@innvoid/getmarket-sdk 0.2.7 → 0.2.9

package/dist/index.d.cts

@@ -4,40 +4,27 @@ export { HEADER_AUTHORIZATION, HEADER_BRANCH_UID, HEADER_COMPANY_UID, HEADER_EMP
 import { R as RequestContext } from './parse-C4vk-fmH.cjs';
 export { g as getRequestContextFromHeaders } from './parse-C4vk-fmH.cjs';
 export { allowAuthAdminOrPerm, allowSysAdminOrAnyPermission, allowSysAdminOrPermissionsAll, allowSysAdminOrRoles, allowSysAdminOrRolesOrAnyPermission, internalAuth, parseHeaders, requestId, requireAnyPermission, requireAuthContext, requirePermissions, requireRoles, requireRolesOrAnyPermission, sendError, sendOk } from './middlewares/index.cjs';
-import { a as AuthMiddlewareOptions } from './types-CRECQuHp.cjs';
-export { A as AuthContext, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType } from './types-CRECQuHp.cjs';
-import { Response, NextFunction } from 'express';
+import { a as AuthMiddlewareOptions } from './types-Cc_McZgD.cjs';
+export { A as AuthContext, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType } from './types-Cc_McZgD.cjs';
 import { JwtPayload } from 'jsonwebtoken';
+import { RequestHandler } from 'express';
 export { InternalBulkRefsOptions, ServiceClientEnv, createBulkRefsClient, createFisClient, createMdClient, createMediaClient, createMkpClient, createPayClient, createPlatformClient, createResClient, readServiceEnv } from './clients/index.cjs';
 export { BulkRefsResponse, BulkUidsRequest } from '@innvoid/getmarket-contracts';
 import 'axios';
 
+declare function getBearerToken(req: any): string | null;
+declare function normalizeUid(v: any): string | null;
 /**
- * ✅ Middleware estándar:
- * - Solo Authorization: Bearer
- * - Solo RS256
- * - Cero legacy
- * - Hidrata vía hook (OBLIGATORIO)
- */
-declare function createAuthMiddleware$1(opts: AuthMiddlewareOptions): (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-
-/**
- * ✅ Keys viven en getmarket-stack:
- * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub (recomendado)
+ * Keys centralizadas:
+ * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub
  * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY
  */
 declare function readRs256PublicKey(): string;
 declare function verifyBackendJwtRS256(raw: string): JwtPayload;
+declare function extractEmployeeUid(decoded: any): string | null;
+declare function extractCustomerUid(decoded: any): string | null;
 
-type Subject = "employee" | "customer";
-declare function createAuthMiddleware(opts: {
-    subject: Subject;
-    allowFirebaseIdToken?: boolean;
-}): (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authEmployeeRequired: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authCustomerRequired: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authEmployeeAllowFirebase: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authCustomerAllowFirebase: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
+declare function createAuthMiddleware(opts: AuthMiddlewareOptions): RequestHandler;
 
 type InternalHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 type InternalHttpClientOptions = {
@@ -95,4 +82,4 @@ declare function newUidV4(): string;
 /** Validación para inputs que vengan de DB/requests durante migración. */
 declare function isUid(value: string): boolean;
 
-export { AuthMiddlewareOptions, type InternalHttpClientOptions, InternalHttpError, type InternalHttpMethod, type InternalRequestOptions, RequestContext, authCustomerAllowFirebase, authCustomerRequired, authEmployeeAllowFirebase, authEmployeeRequired, buildInternalHeaders, createAuthMiddleware$1 as createAuthMiddleware, createAuthMiddleware as createAuthMiddlewareLegacySimple, createInternalHttpClient, isUid, newUid, newUidV4, readRs256PublicKey, verifyBackendJwtRS256 };
+export { AuthMiddlewareOptions, type InternalHttpClientOptions, InternalHttpError, type InternalHttpMethod, type InternalRequestOptions, RequestContext, buildInternalHeaders, createAuthMiddleware, createInternalHttpClient, extractCustomerUid, extractEmployeeUid, getBearerToken, isUid, newUid, newUidV4, normalizeUid, readRs256PublicKey, verifyBackendJwtRS256 };

