@marxbiotech/signet-integration 0.1.1 → 0.2.0

package/README.md

@@ -10,6 +10,12 @@ stored, is yours.
 
 ## Wiring
 
+Two ways in. Both verify the same way, classify the resolver's outcome the same
+way (401 / 403 / 503 / 500) and write the same decision log line; pick by where
+you want the principal to land.
+
+### A. Your own Passport strategy (`request.user` is your principal)
+
 ```ts
 // your-signet.options.ts -- your values, one object
 export const MY_OPTIONS = {
@@ -21,26 +27,25 @@ export const MY_OPTIONS = {
   },
   developmentProfile: { canonicalResource: 'http://localhost/api/mcp', host: 'localhost', namespace: 'development' },
   env: {
-    deploymentNamespace: 'MY_DEPLOYMENT_NAMESPACE',
-    jwtAudience: 'MY_JWT_AUDIENCE',
-    jwtIssuer: 'MY_JWT_ISSUER',
-    jwtJwksUri: 'MY_JWT_JWKS_URI',
-    jwtClockToleranceS: 'MY_JWT_CLOCK_TOLERANCE_S',
+    deploymentNamespace: 'SIGNET_DEPLOYMENT_NAMESPACE',
+    jwtAudience: 'SIGNET_JWT_AUDIENCE',
+    jwtIssuer: 'SIGNET_JWT_ISSUER',
+    jwtJwksUri: 'SIGNET_JWT_JWKS_URI',
+    jwtClockToleranceS: 'SIGNET_JWT_CLOCK_TOLERANCE_S',
     signetEnabled: 'SIGNET_AUTH_ENABLED',       // omit = the Bearer channel is always on
     legacyApiKeyEnabled: 'LEGACY_API_KEY_ENABLED', // omit = no legacy channel
   },
   realm: 'myservice',
-  requestPrincipalKey: 'user',            // where the guard attaches your principal
+  requestPrincipalKey: 'user',            // route B attaches here; route A leaves it to Passport
   scopesSupported: ['myservice:access'],  // RFC 9728 scopes_supported; must include the admission scope
 } as const satisfies SignetIntegrationOptions<'production' | 'staging'>;
 
-// your resolver -- Passport's verify callback, as a Nest provider.
-// Annotate the return type: a class method gets no contextual typing from
-// `implements`, so without it `ok: true` widens to `boolean` and fails to compile.
+// your strategy: Passport's verify callback, with the identity already proven.
+// The package's dependencies are property-injected; the constructor is yours.
 @Injectable()
-export class MyResolver implements SignetPrincipalResolver<MyPrincipal> {
-  constructor(private readonly users: UsersRepository) {}
-  async resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<MyPrincipal>> {
+export class MySignetStrategy extends SignetPrincipalStrategy<MyUser> {
+  constructor(private readonly users: UsersRepository) { super(); }
+  async resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<MyUser>> {
     const user = await this.users.findBySignetSubject(identity.subject); // or identity.claims.erp_user_id
     if (!user) return { ok: false, reason: 'unknown_subject' };          // → 403, reason only logged
     return { ok: true, principal: user, logFields: { userId: user.id } }; // logFields render on the decision line
@@ -48,7 +53,33 @@ export class MyResolver implements SignetPrincipalResolver<MyPrincipal> {
   }
 }
 
-// your auth module
+@Module({
+  imports: [UsersModule, SignetIntegrationModule.forPassport({ options: MY_OPTIONS })],
+  providers: [
+    MySignetStrategy,                                          // registers itself with Passport
+    { provide: APP_GUARD, useClass: SignetPassportGuard },     // AuthGuard('signet-jwt') that honours @Public()
+    { provide: APP_FILTER, useClass: BearerChallengeFilter },  // RFC 6750 challenges on 401/403
+  ],
+  controllers: [createProtectedResourceController(MY_OPTIONS), ...yourControllers],
+})
+export class ApiModule {}
+```
+
+`SignetPassportGuard` is `AuthGuard('signet-jwt')` plus `@Public()` and a
+uniform 401; any `AuthGuard('signet-jwt')` of your own works too. Handlers read
+the principal from `request.user` as they always did.
+
+### B. Module-wired resolver (principal under `requestPrincipalKey`)
+
+The same options and the same `resolve`, as a provider the module binds:
+
+```ts
+@Injectable()
+export class MyResolver implements SignetPrincipalResolver<MyUser> {
+  constructor(private readonly users: UsersRepository) {}
+  async resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<MyUser>> { /* as above */ }
+}
+
 @Module({
   imports: [
     UsersModule,
@@ -58,7 +89,7 @@ export class MyResolver implements SignetPrincipalResolver<MyPrincipal> {
       imports: [UsersModule],        // whatever the resolver's constructor needs
     }),
   ],
-  exports: [SignetIntegrationModule], // so the process module below can inject the package's providers
+  exports: [SignetIntegrationModule],
 })
 export class AuthModule {}
 
@@ -74,6 +105,19 @@ export class AuthModule {}
 export class ApiModule {}
 ```
 
