@jazzmind/busibox-app 3.0.18

package/dist/lib/media/url-normalization.d.ts

@@ -0,0 +1,29 @@
+/**
+ * URL Normalization Utilities
+ *
+ * Normalizes video and poster URLs to use relative paths.
+ * This ensures URLs work regardless of the host (localhost, container IP, or domain).
+ */
+/**
+ * Normalize a URL to a relative path if it's a localhost or container IP URL
+ *
+ * Converts:
+ * - http://localhost:3000/api/videos/files/... → /api/videos/files/...
+ * - http://10.96.200.201:3000/api/videos/files/... → /api/videos/files/...
+ * - /api/videos/files/... → /api/videos/files/... (unchanged)
+ *
+ * @param url - The URL to normalize
+ * @returns Normalized relative path
+ */
+export declare function normalizeVideoUrl(url: string | null | undefined): string | null;
+/**
+ * Normalize video object URLs
+ *
+ * @param video - Video object with downloadUrl and posterUrl
+ * @returns Video object with normalized URLs
+ */
+export declare function normalizeVideoUrls<T extends {
+    downloadUrl?: string | null;
+    posterUrl?: string | null;
+}>(video: T): T;
+//# sourceMappingURL=url-normalization.d.ts.map

package/dist/lib/media/url-normalization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-normalization.d.ts","sourceRoot":"","sources":["../../../src/lib/media/url-normalization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAiC/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACrG,KAAK,EAAE,CAAC,GACP,CAAC,CAMH"}

package/dist/lib/media/url-normalization.js

@@ -0,0 +1,61 @@
+/**
+ * URL Normalization Utilities
+ *
+ * Normalizes video and poster URLs to use relative paths.
+ * This ensures URLs work regardless of the host (localhost, container IP, or domain).
+ */
+/**
+ * Normalize a URL to a relative path if it's a localhost or container IP URL
+ *
+ * Converts:
+ * - http://localhost:3000/api/videos/files/... → /api/videos/files/...
+ * - http://10.96.200.201:3000/api/videos/files/... → /api/videos/files/...
+ * - /api/videos/files/... → /api/videos/files/... (unchanged)
+ *
+ * @param url - The URL to normalize
+ * @returns Normalized relative path
+ */
+export function normalizeVideoUrl(url) {
+    if (!url) {
+        return null;
+    }
+    // If it's already a relative path, return as-is
+    if (url.startsWith('/')) {
+        return url;
+    }
+    // Extract the path from absolute URLs
+    try {
+        const urlObj = new URL(url);
+        // Check if it's a localhost or internal IP URL
+        const hostname = urlObj.hostname;
+        if (hostname === 'localhost' ||
+            hostname === '127.0.0.1' ||
+            hostname.startsWith('10.96.') ||
+            hostname.startsWith('192.168.') ||
+            hostname.startsWith('172.')) {
+            // Return just the pathname
+            return urlObj.pathname;
+        }
+        // For external URLs, return as-is (shouldn't happen for our videos, but just in case)
+        return url;
+    }
+    catch {
+        // If URL parsing fails, assume it's already a relative path or invalid
+        // If it starts with /, return as-is, otherwise return null
+        return url.startsWith('/') ? url : null;
+    }
+}
+/**
+ * Normalize video object URLs
+ *
+ * @param video - Video object with downloadUrl and posterUrl
+ * @returns Video object with normalized URLs
+ */
+export function normalizeVideoUrls(video) {
+    return {
+        ...video,
+        downloadUrl: normalizeVideoUrl(video.downloadUrl),
+        posterUrl: normalizeVideoUrl(video.posterUrl),
+    };
+}
+//# sourceMappingURL=url-normalization.js.map

package/dist/lib/media/url-normalization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-normalization.js","sourceRoot":"","sources":["../../../src/lib/media/url-normalization.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA8B;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gDAAgD;IAChD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,IACE,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC7B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAC/B,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAC3B,CAAC;YACD,2BAA2B;YAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAED,sFAAsF;QACtF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,2DAA2D;QAC3D,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAQ;IAER,OAAO;QACL,GAAG,KAAK;QACR,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC;QACjD,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;KAC9C,CAAC;AACJ,CAAC"}