package/dist/index.d.ts

@@ -4,40 +4,27 @@ export { HEADER_AUTHORIZATION, HEADER_BRANCH_UID, HEADER_COMPANY_UID, HEADER_EMP
 import { R as RequestContext } from './parse-C4vk-fmH.js';
 export { g as getRequestContextFromHeaders } from './parse-C4vk-fmH.js';
 export { allowAuthAdminOrPerm, allowSysAdminOrAnyPermission, allowSysAdminOrPermissionsAll, allowSysAdminOrRoles, allowSysAdminOrRolesOrAnyPermission, internalAuth, parseHeaders, requestId, requireAnyPermission, requireAuthContext, requirePermissions, requireRoles, requireRolesOrAnyPermission, sendError, sendOk } from './middlewares/index.js';
-import { a as AuthMiddlewareOptions } from './types-CRECQuHp.js';
-export { A as AuthContext, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType } from './types-CRECQuHp.js';
-import { Response, NextFunction } from 'express';
+import { a as AuthMiddlewareOptions } from './types-Cc_McZgD.js';
+export { A as AuthContext, b as AuthSession, c as AuthSubject, H as HydrateInput, d as HydrateResult, e as Hydrator, T as TokenType } from './types-Cc_McZgD.js';
 import { JwtPayload } from 'jsonwebtoken';
+import { RequestHandler } from 'express';
 export { InternalBulkRefsOptions, ServiceClientEnv, createBulkRefsClient, createFisClient, createMdClient, createMediaClient, createMkpClient, createPayClient, createPlatformClient, createResClient, readServiceEnv } from './clients/index.js';
 export { BulkRefsResponse, BulkUidsRequest } from '@innvoid/getmarket-contracts';
 import 'axios';
 
+declare function getBearerToken(req: any): string | null;
+declare function normalizeUid(v: any): string | null;
 /**
- * ✅ Middleware estándar:
- * - Solo Authorization: Bearer
- * - Solo RS256
- * - Cero legacy
- * - Hidrata vía hook (OBLIGATORIO)
- */
-declare function createAuthMiddleware$1(opts: AuthMiddlewareOptions): (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-
-/**
- * ✅ Keys viven en getmarket-stack:
- * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub (recomendado)
+ * Keys centralizadas:
+ * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub
  * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY
  */
 declare function readRs256PublicKey(): string;
 declare function verifyBackendJwtRS256(raw: string): JwtPayload;
+declare function extractEmployeeUid(decoded: any): string | null;
+declare function extractCustomerUid(decoded: any): string | null;
 
-type Subject = "employee" | "customer";
-declare function createAuthMiddleware(opts: {
-    subject: Subject;
-    allowFirebaseIdToken?: boolean;
-}): (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authEmployeeRequired: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authCustomerRequired: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authEmployeeAllowFirebase: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-declare const authCustomerAllowFirebase: (req: any, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
+declare function createAuthMiddleware(opts: AuthMiddlewareOptions): RequestHandler;
 
 type InternalHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
 type InternalHttpClientOptions = {
@@ -95,4 +82,4 @@ declare function newUidV4(): string;
 /** Validación para inputs que vengan de DB/requests durante migración. */
 declare function isUid(value: string): boolean;
 
-export { AuthMiddlewareOptions, type InternalHttpClientOptions, InternalHttpError, type InternalHttpMethod, type InternalRequestOptions, RequestContext, authCustomerAllowFirebase, authCustomerRequired, authEmployeeAllowFirebase, authEmployeeRequired, buildInternalHeaders, createAuthMiddleware$1 as createAuthMiddleware, createAuthMiddleware as createAuthMiddlewareLegacySimple, createInternalHttpClient, isUid, newUid, newUidV4, readRs256PublicKey, verifyBackendJwtRS256 };
+export { AuthMiddlewareOptions, type InternalHttpClientOptions, InternalHttpError, type InternalHttpMethod, type InternalRequestOptions, RequestContext, buildInternalHeaders, createAuthMiddleware, createInternalHttpClient, extractCustomerUid, extractEmployeeUid, getBearerToken, isUid, newUid, newUidV4, normalizeUid, readRs256PublicKey, verifyBackendJwtRS256 };

