@marxbiotech/signet-integration 0.1.2 → 0.2.0

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateSignetIntegrationOptions = exports.SignetJwtStrategy = exports.SIGNET_JWT_STRATEGY = exports.bearerToken = exports.createScopeVocabulary = exports.Public = exports.IS_PUBLIC_ROUTE = exports.createProtectedResourceController = exports.SIGNET_PRINCIPAL_RESOLVER = exports.PrincipalStoreUnavailableError = exports.createSignetPrincipalDecorator = exports.SIGNET_INTEGRATION_OPTIONS = exports.DEVELOPMENT_ENVIRONMENT = exports.SignetIntegrationModule = exports.REMOTE_JWKS_OPTIONS = exports.JwtVerifier = exports.JwtRejectionEnum = exports.SignetBearerGuard = exports.SignetDeploymentProfileService = exports.resolveDeploymentProfile = exports.readSignetAuthConfig = exports.readChannelFlags = exports.BearerChallengeFilter = exports.protectedResourceMetadataUrl = exports.protectedResourceMetadataPath = exports.isResourceRequest = exports.InsufficientScopeException = exports.insufficientScopeChallenge = exports.challengeFor = exports.carriesScopeChallenge = exports.bearerChallenge = void 0;
+exports.validateSignetIntegrationOptions = exports.SignetJwtStrategy = exports.SignetBearerVerification = exports.SIGNET_JWT_STRATEGY = exports.bearerToken = exports.createScopeVocabulary = exports.Public = exports.IS_PUBLIC_ROUTE = exports.createProtectedResourceController = exports.SignetPrincipalStrategy = exports.SIGNET_PRINCIPAL_RESOLVER = exports.PrincipalStoreUnavailableError = exports.createSignetPrincipalDecorator = exports.SignetPassportGuard = exports.SIGNET_INTEGRATION_OPTIONS = exports.DEVELOPMENT_ENVIRONMENT = exports.SignetIntegrationModule = exports.REMOTE_JWKS_OPTIONS = exports.JwtVerifier = exports.JwtRejectionEnum = exports.SignetBearerGuard = exports.SignetDeploymentProfileService = exports.resolveDeploymentProfile = exports.SignetDecision = exports.readSignetAuthConfig = exports.readChannelFlags = exports.BearerChallengeFilter = exports.protectedResourceMetadataUrl = exports.protectedResourceMetadataPath = exports.isResourceRequest = exports.InsufficientScopeException = exports.insufficientScopeChallenge = exports.challengeFor = exports.carriesScopeChallenge = exports.bearerChallenge = void 0;
 var bearer_challenge_1 = require("./bearer-challenge");
 Object.defineProperty(exports, "bearerChallenge", { enumerable: true, get: function () { return bearer_challenge_1.bearerChallenge; } });
 Object.defineProperty(exports, "carriesScopeChallenge", { enumerable: true, get: function () { return bearer_challenge_1.carriesScopeChallenge; } });
@@ -15,6 +15,8 @@ Object.defineProperty(exports, "BearerChallengeFilter", { enumerable: true, get:
 var config_1 = require("./config");
 Object.defineProperty(exports, "readChannelFlags", { enumerable: true, get: function () { return config_1.readChannelFlags; } });
 Object.defineProperty(exports, "readSignetAuthConfig", { enumerable: true, get: function () { return config_1.readSignetAuthConfig; } });
+var decision_1 = require("./decision");
+Object.defineProperty(exports, "SignetDecision", { enumerable: true, get: function () { return decision_1.SignetDecision; } });
 var deployment_profile_1 = require("./deployment-profile");
 Object.defineProperty(exports, "resolveDeploymentProfile", { enumerable: true, get: function () { return deployment_profile_1.resolveDeploymentProfile; } });
 Object.defineProperty(exports, "SignetDeploymentProfileService", { enumerable: true, get: function () { return deployment_profile_1.SignetDeploymentProfileService; } });
@@ -29,11 +31,15 @@ Object.defineProperty(exports, "SignetIntegrationModule", { enumerable: true, ge
 var options_1 = require("./options");
 Object.defineProperty(exports, "DEVELOPMENT_ENVIRONMENT", { enumerable: true, get: function () { return options_1.DEVELOPMENT_ENVIRONMENT; } });
 Object.defineProperty(exports, "SIGNET_INTEGRATION_OPTIONS", { enumerable: true, get: function () { return options_1.SIGNET_INTEGRATION_OPTIONS; } });
+var passport_guard_1 = require("./passport-guard");
+Object.defineProperty(exports, "SignetPassportGuard", { enumerable: true, get: function () { return passport_guard_1.SignetPassportGuard; } });