package/dist/lib/next/api-url.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Fetch wrapper that automatically prepends basePath to API routes
+ * Always install - wraps Next.js's fetch wrapper
+ */
+/**
+ * Helper to build an API URL manually (for cases where you need the URL but not fetching)
+ */
+export declare function apiUrl(path: string): string;
+/**
+ * Build a full absolute URL for server-side API calls
+ */
+export declare function absoluteApiUrl(path: string, baseUrl?: string): string;
+/**
+ * Get the data-api URL for server-side calls.
+ * Uses DATA_API_URL, or falls back to DATA_API_HOST/DATA_API_PORT.
+ */
+export declare function getDataApiUrl(): string;
+/**
+ * Get the search-api URL for server-side calls.
+ * Uses SEARCH_API_URL, or falls back to SEARCH_API_HOST/SEARCH_API_PORT.
+ */
+export declare function getSearchApiUrl(): string;
+/**
+ * Get the deploy-api base URL for server-side calls.
+ * Uses DEPLOY_API_URL, or falls back to DEPLOY_API_HOST/DEPLOY_API_PORT.
+ *
+ * NOTE: Do NOT use DEPLOYMENT_SERVICE_URL here — that includes a path suffix
+ * (/api/v1/deployment) which causes double-pathing when the client appends
+ * its own route paths like /api/v1/config.
+ */
+export declare function getDeployApiUrl(): string;
+/**
+ * Get the config-api URL for server-side calls.
+ * Uses CONFIG_API_URL, or falls back to CONFIG_API_HOST/CONFIG_API_PORT.
+ */
+export declare function getConfigApiUrl(): string;
+/**
+ * Get the bridge-api URL for server-side calls.
+ * Uses BRIDGE_API_URL or BRIDGE_API_HOST/BRIDGE_API_PORT environment variables.
+ */
+export declare function getBridgeApiUrl(): string;
+//# sourceMappingURL=api-url.d.ts.map

package/dist/lib/next/api-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-url.d.ts","sourceRoot":"","sources":["../../../src/lib/next/api-url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAkDH;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK3C;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAOtC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAOxC;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAOxC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAOxC;AAED;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAOxC"}