package/dist/index.js

@@ -4,15 +4,8 @@ import {
   allowSysAdminOrPermissionsAll,
   allowSysAdminOrRoles,
   allowSysAdminOrRolesOrAnyPermission,
-  authCustomerAllowFirebase,
-  authCustomerRequired,
-  authEmployeeAllowFirebase,
-  authEmployeeRequired,
-  createAuthMiddleware,
-  createAuthMiddleware2,
   internalAuth,
   parseHeaders,
-  readRs256PublicKey,
   requestId,
   requireAnyPermission,
   requireAuthContext,
@@ -20,9 +13,8 @@ import {
   requireRoles,
   requireRolesOrAnyPermission,
   sendError,
-  sendOk,
-  verifyBackendJwtRS256
-} from "./chunk-WM2QICZQ.js";
+  sendOk
+} from "./chunk-HNOUEVHW.js";
 import {
   InternalHttpError,
   buildInternalHeaders,
@@ -60,6 +52,196 @@ import {
   getRequestContextFromHeaders
 } from "./chunk-KXXIMSON.js";
 
+// src/auth/jwt.ts
+import fs from "fs";
+import jwt from "jsonwebtoken";
+function readFileIfExists(path) {
+  if (!path) return null;
+  try {
+    const v = fs.readFileSync(path, "utf8").trim();
+    return v.length ? v : null;
+  } catch {
+    return null;
+  }
+}
+function getBearerToken(req) {
+  const auth = String(req?.headers?.authorization || "");
+  if (!auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  return token.length ? token : null;
+}
+function normalizeUid(v) {
+  const s = String(v ?? "").trim();
+  return s.length ? s : null;
+}
+function readRs256PublicKey() {
+  const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);
+  if (fromFile) return fromFile;
+  const fromEnv = String(
+    process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || ""
+  ).replace(/\\n/g, "\n").trim();
+  if (fromEnv) return fromEnv;
+  throw new Error(
+    "Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)"
+  );
+}
+function verifyBackendJwtRS256(raw) {
+  const publicKey = readRs256PublicKey();
+  const audience = process.env.JWT_AUDIENCE || process.env.AUTH_JWT_AUDIENCE || "getmarket.api";
+  const issuer = process.env.JWT_ISSUER || process.env.AUTH_JWT_ISSUER || "getmarket-auth";
+  return jwt.verify(raw, publicKey, {
+    algorithms: ["RS256"],
+    audience,
+    issuer
+  });
+}
+function extractEmployeeUid(decoded) {
+  const direct = normalizeUid(decoded?.employee_uid) ?? normalizeUid(decoded?.employee?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^emp:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
+}
+function extractCustomerUid(decoded) {
+  const direct = normalizeUid(decoded?.customer_uid) ?? normalizeUid(decoded?.customer?.uid);
+  if (direct) return direct;
+  const sub = normalizeUid(decoded?.sub);
+  if (!sub) return null;
+  const match = /^cus:(.+)$/i.exec(sub);
+  return match?.[1] ? normalizeUid(match[1]) : null;
+}
+
+// src/auth/middleware.ts
+function sendAuthError(res, code, message, status = 401) {
+  return res.status(status).json({
+    ok: false,
+    code,
+    message
+  });
+}
+function createAuthMiddleware(opts) {
+  const {
+    subject,
+    allowFirebaseIdToken = false,
+    requireSubject = true,
+    hydrate
+  } = opts;
+  return async (req, res, next) => {
+    const token = getBearerToken(req);
+    if (!token) {
+      return sendAuthError(
+        res,
+        "AUTH_MISSING_TOKEN",
+        "Missing Authorization Bearer token"
+      );
+    }
+    const headerCtx = req.context || {};
+    const company_uid = normalizeUid(headerCtx.company_uid);
+    const branch_uid = normalizeUid(headerCtx.branch_uid);
