@nauth-toolkit/core 0.3.0 → 0.3.1

package/dist/services/api-key.service.js

@@ -0,0 +1,378 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyService = void 0;
+const crypto_1 = require("crypto");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enum");
+const ip_match_1 = require("../utils/ip-match");
+/**
+ * API Key Service
+ *
+ * Manages the lifecycle of API keys (create/list/update/revoke/delete) and validates
+ * keys presented on requests. Keys authenticate as their owning user.
+ *
+ * Security:
+ * - Only a SHA-256 hash of the full key is stored; the plaintext is returned once at creation.
+ * - Lookup uses a non-secret, indexed `lookupId`; the secret is compared in constant time.
+ * - Per-key IP allowlists (optional) restrict which source IPs may use a key.
+ *
+ * @remarks
+ * This service does NOT enforce endpoint authorization. Route protection (which endpoints
+ * accept API keys) is the responsibility of the framework adapter (guard/middleware).
+ */
+class ApiKeyService {
+    apiKeyRepository;
+    userRepository;
+    config;
+    logger;
+    auditService;
+    constructor(apiKeyRepository, userRepository, config, logger, auditService) {
+        this.apiKeyRepository = apiKeyRepository;
+        this.userRepository = userRepository;
+        this.config = config;
+        this.logger = logger;
+        this.auditService = auditService;
+        this.logger?.log?.('ApiKeyService initialized');
+    }
+    /**
+     * Create a new API key.
+     *
+     * @param params - Creation parameters (owning userId is required)
+     * @returns The plaintext key (shown once) plus sanitized metadata
+     * @throws {NAuthException} API_KEY_CREATION_DISABLED, API_KEY_LIMIT_REACHED,
+     *   API_KEY_EXPIRY_REQUIRED, API_KEY_INDEFINITE_NOT_ALLOWED, API_KEY_EXPIRY_TOO_LONG,
+     *   VALIDATION_FAILED (invalid IP allowlist), USER_NOT_FOUND
+     */
+    async createKey(params) {
+        const cfg = this.config.apiKeys ?? {};
+        // Creation-rights gate: only admins may create keys unless user creation is enabled.
+        if (!params.createdByAdmin && cfg.allowUserCreation !== true) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_CREATION_DISABLED, 'API key creation is disabled for users. Contact an administrator.');
+        }
+        const user = await this.userRepository.findOne({ where: { id: params.userId } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USER_NOT_FOUND, 'User not found');
+        }
+        // Enforce per-user active key limit.
+        const maxKeys = cfg.maxKeysPerUser ?? 10;
+        const activeCount = await this.apiKeyRepository.count({ where: { userId: params.userId, isActive: true } });
+        if (activeCount >= maxKeys) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_LIMIT_REACHED, `Maximum of ${maxKeys} active API keys reached.`, {
+                maxKeysPerUser: maxKeys,
+            });
+        }
+        const expiresAt = this.resolveExpiry(params.expiresInDays);
+        const allowedIps = this.normalizeAllowedIps(params.allowedIps);
+        // Generate the key material.
+        const keyId = (0, crypto_1.randomUUID)();
+        const lookupId = (0, crypto_1.randomBytes)(8).toString('hex'); // 16 non-secret hex chars
+        const secret = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const prefix = cfg.keyPrefix ?? 'nauth';
+        const fullKey = `${prefix}_${lookupId}.${secret}`;
+        const keyHash = this.hashKey(fullKey);
+        const entity = this.apiKeyRepository.create({
+            keyId,
+            userId: params.userId,
+            lookupId,
+            keyHash,
+            name: params.name ?? null,
+            lastFour: secret.slice(-4),
+            allowedIps: allowedIps.length > 0 ? allowedIps : null,
+            expiresAt,
+            isActive: true,
+            createdByAdmin: params.createdByAdmin === true,
+            usageCount: 0,
+        });
+        const saved = await this.apiKeyRepository.save(entity);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_CREATED, params.userId, 'SUCCESS', {
+            keyId,
+            createdByAdmin: entity.createdByAdmin,
+            hasExpiry: expiresAt !== null,
+            ipRestricted: allowedIps.length > 0,
+        });
+        return { key: fullKey, apiKey: this.toResponse(saved) };
+    }
+    /**
+     * Update a key's mutable fields (name and IP allowlist).
+     * The secret and expiry are immutable — rotate/extend by deleting and recreating.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND, VALIDATION_FAILED
+     */
+    async updateKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (params.name !== undefined) {
+            key.name = params.name ?? null;
+        }
+        if (params.allowedIps !== undefined) {
+            const allowedIps = this.normalizeAllowedIps(params.allowedIps);
+            key.allowedIps = allowedIps.length > 0 ? allowedIps : null;
+        }
+        const saved = await this.apiKeyRepository.save(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_UPDATED, params.userId, 'INFO', { keyId: params.keyId });