+Here Passport's `request.user` stays the verified identity and the principal
+goes under `options.requestPrincipalKey` (`principal`, say), which is what a
+consumer with several credential channels and its own dispatcher wants.
+
+### Entry points
+
+- `@marxbiotech/signet-integration` -- everything.
+- `@marxbiotech/signet-integration/passport` -- everything except
+  `createProtectedResourceController`, whose file needs `@nestjs/swagger` and
+  `@nestjs/throttler` (both optional peers). Import from here if you serve the
+  metadata document some other way.
+- `@marxbiotech/signet-integration/testing` -- see below.
+
 Requirements: `ConfigModule` must be global (the strategy, filter and profile
 service inject `ConfigService`); validate the env variables named in `options.env`
 in your own config validation (Joi or otherwise), the package only re-checks the
@@ -108,4 +152,22 @@ issues), `startJwksServer()`, `FIXTURE_OPTIONS` and `FIXTURE_DEVELOPMENT_PROFILE
 - Verifier failures (bad signature, wrong audience, unreachable JWKS) are one uniform 401; the reason is only logged.
 - `iat` is not required and no `maxTokenAge` is applied; `client_id` is required (RFC 9068 §2.2, Signet issues it always).
 - JWKS options are fixed: 3 s timeout, 30 s cooldown, 10 min cache.
-- The guard's decision log line is `metric reason <your logFields> clientId environment`; the fixed keys are reserved.
+- The decision log line is `metric reason <your logFields> clientId environment`, written under your strategy's or guard's class name; the fixed keys are reserved.
+
+## Development and release
+
+```sh
+pnpm install
+pnpm lint && pnpm typecheck && pnpm test && pnpm build
+```
+
+Releases are cut by tag. Write the `CHANGELOG.md` entry, bump `version` in
+`package.json` on `main`, then push the matching tag:
+
+```sh
+git tag v0.2.0 && git push origin v0.2.0
+```
+
+`.github/workflows/publish.yml` refuses a tag that does not equal
+`v<package.json version>`, runs lint, tests and build, and publishes with npm
+trusted publishing (OIDC). Nothing is published from a developer machine.

package/dist/decision.d.ts

@@ -0,0 +1,18 @@
+import { Logger } from '@nestjs/common';
+import { SignetDeploymentProfileService } from './deployment-profile';
+import { type VerifiedSignetIdentity } from './jwt-verifier';
+import { type SignetIntegrationOptions } from './options';
+import { type SignetPrincipalResolver } from './principal-resolver';
+export interface DecisionContext<P> {
+    readonly attach?: (principal: P) => void;
+    readonly logger?: Logger;
+    readonly source?: string;
+}
+export declare class SignetDecision {
+    private readonly options;
+    private readonly profiles;
+    private readonly logger;
+    constructor(options: SignetIntegrationOptions, profiles: SignetDeploymentProfileService);
+    decide<P>(identity: VerifiedSignetIdentity, resolver: SignetPrincipalResolver<P>, context?: DecisionContext<P>): Promise<P>;
+}
+export declare function logFailure(logger: Logger, message: string, metric: 'auth_store_error' | 'auth_store_unavailable' | 'resolver_contract_error' | 'signet_identity_missing', errorName: string, stack?: string): void;