+    try {
+      const decoded = verifyBackendJwtRS256(token);
+      const baseCtx = {
+        tokenType: "backend",
+        subject,
+        company_uid: company_uid ?? void 0,
+        branch_uid: branch_uid ?? void 0,
+        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],
+        permissions: Array.isArray(decoded?.permissions) ? decoded.permissions : [],
+        denied_permissions: Array.isArray(decoded?.denied_permissions) ? decoded.denied_permissions : [],
+        session: {
+          jti: decoded?.jti,
+          device_id: decoded?.device_id,
+          expires_at: decoded?.exp
+        }
+      };
+      if (subject === "employee") {
+        baseCtx.employee_uid = extractEmployeeUid(decoded) ?? void 0;
+      } else {
+        baseCtx.customer_uid = extractCustomerUid(decoded) ?? void 0;
+      }
+      const hydrated = await hydrate({
+        decoded,
+        req,
+        subject,
+        company_uid,
+        branch_uid
+      });
+      Object.assign(baseCtx, hydrated);
+      if (subject === "employee" && !baseCtx.employee_uid) {
+        return sendAuthError(
+          res,
+          "AUTH_EMPLOYEE_UID_MISSING",
+          "employee_uid missing in token/context (expected employee_uid or sub=emp:<uid>)"
+        );
+      }
+      if (subject === "customer" && !baseCtx.customer_uid) {
+        return sendAuthError(
+          res,
+          "AUTH_CUSTOMER_UID_MISSING",
+          "customer_uid missing in token/context (expected customer_uid or sub=cus:<uid>)"
+        );
+      }
+      if (requireSubject) {
+        if (subject === "employee" && !baseCtx.employee) {
+          return sendAuthError(
+            res,
+            "AUTH_EMPLOYEE_NOT_FOUND",
+            "Employee not resolved by hydrator"
+          );
+        }
+        if (subject === "customer" && !baseCtx.customer) {
+          return sendAuthError(
+            res,
+            "AUTH_CUSTOMER_NOT_FOUND",
+            "Customer not resolved by hydrator"
+          );
+        }
+      }
+      req.auth = baseCtx;
+      return next();
+    } catch (backendErr) {
+      if (!allowFirebaseIdToken) {
+        return sendAuthError(
+          res,
+          "AUTH_INVALID_TOKEN",
+          "Invalid or expired token"
+        );
+      }
+      try {
+        const { default: admin } = await import("firebase-admin");
+        const firebaseDecoded = await admin.auth().verifyIdToken(token);
+        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {
+          return sendAuthError(
+            res,
+            "AUTH_EMAIL_NOT_VERIFIED",
+            "Email not verified"
+          );
+        }
+        const firebaseCtx = {
+          tokenType: "backend",
+          subject,
+          firebase: firebaseDecoded,
+          company_uid: company_uid ?? void 0,
+          branch_uid: branch_uid ?? void 0,
+          companies: [],
+          roles: [],
+          permissions: [],
+          denied_permissions: []
+        };
+        req.auth = firebaseCtx;
+        return next();
+      } catch {
+        return sendAuthError(
+          res,
+          "AUTH_INVALID_TOKEN",
+          "Invalid or expired token"
+        );
+      }
+    }
+  };
+}
+
 // src/common/ids.ts
 import { v7 as uuidv7, v4 as uuidv4, validate as uuidValidate, version as uuidVersion } from "uuid";
 function newUid() {
@@ -87,14 +269,9 @@ export {