 var principal_decorator_1 = require("./principal.decorator");
 Object.defineProperty(exports, "createSignetPrincipalDecorator", { enumerable: true, get: function () { return principal_decorator_1.createSignetPrincipalDecorator; } });
 var principal_resolver_1 = require("./principal-resolver");
 Object.defineProperty(exports, "PrincipalStoreUnavailableError", { enumerable: true, get: function () { return principal_resolver_1.PrincipalStoreUnavailableError; } });
 Object.defineProperty(exports, "SIGNET_PRINCIPAL_RESOLVER", { enumerable: true, get: function () { return principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER; } });
+var principal_strategy_1 = require("./principal-strategy");
+Object.defineProperty(exports, "SignetPrincipalStrategy", { enumerable: true, get: function () { return principal_strategy_1.SignetPrincipalStrategy; } });
 var protected_resource_controller_1 = require("./protected-resource.controller");
 Object.defineProperty(exports, "createProtectedResourceController", { enumerable: true, get: function () { return protected_resource_controller_1.createProtectedResourceController; } });
 var public_decorator_1 = require("./public.decorator");
@@ -44,6 +50,7 @@ Object.defineProperty(exports, "createScopeVocabulary", { enumerable: true, get:
 var strategy_1 = require("./strategy");
 Object.defineProperty(exports, "bearerToken", { enumerable: true, get: function () { return strategy_1.bearerToken; } });
 Object.defineProperty(exports, "SIGNET_JWT_STRATEGY", { enumerable: true, get: function () { return strategy_1.SIGNET_JWT_STRATEGY; } });
+Object.defineProperty(exports, "SignetBearerVerification", { enumerable: true, get: function () { return strategy_1.SignetBearerVerification; } });
 Object.defineProperty(exports, "SignetJwtStrategy", { enumerable: true, get: function () { return strategy_1.SignetJwtStrategy; } });
 var validate_options_1 = require("./validate-options");
 Object.defineProperty(exports, "validateSignetIntegrationOptions", { enumerable: true, get: function () { return validate_options_1.validateSignetIntegrationOptions; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uDAW4B;AAV1B,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AAErB,gHAAA,YAAY,OAAA;AACZ,8HAAA,0BAA0B,OAAA;AAC1B,8HAAA,0BAA0B,OAAA;AAC1B,qHAAA,iBAAiB,OAAA;AACjB,iIAAA,6BAA6B,OAAA;AAC7B,gIAAA,4BAA4B,OAAA;AAG9B,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,mCAOkB;AAJhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AAItB,2DAM8B;AAF5B,8HAAA,wBAAwB,OAAA;AACxB,oIAAA,8BAA8B,OAAA;AAEhC,iCAA4C;AAAnC,0GAAA,iBAAiB,OAAA;AAC1B,+CAOwB;AALtB,gHAAA,gBAAgB,OAAA;AAChB,2GAAA,WAAW,OAAA;AACX,mHAAA,mBAAmB,OAAA;AAIrB,mCAIkB;AAFhB,iHAAA,uBAAuB,OAAA;AAGzB,qCAOmB;AANjB,kHAAA,uBAAuB,OAAA;AACvB,qHAAA,0BAA0B,OAAA;AAM5B,6DAAuE;AAA9D,qIAAA,8BAA8B,OAAA;AACvC,2DAK8B;AAH5B,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AAG3B,iFAGyC;AAFvC,kJAAA,iCAAiC,OAAA;AAGnC,uDAA6D;AAApD,mHAAA,eAAe,OAAA;AAAE,0GAAA,MAAM,OAAA;AAChC,uDAK4B;AAJ1B,yHAAA,qBAAqB,OAAA;AAKvB,uCAIoB;AAHlB,uGAAA,WAAW,OAAA;AACX,+GAAA,mBAAmB,OAAA;AACnB,6GAAA,iBAAiB,OAAA;AAEnB,uDAAsE;AAA7D,oIAAA,gCAAgC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uDAW4B;AAV1B,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AAErB,gHAAA,YAAY,OAAA;AACZ,8HAAA,0BAA0B,OAAA;AAC1B,8HAAA,0BAA0B,OAAA;AAC1B,qHAAA,iBAAiB,OAAA;AACjB,iIAAA,6BAA6B,OAAA;AAC7B,gIAAA,4BAA4B,OAAA;AAG9B,qEAAkE;AAAzD,gIAAA,qBAAqB,OAAA;AAC9B,mCAOkB;AAJhB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AAItB,uCAAkE;AAAnC,0GAAA,cAAc,OAAA;AAC7C,2DAM8B;AAF5B,8HAAA,wBAAwB,OAAA;AACxB,oIAAA,8BAA8B,OAAA;AAEhC,iCAA4C;AAAnC,0GAAA,iBAAiB,OAAA;AAC1B,+CAOwB;AALtB,gHAAA,gBAAgB,OAAA;AAChB,2GAAA,WAAW,OAAA;AACX,mHAAA,mBAAmB,OAAA;AAIrB,mCAKkB;AAHhB,iHAAA,uBAAuB,OAAA;AAIzB,qCAOmB;AANjB,kHAAA,uBAAuB,OAAA;AACvB,qHAAA,0BAA0B,OAAA;AAM5B,mDAG0B;AADxB,qHAAA,mBAAmB,OAAA;AAErB,6DAAuE;AAA9D,qIAAA,8BAA8B,OAAA;AACvC,2DAK8B;AAH5B,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AAG3B,2DAA+D;AAAtD,6HAAA,uBAAuB,OAAA;AAChC,iFAGyC;AAFvC,kJAAA,iCAAiC,OAAA;AAGnC,uDAA6D;AAApD,mHAAA,eAAe,OAAA;AAAE,0GAAA,MAAM,OAAA;AAChC,uDAK4B;AAJ1B,yHAAA,qBAAqB,OAAA;AAKvB,uCAKoB;AAJlB,uGAAA,WAAW,OAAA;AACX,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AAEnB,uDAAsE;AAA7D,oIAAA,gCAAgC,OAAA"}

