@justair/justair-library 6.8.0 → 6.9.0-alpha.d61eca7

package/dist/models/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/models/admin.js"],"names":[],"mappings":"AAEA,8BAgBG;AAUH,wBAAmD"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/models/admin.js"],"names":[],"mappings":"AAEA,8BAsBG;AAcH,wBAAmD"}

package/dist/models/measurements.d.ts

@@ -6,10 +6,10 @@ export const annotationSchema: mongoose.Schema<any, mongoose.Model<any, any, any
     _id: true;
     timestamps: false;
 }, {
-    source: "admin" | "processing_engine";
-    timestamp: Date;
     comment: string;
     measurementIdentifier: string;
+    source: "admin" | "processing_engine";
+    timestamp: Date;
     adminId?: {
         prototype?: mongoose.Types.ObjectId;
         cacheHexString?: unknown;
@@ -20,10 +20,10 @@ export const annotationSchema: mongoose.Schema<any, mongoose.Model<any, any, any
         isValid?: {};
     };
 }, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
-    source: "admin" | "processing_engine";
-    timestamp: Date;
     comment: string;
     measurementIdentifier: string;
+    source: "admin" | "processing_engine";
+    timestamp: Date;
     adminId?: {
         prototype?: mongoose.Types.ObjectId;
         cacheHexString?: unknown;
@@ -34,10 +34,10 @@ export const annotationSchema: mongoose.Schema<any, mongoose.Model<any, any, any
         isValid?: {};
     };
 }>> & mongoose.FlatRecord<{
-    source: "admin" | "processing_engine";
-    timestamp: Date;
     comment: string;
     measurementIdentifier: string;
+    source: "admin" | "processing_engine";
+    timestamp: Date;
     adminId?: {
         prototype?: mongoose.Types.ObjectId;
         cacheHexString?: unknown;

package/dist/modules/audit/actions.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Auth/compliance audit action enum (auth-contracts #4 — EXACT strings, frozen).
+ * Distinct domain from the measurement-lineage `Audit` model in
+ * models/measurements.js: this tracks WHO did WHAT to admin/auth state, for the
+ * government-compliance audit trail.
+ *
+ * Emit sites (in the services): login (success/failure), logout, forgot-password
+ * (requested/completed), silent refresh, and the admin mutation sites
+ * (create/update/delete, role.change when permissionName changes,
+ * deactivate/reactivate when isActive toggles).
+ */
+export const AUDIT_ACTIONS: Readonly<{
+    LOGIN_SUCCESS: "auth.login.success";
+    LOGIN_FAILURE: "auth.login.failure";
+    LOGOUT: "auth.logout";
+    PASSWORD_RESET_REQUESTED: "auth.password.reset.requested";
+    PASSWORD_RESET_COMPLETED: "auth.password.reset.completed";
+    TOKEN_REFRESH: "auth.token.refresh";
+    ADMIN_CREATE: "admin.create";
+    ADMIN_UPDATE: "admin.update";
+    ADMIN_DELETE: "admin.delete";
+    ADMIN_ROLE_CHANGE: "admin.role.change";
+    ADMIN_DEACTIVATE: "admin.deactivate";
+    ADMIN_REACTIVATE: "admin.reactivate";
+}>;
+/** Frozen list of all valid action strings — used as the AuditLog schema enum. */
+export const AUDIT_ACTION_VALUES: readonly ("auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate")[];
+//# sourceMappingURL=actions.d.ts.map

package/dist/modules/audit/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/actions.js"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;GAaG;AAEH,kFAAkF;AAClF,yTAA+E"}

package/dist/modules/audit/auditLog.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Single canonical audit write path (auth-contracts #4).
+ *
+ *   writeAudit(entry) ──► AuditLog.create
+ *                           │ ok            │ throws (db down, validation)
+ *                           ▼               ▼
+ *                        return true   logger.error + return false  (NEVER throws)
+ *
+ * An audit hiccup must not fail the request it is recording (e.g. a login). The
+ * caller gets a boolean and decides; the failure is logged at error for compliance
+ * follow-up. Inject the consuming service's logger via deps.logger (DI); it falls
+ * back to a no-op rather than raw console so it honors the "no console" rule.
+ *
+ * @param {{action:string, actor?:object, resource?:object, outcome:string,
+ *          reason?:string, metadata?:object, requestId?:string}} entry
+ * @param {{ logger?: { error: Function } }} [deps]
+ * @returns {Promise<boolean>} true if persisted, false if the write failed
+ */
+export function writeAudit({ action, actor, resource, outcome, reason, metadata, requestId }?: {
+    action: string;
+    actor?: object;
+    resource?: object;
+    outcome: string;
+    reason?: string;
+    metadata?: object;
+    requestId?: string;
+}, { logger }?: {
+    logger?: {
+        error: Function;
+    };
+}): Promise<boolean>;
+//# sourceMappingURL=auditLog.d.ts.map