   allowSysAdminOrPermissionsAll,
   allowSysAdminOrRoles,
   allowSysAdminOrRolesOrAnyPermission,
-  authCustomerAllowFirebase,
-  authCustomerRequired,
-  authEmployeeAllowFirebase,
-  authEmployeeRequired,
   buildInternalHeaders,
   closeCache,
   createAuthMiddleware,
-  createAuthMiddleware2 as createAuthMiddlewareLegacySimple,
   createBulkRefsClient,
   createFisClient,
   createHttpClient,
@@ -105,6 +282,9 @@ export {
   createPayClient,
   createPlatformClient,
   createResClient,
+  extractCustomerUid,
+  extractEmployeeUid,
+  getBearerToken,
   getOrSet,
   getRequestContextFromHeaders,
   getTwoLevelCache,
@@ -113,6 +293,7 @@ export {
   mapAxiosToUpstreamError,
   newUid,
   newUidV4,
+  normalizeUid,
   parseHeaders,
   readRs256PublicKey,
   readServiceEnv,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/common/ids.ts"],"sourcesContent":["// packages/sdk/src/common/ids.ts\nimport {v7 as uuidv7, v4 as uuidv4, validate as uuidValidate, version as uuidVersion} from \"uuid\";\n\n/**\n * UID canónico GetMarket.\n * - Por defecto genera UUIDv7 (time-ordered).\n * - Durante transición, aceptamos v4 y v7 como válidos.\n */\nexport function newUid(): string {\n  return uuidv7();\n}\n\n/** Útil si necesitas generar v4 puntualmente (idealmente no usarlo). */\nexport function newUidV4(): string {\n  return uuidv4();\n}\n\n/** Validación para inputs que vengan de DB/requests durante migración. */\nexport function isUid(value: string): boolean {\n  return uuidValidate(value) && (uuidVersion(value) === 7 || uuidVersion(value) === 4);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAAQ,MAAM,QAAQ,MAAM,QAAQ,YAAY,cAAc,WAAW,mBAAkB;AAOpF,SAAS,SAAiB;AAC/B,SAAO,OAAO;AAChB;AAGO,SAAS,WAAmB;AACjC,SAAO,OAAO;AAChB;AAGO,SAAS,MAAM,OAAwB;AAC5C,SAAO,aAAa,KAAK,MAAM,YAAY,KAAK,MAAM,KAAK,YAAY,KAAK,MAAM;AACpF;","names":[]}
+{"version":3,"sources":["../src/auth/jwt.ts","../src/auth/middleware.ts","../src/common/ids.ts"],"sourcesContent":["import fs from \"fs\";\nimport jwt, {JwtPayload} from \"jsonwebtoken\";\n\nfunction readFileIfExists(path?: string): string | null {\n  if (!path) return null;\n  try {\n    const v = fs.readFileSync(path, \"utf8\").trim();\n    return v.length ? v : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function getBearerToken(req: any): string | null {\n  const auth = String(req?.headers?.authorization || \"\");\n  if (!auth.startsWith(\"Bearer \")) return null;\n\n  const token = auth.slice(7).trim();\n  return token.length ? token : null;\n}\n\nexport function normalizeUid(v: any): string | null {\n  const s = String(v ?? \"\").trim();\n  return s.length ? s : null;\n}\n\n/**\n * Keys centralizadas:\n * - JWT_PUBLIC_KEY_PATH=/run/secrets/jwtRS256.key.pub\n * - fallback env AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY\n */\nexport function readRs256PublicKey(): string {\n  const fromFile = readFileIfExists(process.env.JWT_PUBLIC_KEY_PATH);\n  if (fromFile) return fromFile;\n\n  const fromEnv = String(\n    process.env.AUTH_JWT_PUBLIC_KEY || process.env.AUTH_RSA_PUBLIC_KEY || \"\"\n  )\n    .replace(/\\\\n/g, \"\\n\")\n    .trim();\n\n  if (fromEnv) return fromEnv;\n\n  throw new Error(\n    \"Missing RS256 public key (JWT_PUBLIC_KEY_PATH / AUTH_JWT_PUBLIC_KEY / AUTH_RSA_PUBLIC_KEY)\"\n  );\n}\n\nexport function verifyBackendJwtRS256(raw: string): JwtPayload {\n  const publicKey = readRs256PublicKey();\n\n  const audience =\n    process.env.JWT_AUDIENCE ||\n    process.env.AUTH_JWT_AUDIENCE ||\n    \"getmarket.api\";\n\n  const issuer =\n    process.env.JWT_ISSUER ||\n    process.env.AUTH_JWT_ISSUER ||\n    \"getmarket-auth\";\n\n  return jwt.verify(raw, publicKey, {\n    algorithms: [\"RS256\"],\n    audience,\n    issuer,\n  }) as JwtPayload;\n}\n\nexport function extractEmployeeUid(decoded: any): string | null {\n  const direct =\n    normalizeUid(decoded?.employee_uid) ??