package/dist/module.d.ts

@@ -2,11 +2,14 @@ import { type DynamicModule, type ExistingProvider, type FactoryProvider, type T
 import { type SignetIntegrationOptions } from './options';
 import { type SignetPrincipalResolver } from './principal-resolver';
 export type ResolverProvider = Omit<ExistingProvider<SignetPrincipalResolver>, 'provide'> | Omit<FactoryProvider<SignetPrincipalResolver>, 'provide'> | Omit<ValueProvider<SignetPrincipalResolver>, 'provide'> | Type<SignetPrincipalResolver>;
-export interface SignetIntegrationModuleOptions {
+export interface SignetPassportModuleOptions {
     readonly imports?: DynamicModule['imports'];
     readonly options: SignetIntegrationOptions;
+}
+export interface SignetIntegrationModuleOptions extends SignetPassportModuleOptions {
     readonly resolver: ResolverProvider;
 }
 export declare class SignetIntegrationModule {
+    static forPassport(input: SignetPassportModuleOptions): DynamicModule;
     static forRoot(input: SignetIntegrationModuleOptions): DynamicModule;
 }

package/dist/module.js

@@ -9,35 +9,39 @@ var SignetIntegrationModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignetIntegrationModule = void 0;
 const common_1 = require("@nestjs/common");
+const decision_1 = require("./decision");
 const deployment_profile_1 = require("./deployment-profile");
 const guard_1 = require("./guard");
 const options_1 = require("./options");
+const passport_guard_1 = require("./passport-guard");
 const principal_resolver_1 = require("./principal-resolver");
 const strategy_1 = require("./strategy");
 const validate_options_1 = require("./validate-options");
-// Wires the Bearer channel: options behind their token, the consumer's
-// resolver behind its token, the deployment profile, the Passport strategy
-// (which registers itself by name in its constructor, so it must be a
-// provider) and the guard. Exports everything a consumer's own auth module
-// re-exports or a dispatcher injects.
+// Two ways in, one set of providers underneath.
 //
-// NOT here: the metadata controller (createProtectedResourceController --
+// forPassport: the consumer brings its own strategy (a SignetPrincipalStrategy
+// subclass, registered as a provider in the consumer's module) and guards
+// with SignetPassportGuard or any AuthGuard(SIGNET_JWT_STRATEGY). This
+// module then provides what that strategy injects: the options behind their
+// token, the deployment profile, and SignetDecision.
+//
+// forRoot: the module-wired shape. Adds the consumer's resolver behind its
+// token, SignetJwtStrategy (which registers itself by name in its
+// constructor, so it must be a provider) and SignetBearerGuard.
+//
+// NOT here either way: the metadata controller (createProtectedResourceController --
 // the consumer declares it in the module of the process that serves the
 // resource), the exception filter (BearerChallengeFilter as APP_FILTER, or
 // the consumer's own filter calling challengeFor), and the guard's mounting
 // (APP_GUARD, or inside a consumer's credential dispatcher).
 let SignetIntegrationModule = SignetIntegrationModule_1 = class SignetIntegrationModule {
-    static forRoot(input) {
-        const resolver = typeof input.resolver === 'function'
-            ? { provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER, useClass: input.resolver }
-            : { ...input.resolver, provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER };
+    static forPassport(input) {
         return {
             exports: [
                 options_1.SIGNET_INTEGRATION_OPTIONS,
-                principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER,
-                guard_1.SignetBearerGuard,
+                decision_1.SignetDecision,
                 deployment_profile_1.SignetDeploymentProfileService,
-                strategy_1.SignetJwtStrategy,
+                passport_guard_1.SignetPassportGuard,
             ],
             imports: input.imports ?? [],
             module: SignetIntegrationModule_1,
@@ -46,9 +50,29 @@ let SignetIntegrationModule = SignetIntegrationModule_1 = class SignetIntegratio
                     provide: options_1.SIGNET_INTEGRATION_OPTIONS,
                     useValue: (0, validate_options_1.validateSignetIntegrationOptions)(input.options),
                 },
+                decision_1.SignetDecision,
+                deployment_profile_1.SignetDeploymentProfileService,
+                passport_guard_1.SignetPassportGuard,
+            ],
+        };
+    }
+    static forRoot(input) {
+        const resolver = typeof input.resolver === 'function'
+            ? { provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER, useClass: input.resolver }
+            : { ...input.resolver, provide: principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER };
+        const base = SignetIntegrationModule_1.forPassport(input);
+        return {
+            ...base,
+            exports: [
+                ...(base.exports ?? []),
+                principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER,
+                guard_1.SignetBearerGuard,
+                strategy_1.SignetJwtStrategy,
+            ],
+            providers: [
+                ...(base.providers ?? []),
                 resolver,
                 guard_1.SignetBearerGuard,
-                deployment_profile_1.SignetDeploymentProfileService,
                 strategy_1.SignetJwtStrategy,
             ],
         };

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAQwB;AAExB,6DAAsE;AACtE,mCAA4C;AAC5C,uCAGmB;AACnB,6DAG8B;AAC9B,yCAA+C;AAC/C,yDAAsE;AAoBtE,uEAAuE;AACvE,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,6DAA6D;AAEtD,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,MAAM,CAAC,OAAO,CAAC,KAAqC;QAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,8CAAyB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,8CAAyB,EAAE,CAAC;QAChE,OAAO;YACL,OAAO,EAAE;gBACP,oCAA0B;gBAC1B,8CAAyB;gBACzB,yBAAiB;gBACjB,mDAA8B;gBAC9B,4BAAiB;aAClB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,MAAM,EAAE,yBAAuB;YAC/B,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,oCAA0B;oBACnC,QAAQ,EAAE,IAAA,mDAAgC,EAAC,KAAK,CAAC,OAAO,CAAC;iBAC1D;gBACD,QAAQ;gBACR,yBAAiB;gBACjB,mDAA8B;gBAC9B,4BAAiB;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA5BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CA4BnC"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAQwB;AAExB,yCAA4C;AAC5C,6DAAsE;AACtE,mCAA4C;AAC5C,uCAGmB;AACnB,qDAAuD;AACvD,6DAG8B;AAC9B,yCAA+C;AAC/C,yDAAsE;AAuBtE,gDAAgD;AAChD,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,qDAAqD;AACrD,EAAE;AACF,2EAA2E;AAC3E,kEAAkE;AAClE,gEAAgE;AAChE,EAAE;AACF,qFAAqF;AACrF,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,6DAA6D;AAEtD,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,MAAM,CAAC,WAAW,CAAC,KAAkC;QACnD,OAAO;YACL,OAAO,EAAE;gBACP,oCAA0B;gBAC1B,yBAAc;gBACd,mDAA8B;gBAC9B,oCAAmB;aACpB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,MAAM,EAAE,yBAAuB;YAC/B,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,oCAA0B;oBACnC,QAAQ,EAAE,IAAA,mDAAgC,EAAC,KAAK,CAAC,OAAO,CAAC;iBAC1D;gBACD,yBAAc;gBACd,mDAA8B;gBAC9B,oCAAmB;aACpB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAAqC;QAClD,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU;YAClC,CAAC,CAAC,EAAE,OAAO,EAAE,8CAAyB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YAClE,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,8CAAyB,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,yBAAuB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvB,8CAAyB;gBACzB,yBAAiB;gBACjB,4BAAiB;aAClB;YACD,SAAS,EAAE;gBACT,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;gBACzB,QAAQ;gBACR,yBAAiB;gBACjB,4BAAiB;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CA6CnC"}

package/dist/passport/index.d.ts

@@ -0,0 +1,17 @@
+export { bearerChallenge, carriesScopeChallenge, type ChallengeDecision, challengeFor, insufficientScopeChallenge, InsufficientScopeException, isResourceRequest, protectedResourceMetadataPath, protectedResourceMetadataUrl, type ScopeChallengeCarrier, } from '../bearer-challenge';
+export { BearerChallengeFilter } from '../bearer-challenge.filter';
+export { type ChannelFlags, type JwtSettings, readChannelFlags, readSignetAuthConfig, type SignetAuthConfig, type SignetEnvOptions, } from '../config';
+export { type DecisionContext, SignetDecision } from '../decision';
+export { type DeploymentProfile, type DeploymentProfileInput, type DeploymentProfileResolution, resolveDeploymentProfile, SignetDeploymentProfileService, } from '../deployment-profile';
+export { SignetBearerGuard } from '../guard';
+export { type JwtRejection, JwtRejectionEnum, JwtVerifier, REMOTE_JWKS_OPTIONS, type VerifiedSignetIdentity, type VerifyResult, } from '../jwt-verifier';
+export { type ResolverProvider, SignetIntegrationModule, type SignetIntegrationModuleOptions, type SignetPassportModuleOptions, } from '../module';
+export { DEVELOPMENT_ENVIRONMENT, SIGNET_INTEGRATION_OPTIONS, type SignetDeployedProfile, type SignetDevelopmentProfile, type SignetEnvNames, type SignetIntegrationOptions, } from '../options';
+export { type AuthenticatedRequest, SignetPassportGuard, } from '../passport-guard';
+export { createSignetPrincipalDecorator } from '../principal.decorator';
+export { type PrincipalResolution, PrincipalStoreUnavailableError, SIGNET_PRINCIPAL_RESOLVER, type SignetPrincipalResolver, } from '../principal-resolver';
+export { SignetPrincipalStrategy } from '../principal-strategy';
+export { IS_PUBLIC_ROUTE, Public } from '../public.decorator';
+export { createScopeVocabulary, type ScopeVocabulary, type ScopeVocabularyInput, type TokenScopeRead, } from '../scope-vocabulary';
+export { bearerToken, SIGNET_JWT_STRATEGY, SignetBearerVerification, SignetJwtStrategy, } from '../strategy';
+export { validateSignetIntegrationOptions } from '../validate-options';