package/dist/lib/next/api-url.js

@@ -0,0 +1,128 @@
+/**
+ * Fetch wrapper that automatically prepends basePath to API routes
+ * Always install - wraps Next.js's fetch wrapper
+ */
+const BASE_PATH = process.env.NEXT_PUBLIC_BASE_PATH || '';
+console.log('[api-url] Installing fetch wrapper, basePath:', BASE_PATH || '(none)');
+const originalFetch = globalThis.fetch;
+globalThis.fetch = function (input, init) {
+    // Handle different input types
+    let url;
+    if (typeof input === 'string') {
+        url = input;
+    }
+    else if (input instanceof URL) {
+        url = input.href;
+    }
+    else if (input instanceof Request) {
+        url = input.url;
+    }
+    else {
+        url = String(input);
+    }
+    // Debug logging for API calls
+    // if (url.includes('/api/')) {
+    //   console.log('[fetch wrapper]', { original: url, basePath: BASE_PATH || '(none)' });
+    // }
+    // Only modify URLs that:
+    // 1. Have a basePath configured
+    // 2. Start with /api (relative API routes)
+    // 3. Don't already include the base path
+    if (BASE_PATH && url.startsWith('/api') && !url.startsWith(BASE_PATH)) {
+        url = `${BASE_PATH}${url}`;
+        // console.log('[fetch wrapper] rewritten to:', url);
+        // Create new Request object or URL string with modified path
+        if (input instanceof Request) {
+            input = new Request(url, input);
+        }
+        else if (input instanceof URL) {
+            input = new URL(url, input);
+        }
+        else {
+            input = url;
+        }
+    }
+    return originalFetch.call(this, input, init);
+};
+// console.log('[api-url] Fetch wrapper installed');
+/**
+ * Helper to build an API URL manually (for cases where you need the URL but not fetching)
+ */
+export function apiUrl(path) {
+    if (BASE_PATH && path.startsWith('/api')) {
+        return `${BASE_PATH}${path}`;
+    }
+    return path;
+}
+/**
+ * Build a full absolute URL for server-side API calls
+ */
+export function absoluteApiUrl(path, baseUrl) {
+    const base = baseUrl || (typeof window !== 'undefined' ? window.location.origin : '');
+    return `${base}${apiUrl(path)}`;
+}
+/**
+ * Get the data-api URL for server-side calls.
+ * Uses DATA_API_URL, or falls back to DATA_API_HOST/DATA_API_PORT.
+ */
+export function getDataApiUrl() {
+    if (process.env.DATA_API_URL) {
+        return process.env.DATA_API_URL;
+    }
+    const host = process.env.DATA_API_HOST || 'localhost';
+    const port = process.env.DATA_API_PORT || '8002';
+    return `http://${host}:${port}`;
+}
+/**
+ * Get the search-api URL for server-side calls.
+ * Uses SEARCH_API_URL, or falls back to SEARCH_API_HOST/SEARCH_API_PORT.
+ */
+export function getSearchApiUrl() {
+    if (process.env.SEARCH_API_URL) {
+        return process.env.SEARCH_API_URL;
+    }
+    const host = process.env.SEARCH_API_HOST || 'localhost';
+    const port = process.env.SEARCH_API_PORT || '8003';
+    return `http://${host}:${port}`;
+}
+/**
+ * Get the deploy-api base URL for server-side calls.
+ * Uses DEPLOY_API_URL, or falls back to DEPLOY_API_HOST/DEPLOY_API_PORT.
+ *
+ * NOTE: Do NOT use DEPLOYMENT_SERVICE_URL here — that includes a path suffix
+ * (/api/v1/deployment) which causes double-pathing when the client appends
+ * its own route paths like /api/v1/config.
+ */
+export function getDeployApiUrl() {
+    if (process.env.DEPLOY_API_URL) {
+        return process.env.DEPLOY_API_URL;
+    }
+    const host = process.env.DEPLOY_API_HOST || 'localhost';
+    const port = process.env.DEPLOY_API_PORT || '8011';
+    return `http://${host}:${port}`;
+}
+/**
+ * Get the config-api URL for server-side calls.
+ * Uses CONFIG_API_URL, or falls back to CONFIG_API_HOST/CONFIG_API_PORT.
+ */
+export function getConfigApiUrl() {
+    if (process.env.CONFIG_API_URL) {
+        return process.env.CONFIG_API_URL;
+    }
+    const host = process.env.CONFIG_API_HOST || 'localhost';
+    const port = process.env.CONFIG_API_PORT || '8012';
+    return `http://${host}:${port}`;
+}
+/**
+ * Get the bridge-api URL for server-side calls.
+ * Uses BRIDGE_API_URL or BRIDGE_API_HOST/BRIDGE_API_PORT environment variables.
+ */
+export function getBridgeApiUrl() {
+    if (process.env.BRIDGE_API_URL) {
+        return process.env.BRIDGE_API_URL;
+    }
+    const host = process.env.BRIDGE_API_HOST || 'localhost';
+    const port = process.env.BRIDGE_API_PORT || '8081';
+    return `http://${host}:${port}`;
+}
+//# sourceMappingURL=api-url.js.map

package/dist/lib/next/api-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-url.js","sourceRoot":"","sources":["../../../src/lib/next/api-url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;AAE1D,OAAO,CAAC,GAAG,CAAC,+CAA+C,EAAE,SAAS,IAAI,QAAQ,CAAC,CAAC;AAEpF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,UAAU,CAAC,KAAK,GAAG,UAAS,KAAwB,EAAE,IAAkB;IACtE,+BAA+B;IAC/B,IAAI,GAAW,CAAC;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QAChC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;QACpC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,8BAA8B;IAC9B,+BAA+B;IAC/B,wFAAwF;IACxF,IAAI;IAEJ,yBAAyB;IACzB,gCAAgC;IAChC,2CAA2C;IAC3C,yCAAyC;IACzC,IAAI,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC;QAC3B,qDAAqD;QAErD,6DAA6D;QAC7D,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC7B,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;YAChC,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,GAAG,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC,CAAC;AAEF,oDAAoD;AAEpD;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,GAAG,SAAS,GAAG,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAgB;IAC3D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,WAAW,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC;IACjD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;IACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;IACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;IACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC;IACnD,OAAO,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/next/authz-client.d.ts