package/dist/modules/audit/auditLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/auditLog.js"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,+FALW;IAAC,MAAM,EAAC,MAAM,CAAC;IAAC,KAAK,CAAC,EAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAC,MAAM,CAAC;IAAC,OAAO,EAAC,MAAM,CAAC;IAC/D,MAAM,CAAC,EAAC,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAC,MAAM,CAAA;CAAC,eACrD;IAAE,MAAM,CAAC,EAAE;QAAE,KAAK,WAAU;KAAE,CAAA;CAAE,GAC9B,OAAO,CAAC,OAAO,CAAC,CAiB5B"}

package/dist/modules/audit/index.d.ts

@@ -0,0 +1,4 @@
+export { writeAudit } from "./auditLog.js";
+export { AUDIT_ACTIONS, AUDIT_ACTION_VALUES } from "./actions.js";
+export { AuditLog, auditLogSchema } from "./schema.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/index.js"],"names":[],"mappings":""}

package/dist/modules/audit/schema.d.ts

@@ -0,0 +1,321 @@
+/**
+ * AuditLog — auth/compliance audit trail (JA-2814, auth-contracts #4).
+ * One model definition; both services import it, neither redefines it. This is NOT
+ * the measurement-lineage `Audit` model (models/measurements.js) — different domain,
+ * different collection.
+ *
+ *   actor (who)   ─┐
+ *   action (what)  ├─► AuditLog doc ──► compliance queries (by actor / action / target)
+ *   resource (tgt) ┘
+ */
+export const auditLogSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any, any, any>, {}, {}, {}, {}, {
+    timestamps: true;
+}, {
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}>> & mongoose.FlatRecord<{
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}> & {
+    _id: mongoose.Types.ObjectId;
+}>;
+export const AuditLog: mongoose.Model<{
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}, {}, {}, {}, mongoose.Document<unknown, {}, {
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}> & {
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+} & {
+    _id: mongoose.Types.ObjectId;
+}, mongoose.Schema<any, mongoose.Model<any, any, any, any, any, any>, {}, {}, {}, {}, {
+    timestamps: true;
+}, {
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}>> & mongoose.FlatRecord<{
+    createdAt: NativeDate;
+    updatedAt: NativeDate;
+} & {
+    action: "auth.login.success" | "auth.login.failure" | "auth.logout" | "auth.password.reset.requested" | "auth.password.reset.completed" | "auth.token.refresh" | "admin.create" | "admin.update" | "admin.delete" | "admin.role.change" | "admin.deactivate" | "admin.reactivate";
+    outcome: "success" | "failure";
+    metadata?: any;
+    actor?: {
+        adminId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+        email?: string;
+        orgId?: {
+            prototype?: mongoose.Types.ObjectId;
+            cacheHexString?: unknown;
+            generate?: {};
+            createFromTime?: {};
+            createFromHexString?: {};
+            createFromBase64?: {};
+            isValid?: {};
+        };
+    };
+    resource?: {
+        type?: string;
+    };
+    reason?: string;
+    requestId?: string;
+}> & {
+    _id: mongoose.Types.ObjectId;
+}>>;
+import mongoose from 'mongoose';
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/audit/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/audit/schema.js"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqBE;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA4D;qBAzCvC,UAAU"}

package/dist/modules/audit/tests/actions.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=actions.test.d.ts.map

package/dist/modules/audit/tests/actions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.test.d.ts","sourceRoot":"","sources":["../../../../src/modules/audit/tests/actions.test.js"],"names":[],"mappings":""}

package/dist/modules/audit/tests/auditLog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auditLog.test.d.ts.map

package/dist/modules/audit/tests/auditLog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditLog.test.d.ts","sourceRoot":"","sources":["../../../../src/modules/audit/tests/auditLog.test.js"],"names":[],"mappings":""}

package/dist/modules/audit/tests/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/modules/audit/tests/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/modules/audit/tests/schema.test.js"],"names":[],"mappings":""}