+        return this.toResponse(saved);
+    }
+    /**
+     * List all keys owned by a user (sanitized; never includes secrets).
+     */
+    async listKeys(userId) {
+        const keys = await this.apiKeyRepository.find({
+            where: { userId },
+            order: { createdAt: 'DESC' },
+        });
+        return keys.map((k) => this.toResponse(k));
+    }
+    /**
+     * Revoke (soft-delete) a key. The record is retained for audit history.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND
+     */
+    async revokeKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (key.isActive) {
+            key.isActive = false;
+            key.revokedAt = new Date();
+            key.revokeReason = params.reason ?? 'user_revoked';
+            await this.apiKeyRepository.save(key);
+        }
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_REVOKED, params.userId, 'INFO', { keyId: params.keyId });
+        return { success: true };
+    }
+    /**
+     * Permanently delete a key.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND
+     */
+    async deleteKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        await this.apiKeyRepository.remove(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_DELETED, params.userId, 'INFO', { keyId: params.keyId });
+        return { success: true };
+    }
+    /**
+     * Validate a presented API key and resolve its owner.
+     *
+     * On any failure this throws a precise {@link NAuthException} (access denied) — callers
+     * MUST NOT fall back to other credentials.
+     *
+     * @param rawKey - The full plaintext key from the request header
+     * @param callerIp - Source IP of the request (for IP-allowlist enforcement + usage tracking)
+     * @returns The owning user's identifiers on success
+     * @throws {NAuthException} API_KEY_INVALID, API_KEY_EXPIRED, API_KEY_IP_NOT_ALLOWED
+     */
+    async validateKey(rawKey, callerIp) {
+        const lookupId = this.parseLookupId(rawKey);
+        if (!lookupId) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, null, 'FAILURE', { reason: 'malformed' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        const key = await this.apiKeyRepository.findOne({ where: { lookupId } });
+        if (!key || !key.isActive || !this.hashesEqual(key.keyHash, this.hashKey(rawKey))) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key?.userId ?? null, 'FAILURE', { reason: 'invalid' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        if (key.isExpired()) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'expired',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRED, 'API key has expired');
+        }
+        if (!key.isIpAllowed(callerIp, ip_match_1.ipMatchesEntry)) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'SUSPICIOUS', {
+                keyId: key.keyId,
+                reason: 'ip_not_allowed',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_IP_NOT_ALLOWED, 'API key not permitted from this IP address');
+        }
+        // Resolve the owner's external id (sub) so callers can load the shared auth context.
+        const owner = await this.userRepository.findOne({
+            where: { id: key.userId },
+            select: { id: true, sub: true, isActive: true },
+        });
+        if (!owner || !owner.isActive) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'owner_inactive',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        await this.recordUsage(key, callerIp ?? null);
+        return { keyId: key.keyId, userId: key.userId, sub: owner.sub };
+    }
+    // ==========================================================================
+    // Internal helpers
+    // ==========================================================================
+    /**
+     * Resolve the mandatory, config-bounded expiry.
+     */
+    resolveExpiry(expiresInDays) {
+        const cfg = this.config.apiKeys ?? {};
+        if (expiresInDays === undefined) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_REQUIRED, 'An expiry must be specified when creating an API key (a number of days, or null for never).');
+        }
+        if (expiresInDays === null) {
+            if (cfg.allowIndefinite === false) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INDEFINITE_NOT_ALLOWED, 'Non-expiring API keys are not allowed. Specify an expiry in days.');
+            }
+            return null;
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays < 1) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'expiresInDays must be a positive integer or null.');
+        }
+        if (typeof cfg.maxExpiryDays === 'number' && expiresInDays > cfg.maxExpiryDays) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_TOO_LONG, `Expiry exceeds the maximum of ${cfg.maxExpiryDays} days.`, { maxExpiryDays: cfg.maxExpiryDays });
+        }
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + expiresInDays);
+        return expiresAt;
+    }
+    /**