package/dist/passport/index.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateSignetIntegrationOptions = exports.SignetJwtStrategy = exports.SignetBearerVerification = exports.SIGNET_JWT_STRATEGY = exports.bearerToken = exports.createScopeVocabulary = exports.Public = exports.IS_PUBLIC_ROUTE = exports.SignetPrincipalStrategy = exports.SIGNET_PRINCIPAL_RESOLVER = exports.PrincipalStoreUnavailableError = exports.createSignetPrincipalDecorator = exports.SignetPassportGuard = exports.SIGNET_INTEGRATION_OPTIONS = exports.DEVELOPMENT_ENVIRONMENT = exports.SignetIntegrationModule = exports.REMOTE_JWKS_OPTIONS = exports.JwtVerifier = exports.JwtRejectionEnum = exports.SignetBearerGuard = exports.SignetDeploymentProfileService = exports.resolveDeploymentProfile = exports.SignetDecision = exports.readSignetAuthConfig = exports.readChannelFlags = exports.BearerChallengeFilter = exports.protectedResourceMetadataUrl = exports.protectedResourceMetadataPath = exports.isResourceRequest = exports.InsufficientScopeException = exports.insufficientScopeChallenge = exports.challengeFor = exports.carriesScopeChallenge = exports.bearerChallenge = void 0;
+// The Passport-level API: everything in the main entry except the RFC 9728
+// metadata controller, whose file needs @nestjs/swagger and @nestjs/throttler.
+// A consumer that serves the metadata elsewhere (or not at all) imports from
+// here and installs neither.
+var bearer_challenge_1 = require("../bearer-challenge");
+Object.defineProperty(exports, "bearerChallenge", { enumerable: true, get: function () { return bearer_challenge_1.bearerChallenge; } });
+Object.defineProperty(exports, "carriesScopeChallenge", { enumerable: true, get: function () { return bearer_challenge_1.carriesScopeChallenge; } });
+Object.defineProperty(exports, "challengeFor", { enumerable: true, get: function () { return bearer_challenge_1.challengeFor; } });
+Object.defineProperty(exports, "insufficientScopeChallenge", { enumerable: true, get: function () { return bearer_challenge_1.insufficientScopeChallenge; } });
+Object.defineProperty(exports, "InsufficientScopeException", { enumerable: true, get: function () { return bearer_challenge_1.InsufficientScopeException; } });
+Object.defineProperty(exports, "isResourceRequest", { enumerable: true, get: function () { return bearer_challenge_1.isResourceRequest; } });
+Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return bearer_challenge_1.protectedResourceMetadataPath; } });
+Object.defineProperty(exports, "protectedResourceMetadataUrl", { enumerable: true, get: function () { return bearer_challenge_1.protectedResourceMetadataUrl; } });
+var bearer_challenge_filter_1 = require("../bearer-challenge.filter");
+Object.defineProperty(exports, "BearerChallengeFilter", { enumerable: true, get: function () { return bearer_challenge_filter_1.BearerChallengeFilter; } });
+var config_1 = require("../config");
+Object.defineProperty(exports, "readChannelFlags", { enumerable: true, get: function () { return config_1.readChannelFlags; } });
+Object.defineProperty(exports, "readSignetAuthConfig", { enumerable: true, get: function () { return config_1.readSignetAuthConfig; } });
+var decision_1 = require("../decision");
+Object.defineProperty(exports, "SignetDecision", { enumerable: true, get: function () { return decision_1.SignetDecision; } });
+var deployment_profile_1 = require("../deployment-profile");
+Object.defineProperty(exports, "resolveDeploymentProfile", { enumerable: true, get: function () { return deployment_profile_1.resolveDeploymentProfile; } });
+Object.defineProperty(exports, "SignetDeploymentProfileService", { enumerable: true, get: function () { return deployment_profile_1.SignetDeploymentProfileService; } });
+var guard_1 = require("../guard");
+Object.defineProperty(exports, "SignetBearerGuard", { enumerable: true, get: function () { return guard_1.SignetBearerGuard; } });
+var jwt_verifier_1 = require("../jwt-verifier");
+Object.defineProperty(exports, "JwtRejectionEnum", { enumerable: true, get: function () { return jwt_verifier_1.JwtRejectionEnum; } });
+Object.defineProperty(exports, "JwtVerifier", { enumerable: true, get: function () { return jwt_verifier_1.JwtVerifier; } });
+Object.defineProperty(exports, "REMOTE_JWKS_OPTIONS", { enumerable: true, get: function () { return jwt_verifier_1.REMOTE_JWKS_OPTIONS; } });
+var module_1 = require("../module");
+Object.defineProperty(exports, "SignetIntegrationModule", { enumerable: true, get: function () { return module_1.SignetIntegrationModule; } });
+var options_1 = require("../options");
+Object.defineProperty(exports, "DEVELOPMENT_ENVIRONMENT", { enumerable: true, get: function () { return options_1.DEVELOPMENT_ENVIRONMENT; } });
+Object.defineProperty(exports, "SIGNET_INTEGRATION_OPTIONS", { enumerable: true, get: function () { return options_1.SIGNET_INTEGRATION_OPTIONS; } });
+var passport_guard_1 = require("../passport-guard");
+Object.defineProperty(exports, "SignetPassportGuard", { enumerable: true, get: function () { return passport_guard_1.SignetPassportGuard; } });
+var principal_decorator_1 = require("../principal.decorator");
+Object.defineProperty(exports, "createSignetPrincipalDecorator", { enumerable: true, get: function () { return principal_decorator_1.createSignetPrincipalDecorator; } });
+var principal_resolver_1 = require("../principal-resolver");
+Object.defineProperty(exports, "PrincipalStoreUnavailableError", { enumerable: true, get: function () { return principal_resolver_1.PrincipalStoreUnavailableError; } });
+Object.defineProperty(exports, "SIGNET_PRINCIPAL_RESOLVER", { enumerable: true, get: function () { return principal_resolver_1.SIGNET_PRINCIPAL_RESOLVER; } });
+var principal_strategy_1 = require("../principal-strategy");
+Object.defineProperty(exports, "SignetPrincipalStrategy", { enumerable: true, get: function () { return principal_strategy_1.SignetPrincipalStrategy; } });
+var public_decorator_1 = require("../public.decorator");
+Object.defineProperty(exports, "IS_PUBLIC_ROUTE", { enumerable: true, get: function () { return public_decorator_1.IS_PUBLIC_ROUTE; } });
+Object.defineProperty(exports, "Public", { enumerable: true, get: function () { return public_decorator_1.Public; } });
+var scope_vocabulary_1 = require("../scope-vocabulary");
+Object.defineProperty(exports, "createScopeVocabulary", { enumerable: true, get: function () { return scope_vocabulary_1.createScopeVocabulary; } });
+var strategy_1 = require("../strategy");
+Object.defineProperty(exports, "bearerToken", { enumerable: true, get: function () { return strategy_1.bearerToken; } });
+Object.defineProperty(exports, "SIGNET_JWT_STRATEGY", { enumerable: true, get: function () { return strategy_1.SIGNET_JWT_STRATEGY; } });
+Object.defineProperty(exports, "SignetBearerVerification", { enumerable: true, get: function () { return strategy_1.SignetBearerVerification; } });
+Object.defineProperty(exports, "SignetJwtStrategy", { enumerable: true, get: function () { return strategy_1.SignetJwtStrategy; } });
+var validate_options_1 = require("../validate-options");
+Object.defineProperty(exports, "validateSignetIntegrationOptions", { enumerable: true, get: function () { return validate_options_1.validateSignetIntegrationOptions; } });
+//# sourceMappingURL=index.js.map