package/dist/decision.js

@@ -0,0 +1,158 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var SignetDecision_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetDecision = void 0;
+exports.logFailure = logFailure;
+const common_1 = require("@nestjs/common");
+const bearer_challenge_1 = require("./bearer-challenge");
+const deployment_profile_1 = require("./deployment-profile");
+const log_sanitise_1 = require("./log-sanitise");
+const options_1 = require("./options");
+const principal_resolver_1 = require("./principal-resolver");
+// The decision line's own keys. A resolver's `logFields` may not reuse them:
+// a second `metric=` or `clientId=` on one line is whichever copy the log
+// parser keeps, and operators alert on these.
+const RESERVED_LOG_KEYS = new Set([
+    'metric',
+    'reason',
+    'clientId',
+    'environment',
+]);
+// The layer between a verified identity and a request that may proceed: the
+// admission scope, the consumer's resolver, and the one rendering of the
+// outcome as an HTTP status and a log line. Both the package's Bearer guard
+// and a consumer's own Passport strategy go through here, so the
+// classification cannot drift between them:
+//
+//   token lacks the admission scope         → 403 (service scope), with an
+//                                             insufficient_scope challenge
+//   resolver says { ok: false }             → 403, bare
+//   resolver throws PrincipalStoreUnavailableError → 503, fail closed
+//   resolver throws an HttpException        → its own status
+//   resolver throws anything else           → 500, the error under its own name
+//   resolver logFields reuses a fixed key   → 500, resolver_contract_error
+//
+// None of these are 401: the token was valid. The 403 messages distinguish
+// "get a token with the right scope" from "ask an administrator" without
+// naming what the caller does not hold. The 500 is deliberately NOT a 503:
+// a bug in the resolver must not send the operator to check the database.
+//
+// The resolver is a parameter, not something the caller runs first: a
+// consumer that wrapped its own call in try/catch could turn a store outage
+// into a 401, which is the silent failure this layer exists to prevent.
+let SignetDecision = SignetDecision_1 = class SignetDecision {
+    options;
+    profiles;
+    logger = new common_1.Logger(SignetDecision_1.name);
+    constructor(options, profiles) {
+        this.options = options;
+        this.profiles = profiles;
+    }
+    async decide(identity, resolver, context = {}) {
+        const logger = context.logger ?? this.logger;
+        const { admissionScope } = this.options;
+        if (!identity.scopes.includes(admissionScope)) {
+            logger.warn(`signet token lacks service scope: metric=signet_scope_missing source=${(0, log_sanitise_1.sanitiseLogToken)(context.source ?? 'none')}`);
+            // A 403 a client CAN fix by re-authorising (RFC 6750 §3.1); the
+            // resolver's refusals below stay bare, because a wider OAuth scope
+            // would not supply a missing local authorization.
+            throw new bearer_challenge_1.InsufficientScopeException(admissionScope);
+        }
+        const environment = this.profiles.profile.environment;
+        let resolution;
+        try {
+            resolution = await resolver.resolve(identity);
+        }
+        catch (error) {
+            // An HttpException is a decision already taken below us; it is neither
+            // the store nor a bug, and it must reach the caller with its own status.
+            if (error instanceof common_1.HttpException)
+                throw error;
+            if (error instanceof principal_resolver_1.PrincipalStoreUnavailableError) {
+                // The line names what actually failed (the cause's class), not the
+                // wrapper; the driver's message travels in the stack, never on the
+                // key=value line.
+                logFailure(logger, 'authorization store unavailable', 'auth_store_unavailable', error.causeName, error.causeStack);
+                throw new common_1.ServiceUnavailableException('authorization store unavailable');
+            }
+            const errorName = error instanceof Error && error.name ? error.name : typeof error;
+            const stack = error instanceof Error ? error.stack : undefined;
+            // A bug: rethrow unchanged so Nest answers 500 and the error keeps its
+            // own name in the exception filter.
+            logFailure(logger, 'authorization load failed', 'auth_store_error', errorName, stack);
+            throw error;
+        }
+        if (!resolution.ok) {
+            // The reason is logged for the operator and NOT returned.
+            logDecision(logger, 'refused', identity.clientId, environment, resolution);
+            throw new common_1.ForbiddenException(this.options.principalRefusalMessage ??
+                'this identity holds no authorization in this service');
+        }
+        context.attach?.(resolution.principal);
+        logDecision(logger, 'authorized', identity.clientId, environment, resolution);
+        return resolution.principal;
+    }
+};
+exports.SignetDecision = SignetDecision;
+exports.SignetDecision = SignetDecision = SignetDecision_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+    __metadata("design:paramtypes", [Object, deployment_profile_1.SignetDeploymentProfileService])
+], SignetDecision);
+// The one rendering of the authorization DECISION: the line that lets a
+// request through and the line that refuses one, so their field set and its
+// order cannot drift apart -- metric, reason, the resolver's logFields in the
+// order given, clientId, environment.
+//
+// What these lines disclose about the caller: the client id (software, not
+// a person; a registration identifier, not a credential) and whatever the
+// resolver chose to put in `logFields`. No `sub`, no issuer.
+//
+// Levels: a refusal is a `warn`, an authorization a `log` (info). One line
+// per authorized request is the price of having any record of which client
+// acted; it is paid deliberately, because the alternative is no record.
+function logDecision(logger, outcome, clientId, environment, resolution) {
+    const consumerFields = Object.entries(resolution.logFields ?? {});
+    for (const [key] of consumerFields) {
+        if (RESERVED_LOG_KEYS.has(key)) {
+            // A programming error in the resolver, not a decision: one alertable
+            // line, then a 500 under its own name rather than a forged log line.
+            logFailure(logger, 'resolver logFields invalid', 'resolver_contract_error', 'Error');
+            throw new Error(`resolver logFields must not use the reserved key ${key}`);
+        }
+    }
+    const pairs = [
+        ['reason', resolution.ok ? 'none' : resolution.reason],
+        ...consumerFields,
+        ['clientId', clientId],
+        ['environment', environment],
+    ];
+    const rendered = pairs
+        .map(([key, value]) => `${(0, log_sanitise_1.sanitiseLogToken)(key)}=${(0, log_sanitise_1.sanitiseLogToken)(value)}`)
+        .join(' ');
+    if (outcome === 'refused') {
+        logger.warn(`signet principal refused: metric=signet_principal_refused ${rendered}`);
+        return;
+    }
+    logger.log(`signet principal authorized: metric=signet_principal_authorized ${rendered}`);
+}
+// The one rendering of the failure lines. Only the error's class name goes
+// into the key=value line: the driver's message can carry the DSN or the
+// SQL, so it travels in the stack as the SECOND argument, where a structured
+// logger renders it after the filterable fields.
+function logFailure(logger, message, metric, errorName, stack) {
+    logger.error(`${message}: metric=${metric} errorName=${(0, log_sanitise_1.sanitiseLogToken)(errorName)}`, stack);
+}
+//# sourceMappingURL=decision.js.map