+     * Validate and normalize an IP allowlist per configuration.
+     */
+    normalizeAllowedIps(allowedIps) {
+        const cfg = this.config.apiKeys ?? {};
+        const ipCfg = cfg.ipRestrictions ?? {};
+        // When IP restrictions are disabled, allowlists are ignored entirely.
+        if (ipCfg.enabled === false) {
+            if (allowedIps && allowedIps.length > 0) {
+                this.logger?.debug?.('[ApiKey] IP restrictions disabled - ignoring provided allowedIps');
+            }
+            return [];
+        }
+        const normalized = (allowedIps ?? []).map((e) => e.trim()).filter((e) => e.length > 0);
+        if (ipCfg.requireForNewKeys === true && normalized.length === 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'An IP allowlist is required for new API keys (apiKeys.ipRestrictions.requireForNewKeys).');
+        }
+        const maxIps = ipCfg.maxIpsPerKey ?? 20;
+        if (normalized.length > maxIps) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `An API key may have at most ${maxIps} IP entries.`, {
+                maxIpsPerKey: maxIps,
+            });
+        }
+        const invalid = normalized.filter((e) => !(0, ip_match_1.isValidIpOrCidr)(e));
+        if (invalid.length > 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'allowedIps contains invalid IP or CIDR entries.', {
+                invalid,
+            });
+        }
+        return normalized;
+    }
+    /**
+     * Compute the SHA-256 hex hash of a full key string.
+     */
+    hashKey(rawKey) {
+        return (0, crypto_1.createHash)('sha256').update(rawKey).digest('hex');
+    }
+    /**
+     * Constant-time comparison of two equal-length hex hashes.
+     */
+    hashesEqual(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        try {
+            return (0, crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Extract the non-secret lookup id from a raw key of the form `prefix_lookupId.secret`.
+     */
+    parseLookupId(rawKey) {
+        if (typeof rawKey !== 'string') {
+            return null;
+        }
+        const dotIndex = rawKey.indexOf('.');
+        if (dotIndex <= 0) {
+            return null;
+        }
+        const head = rawKey.slice(0, dotIndex); // prefix_lookupId
+        const underscoreIndex = head.lastIndexOf('_');
+        if (underscoreIndex < 0 || underscoreIndex === head.length - 1) {
+            return null;
+        }
+        return head.slice(underscoreIndex + 1);
+    }
+    /**
+     * Update last-used metadata, throttled to avoid a write on every request.
+     * Never throws — usage tracking must not block authentication.
+     */
+    async recordUsage(key, callerIp) {
+        const cfg = this.config.apiKeys ?? {};
+        const throttleMs = (cfg.lastUsedThrottleSeconds ?? 60) * 1000;
+        const now = Date.now();
+        const last = key.lastUsedAt ? key.lastUsedAt.getTime() : 0;
+        if (last !== 0 && now - last < throttleMs) {
+            return; // Within throttle window - skip write and audit noise.
+        }
+        try {
+            const update = {
+                lastUsedAt: new Date(now),
+            };
+            if (cfg.trackUsageIp !== false) {
+                update.lastUsedIp = callerIp;
+            }
+            await this.apiKeyRepository.update({ id: key.id }, update);
+            // Atomic increment avoids lost updates under concurrent use (read-modify-write race).
+            await this.apiKeyRepository.increment({ id: key.id }, 'usageCount', 1);
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_USED, key.userId, 'SUCCESS', { keyId: key.keyId });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record usage for key ${key.keyId}: ${message}`);
+        }
+    }
+    /**
+     * Build a sanitized response DTO from an entity.
+     */
+    toResponse(key) {
+        return {
+            keyId: key.keyId,
+            name: key.name ?? null,
+            lastFour: key.lastFour ?? null,
+            allowedIps: key.allowedIps ?? null,
+            expiresAt: key.expiresAt ?? null,
+            isActive: key.isActive,
+            createdByAdmin: key.createdByAdmin,
+            lastUsedAt: key.lastUsedAt ?? null,
+            lastUsedIp: key.lastUsedIp ?? null,
+            usageCount: key.usageCount ?? 0,
+            createdAt: key.createdAt,
+        };
+    }
+    /**
+     * Record an audit event (no-op when audit logging is disabled). Never throws.
+     */
+    async audit(eventType, userId, eventStatus, metadata) {
+        if (!this.auditService) {
+            return;
+        }
+        try {
+            await this.auditService.recordEvent({
+                userId: userId ?? undefined,
+                eventType,
+                eventStatus,
+                authMethod: 'api-key',
+                metadata,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record audit event ${eventType}: ${message}`);
+        }
+    }
+}
+exports.ApiKeyService = ApiKeyService;
+//# sourceMappingURL=api-key.service.js.map