@@ -0,0 +1,120 @@
+/**
+ * AuthZ client (server-side only)
+ *
+ * Zero Trust Authentication Architecture:
+ * - AuthZ issues RS256-signed session JWTs
+ * - busibox-portal exchanges session JWTs for downstream access tokens
+ * - NO client credentials required for user operations
+ *
+ * This module uses the shared Zero Trust functions from busibox-app.
+ */
+import { clearZeroTrustTokenCache, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, type AuthzAudience as SharedAuthzAudience } from '@jazzmind/busibox-app';
+export { InvalidSessionError, isInvalidSessionError };
+export type AuthzAudience = SharedAuthzAudience;
+/**
+ * Get the authz service base URL.
+ * Uses AUTHZ_BASE_URL env var or defaults to Docker service name.
+ */
+export declare function getAuthzBaseUrl(): string;
+/**
+ * Get standard RBAC client options for authz service calls.
+ * Zero Trust: Only authzUrl is needed - no admin tokens or client credentials.
+ *
+ * Import this instead of duplicating getAuthzOptions() in every route file.
+ */
+export declare function getAuthzOptions(): {
+    authzUrl: string;
+};
+/**
+ * Get RBAC client options with an exchanged access token for admin operations.
+ *
+ * Use this for admin routes that need to access user management or RBAC APIs.
+ * Exchanges the session JWT for an authz-api access token.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * this request. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - The admin user's session JWT from requireAdminAuth()
+ * @returns Options object with authzUrl and accessToken for busibox-app RBAC functions
+ */
+export declare function getAuthzOptionsWithToken(sessionJwt: string): Promise<{
+    authzUrl: string;
+    accessToken: string;
+}>;
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ * The session JWT cryptographically proves user identity.
+ */
+export declare function exchangeWithSubjectToken(args: {
+    sessionJwt: string;
+    userId: string;
+    audience: AuthzAudience;
+    scopes?: string[];
+    purpose?: string;
+}): Promise<{
+    accessToken: string;
+    tokenType: 'bearer';
+    expiresIn: number;
+    scope: string;
+}>;
+/**
+ * Get authorization header using session JWT (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ */
+export declare function getAuthorizationHeaderWithSession(args: {
+    sessionJwt: string;
+    userId: string;
+    audience: AuthzAudience;
+    scopes?: string[];
+    purpose?: string;
+}): Promise<string>;
+/**
+ * Invalidate a cached downstream token.
+ */
+export declare function invalidateDownstreamToken(userId: string, audience: AuthzAudience, scopes?: string[]): void;
+/**
+ * Clear all cached tokens.
+ */
+export { clearZeroTrustTokenCache };
+/**
+ * Create a delegation token for background tasks.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @param name - Human-readable name for the delegation
+ * @param scopes - Scopes to delegate (optional, defaults to all user's scopes)
+ * @param expiresInSeconds - TTL in seconds (default: 7 days)
+ */
+export declare function createDelegationToken(args: {
+    sessionJwt: string;
+    name: string;
+    scopes?: string[];
+    expiresInSeconds?: number;
+}): Promise<{
+    delegationToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    expiresAt: string;
+    jti: string;
+    name: string;
+    scopes: string[];
+}>;
+/**
+ * List active delegation tokens for the authenticated user.
+ */
+export declare function listDelegationTokens(sessionJwt: string): Promise<Array<{
+    jti: string;
+    name: string;
+    scopes: string[];
+    expiresAt: string;
+    createdAt: string;
+    revoked: boolean;
+}>>;
+/**
+ * Revoke a delegation token.
+ */
+export declare function revokeDelegationToken(sessionJwt: string, jti: string): Promise<void>;
+export { getUserIdFromSessionJwt };
+//# sourceMappingURL=authz-client.d.ts.map

package/dist/lib/next/authz-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-client.d.ts","sourceRoot":"","sources":["../../../src/lib/next/authz-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,aAAa,IAAI,mBAAmB,EAE1C,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AAGtD,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAWhD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAItD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrH;AAMD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B1F;AAED;;;;GAIG;AACH,wBAAsB,iCAAiC,CAAC,IAAI,EAAE;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,IAAI,CAGN;AAED;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAMpC;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC;IACV,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC,CA2BD;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CACR,KAAK,CAAC;IACJ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC,CACH,CAsBA;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAY1F;AAMD,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/lib/next/authz-client.js