package/dist/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../src/decision.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA2NA,gCAeC;AA1OD,2CAOwB;AAExB,yDAAgE;AAChE,6DAAsE;AAEtE,iDAAkD;AAClD,uCAGmB;AACnB,6DAI8B;AAE9B,6EAA6E;AAC7E,0EAA0E;AAC1E,8CAA8C;AAC9C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAeH,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,iEAAiE;AACjE,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wDAAwD;AACxD,sEAAsE;AACtE,6DAA6D;AAC7D,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,EAAE;AACF,sEAAsE;AACtE,4EAA4E;AAC5E,wEAAwE;AAEjE,IAAM,cAAc,sBAApB,MAAM,cAAc;IAKN;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAE1D,YAEmB,OAAiC,EACjC,QAAwC;QADxC,YAAO,GAAP,OAAO,CAA0B;QACjC,aAAQ,GAAR,QAAQ,CAAgC;IACxD,CAAC;IAEJ,KAAK,CAAC,MAAM,CACV,QAAgC,EAChC,QAAoC,EACpC,UAA8B,EAAE;QAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QAC7C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CACT,wEAAwE,IAAA,+BAAgB,EAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CACrH,CAAC;YACF,gEAAgE;YAChE,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,IAAI,6CAA0B,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACtD,IAAI,UAAkC,CAAC;QACvC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,KAAK,YAAY,sBAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,IAAI,KAAK,YAAY,mDAA8B,EAAE,CAAC;gBACpD,mEAAmE;gBACnE,mEAAmE;gBACnE,kBAAkB;gBAClB,UAAU,CACR,MAAM,EACN,iCAAiC,EACjC,wBAAwB,EACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;gBACF,MAAM,IAAI,oCAA2B,CACnC,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,uEAAuE;YACvE,oCAAoC;YACpC,UAAU,CACR,MAAM,EACN,2BAA2B,EAC3B,kBAAkB,EAClB,SAAS,EACT,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,0DAA0D;YAC1D,WAAW,CACT,MAAM,EACN,SAAS,EACT,QAAQ,CAAC,QAAQ,EACjB,WAAW,EACX,UAAU,CACX,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B,IAAI,CAAC,OAAO,CAAC,uBAAuB;gBAClC,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,WAAW,CACT,MAAM,EACN,YAAY,EACZ,QAAQ,CAAC,QAAQ,EACjB,WAAW,EACX,UAAU,CACX,CAAC;QACF,OAAO,UAAU,CAAC,SAAS,CAAC;IAC9B,CAAC;CACF,CAAA;AAvFY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;6CAER,mDAA8B;GANhD,cAAc,CAuF1B;AAED,wEAAwE;AACxE,4EAA4E;AAC5E,8EAA8E;AAC9E,sCAAsC;AACtC,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,SAAS,WAAW,CAClB,MAAc,EACd,OAAiC,EACjC,QAAgB,EAChB,WAAmB,EACnB,UAAwC;IAExC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,qEAAqE;YACrE,qEAAqE;YACrE,UAAU,CACR,MAAM,EACN,4BAA4B,EAC5B,yBAAyB,EACzB,OAAO,CACR,CAAC;YACF,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,EAAE,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAuB;QAChC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QACtD,GAAG,cAAc;QACjB,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,aAAa,EAAE,WAAW,CAAC;KAC7B,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK;SACnB,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,IAAI,IAAA,+BAAgB,EAAC,KAAK,CAAC,EAAE,CACxE;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,6DAA6D,QAAQ,EAAE,CACxE,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,CACR,mEAAmE,QAAQ,EAAE,CAC9E,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,iDAAiD;AACjD,SAAgB,UAAU,CACxB,MAAc,EACd,OAAe,EACf,MAI6B,EAC7B,SAAiB,EACjB,KAAc;IAEd,MAAM,CAAC,KAAK,CACV,GAAG,OAAO,YAAY,MAAM,cAAc,IAAA,+BAAgB,EAAC,SAAS,CAAC,EAAE,EACvE,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/guard.d.ts