package/dist/services/api-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.service.js","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":";;;AACA,mCAA8E;AAK9E,mEAA+D;AAC/D,gEAA0D;AAC1D,oFAAyE;AACzE,gDAAoE;AAuCpE;;;;;;;;;;;;;;GAcG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IACA;IACA;IALnB,YACmB,gBAAwC,EACxC,cAAoC,EACpC,MAAmB,EACnB,MAAmB,EACnB,YAAuC;QAJvC,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,mBAAc,GAAd,cAAc,CAAsB;QACpC,WAAM,GAAN,MAAM,CAAa;QACnB,WAAM,GAAN,MAAM,CAAa;QACnB,iBAAY,GAAZ,YAAY,CAA2B;QAExD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0B;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,qFAAqF;QACrF,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,yBAAyB,EACvC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QAED,qCAAqC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,qBAAqB,EAAE,cAAc,OAAO,2BAA2B,EAAE;gBAC9G,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/D,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B;QAC3E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ;YACR,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;YAC9C,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE;YAC7E,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,SAAS,EAAE,SAAS,KAAK,IAAI;YAC7B,YAAY,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;SACpC,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0B;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/D,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0D;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;YACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAyC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAwB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACnG,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,yBAAc,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE;gBACjF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,sBAAsB,EAAE,4CAA4C,CAAC,CAAC;QAC/G,CAAC;QAED,qFAAqF;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;YACzB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;QAE9C,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAClE,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACK,aAAa,CAAC,aAAwC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,8BAA8B,EAC5C,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QACjH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,aAAa,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/E,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,iCAAiC,GAAG,CAAC,aAAa,QAAQ,EAC1D,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,UAAgC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QAEvC,sEAAsE;QACtE,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kEAAkE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,iBAAiB,EAC/B,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,+BAA+B,MAAM,cAAc,EAAE;gBAC7G,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;gBAC3G,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,MAAc;QAC5B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,CAAS,EAAE,CAAS;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB;QAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,GAAe,EAAE,QAAuB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3D,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,EAAE,CAAC;YAC1C,OAAO,CAAC,uDAAuD;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAqD;gBAC/D,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;aAC1B,CAAC;YACF,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,sFAAsF;YACtF,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YAEvE,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,2CAA2C,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAe;QAChC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CACjB,SAA6B,EAC7B,MAAqB,EACrB,WAA0D,EAC1D,QAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAClC,MAAM,EAAE,MAAM,IAAI,SAAS;gBAC3B,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,SAAS;gBACrB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,yCAAyC,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;CACF;AApaD,sCAoaC"}

