" | "roles" | "permissions" | "denied_permissions">>;
+type Hydrator = (input: HydrateInput) => Promise<HydrateResult> | HydrateResult;
+type AuthMiddlewareOptions = {
+    subject: AuthSubject;
+    /**
+     * ✅ Si true, exige que el sujeto (employee/customer) exista tras hydrate.
+     * Default: true
+     */
+    requireSubject?: boolean;
+    /**
+     * Si true, permite fallback a Firebase idToken.
+     * Default: false
+     */
+    allowFirebaseIdToken?: boolean;
+    /**
+     * ✅ OBLIGATORIO para evitar acoplamientos:
+     * el micro decide cómo hidratar (DB local / AuthClient / etc).
+     */
+    hydrate: Hydrator;
+};
+
+export type { AuthContext as A, HydrateInput as H, TokenType as T, AuthMiddlewareOptions as a, AuthSession as b, AuthSubject as c, HydrateResult as d, Hydrator as e };

package/dist/types-CRECQuHp.d.ts

@@ -0,0 +1,54 @@
+import { Request } from 'express';
+
+type AuthSubject = "employee" | "customer";
+type TokenType = "backend";
+type AuthSession = {
+    jti?: string;
+    device_id?: string;
+    expires_at?: number;
+};
+type AuthContext = {
+    tokenType: TokenType;
+    subject: AuthSubject;
+    employee?: any;
+    customer?: any;
+    company_uid?: string;
+    branch_uid?: string;
+    companies?: any[];
+    company?: any;
+    branch?: any;
+    roles?: string[];
+    permissions?: string[];
+    denied_permissions?: string[];
+    session?: AuthSession;
+    firebase?: any;
+};
+type HydrateInput = {
+    decoded: any;
+    req: Request;
+    subject: AuthSubject;
+    company_uid: string | null;
+    branch_uid: string | null;
+};
+type HydrateResult = Partial<Pick<AuthContext, "employee" | "customer" | "companies" | "company" | "branch" | "roles" | "permissions" | "denied_permissions">>;
+type Hydrator = (input: HydrateInput) => Promise<HydrateResult> | HydrateResult;
+type AuthMiddlewareOptions = {
+    subject: AuthSubject;
+    /**
+     * ✅ Si true, exige que el sujeto (employee/customer) exista tras hydrate.
+     * Default: true
+     */
+    requireSubject?: boolean;
+    /**
+     * Si true, permite fallback a Firebase idToken.
+     * Default: false
+     */
+    allowFirebaseIdToken?: boolean;
+    /**
+     * ✅ OBLIGATORIO para evitar acoplamientos:
+     * el micro decide cómo hidratar (DB local / AuthClient / etc).
+     */
+    hydrate: Hydrator;
+};
+
+export type { AuthContext as A, HydrateInput as H, TokenType as T, AuthMiddlewareOptions as a, AuthSession as b, AuthSubject as c, HydrateResult as d, Hydrator as e };