@@ -0,0 +1,203 @@
+/**
+ * AuthZ client (server-side only)
+ *
+ * Zero Trust Authentication Architecture:
+ * - AuthZ issues RS256-signed session JWTs
+ * - busibox-portal exchanges session JWTs for downstream access tokens
+ * - NO client credentials required for user operations
+ *
+ * This module uses the shared Zero Trust functions from busibox-app.
+ */
+import { exchangeTokenZeroTrust, getAuthHeaderZeroTrust, invalidateZeroTrustToken, clearZeroTrustTokenCache, getUserIdFromSessionJwt, InvalidSessionError, isInvalidSessionError, } from '@jazzmind/busibox-app';
+// Re-export error utilities for use in middleware/routes
+export { InvalidSessionError, isInvalidSessionError };
+// Verbose logging toggle
+const VERBOSE_AUTHZ_LOGGING = process.env.VERBOSE_AUTHZ_LOGGING === 'true';
+function authzLog(...args) {
+    if (VERBOSE_AUTHZ_LOGGING) {
+        console.log(...args);
+    }
+}
+/**
+ * Get the authz service base URL.
+ * Uses AUTHZ_BASE_URL env var or defaults to Docker service name.
+ */
+export function getAuthzBaseUrl() {
+    return process.env.AUTHZ_BASE_URL || 'http://authz-api:8010';
+}
+/**
+ * Get standard RBAC client options for authz service calls.
+ * Zero Trust: Only authzUrl is needed - no admin tokens or client credentials.
+ *
+ * Import this instead of duplicating getAuthzOptions() in every route file.
+ */
+export function getAuthzOptions() {
+    return {
+        authzUrl: getAuthzBaseUrl(),
+    };
+}
+/**
+ * Get RBAC client options with an exchanged access token for admin operations.
+ *
+ * Use this for admin routes that need to access user management or RBAC APIs.
+ * Exchanges the session JWT for an authz-api access token.
+ *
+ * Note: The scopes in the access token come from the user's roles, not from
+ * this request. The Admin role must have authz.* scopes configured.
+ *
+ * @param sessionJwt - The admin user's session JWT from requireAdminAuth()
+ * @returns Options object with authzUrl and accessToken for busibox-app RBAC functions
+ */
+export async function getAuthzOptionsWithToken(sessionJwt) {
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt,
+        audience: 'authz-api',
+        purpose: 'admin-operations',
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: process.env.VERBOSE_AUTHZ_LOGGING === 'true',
+    });
+    return {
+        authzUrl: getAuthzBaseUrl(),
+        accessToken: result.accessToken,
+    };
+}
+// =============================================================================
+// Zero Trust Token Exchange (Preferred Method)
+// =============================================================================
+/**
+ * Exchange a session JWT for a downstream access token (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ * The session JWT cryptographically proves user identity.
+ */
+export async function exchangeWithSubjectToken(args) {
+    authzLog('[AUTHZ] Zero Trust token exchange:', {
+        userId: args.userId,
+        audience: args.audience,
+        scopes: args.scopes,
+    });
+    const result = await exchangeTokenZeroTrust({
+        sessionJwt: args.sessionJwt,
+        audience: args.audience,
+        scopes: args.scopes,
+        purpose: args.purpose,
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: VERBOSE_AUTHZ_LOGGING,
+    });
+    return {
+        accessToken: result.accessToken,
+        tokenType: result.tokenType,
+        expiresIn: result.expiresIn,
+        scope: result.scope,
+    };
+}
+/**
+ * Get authorization header using session JWT (Zero Trust mode).
+ *
+ * This is the preferred method - no client credentials required.
+ */
+export async function getAuthorizationHeaderWithSession(args) {
+    return getAuthHeaderZeroTrust({
+        sessionJwt: args.sessionJwt,
+        audience: args.audience,
+        scopes: args.scopes,
+        purpose: args.purpose,
+    }, {
+        authzBaseUrl: getAuthzBaseUrl(),
+        verbose: VERBOSE_AUTHZ_LOGGING,
+    });
+}
+/**
+ * Invalidate a cached downstream token.
+ */
+export function invalidateDownstreamToken(userId, audience, scopes) {
+    invalidateZeroTrustToken(userId, audience, scopes || []);
+    authzLog('[AUTHZ] Token cache invalidated for:', { userId, audience });
+}
+/**
+ * Clear all cached tokens.
+ */
+export { clearZeroTrustTokenCache };
+// =============================================================================
+// Delegation Tokens (for background/scheduled tasks)
+// =============================================================================
+/**
+ * Create a delegation token for background tasks.
+ *
+ * @param sessionJwt - The user's session JWT
+ * @param name - Human-readable name for the delegation
+ * @param scopes - Scopes to delegate (optional, defaults to all user's scopes)
+ * @param expiresInSeconds - TTL in seconds (default: 7 days)
+ */
+export async function createDelegationToken(args) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegation`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            subject_token: args.sessionJwt,
+            name: args.name,
+            scopes: args.scopes || [],
+            expires_in_seconds: args.expiresInSeconds || 604800, // 7 days default
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to create delegation token (${res.status}): ${text}`);
+    }
+    const data = await res.json();
+    return {
+        delegationToken: data.delegation_token,
+        tokenType: data.token_type,
+        expiresIn: data.expires_in,
+        expiresAt: data.expires_at,
+        jti: data.jti,
+        name: data.name,
+        scopes: data.scopes,
+    };
+}
+/**
+ * List active delegation tokens for the authenticated user.
+ */
+export async function listDelegationTokens(sessionJwt) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegations`, {
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${sessionJwt}`,
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to list delegation tokens (${res.status}): ${text}`);
+    }
+    const data = await res.json();
+    return data.delegations.map((d) => ({
+        jti: d.jti,
+        name: d.name,
+        scopes: d.scopes,
+        expiresAt: d.expires_at,
+        createdAt: d.created_at,
+        revoked: d.revoked,
+    }));
+}
+/**
+ * Revoke a delegation token.
+ */
+export async function revokeDelegationToken(sessionJwt, jti) {
+    const res = await fetch(`${getAuthzBaseUrl()}/oauth/delegations/${jti}`, {
+        method: 'DELETE',
+        headers: {
+            Authorization: `Bearer ${sessionJwt}`,
+        },
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Failed to revoke delegation token (${res.status}): ${text}`);
+    }
+}
+// =============================================================================
+// Utility Re-exports
+// =============================================================================
+export { getUserIdFromSessionJwt };
+//# sourceMappingURL=authz-client.js.map