package/dist/utils/index.d.ts

@@ -3,6 +3,7 @@
  */
 export * from './pii-redactor';
 export * from './ip-extractor';
+export * from './ip-match';
 export * from './nauth-logger';
 export * from './cookies.util';
 export * from './cookie-names.util';

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -19,6 +19,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./pii-redactor"), exports);
 __exportStar(require("./ip-extractor"), exports);
+__exportStar(require("./ip-match"), exports);
 __exportStar(require("./nauth-logger"), exports);
 __exportStar(require("./cookies.util"), exports);
 __exportStar(require("./cookie-names.util"), exports);

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,iDAA+B;AAC/B,iDAA+B;AAC/B,iDAA+B;AAC/B,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC;AAClC,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,wFAAwF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;AAEH,iDAA+B;AAC/B,iDAA+B;AAC/B,6CAA2B;AAC3B,iDAA+B;AAC/B,iDAA+B;AAC/B,sDAAoC;AACpC,oDAAkC;AAClC,0DAAwC;AACxC,uDAAqC;AACrC,kDAAgC;AAChC,wFAAwF"}

package/dist/utils/ip-match.d.ts

@@ -0,0 +1,44 @@
+/**
+ * IP Allowlist Matching
+ *
+ * Utilities for matching a source IP against an allowlist entry that may be an
+ * exact IPv4/IPv6 address or an IPv4 CIDR range. Used to enforce per-API-key IP
+ * restrictions.
+ *
+ * @remarks
+ * IPv4 CIDR ranges (e.g. `10.0.0.0/8`) and exact IPv4/IPv6 addresses are supported.
+ * IPv6 CIDR ranges are not expanded; provide exact IPv6 addresses instead.
+ */
+/**
+ * Validate whether a string is a valid IP address or IPv4 CIDR range.
+ *
+ * @param entry - Candidate allowlist entry
+ * @returns true if the entry is a usable IP or IPv4 CIDR
+ *
+ * @example
+ * ```typescript
+ * isValidIpOrCidr('203.0.113.4');   // true
+ * isValidIpOrCidr('10.0.0.0/8');    // true
+ * isValidIpOrCidr('not-an-ip');     // false
+ * ```
+ */
+export declare function isValidIpOrCidr(entry: string): boolean;
+/**
+ * Determine whether a source IP matches a single allowlist entry.
+ *
+ * Supports:
+ * - Exact IPv4/IPv6 match (case-insensitive for IPv6)
+ * - IPv4 CIDR range match (e.g. `10.0.0.0/8`)
+ *
+ * @param ip - Source IP of the request
+ * @param entry - Allowlist entry (IP or IPv4 CIDR)
+ * @returns true if the IP is covered by the entry
+ *
+ * @example
+ * ```typescript
+ * ipMatchesEntry('10.1.2.3', '10.0.0.0/8'); // true
+ * ipMatchesEntry('203.0.113.4', '203.0.113.4'); // true
+ * ```
+ */
+export declare function ipMatchesEntry(ip: string, entry: string): boolean;
+//# sourceMappingURL=ip-match.d.ts.map

package/dist/utils/ip-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.d.ts","sourceRoot":"","sources":["../../src/utils/ip-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAuCH;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAetD;AAkBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAwBjE"}