\n    normalizeUid(decoded?.employee?.uid);\n\n  if (direct) return direct;\n\n  const sub = normalizeUid(decoded?.sub);\n  if (!sub) return null;\n\n  const match = /^emp:(.+)$/i.exec(sub);\n  return match?.[1] ? normalizeUid(match[1]) : null;\n}\n\nexport function extractCustomerUid(decoded: any): string | null {\n  const direct =\n    normalizeUid(decoded?.customer_uid) ??\n    normalizeUid(decoded?.customer?.uid);\n\n  if (direct) return direct;\n\n  const sub = normalizeUid(decoded?.sub);\n  if (!sub) return null;\n\n  const match = /^cus:(.+)$/i.exec(sub);\n  return match?.[1] ? normalizeUid(match[1]) : null;\n}\n","import type {NextFunction, RequestHandler, Response} from \"express\";\nimport type {AuthContext, AuthMiddlewareOptions} from \"./types\";\nimport {\n  extractCustomerUid,\n  extractEmployeeUid,\n  getBearerToken,\n  normalizeUid,\n  verifyBackendJwtRS256,\n} from \"./jwt\";\n\nfunction sendAuthError(\n  res: Response,\n  code: string,\n  message: string,\n  status = 401\n) {\n  return res.status(status).json({\n    ok: false,\n    code,\n    message,\n  });\n}\n\nexport function createAuthMiddleware(opts: AuthMiddlewareOptions): RequestHandler {\n  const {\n    subject,\n    allowFirebaseIdToken = false,\n    requireSubject = true,\n    hydrate,\n  } = opts;\n\n  return async (req: any, res: Response, next: NextFunction) => {\n    const token = getBearerToken(req);\n\n    if (!token) {\n      return sendAuthError(\n        res,\n        \"AUTH_MISSING_TOKEN\",\n        \"Missing Authorization Bearer token\"\n      );\n    }\n\n    const headerCtx = req.context || {};\n    const company_uid = normalizeUid(headerCtx.company_uid);\n    const branch_uid = normalizeUid(headerCtx.branch_uid);\n\n    try {\n      const decoded: any = verifyBackendJwtRS256(token);\n\n      const baseCtx: AuthContext = {\n        tokenType: \"backend\",\n        subject,\n        company_uid: company_uid ?? undefined,\n        branch_uid: branch_uid ?? undefined,\n        roles: Array.isArray(decoded?.roles) ? decoded.roles : [],\n        permissions: Array.isArray(decoded?.permissions)\n          ? decoded.permissions\n          : [],\n        denied_permissions: Array.isArray(decoded?.denied_permissions)\n          ? decoded.denied_permissions\n          : [],\n        session: {\n          jti: decoded?.jti,\n          device_id: decoded?.device_id,\n          expires_at: decoded?.exp,\n        },\n      };\n\n      if (subject === \"employee\") {\n        baseCtx.employee_uid = extractEmployeeUid(decoded) ?? undefined;\n      } else {\n        baseCtx.customer_uid = extractCustomerUid(decoded) ?? undefined;\n      }\n\n      const hydrated = await hydrate({\n        decoded,\n        req,\n        subject,\n        company_uid,\n        branch_uid,\n      });\n\n      Object.assign(baseCtx, hydrated);\n\n      if (subject === \"employee\" && !baseCtx.employee_uid) {\n        