package/dist/passport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/passport/index.ts"],"names":[],"mappings":";;;AAAA,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,6BAA6B;AAC7B,wDAW6B;AAV3B,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AAErB,gHAAA,YAAY,OAAA;AACZ,8HAAA,0BAA0B,OAAA;AAC1B,8HAAA,0BAA0B,OAAA;AAC1B,qHAAA,iBAAiB,OAAA;AACjB,iIAAA,6BAA6B,OAAA;AAC7B,gIAAA,4BAA4B,OAAA;AAG9B,sEAAmE;AAA1D,gIAAA,qBAAqB,OAAA;AAC9B,oCAOmB;AAJjB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AAItB,wCAAmE;AAApC,0GAAA,cAAc,OAAA;AAC7C,4DAM+B;AAF7B,8HAAA,wBAAwB,OAAA;AACxB,oIAAA,8BAA8B,OAAA;AAEhC,kCAA6C;AAApC,0GAAA,iBAAiB,OAAA;AAC1B,gDAOyB;AALvB,gHAAA,gBAAgB,OAAA;AAChB,2GAAA,WAAW,OAAA;AACX,mHAAA,mBAAmB,OAAA;AAIrB,oCAKmB;AAHjB,iHAAA,uBAAuB,OAAA;AAIzB,sCAOoB;AANlB,kHAAA,uBAAuB,OAAA;AACvB,qHAAA,0BAA0B,OAAA;AAM5B,oDAG2B;AADzB,qHAAA,mBAAmB,OAAA;AAErB,8DAAwE;AAA/D,qIAAA,8BAA8B,OAAA;AACvC,4DAK+B;AAH7B,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AAG3B,4DAAgE;AAAvD,6HAAA,uBAAuB,OAAA;AAChC,wDAA8D;AAArD,mHAAA,eAAe,OAAA;AAAE,0GAAA,MAAM,OAAA;AAChC,wDAK6B;AAJ3B,yHAAA,qBAAqB,OAAA;AAKvB,wCAKqB;AAJnB,uGAAA,WAAW,OAAA;AACX,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AAEnB,wDAAuE;AAA9D,oIAAA,gCAAgC,OAAA"}

package/dist/passport-guard.d.ts

@@ -0,0 +1,17 @@
+import { type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { type Request } from 'express';
+export declare function ownConstructorParametersRequired(): ClassDecorator;
+export type AuthenticatedRequest<U = unknown> = Omit<Request, 'user'> & {
+    user: U;
+    [key: string]: unknown;
+};
+declare const SignetPassportGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+export declare class SignetPassportGuard extends SignetPassportGuard_base {
+    private readonly reflector;
+    private readonly passportLogger;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    protected authenticate<U = unknown>(context: ExecutionContext): Promise<AuthenticatedRequest<U> | 'public'>;
+}
+export {};

package/dist/passport-guard.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetPassportGuard = void 0;
+exports.ownConstructorParametersRequired = ownConstructorParametersRequired;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const decision_1 = require("./decision");
+const public_decorator_1 = require("./public.decorator");
+const strategy_1 = require("./strategy");
+// Nest's OPTIONAL_DEPS_METADATA. `@nestjs/common` does not re-export it.
+const OPTIONAL_PARAMTYPES = 'optional:paramtypes';
+// AuthGuard's mixin marks its constructor parameter 0 `@Optional()`.
+// `Reflect.getMetadata` walks the constructor prototype chain, so a subclass
+// that never writes its own list treats ITS parameter 0 as optional.
+// `@Optional()` on a later parameter copies that inherited list onto this
+// constructor before appending its own index. Parameter decorators run
+// before this one, so the copy is already own metadata by the time this
+// drops index 0 (and writes a list when absent).
+function ownConstructorParametersRequired() {
+    return (target) => {
+        const own = Reflect.getOwnMetadata(OPTIONAL_PARAMTYPES, target);
+        const optionalIndexes = Array.isArray(own)
+            ? own.filter((index) => index !== 0)
+            : [];
+        Reflect.defineMetadata(OPTIONAL_PARAMTYPES, optionalIndexes, target);
+    };
+}
+// Passport's AuthGuard for the Signet strategy plus the two things every
+// consumer of it needs: a route marked `@Public()` (on the handler or its
+// class) is let through without running the strategy, so this can be an
+// APP_GUARD on its own; and a strategy refusal is ONE indistinguishable 401,
+// whatever Passport's own exception said.
+//
+// This is the whole guard for a consumer whose strategy already resolves the
+// principal (SignetPrincipalStrategy): Passport has put it on request.user.
+// SignetBearerGuard extends it for the module-wired resolver.
+let SignetPassportGuard = class SignetPassportGuard extends (0, passport_1.AuthGuard)(strategy_1.SIGNET_JWT_STRATEGY) {
+    reflector;
+    passportLogger = new common_1.Logger(this.constructor.name);
+    constructor(reflector) {
+        super();
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        await this.authenticate(context);
+        return true;
+    }
+    // 'public' when the route opted out; otherwise the request with Passport's
+    // user attached. A consumer with a credential dispatcher of its own decides
+    // `@Public()` there and never hands a public route to this guard.
+    async authenticate(context) {
+        if (this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_ROUTE, [
+            context.getHandler(),
+            context.getClass(),
+        ]) === true) {
+            return 'public';
+        }
+        // Typed unknown: the base declares boolean | Promise<boolean> |
+        // Observable<boolean>, and anything other than a literal true is treated
+        // as "did not pass".
+        let passed;
+        try {
+            passed = await super.canActivate(context);
+        }
+        catch (error) {
+            // Passport's own UnauthorizedException carries a message; the contract
+            // is one indistinguishable 401. Anything else is a programming error
+            // and must not be dressed up as an authentication failure.
+            if (error instanceof common_1.UnauthorizedException) {
+                throw new common_1.UnauthorizedException();
+            }
+            throw error;
+        }
+        const request = context
+            .switchToHttp()
+            .getRequest();
+        if (passed !== true || request.user === undefined) {
+            (0, decision_1.logFailure)(this.passportLogger, 'signet strategy did not pass cleanly', 'signet_identity_missing', 'none');
+            throw new common_1.InternalServerErrorException('signet strategy did not pass cleanly');
+        }
+        return request;
+    }
+};
+exports.SignetPassportGuard = SignetPassportGuard;
+exports.SignetPassportGuard = SignetPassportGuard = __decorate([
+    (0, common_1.Injectable)(),
+    ownConstructorParametersRequired(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], SignetPassportGuard);
+//# sourceMappingURL=passport-guard.js.map