package/dist/lib/next/authz-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-client.js","sourceRoot":"","sources":["../../../src/lib/next/authz-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,uBAAuB,CAAC;AAE/B,yDAAyD;AACzD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC;AAKtD,yBAAyB;AACzB,MAAM,qBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,CAAC;AAE3E,SAAS,QAAQ,CAAC,GAAG,IAAe;IAClC,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,UAAkB;IAC/D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,UAAU;QACV,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,kBAAkB;KAC5B,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;KACtD,CACF,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,eAAe,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,+CAA+C;AAC/C,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAM9C;IACC,QAAQ,CAAC,oCAAoC,EAAE;QAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,qBAAqB;KAC/B,CACF,CAAC;IAEF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,IAMvD;IACC,OAAO,sBAAsB,CAC3B;QACE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,EACD;QACE,YAAY,EAAE,eAAe,EAAE;QAC/B,OAAO,EAAE,qBAAqB;KAC/B,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAc,EACd,QAAuB,EACvB,MAAiB;IAEjB,wBAAwB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,CAAC;AAEpC,gFAAgF;AAChF,qDAAqD;AACrD,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAK3C;IASC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,mBAAmB,EAAE;QAC/D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,IAAI,CAAC,UAAU;YAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,IAAI,MAAM,EAAE,iBAAiB;SACvE,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,gBAAgB;QACtC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB;IAWlB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,oBAAoB,EAAE;QAChE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,UAAU,EAAE;SACtC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;QACvC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,OAAO,EAAE,CAAC,CAAC,OAAO;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAkB,EAAE,GAAW;IACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,eAAe,EAAE,sBAAsB,GAAG,EAAE,EAAE;QACvE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,UAAU,EAAE;SACtC;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}