@@ -1,18 +1,14 @@
 import { type ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
-import { SignetDeploymentProfileService } from './deployment-profile';
+import { SignetDecision } from './decision';
 import { type SignetIntegrationOptions } from './options';
+import { SignetPassportGuard } from './passport-guard';
 import { type SignetPrincipalResolver } from './principal-resolver';
-declare const SignetBearerGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
-export declare class SignetBearerGuard extends SignetBearerGuard_base {
+export declare class SignetBearerGuard extends SignetPassportGuard {
     private readonly resolver;
-    private readonly profiles;
+    private readonly decision;
     private readonly signetOptions;
-    private readonly reflector;
     private readonly logger;
-    constructor(resolver: SignetPrincipalResolver, profiles: SignetDeploymentProfileService, signetOptions: SignetIntegrationOptions, reflector: Reflector);
+    constructor(resolver: SignetPrincipalResolver, decision: SignetDecision, signetOptions: SignetIntegrationOptions, reflector: Reflector);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    private logDecision;
-    private logFailure;
 }
-export {};

package/dist/guard.js

@@ -15,200 +15,49 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignetBearerGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
-const passport_1 = require("@nestjs/passport");
-const bearer_challenge_1 = require("./bearer-challenge");
-const deployment_profile_1 = require("./deployment-profile");
-const log_sanitise_1 = require("./log-sanitise");
+const decision_1 = require("./decision");
 const options_1 = require("./options");
+const passport_guard_1 = require("./passport-guard");
 const principal_resolver_1 = require("./principal-resolver");
-const public_decorator_1 = require("./public.decorator");
-const strategy_1 = require("./strategy");
-// The decision line's own keys. A resolver's `logFields` may not reuse them:
-// a second `metric=` or `clientId=` on one line is whichever copy the log
-// parser keeps, and operators alert on these.
-const RESERVED_LOG_KEYS = new Set([
-    'metric',
-    'reason',
-    'clientId',
-    'environment',
-]);
-// Nest's OPTIONAL_DEPS_METADATA. `@nestjs/common` does not re-export it.
-const OPTIONAL_PARAMTYPES = 'optional:paramtypes';
-// AuthGuard's mixin marks its constructor parameter 0 `@Optional()`.
-// `Reflect.getMetadata` walks the constructor prototype chain, so a subclass
-// that never writes its own list treats ITS parameter 0 — the principal
-// resolver — as optional. `@Optional()` on a later parameter copies that
-// inherited list onto this constructor before appending its own index.
-// Parameter decorators run before this one, so the copy is already own
-// metadata by the time this drops index 0 (and writes a list when absent).
-function requirePrincipalResolver() {
-    return (target) => {
-        const own = Reflect.getOwnMetadata(OPTIONAL_PARAMTYPES, target);
-        const optionalIndexes = Array.isArray(own)
-            ? own.filter((index) => index !== 0)
-            : [];
-        Reflect.defineMetadata(OPTIONAL_PARAMTYPES, optionalIndexes, target);
-    };
-}
-// The Bearer channel's guard: Passport dispatches SignetJwtStrategy, and a
-// false from it is a uniform 401. A route marked `@Public()` (on the handler
-// or its class) is let through first, so the guard can be an APP_GUARD on
-// its own; a consumer with a credential dispatcher of its own decides
-// `@Public()` there and never hands a public route to this guard. What
-// follows is the layer on top:
-//
-//   token lacks the admission scope         → 403 (service scope), with an
-//                                             insufficient_scope challenge
-//   resolver says { ok: false }             → 403, bare
-//   resolver throws PrincipalStoreUnavailableError → 503, fail closed
-//   resolver throws an HttpException        → its own status
-//   resolver throws anything else           → 500, the error under its own name
-//   resolver logFields reuses a fixed key   → 500, resolver_contract_error
-//   Passport passed but attached no user    → 500, programming error
-//
-// None of these are 401: the token was valid. The 403 messages distinguish
-// "get a token with the right scope" from "ask an administrator" without
-// naming what the caller does not hold. The 500 is deliberately NOT a 503:
-// a bug in the resolver must not send the operator to check the database.
-let SignetBearerGuard = class SignetBearerGuard extends (0, passport_1.AuthGuard)(strategy_1.SIGNET_JWT_STRATEGY) {
+// The Bearer channel's guard for the module-wired resolver: SignetJwtStrategy
+// leaves the verified identity on request.user, the resolver bound to
+// SIGNET_PRINCIPAL_RESOLVER turns it into the consumer's principal, and the
+// principal goes under options.requestPrincipalKey (which may also be `user`,
+// in which case the identity is overwritten by the principal). The
+// classification of the resolver's outcome is SignetDecision's.
+let SignetBearerGuard = class SignetBearerGuard extends passport_guard_1.SignetPassportGuard {
     resolver;
-    profiles;
+    decision;
     signetOptions;
-    reflector;
     // The subclass's name when a consumer subclasses this guard, so its log
     // `context` keeps the name the consumer's operators filter on.
     logger = new common_1.Logger(this.constructor.name);
-    constructor(resolver, profiles, signetOptions, reflector) {
-        super();
+    constructor(resolver, decision, signetOptions, reflector) {
+        super(reflector);
         this.resolver = resolver;
-        this.profiles = profiles;
+        this.decision = decision;
         this.signetOptions = signetOptions;
-        this.reflector = reflector;
     }
     async canActivate(context) {
-        if (this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_ROUTE, [
-            context.getHandler(),
-            context.getClass(),
-        ]) === true) {
+        const request = await this.authenticate(context);
+        if (request === 'public')
             return true;
-        }
-        // Typed unknown: the base declares boolean | Promise<boolean> |