package/dist/passport-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passport-guard.js","sourceRoot":"","sources":["../src/passport-guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyBA,4EAQC;AAjCD,2CAMwB;AACxB,uCAAyC;AACzC,+CAA6C;AAG7C,yCAAwC;AACxC,yDAAqD;AACrD,yCAAiD;AAEjD,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,qEAAqE;AACrE,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,iDAAiD;AACjD,SAAgB,gCAAgC;IAC9C,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,GAAG,GAAY,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,CAAC,cAAc,CAAC,mBAAmB,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC;AACJ,CAAC;AAYD,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,0CAA0C;AAC1C,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8DAA8D;AAGvD,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,IAAA,oBAAS,EAAC,8BAAmB,CAAC;IAGxC;IAFZ,cAAc,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAEpE,YAA6B,SAAoB;QAC/C,KAAK,EAAE,CAAC;QADmB,cAAS,GAAT,SAAS,CAAW;IAEjD,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAClD,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IACxD,KAAK,CAAC,YAAY,CAC1B,OAAyB;QAEzB,IACE,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kCAAe,EAAE;YACzD,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,KAAK,IAAI,EACX,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,gEAAgE;QAChE,yEAAyE;QACzE,qBAAqB;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qEAAqE;YACrE,2DAA2D;YAC3D,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAAuC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAClD,IAAA,qBAAU,EACR,IAAI,CAAC,cAAc,EACnB,sCAAsC,EACtC,yBAAyB,EACzB,MAAM,CACP,CAAC;YACF,MAAM,IAAI,qCAA4B,CACpC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;CACF,CAAA;AAzDY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,mBAAU,GAAE;IACZ,gCAAgC,EAAE;qCAIO,gBAAS;GAHtC,mBAAmB,CAyD/B"}

package/dist/principal-strategy.d.ts

@@ -0,0 +1,17 @@
+import { Logger, type OnModuleInit } from '@nestjs/common';
+import { type Request } from 'express';
+import { type VerifiedSignetIdentity } from './jwt-verifier';
+import { type PrincipalResolution, type SignetPrincipalResolver } from './principal-resolver';
+declare const SignetPrincipalStrategy_base: new (...args: any[]) => import("passport-custom");
+export declare abstract class SignetPrincipalStrategy<P> extends SignetPrincipalStrategy_base implements SignetPrincipalResolver<P>, OnModuleInit {
+    protected readonly logger: Logger;
+    private readonly configService;
+    private readonly profiles;
+    private readonly options;
+    private readonly decision;
+    private verification;
+    abstract resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<P>>;
+    onModuleInit(): void;
+    validate(request: Request): Promise<P | false>;
+}
+export {};

package/dist/principal-strategy.js

@@ -0,0 +1,84 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetPrincipalStrategy = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const passport_1 = require("@nestjs/passport");
+const passport_custom_1 = require("passport-custom");
+const decision_1 = require("./decision");
+const deployment_profile_1 = require("./deployment-profile");
+const options_1 = require("./options");
+const strategy_1 = require("./strategy");
+// The Passport-native shape: a strategy whose validate() ends with the
+// consumer's principal, which Passport then leaves on request.user. Subclass
+// it and implement `resolve` -- Passport's verify callback, with the
+// identity already proven -- and register the subclass as a provider; the
+// package's dependencies are property-injected, so the subclass's
+// constructor is its own.
+//
+//   @Injectable()
+//   class MyStrategy extends SignetPrincipalStrategy<User> {
+//     constructor(private readonly users: UsersService) { super(); }
+//     async resolve(identity) { ... }   // see SignetPrincipalResolver
+//   }
+//
+// Verification and the outcome's classification are the same code
+// SignetBearerGuard runs (SignetBearerVerification, SignetDecision), so a
+// consumer on this path gets the same 401/403/503/500 contract and the same
+// decision log line, written under the subclass's name. Guard it with
+// SignetPassportGuard, or any AuthGuard(SIGNET_JWT_STRATEGY).
+let SignetPrincipalStrategy = class SignetPrincipalStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, strategy_1.SIGNET_JWT_STRATEGY) {
+    logger = new common_1.Logger(this.constructor.name);
+    configService;
+    profiles;
+    options;
+    decision;
+    verification;
+    // Property injection lands after construction, so the verifier (and its
+    // startup line) is built here rather than in the constructor.
+    onModuleInit() {
+        this.verification = new strategy_1.SignetBearerVerification(this.configService, this.profiles, this.options, this.logger);
+    }
+    async validate(request) {
+        if (this.verification === undefined) {
+            throw new Error(`${this.constructor.name}: onModuleInit has not run; register the strategy as a provider`);
+        }
+        const identity = await this.verification.verify(request);
+        if (identity === false)
+            return false;
+        return this.decision.decide(identity, this, {
+            logger: this.logger,
+            source: request.ip,
+        });
+    }
+};
+exports.SignetPrincipalStrategy = SignetPrincipalStrategy;
+__decorate([
+    (0, common_1.Inject)(config_1.ConfigService),
+    __metadata("design:type", config_1.ConfigService)
+], SignetPrincipalStrategy.prototype, "configService", void 0);
+__decorate([
+    (0, common_1.Inject)(deployment_profile_1.SignetDeploymentProfileService),
+    __metadata("design:type", deployment_profile_1.SignetDeploymentProfileService)
+], SignetPrincipalStrategy.prototype, "profiles", void 0);
+__decorate([
+    (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS),
+    __metadata("design:type", Object)
+], SignetPrincipalStrategy.prototype, "options", void 0);
+__decorate([
+    (0, common_1.Inject)(decision_1.SignetDecision),
+    __metadata("design:type", decision_1.SignetDecision)
+], SignetPrincipalStrategy.prototype, "decision", void 0);
+exports.SignetPrincipalStrategy = SignetPrincipalStrategy = __decorate([
+    (0, common_1.Injectable)()
+], SignetPrincipalStrategy);
+//# sourceMappingURL=principal-strategy.js.map