package/dist/modules/auth/cookieConfig.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Canonical httpOnly cookie options for Keycloak tokens (auth-contracts #3).
+ * Lifted from JustAirService/util/cookieConfig.js and extended to the two-TTL model:
+ * a short-lived access cookie + a long-lived refresh cookie. Both services import
+ * THIS — do not hand-roll cookie options per controller.
+ *
+ * Exposed as functions (not constants) so NODE_ENV is read at call time, not at
+ * import time — a service that configures env after importing still gets the right
+ * secure/SameSite flags.
+ */
+/**
+ * Shared flags. SameSite=Lax: every JustAir admin frontend lives under
+ * `*.justair.app`, so frontend → API requests are same-site (same registrable
+ * domain) and Lax sends the cookie cross-subdomain while still blocking cross-site
+ * POST/fetch (tighter CSRF posture than None). Secure only in prod — dev is
+ * http://localhost, and Lax (unlike None) does not require Secure.
+ */
+export function baseCookieOptions(): {
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: string;
+    path: string;
+};
+/** Options for the short-lived access_token cookie. */
+export function accessTokenCookieOptions(): {
+    maxAge: number;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: string;
+    path: string;
+};
+/** Options for the long-lived refresh_token cookie. */
+export function refreshTokenCookieOptions(): {
+    maxAge: number;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: string;
+    path: string;
+};
+export const ACCESS_TOKEN_MAX_AGE_MS: number;
+export const REFRESH_TOKEN_MAX_AGE_MS: number;
+//# sourceMappingURL=cookieConfig.d.ts.map

package/dist/modules/auth/cookieConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieConfig.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/cookieConfig.js"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;GAMG;AACH;;;;;EAQC;AAKD,uDAAuD;AACvD;;;;;;EAEC;AAED,uDAAuD;AACvD;;;;;;EAEC;AAXD,6CAAqD;AACrD,8CAAgE"}

package/dist/modules/auth/extractClaims.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Normalize a verified Keycloak token payload into the canonical AuthContext
+ * (auth-contracts #1 — FROZEN shape; consumers read these exact keys, never raw
+ * Keycloak claim paths).
+ *
+ *   verified payload ──► { sub, email, roles, orgId }
+ *
+ * Pure function of the token. Request context (ip/userAgent/source) and persisted
+ * Admin state (ssoProvider) are deliberately NOT here — see ./requestContext.js
+ * and the Admin model. `roles` is realm roles only; `orgId` is undefined when the
+ * user has no org attribute.
+ *
+ * @param {import('jose').JWTPayload} payload - output of verifyToken()
+ * @returns {{ sub: string|undefined, email: string|undefined, roles: string[], orgId: string|undefined }}
+ */
+export function extractClaims(payload: import("jose").JWTPayload): {
+    sub: string | undefined;
+    email: string | undefined;
+    roles: string[];
+    orgId: string | undefined;
+};
+//# sourceMappingURL=extractClaims.d.ts.map

package/dist/modules/auth/extractClaims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractClaims.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/extractClaims.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,uCAHW,OAAO,MAAM,EAAE,UAAU,GACvB;IAAE,GAAG,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAC,SAAS,CAAA;CAAE,CAYxG"}

package/dist/modules/auth/index.d.ts

@@ -0,0 +1,6 @@
+export { extractClaims } from "./extractClaims.js";
+export { requestContext } from "./requestContext.js";
+export { verifyToken, isExpiredError } from "./oidcVerifier.js";
+export { silentRefresh, RefreshError } from "./silentRefresh.js";
+export { baseCookieOptions, accessTokenCookieOptions, refreshTokenCookieOptions, ACCESS_TOKEN_MAX_AGE_MS, REFRESH_TOKEN_MAX_AGE_MS } from "./cookieConfig.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/index.js"],"names":[],"mappings":""}

package/dist/modules/auth/oidcVerifier.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @param {string} token - raw access-token JWT (from cookie or Authorization header)
+ * @param {{ issuer: string, audience: string, jwksUri: string }} config
+ * @returns {Promise<import('jose').JWTPayload>} the verified token payload
+ * @throws jose errors (carry `.code`); use isExpiredError() to branch on expiry
+ */
+export function verifyToken(token: string, { issuer, audience, jwksUri }?: {
+    issuer: string;
+    audience: string;
+    jwksUri: string;
+}): Promise<import("jose").JWTPayload>;
+/**
+ * True when verification failed solely because the token is expired — the one
+ * failure consumers recover from via silent refresh. All other failures → 401.
+ *
+ * @param {unknown} err
+ * @returns {boolean}
+ */
+export function isExpiredError(err: unknown): boolean;
+/** Test-only: clear the module-level JWKS cache between cases. */
+export function _resetJwksCache(): void;
+//# sourceMappingURL=oidcVerifier.d.ts.map