-        // Observable<boolean>, and anything other than a literal true is treated
-        // as "did not pass".
-        let passed;
-        try {
-            passed = await super.canActivate(context);
-        }
-        catch (error) {
-            // Passport's own UnauthorizedException carries a message; the contract
-            // is one indistinguishable 401. Anything else is a programming error
-            // and must not be dressed up as an authentication failure.
-            if (error instanceof common_1.UnauthorizedException) {
-                throw new common_1.UnauthorizedException();
-            }
-            throw error;
-        }
-        const request = context.switchToHttp().getRequest();
-        const identity = request.user;
-        if (passed !== true || identity === undefined) {
-            this.logFailure('signet strategy did not pass cleanly', 'signet_identity_missing', 'none');
-            throw new common_1.InternalServerErrorException('signet strategy did not pass cleanly');
-        }
-        const { admissionScope } = this.signetOptions;
-        if (!identity.scopes.includes(admissionScope)) {
-            this.logger.warn(`signet token lacks service scope: metric=signet_scope_missing source=${(0, log_sanitise_1.sanitiseLogToken)(request.ip ?? 'none')}`);
-            // A 403 a client CAN fix by re-authorising (RFC 6750 §3.1); the
-            // resolver's refusals below stay bare, because a wider OAuth scope
-            // would not supply a missing local authorization.
-            throw new bearer_challenge_1.InsufficientScopeException(admissionScope);
-        }
-        const environment = this.profiles.profile.environment;
-        let resolution;
-        try {
-            resolution = await this.resolver.resolve(identity);
-        }
-        catch (error) {
-            // An HttpException is a decision already taken below us; it is neither
-            // the store nor a bug, and it must reach the caller with its own status.
-            if (error instanceof common_1.HttpException)
-                throw error;
-            if (error instanceof principal_resolver_1.PrincipalStoreUnavailableError) {
-                // The line names what actually failed (the cause's class), not the
-                // wrapper; the driver's message travels in the stack, never on the
-                // key=value line.
-                this.logFailure('authorization store unavailable', 'auth_store_unavailable', error.causeName, error.causeStack);
-                throw new common_1.ServiceUnavailableException('authorization store unavailable');
-            }
-            const errorName = error instanceof Error && error.name ? error.name : typeof error;
-            const stack = error instanceof Error ? error.stack : undefined;
-            // A bug: rethrow unchanged so Nest answers 500 and the error keeps its
-            // own name in the exception filter.
-            this.logFailure('authorization load failed', 'auth_store_error', errorName, stack);
-            throw error;
-        }
-        if (!resolution.ok) {
-            // The reason is logged for the operator and NOT returned.
-            this.logDecision('refused', identity.clientId, environment, resolution);
-            throw new common_1.ForbiddenException(this.signetOptions.principalRefusalMessage ??
-                'this identity holds no authorization in this service');
-        }
-        // Attached before the decision line: an assignment that throws must not
-        // leave an "authorized" line behind.
-        request[this.signetOptions.requestPrincipalKey] = resolution.principal;
-        this.logDecision('authorized', identity.clientId, environment, resolution);
+        await this.decision.decide(request.user, this.resolver, {
+            attach: (principal) => {
+                request[this.signetOptions.requestPrincipalKey] = principal;
+            },
+            logger: this.logger,
+            source: request.ip,
+        });
         return true;
     }
-    // The one rendering of this guard's authorization DECISION: the line that
-    // lets a request through and the line that refuses one, so their field set
-    // and its order cannot drift apart -- metric, reason, the resolver's
-    // logFields in the order given, clientId, environment.
-    //
-    // What these lines disclose about the caller: the client id (software, not
-    // a person; a registration identifier, not a credential) and whatever the
-    // resolver chose to put in `logFields`. No `sub`, no issuer.
-    //
-    // Levels: a refusal is a `warn`, an authorization a `log` (info). One line
-    // per authorized request is the price of having any record of which client
-    // acted; it is paid deliberately, because the alternative is no record.
-    logDecision(outcome, clientId, environment, resolution) {
-        const consumerFields = Object.entries(resolution.logFields ?? {});
-        for (const [key] of consumerFields) {
-            if (RESERVED_LOG_KEYS.has(key)) {
-                // A programming error in the resolver, not a decision: one alertable
-                // line, then a 500 under its own name rather than a forged log line.
-                this.logFailure('resolver logFields invalid', 'resolver_contract_error', 'Error');
-                throw new Error(`resolver logFields must not use the reserved key ${key}`);
-            }
-        }
-        const pairs = [
-            ['reason', resolution.ok ? 'none' : resolution.reason],
-            ...consumerFields,
-            ['clientId', clientId],
-            ['environment', environment],
-        ];
-        const rendered = pairs
-            .map(([key, value]) => `${(0, log_sanitise_1.sanitiseLogToken)(key)}=${(0, log_sanitise_1.sanitiseLogToken)(value)}`)
-            .join(' ');
-        if (outcome === 'refused') {
-            this.logger.warn(`signet principal refused: metric=signet_principal_refused ${rendered}`);
-            return;
-        }
-        this.logger.log(`signet principal authorized: metric=signet_principal_authorized ${rendered}`);
-    }
-    // The one rendering of this guard's failure lines. Only the error's class