package/dist/utils/ip-match.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * IP Allowlist Matching
+ *
+ * Utilities for matching a source IP against an allowlist entry that may be an
+ * exact IPv4/IPv6 address or an IPv4 CIDR range. Used to enforce per-API-key IP
+ * restrictions.
+ *
+ * @remarks
+ * IPv4 CIDR ranges (e.g. `10.0.0.0/8`) and exact IPv4/IPv6 addresses are supported.
+ * IPv6 CIDR ranges are not expanded; provide exact IPv6 addresses instead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidIpOrCidr = isValidIpOrCidr;
+exports.ipMatchesEntry = ipMatchesEntry;
+/**
+ * Validate a dotted-quad IPv4 string (octet range enforced).
+ */
+function isIpv4(value) {
+    const ipv4 = /^(\d{1,3}\.){3}\d{1,3}$/;
+    if (!ipv4.test(value)) {
+        return false;
+    }
+    return value
+        .split('.')
+        .map(Number)
+        .every((part) => part >= 0 && part <= 255);
+}
+/**
+ * Validate whether a string is a plausible IPv4 or IPv6 address.
+ *
+ * Accepts IPv4, IPv4-mapped IPv6 (e.g. `::ffff:192.168.0.1`), and general IPv6.
+ * Rejects malformed IPv6 with more than one `::` compression.
+ */
+function isIpAddress(value) {
+    if (isIpv4(value)) {
+        return true;
+    }
+    // IPv4-mapped IPv6, e.g. ::ffff:203.0.113.4
+    const mapped = value.match(/^::ffff:(.+)$/i);
+    if (mapped) {
+        return isIpv4(mapped[1]);
+    }
+    // General IPv6: at most one "::" compression allowed.
+    if ((value.match(/::/g) ?? []).length > 1) {
+        return false;
+    }
+    const ipv6 = /^([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}$/;
+    return ipv6.test(value);
+}
+/**
+ * Validate whether a string is a valid IP address or IPv4 CIDR range.
+ *
+ * @param entry - Candidate allowlist entry
+ * @returns true if the entry is a usable IP or IPv4 CIDR
+ *
+ * @example
+ * ```typescript
+ * isValidIpOrCidr('203.0.113.4');   // true
+ * isValidIpOrCidr('10.0.0.0/8');    // true
+ * isValidIpOrCidr('not-an-ip');     // false
+ * ```
+ */
+function isValidIpOrCidr(entry) {
+    if (typeof entry !== 'string' || entry.trim().length === 0) {
+        return false;
+    }
+    const trimmed = entry.trim();
+    if (trimmed.includes('/')) {
+        const [base, prefixStr] = trimmed.split('/');
+        const prefix = Number(prefixStr);
+        // Only IPv4 CIDR is supported for range matching.
+        if (!isIpv4(base)) {
+            return false;
+        }
+        return Number.isInteger(prefix) && prefix >= 0 && prefix <= 32;
+    }
+    return isIpAddress(trimmed);
+}
+/**
+ * Convert an IPv4 dotted-quad string to a 32-bit unsigned integer.
+ */
+function ipv4ToInt(ip) {
+    const ipv4 = /^(\d{1,3}\.){3}\d{1,3}$/;
+    if (!ipv4.test(ip)) {
+        return null;
+    }
+    const parts = ip.split('.').map(Number);
+    if (!parts.every((p) => p >= 0 && p <= 255)) {
+        return null;
+    }
+    // Unsigned 32-bit via >>> 0
+    return ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0;
+}
+/**
+ * Determine whether a source IP matches a single allowlist entry.
+ *
+ * Supports:
+ * - Exact IPv4/IPv6 match (case-insensitive for IPv6)
+ * - IPv4 CIDR range match (e.g. `10.0.0.0/8`)
+ *
+ * @param ip - Source IP of the request
+ * @param entry - Allowlist entry (IP or IPv4 CIDR)
+ * @returns true if the IP is covered by the entry
+ *
+ * @example
+ * ```typescript
+ * ipMatchesEntry('10.1.2.3', '10.0.0.0/8'); // true
+ * ipMatchesEntry('203.0.113.4', '203.0.113.4'); // true
+ * ```
+ */
+function ipMatchesEntry(ip, entry) {
+    if (!ip || !entry) {
+        return false;
+    }
+    const normalizedIp = ip.trim().replace(/^::ffff:/i, '');
+    const normalizedEntry = entry.trim();
+    if (normalizedEntry.includes('/')) {
+        const [base, prefixStr] = normalizedEntry.split('/');
+        const prefix = Number(prefixStr);
+        const ipInt = ipv4ToInt(normalizedIp);
+        const baseInt = ipv4ToInt(base);
+        if (ipInt === null || baseInt === null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) {
+            return false;
+        }
+        if (prefix === 0) {
+            return true;
+        }
+        const mask = (0xffffffff << (32 - prefix)) >>> 0;
+        return (ipInt & mask) === (baseInt & mask);
+    }
+    // Exact match (case-insensitive to accommodate IPv6 hex casing)
+    return normalizedIp.toLowerCase() === normalizedEntry.replace(/^::ffff:/i, '').toLowerCase();
+}
+//# sourceMappingURL=ip-match.js.map