package/dist/modules/auth/oidcVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcVerifier.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/oidcVerifier.js"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,mCALW,MAAM,kCACN;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,MAAM,EAAE,UAAU,CAAC,CAa9C;AAED;;;;;;GAMG;AACH,oCAHW,OAAO,GACL,OAAO,CAInB;AAED,kEAAkE;AAClE,wCAEC"}

package/dist/modules/auth/requestContext.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Audit request-context extractor (auth-contracts #1/#4 seam).
+ *
+ * AuthContext (extractClaims) is token-only by design. The request-scoped fields an
+ * audit row needs — ip, userAgent, source — live on the Express request, not the
+ * token. Both JustAirService and JustAirUserService call this and feed the result
+ * into writeAudit({ metadata }) so audit rows carry consistent request context
+ * without each service re-deriving the same three lines.
+ *
+ * @param {{ ip?: string, headers?: Object, socket?: { remoteAddress?: string } }} req - Express request
+ * @param {string} source - logical channel, e.g. 'web' | 'light-system'
+ * @returns {{ ip: string|undefined, userAgent: string|undefined, source: string }}
+ */
+export function requestContext(req: {
+    ip?: string;
+    headers?: any;
+    socket?: {
+        remoteAddress?: string;
+    };
+}, source: string): {
+    ip: string | undefined;
+    userAgent: string | undefined;
+    source: string;
+};
+//# sourceMappingURL=requestContext.d.ts.map

package/dist/modules/auth/requestContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/requestContext.js"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,oCAJW;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,MAAS;IAAC,MAAM,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,UACtE,MAAM,GACJ;IAAE,EAAE,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,GAAC,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAQjF"}

package/dist/modules/auth/silentRefresh.d.ts

@@ -0,0 +1,33 @@
+/**
+ * @param {string} refreshToken
+ * @param {{ tokenUrl: string, clientId: string, clientSecret: string }} config
+ * @returns {Promise<{accessToken:string, refreshToken:string, expiresIn:number, refreshExpiresIn:number}>}
+ * @throws {RefreshError}
+ */
+export function silentRefresh(refreshToken: string, { tokenUrl, clientId, clientSecret }?: {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+}): Promise<{
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    refreshExpiresIn: number;
+}>;
+/**
+ * Silent refresh against Keycloak's token endpoint (auth-contracts #3).
+ *
+ *   refreshToken ──► POST {tokenUrl}  grant_type=refresh_token
+ *                      │ 200                         │ non-200 / network / bad-json
+ *                      ▼                             ▼
+ *        { accessToken, refreshToken, ... }        throw RefreshError (caller → 401)
+ *
+ * Uses Node's global fetch (Node 18+). Every failure throws RefreshError so the
+ * middleware maps any refresh miss to a single 401.
+ */
+export class RefreshError extends Error {
+    constructor(message: any, { status, cause }?: {});
+    status: any;
+    cause: any;
+}
+//# sourceMappingURL=silentRefresh.d.ts.map

package/dist/modules/auth/silentRefresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"silentRefresh.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/silentRefresh.js"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,4CALW,MAAM,yCACN;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1D,OAAO,CAAC;IAAC,WAAW,EAAC,MAAM,CAAC;IAAC,YAAY,EAAC,MAAM,CAAC;IAAC,SAAS,EAAC,MAAM,CAAC;IAAC,gBAAgB,EAAC,MAAM,CAAA;CAAC,CAAC,CAoDzG;AA5ED;;;;;;;;;;GAUG;AAEH;IACE,kDAKC;IAFC,YAAoB;IACT,WAAkB;CAEhC"}

package/dist/modules/auth/tests/cookieConfig.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cookieConfig.test.d.ts.map

package/dist/modules/auth/tests/cookieConfig.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookieConfig.test.d.ts","sourceRoot":"","sources":["../../../../src/modules/auth/tests/cookieConfig.test.js"],"names":[],"mappings":""}

package/dist/modules/auth/tests/extractClaims.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=extractClaims.test.d.ts.map