-    // name goes into the key=value line: the driver's message can carry the
-    // DSN or the SQL, so it travels in the stack as the SECOND argument, where
-    // a structured logger renders it after the filterable fields.
-    logFailure(message, metric, errorName, stack) {
-        this.logger.error(`${message}: metric=${metric} errorName=${(0, log_sanitise_1.sanitiseLogToken)(errorName)}`, stack);
-    }
 };
 exports.SignetBearerGuard = SignetBearerGuard;
 exports.SignetBearerGuard = SignetBearerGuard = __decorate([
     (0, common_1.Injectable)(),
-    requirePrincipalResolver(),
+    (0, passport_guard_1.ownConstructorParametersRequired)(),
     __param(0, (0, common_1.Inject)(principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER)),
     __param(2, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
-    __metadata("design:paramtypes", [Object, deployment_profile_1.SignetDeploymentProfileService, Object, core_1.Reflector])
+    __metadata("design:paramtypes", [Object, decision_1.SignetDecision, Object, core_1.Reflector])
 ], SignetBearerGuard);
 //# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uCAAyC;AACzC,+CAA6C;AAG7C,yDAAgE;AAChE,6DAAsE;AAEtE,iDAAkD;AAClD,uCAGmB;AACnB,6DAK8B;AAC9B,yDAAqD;AACrD,yCAAiD;AAEjD,6EAA6E;AAC7E,0EAA0E;AAC1E,8CAA8C;AAC9C,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,2EAA2E;AAC3E,SAAS,wBAAwB;IAC/B,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,GAAG,GAAY,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAUD,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,sEAAsE;AACtE,uEAAuE;AACvE,+BAA+B;AAC/B,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wDAAwD;AACxD,sEAAsE;AACtE,6DAA6D;AAC7D,gFAAgF;AAChF,2EAA2E;AAC3E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAGnE,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,8BAAmB,CAAC;IAOhD;IACA;IAKA;IACA;IAbnB,wEAAwE;IACxE,+DAA+D;IAC9C,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAE5D,YAEmB,QAAiC,EACjC,QAAwC,EAKxC,aAAuC,EACvC,SAAoB;QAErC,KAAK,EAAE,CAAC;QATS,aAAQ,GAAR,QAAQ,CAAyB;QACjC,aAAQ,GAAR,QAAQ,CAAgC;QAKxC,kBAAa,GAAb,aAAa,CAA0B;QACvC,cAAS,GAAT,SAAS,CAAW;IAGvC,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAClD,IACE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kCAAe,EAAE;YACzD,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,EACX,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,gEAAgE;QAChE,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAiB,CAAC;QACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,CACb,sCAAsC,EACtC,yBAAyB,EACzB,MAAM,CACP,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,IAAA,+BAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CACjH,CAAC;YACF,gEAAgE;YAChE,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,IAAI,6CAA0B,CAAC,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACtD,IAAI,UAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,KAAK,YAAY,sBAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,IAAI,KAAK,YAAY,mDAA8B,EAAE,CAAC;gBACpD,mEAAmE;gBACnE,mEAAmE;gBACnE,kBAAkB;gBAClB,IAAI,CAAC,UAAU,CACb,iCAAiC,EACjC,wBAAwB,EACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,UAAU,CACjB,CAAC;gBACF,MAAM,IAAI,oCAA2B,CACnC,iCAAiC,CAClC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GACb,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,uEAAuE;YACvE,oCAAoC;YACpC,IAAI,CAAC,UAAU,CACb,2BAA2B,EAC3B,kBAAkB,EAClB,SAAS,EACT,KAAK,CACN,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,0DAA0D;YAC1D,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YACxE,MAAM,IAAI,2BAAkB,CAC1B,IAAI,CAAC,aAAa,CAAC,uBAAuB;gBACxC,sDAAsD,CACzD,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,qCAAqC;QACrC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,UAAU,CAAC,SAAS,CAAC;QACvE,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,qEAAqE;IACrE,uDAAuD;IACvD,EAAE;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IAChE,WAAW,CACjB,OAAiC,EACjC,QAAgB,EAChB,WAAmB,EACnB,UAAwC;QAExC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,qEAAqE;gBACrE,qEAAqE;gBACrE,IAAI,CAAC,UAAU,CACb,4BAA4B,EAC5B,yBAAyB,EACzB,OAAO,CACR,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,EAAE,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAuB;YAChC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YACtD,GAAG,cAAc;YACjB,CAAC,UAAU,EAAE,QAAQ,CAAC;YACtB,CAAC,aAAa,EAAE,WAAW,CAAC;SAC7B,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK;aACnB,GAAG,CACF,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,IAAI,IAAA,+BAAgB,EAAC,KAAK,CAAC,EAAE,CACxE;aACA,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA6D,QAAQ,EAAE,CACxE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mEAAmE,QAAQ,EAAE,CAC9E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,8DAA8D;IACtD,UAAU,CAChB,OAAe,EACf,MAI6B,EAC7B,SAAiB,EACjB,KAAc;QAEd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,GAAG,OAAO,YAAY,MAAM,cAAc,IAAA,+BAAgB,EAAC,SAAS,CAAC,EAAE,EACvE,KAAK,CACN,CAAC;IACJ,CAAC;CACF,CAAA;AA/LY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,mBAAU,GAAE;IACZ,wBAAwB,EAAE;IAOtB,WAAA,IAAA,eAAM,EAAC,8CAAyB,CAAC,CAAA;IAMjC,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;6CAJR,mDAA8B,UAM7B,gBAAS;GAd5B,iBAAiB,CA+L7B"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AAEzC,yCAA4C;AAE5C,uCAGmB;AACnB,qDAG0B;AAC1B,6DAG8B;AAE9B,8EAA8E;AAC9E,sEAAsE;AACtE,4EAA4E;AAC5E,8EAA8E;AAC9E,mEAAmE;AACnE,gEAAgE;AAGzD,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,oCAAmB;IAOrC;IACA;IAKA;IAZnB,wEAAwE;IACxE,+DAA+D;IAC9C,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAE5D,YAEmB,QAAiC,EACjC,QAAwB,EAKxB,aAAuC,EACxD,SAAoB;QAEpB,KAAK,CAAC,SAAS,CAAC,CAAC;QATA,aAAQ,GAAR,QAAQ,CAAyB;QACjC,aAAQ,GAAR,QAAQ,CAAgB;QAKxB,kBAAa,GAAb,aAAa,CAA0B;IAI1D,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAyB,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YACtD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE;gBACpB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC;YAC9D,CAAC;YACD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,OAAO,CAAC,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA/BY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,mBAAU,GAAE;IACZ,IAAA,iDAAgC,GAAE;IAO9B,WAAA,IAAA,eAAM,EAAC,8CAAyB,CAAC,CAAA;IAMjC,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;6CAJR,yBAAc,UAM9B,gBAAS;GAdX,iBAAiB,CA+B7B"}