return sendAuthError(\n          res,\n          \"AUTH_EMPLOYEE_UID_MISSING\",\n          \"employee_uid missing in token/context (expected employee_uid or sub=emp:<uid>)\"\n        );\n      }\n\n      if (subject === \"customer\" && !baseCtx.customer_uid) {\n        return sendAuthError(\n          res,\n          \"AUTH_CUSTOMER_UID_MISSING\",\n          \"customer_uid missing in token/context (expected customer_uid or sub=cus:<uid>)\"\n        );\n      }\n\n      if (requireSubject) {\n        if (subject === \"employee\" && !baseCtx.employee) {\n          return sendAuthError(\n            res,\n            \"AUTH_EMPLOYEE_NOT_FOUND\",\n            \"Employee not resolved by hydrator\"\n          );\n        }\n\n        if (subject === \"customer\" && !baseCtx.customer) {\n          return sendAuthError(\n            res,\n            \"AUTH_CUSTOMER_NOT_FOUND\",\n            \"Customer not resolved by hydrator\"\n          );\n        }\n      }\n\n      req.auth = baseCtx;\n      return next();\n    } catch (backendErr) {\n      if (!allowFirebaseIdToken) {\n        return sendAuthError(\n          res,\n          \"AUTH_INVALID_TOKEN\",\n          \"Invalid or expired token\"\n        );\n      }\n\n      try {\n        const {default: admin} = await import(\"firebase-admin\");\n        const firebaseDecoded = await admin.auth().verifyIdToken(token);\n\n        if (firebaseDecoded.email && firebaseDecoded.email_verified === false) {\n          return sendAuthError(\n            res,\n            \"AUTH_EMAIL_NOT_VERIFIED\",\n            \"Email not verified\"\n          );\n        }\n\n        const firebaseCtx: AuthContext = {\n          tokenType: \"backend\",\n          subject,\n          firebase: firebaseDecoded,\n          company_uid: company_uid ?? undefined,\n          branch_uid: branch_uid ?? undefined,\n          companies: [],\n          roles: [],\n          permissions: [],\n          denied_permissions: [],\n        };\n\n        req.auth = firebaseCtx;\n        return next();\n      } catch {\n        return sendAuthError(\n          res,\n          \"AUTH_INVALID_TOKEN\",\n          \"Invalid or expired token\"\n        );\n      }\n    }\n  };\n}\n","// packages/sdk/src/common/ids.ts\nimport {v7 as uuidv7, v4 as uuidv4, validate as uuidValidate, version as uuidVersion} from \"uuid\";\n\n/**\n * UID canónico GetMarket.\n * - Por defecto genera UUIDv7 (time-ordered).\n * - Durante transición, aceptamos v4 y v7 como válidos.\n */\nexport function newUid(): string {\n  return uuidv7();\n}\n\n/** Útil si necesitas generar v4 puntualmente (idealmente no usarlo). */\nexport function newUidV4(): string {\n  return uuidv4();\n}\n\n/** Validación para inputs que vengan de DB/requests durante migración. */\nexport function isUid(value: string): boolean {\n  return uuidValidate(value) && (uuidVersion(value) === 7 || uuidVersion(value) === 