package/dist/principal-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-strategy.js","sourceRoot":"","sources":["../src/principal-strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+E;AAC/E,2CAA+C;AAC/C,+CAAoD;AAEpD,qDAA2C;AAE3C,yCAA4C;AAC5C,6DAAsE;AAEtE,uCAGmB;AAKnB,yCAA2E;AAE3E,uEAAuE;AACvE,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,0BAA0B;AAC1B,EAAE;AACF,kBAAkB;AAClB,6DAA6D;AAC7D,qEAAqE;AACrE,uEAAuE;AACvE,MAAM;AACN,EAAE;AACF,kEAAkE;AAClE,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,8DAA8D;AAEvD,IAAe,uBAAuB,GAAtC,MAAe,uBACpB,SAAQ,IAAA,2BAAgB,EAAC,0BAAQ,EAAE,8BAAmB,CAAC;IAGpC,MAAM,GAAG,IAAI,eAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAG7C,aAAa,CAAiB;IAE9B,QAAQ,CAAkC;IAE1C,OAAO,CAA4B;IAEnC,QAAQ,CAAkB;IACnC,YAAY,CAAuC;IAM3D,wEAAwE;IACxE,8DAA8D;IAC9D,YAAY;QACV,IAAI,CAAC,YAAY,GAAG,IAAI,mCAAwB,CAC9C,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,iEAAiE,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,OAAO,CAAC,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5CqB,0DAAuB;AAO1B;IADhB,IAAA,eAAM,EAAC,sBAAa,CAAC;8BACW,sBAAa;8DAAC;AAE9B;IADhB,IAAA,eAAM,EAAC,mDAA8B,CAAC;8BACX,mDAA8B;yDAAC;AAE1C;IADhB,IAAA,eAAM,EAAC,oCAA0B,CAAC;;wDACiB;AAEnC;IADhB,IAAA,eAAM,EAAC,yBAAc,CAAC;8BACK,yBAAc;yDAAC;kCAbvB,uBAAuB;IAD5C,IAAA,mBAAU,GAAE;GACS,uBAAuB,CA4C5C"}

package/dist/strategy.d.ts

@@ -1,16 +1,22 @@
+import { Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { type Request } from 'express';
 import { SignetDeploymentProfileService } from './deployment-profile';
 import { type VerifiedSignetIdentity } from './jwt-verifier';
 import { type SignetIntegrationOptions } from './options';
 export declare const SIGNET_JWT_STRATEGY = "signet-jwt";
-declare const SignetJwtStrategy_base: new (...args: any[]) => import("passport-custom");
-export declare class SignetJwtStrategy extends SignetJwtStrategy_base {
+export declare class SignetBearerVerification {
     private readonly logger;
     private readonly verifier;
+    constructor(configService: ConfigService, profiles: SignetDeploymentProfileService, options: SignetIntegrationOptions, logger: Logger);
+    verify(request: Request): Promise<VerifiedSignetIdentity | false>;
+    private reject;
+}
+declare const SignetJwtStrategy_base: new (...args: any[]) => import("passport-custom");
+export declare class SignetJwtStrategy extends SignetJwtStrategy_base {
+    private readonly verification;
     constructor(configService: ConfigService, profiles: SignetDeploymentProfileService, options: SignetIntegrationOptions);
     validate(request: Request): Promise<VerifiedSignetIdentity | false>;
-    private reject;
 }
 export declare function bearerToken(request: Request): string | undefined;
 export {};