package/dist/index.d.ts

@@ -1,15 +1,18 @@
 export { bearerChallenge, carriesScopeChallenge, type ChallengeDecision, challengeFor, insufficientScopeChallenge, InsufficientScopeException, isResourceRequest, protectedResourceMetadataPath, protectedResourceMetadataUrl, type ScopeChallengeCarrier, } from './bearer-challenge';
 export { BearerChallengeFilter } from './bearer-challenge.filter';
 export { type ChannelFlags, type JwtSettings, readChannelFlags, readSignetAuthConfig, type SignetAuthConfig, type SignetEnvOptions, } from './config';
+export { type DecisionContext, SignetDecision } from './decision';
 export { type DeploymentProfile, type DeploymentProfileInput, type DeploymentProfileResolution, resolveDeploymentProfile, SignetDeploymentProfileService, } from './deployment-profile';
 export { SignetBearerGuard } from './guard';
 export { type JwtRejection, JwtRejectionEnum, JwtVerifier, REMOTE_JWKS_OPTIONS, type VerifiedSignetIdentity, type VerifyResult, } from './jwt-verifier';
-export { type ResolverProvider, SignetIntegrationModule, type SignetIntegrationModuleOptions, } from './module';
+export { type ResolverProvider, SignetIntegrationModule, type SignetIntegrationModuleOptions, type SignetPassportModuleOptions, } from './module';
 export { DEVELOPMENT_ENVIRONMENT, SIGNET_INTEGRATION_OPTIONS, type SignetDeployedProfile, type SignetDevelopmentProfile, type SignetEnvNames, type SignetIntegrationOptions, } from './options';
+export { type AuthenticatedRequest, SignetPassportGuard, } from './passport-guard';
 export { createSignetPrincipalDecorator } from './principal.decorator';
 export { type PrincipalResolution, PrincipalStoreUnavailableError, SIGNET_PRINCIPAL_RESOLVER, type SignetPrincipalResolver, } from './principal-resolver';
+export { SignetPrincipalStrategy } from './principal-strategy';
 export { createProtectedResourceController, type ProtectedResourceMetadata, } from './protected-resource.controller';
 export { IS_PUBLIC_ROUTE, Public } from './public.decorator';
 export { createScopeVocabulary, type ScopeVocabulary, type ScopeVocabularyInput, type TokenScopeRead, } from './scope-vocabulary';
-export { bearerToken, SIGNET_JWT_STRATEGY, SignetJwtStrategy, } from './strategy';
+export { bearerToken, SIGNET_JWT_STRATEGY, SignetBearerVerification, SignetJwtStrategy, } from './strategy';
 export { validateSignetIntegrationOptions } from './validate-options';