4);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,SAAuB;AAE9B,SAAS,iBAAiB,MAA8B;AACtD,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,IAAI,GAAG,aAAa,MAAM,MAAM,EAAE,KAAK;AAC7C,WAAO,EAAE,SAAS,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,KAAyB;AACtD,QAAM,OAAO,OAAO,KAAK,SAAS,iBAAiB,EAAE;AACrD,MAAI,CAAC,KAAK,WAAW,SAAS,EAAG,QAAO;AAExC,QAAM,QAAQ,KAAK,MAAM,CAAC,EAAE,KAAK;AACjC,SAAO,MAAM,SAAS,QAAQ;AAChC;AAEO,SAAS,aAAa,GAAuB;AAClD,QAAM,IAAI,OAAO,KAAK,EAAE,EAAE,KAAK;AAC/B,SAAO,EAAE,SAAS,IAAI;AACxB;AAOO,SAAS,qBAA6B;AAC3C,QAAM,WAAW,iBAAiB,QAAQ,IAAI,mBAAmB;AACjE,MAAI,SAAU,QAAO;AAErB,QAAM,UAAU;AAAA,IACd,QAAQ,IAAI,uBAAuB,QAAQ,IAAI,uBAAuB;AAAA,EACxE,EACG,QAAQ,QAAQ,IAAI,EACpB,KAAK;AAER,MAAI,QAAS,QAAO;AAEpB,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,sBAAsB,KAAyB;AAC7D,QAAM,YAAY,mBAAmB;AAErC,QAAM,WACJ,QAAQ,IAAI,gBACZ,QAAQ,IAAI,qBACZ;AAEF,QAAM,SACJ,QAAQ,IAAI,cACZ,QAAQ,IAAI,mBACZ;AAEF,SAAO,IAAI,OAAO,KAAK,WAAW;AAAA,IAChC,YAAY,CAAC,OAAO;AAAA,IACpB;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,mBAAmB,SAA6B;AAC9D,QAAM,SACJ,aAAa,SAAS,YAAY,KAClC,aAAa,SAAS,UAAU,GAAG;AAErC,MAAI,OAAQ,QAAO;AAEnB,QAAM,MAAM,aAAa,SAAS,GAAG;AACrC,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,QAAQ,cAAc,KAAK,GAAG;AACpC,SAAO,QAAQ,CAAC,IAAI,aAAa,MAAM,CAAC,CAAC,IAAI;AAC/C;AAEO,SAAS,mBAAmB,SAA6B;AAC9D,QAAM,SACJ,aAAa,SAAS,YAAY,KAClC,aAAa,SAAS,UAAU,GAAG;AAErC,MAAI,OAAQ,QAAO;AAEnB,QAAM,MAAM,aAAa,SAAS,GAAG;AACrC,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,QAAQ,cAAc,KAAK,GAAG;AACpC,SAAO,QAAQ,CAAC,IAAI,aAAa,MAAM,CAAC,CAAC,IAAI;AAC/C;;;ACpFA,SAAS,cACP,KACA,MACA,SACA,SAAS,KACT;AACA,SAAO,IAAI,OAAO,MAAM,EAAE,KAAK;AAAA,IAC7B,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEO,SAAS,qBAAqB,MAA6C;AAChF,QAAM;AAAA,IACJ;AAAA,IACA,uBAAuB;AAAA,IACvB,iBAAiB;AAAA,IACjB;AAAA,EACF,IAAI;AAEJ,SAAO,OAAO,KAAU,KAAe,SAAuB;AAC5D,UAAM,QAAQ,eAAe,GAAG;AAEhC,QAAI,CAAC,OAAO;AACV,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,YAAY,IAAI,WAAW,CAAC;AAClC,UAAM,cAAc,aAAa,UAAU,WAAW;AACtD,UAAM,aAAa,aAAa,UAAU,UAAU;AAEpD,QAAI;AACF,YAAM,UAAe,sBAAsB,KAAK;AAEhD,YAAM,UAAuB;AAAA,QAC3B,WAAW;AAAA,QACX;AAAA,QACA,aAAa,eAAe;AAAA,QAC5B,YAAY,cAAc;AAAA,QAC1B,OAAO,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAAA,QACxD,aAAa,MAAM,QAAQ,SAAS,WAAW,IAC3C,QAAQ,cACR,CAAC;AAAA,QACL,oBAAoB,MAAM,QAAQ,SAAS,kBAAkB,IACzD,QAAQ,qBACR,CAAC;AAAA,QACL,SAAS;AAAA,UACP,KAAK,SAAS;AAAA,UACd,WAAW,SAAS;AAAA,UACpB,YAAY,SAAS;AAAA,QACvB;AAAA,MACF;AAEA,UAAI,YAAY,YAAY;AAC1B,gBAAQ,eAAe,mBAAmB,OAAO,KAAK;AAAA,MACxD,OAAO;AACL,gBAAQ,eAAe,mBAAmB,OAAO,KAAK;AAAA,MACxD;AAEA,YAAM,WAAW,MAAM,QAAQ;AAAA,QAC7B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,aAAO,OAAO,SAAS,QAAQ;AAE/B,UAAI,YAAY,cAAc,CAAC,QAAQ,cAAc;AACnD,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,YAAY,cAAc,CAAC,QAAQ,cAAc;AACnD,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI,gBAAgB;AAClB,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC/C,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,YAAI,YAAY,cAAc,CAAC,QAAQ,UAAU;AAC/C,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,UAAI,OAAO;AACX,aAAO,KAAK;AAAA,IACd,SAAS,YAAY;AACnB,UAAI,CAAC,sBAAsB;AACzB,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,UAAI;AACF,cAAM,EAAC,SAAS,MAAK,IAAI,MAAM,OAAO,gBAAgB;AACtD,cAAM,kBAAkB,MAAM,MAAM,KAAK,EAAE,cAAc,KAAK;AAE9D,YAAI,gBAAgB,SAAS,gBAAgB,mBAAmB,OAAO;AACrE,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAA2B;AAAA,UAC/B,WAAW;AAAA,UACX;AAAA,UACA,UAAU;AAAA,UACV,aAAa,eAAe;AAAA,UAC5B,YAAY,cAAc;AAAA,UAC1B,WAAW,CAAC;AAAA,UACZ,OAAO,CAAC;AAAA,UACR,aAAa,CAAC;AAAA,UACd,oBAAoB,CAAC;AAAA,QACvB;AAEA,YAAI,OAAO;AACX,eAAO,KAAK;AAAA,MACd,QAAQ;AACN,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ACnKA,SAAQ,MAAM,QAAQ,MAAM,QAAQ,YAAY,cAAc,WAAW,mBAAkB;AAOpF,SAAS,SAAiB;AAC/B,SAAO,OAAO;AAChB;AAGO,SAAS,WAAmB;AACjC,SAAO,OAAO;AAChB;AAGO,SAAS,MAAM,OAAwB;AAC5C,SAAO,aAAa,KAAK,MAAM,YAAY,KAAK,MAAM,KAAK,YAAY,KAAK,MAAM;AACpF;","names":[]}