package/dist/strategy.js

@@ -13,7 +13,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 var SignetJwtStrategy_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SignetJwtStrategy = exports.SIGNET_JWT_STRATEGY = void 0;
+exports.SignetJwtStrategy = exports.SignetBearerVerification = exports.SIGNET_JWT_STRATEGY = void 0;
 exports.bearerToken = bearerToken;
 const common_1 = require("@nestjs/common");
 const config_1 = require("@nestjs/config");
@@ -25,11 +25,10 @@ const jwt_verifier_1 = require("./jwt-verifier");
 const log_sanitise_1 = require("./log-sanitise");
 const options_1 = require("./options");
 exports.SIGNET_JWT_STRATEGY = 'signet-jwt';
-// Extracts `Authorization: Bearer <jwt>` and hands it to JwtVerifier.
-// passport-custom rather than passport-jwt: passport-jwt is a second JWT
-// implementation (jsonwebtoken) with its own JWKS story, and two verifiers
-// means two places to get the algorithm allowlist right. Only Passport's
-// registration and dispatch are borrowed; the cryptography stays in one place.
+// What a Signet strategy does before anything consumer-specific: read the
+// channel's settings once, build the verifier once (the remote JWKS cache
+// lives on it), and turn a request into a verified identity or a logged
+// `false`. SignetJwtStrategy and SignetPrincipalStrategy both hold one.
 //
 // Failure is `false`, never a throw. Passport moves to the next strategy only
 // on fail(); error() short-circuits the chain, and Nest turns a thrown
@@ -38,14 +37,13 @@ exports.SIGNET_JWT_STRATEGY = 'signet-jwt';
 //
 // The log line carries the reason and the source address and NOTHING derived
 // from the token: no fingerprint, no sub.
-let SignetJwtStrategy = SignetJwtStrategy_1 = class SignetJwtStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, exports.SIGNET_JWT_STRATEGY) {
-    logger = new common_1.Logger(SignetJwtStrategy_1.name);
+class SignetBearerVerification {
+    logger;
     verifier;
-    constructor(configService, profiles, options) {
-        super();
+    constructor(configService, profiles, options, logger) {
+        this.logger = logger;
         const config = (0, config_2.readSignetAuthConfig)(options, configService, profiles.profile);
         if (config.signetEnabled) {
-            // Constructed once per process: the remote JWKS cache lives on it.
             this.verifier = new jwt_verifier_1.JwtVerifier(config.jwt);
             this.logger.log(`signet jwt verification loaded: iss=${config.jwt.issuer} aud=${config.jwt.audience}`);
         }
@@ -53,7 +51,7 @@ let SignetJwtStrategy = SignetJwtStrategy_1 = class SignetJwtStrategy extends (0
             this.verifier = null;
         }
     }
-    async validate(request) {
+    async verify(request) {
         if (this.verifier === null)
             return this.reject(request, 'signet_disabled');
         const token = bearerToken(request);
@@ -71,6 +69,25 @@ let SignetJwtStrategy = SignetJwtStrategy_1 = class SignetJwtStrategy extends (0
         this.logger.warn(`signet auth rejected: metric=signet_auth_rejected reason=${(0, log_sanitise_1.sanitiseLogToken)(reason)} source=${(0, log_sanitise_1.sanitiseLogToken)(request.ip ?? 'none')} method=${(0, log_sanitise_1.sanitiseLogToken)(request.method)} route=${(0, log_sanitise_1.sanitiseLogToken)((0, log_sanitise_1.truncate)(request.originalUrl, log_sanitise_1.REFUSAL_ROUTE_MAX))}`);
         return false;
     }
+}
+exports.SignetBearerVerification = SignetBearerVerification;
+// The strategy behind SignetBearerGuard: validate() is verification alone,
+// and the verified identity is what Passport leaves on request.user. The
+// guard then runs the module-wired resolver.
+//
+// passport-custom rather than passport-jwt: passport-jwt is a second JWT
+// implementation (jsonwebtoken) with its own JWKS story, and two verifiers
+// means two places to get the algorithm allowlist right. Only Passport's
+// registration and dispatch are borrowed; the cryptography stays in one place.
+let SignetJwtStrategy = SignetJwtStrategy_1 = class SignetJwtStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, exports.SIGNET_JWT_STRATEGY) {
+    verification;
+    constructor(configService, profiles, options) {
+        super();
+        this.verification = new SignetBearerVerification(configService, profiles, options, new common_1.Logger(SignetJwtStrategy_1.name));
+    }
+    validate(request) {
+        return this.verification.verify(request);
+    }
 };
 exports.SignetJwtStrategy = SignetJwtStrategy;
 exports.SignetJwtStrategy = SignetJwtStrategy = SignetJwtStrategy_1 = __decorate([

package/dist/strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAwFA,kCAIC;AA5FD,2CAA4D;AAC5D,2CAA+C;AAC/C,+CAAoD;AAEpD,qDAA2C;AAE3C,qCAAgD;AAChD,6DAAsE;AACtE,iDAA0E;AAC1E,iDAA+E;AAC/E,uCAGmB;AAEN,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD,sEAAsE;AACtE,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,0CAA0C;AAEnC,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,IAAA,2BAAgB,EACrD,0BAAQ,EACR,2BAAmB,CACpB;IACkB,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAqB;IAE9C,YACE,aAA4B,EAC5B,QAAwC,EACJ,OAAiC;QAErE,KAAK,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,IAAA,6BAAoB,EACjC,OAAO,EACP,aAAa,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;QACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,mEAAmE;YACnE,IAAI,CAAC,QAAQ,GAAG,IAAI,0BAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uCAAuC,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAChB,OAAO,EACP,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,OAAgB,EAAE,MAAc;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,IAAA,+BAAgB,EAAC,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAA,+BAAgB,EAAC,IAAA,uBAAQ,EAAC,OAAO,CAAC,WAAW,EAAE,gCAAiB,CAAC,CAAC,EAAE,CAC/P,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAnDY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAWR,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;qCAFpB,sBAAa;QAClB,mDAA8B;GAT/B,iBAAiB,CAmD7B;AAED,yEAAyE;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,8DAA8D;AAC9D,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAC5B,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5C,EAAE,CAAC,CAAC,CAAC,CAAC;AACT,CAAC"}
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../src/strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAmHA,kCAIC;AAvHD,2CAA4D;AAC5D,2CAA+C;AAC/C,+CAAoD;AAEpD,qDAA2C;AAE3C,qCAAgD;AAChD,6DAAsE;AACtE,iDAA0E;AAC1E,iDAA+E;AAC/E,uCAGmB;AAEN,QAAA,mBAAmB,GAAG,YAAY,CAAC;AAEhD,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAC9E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,0CAA0C;AAC1C,MAAa,wBAAwB;IAOhB;IANF,QAAQ,CAAqB;IAE9C,YACE,aAA4B,EAC5B,QAAwC,EACxC,OAAiC,EAChB,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QAE/B,MAAM,MAAM,GAAG,IAAA,6BAAoB,EACjC,OAAO,EACP,aAAa,EACb,QAAQ,CAAC,OAAO,CACjB,CAAC;QACF,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,GAAG,IAAI,0BAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uCAAuC,MAAM,CAAC,GAAG,CAAC,MAAM,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAgB;QAC3B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAChB,OAAO,EACP,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,MAAM,CAAC,OAAgB,EAAE,MAAc;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4DAA4D,IAAA,+BAAgB,EAAC,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,WAAW,IAAA,+BAAgB,EAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAA,+BAAgB,EAAC,IAAA,uBAAQ,EAAC,OAAO,CAAC,WAAW,EAAE,gCAAiB,CAAC,CAAC,EAAE,CAC/P,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AA9CD,4DA8CC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,6CAA6C;AAC7C,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,+EAA+E;AAExE,IAAM,iBAAiB,yBAAvB,MAAM,iBAAkB,SAAQ,IAAA,2BAAgB,EACrD,0BAAQ,EACR,2BAAmB,CACpB;IACkB,YAAY,CAA2B;IAExD,YACE,aAA4B,EAC5B,QAAwC,EACJ,OAAiC;QAErE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,wBAAwB,CAC9C,aAAa,EACb,QAAQ,EACR,OAAO,EACP,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CACnC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,OAAgB;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AAvBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;qCAFpB,sBAAa;QAClB,mDAA8B;GAR/B,iBAAiB,CAuB7B;AAED,yEAAyE;AACzE,uEAAuE;AACvE,gEAAgE;AAChE,8DAA8D;AAC9D,SAAgB,WAAW,CAAC,OAAgB;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAC5B,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5C,EAAE,CAAC,CAAC,CAAC,CAAC;AACT,CAAC"}