package/dist/utils/ip-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.js","sourceRoot":"","sources":["../../src/utils/ip-match.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAoDH,0CAeC;AAmCD,wCAwBC;AA5HD;;GAEG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,IAAI,GAAG,yBAAyB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,MAAM,CAAC;SACX,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4CAA4C;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,sDAAsD;IACtD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,4CAA4C,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,eAAe,CAAC,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,IAAI,GAAG,yBAAyB,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,4BAA4B;IAC5B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,gEAAgE;IAChE,OAAO,YAAY,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/F,CAAC"}

package/dist/utils/setup/get-repositories.d.ts

@@ -5,7 +5,7 @@
  * Supports both explicit entity names and table name matching.
  */
 import { DataSource, Repository } from 'typeorm';
-import { BaseUser, BaseSession, BaseLoginAttempt, BaseVerificationToken, BaseSocialAccount, BaseChallengeSession, BaseMFADevice, BaseAuthAudit, BaseTrustedDevice, BaseRateLimit, BaseStorageLock, BaseSocialProviderSecret } from '../../entities';
+import { BaseUser, BaseSession, BaseLoginAttempt, BaseVerificationToken, BaseSocialAccount, BaseChallengeSession, BaseMFADevice, BaseAuthAudit, BaseTrustedDevice, BaseRateLimit, BaseStorageLock, BaseSocialProviderSecret, BaseApiKey } from '../../entities';
 /**
  * Get all required repositories from DataSource
  *
@@ -29,5 +29,6 @@ export declare function getRepositories(dataSource: DataSource): {
     rateLimitRepository: Repository<BaseRateLimit> | null;
     storageLockRepository: Repository<BaseStorageLock> | null;
     socialProviderSecretRepository: Repository<BaseSocialProviderSecret>;
+    apiKeyRepository: Repository<BaseApiKey> | null;
 };
 //# sourceMappingURL=get-repositories.d.ts.map

package/dist/utils/setup/get-repositories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-repositories.d.ts","sourceRoot":"","sources":["../../../src/utils/setup/get-repositories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAkB,UAAU,EAAiB,MAAM,SAAS,CAAC;AAEhF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,wBAAwB,EACzB,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG;IACvD,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,iBAAiB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACrD,2BAA2B,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAC/D,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACvD,0BAA0B,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC7D,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC/C,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC/C,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;IAC9D,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACtD,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAC1D,8BAA8B,EAAE,UAAU,CAAC,wBAAwB,CAAC,CAAC;CACtE,CA4DA"}
+{"version":3,"file":"get-repositories.d.ts","sourceRoot":"","sources":["../../../src/utils/setup/get-repositories.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAkB,UAAU,EAAiB,MAAM,SAAS,CAAC;AAEhF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,wBAAwB,EACxB,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG;IACvD,cAAc,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,iBAAiB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAC3C,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACrD,2BAA2B,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAC/D,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACvD,0BAA0B,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC7D,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC/C,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;IAC/C,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAAC,GAAG,IAAI,CAAC;IAC9D,mBAAmB,EAAE,UAAU,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;IACtD,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;IAC1D,8BAA8B,EAAE,UAAU,CAAC,wBAAwB,CAAC,CAAC;IACrE,gBAAgB,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;CACjD,CA8DA"}

package/dist/utils/setup/get-repositories.js

@@ -32,6 +32,8 @@ function getRepositories(dataSource) {
         trustedDeviceRepository: getRepository(dataSource, 'TrustedDevice', 'nauth_trusted_devices', false),
         rateLimitRepository: getRepository(dataSource, 'RateLimit', 'nauth_rate_limits', false),
         storageLockRepository: getRepository(dataSource, 'StorageLock', 'nauth_storage_locks', false),
+        // Optional - only present when the API keys feature is enabled and the entity is registered
+        apiKeyRepository: getRepository(dataSource, 'ApiKey', 'nauth_api_keys', false),
         socialProviderSecretRepository: (() => {
             try {
                 return getRepository(dataSource, 'SocialProviderSecret', 'nauth_social_provider_secrets', true);