@nolag/core 0.4.0

package/dist/modules/actorTokenModule/actorToken.module.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenModule = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const actorAppAccess_entity_1 = require("./actorAppAccess.entity");
+const actorToken_entity_1 = require("./actorToken.entity");
+const actorToken_facade_1 = require("./actorToken.facade");
+const actorToken_repository_1 = require("./actorToken.repository");
+const actorToken_service_1 = require("./actorToken.service");
+const actorTokenState_repository_1 = require("./actorTokenState.repository");
+const actorToken_query_service_1 = require("./query/actorToken.query.service");
+const actorTokenState_entity_1 = require("./actorTokenState.entity");
+let ActorTokenModule = class ActorTokenModule {
+};
+exports.ActorTokenModule = ActorTokenModule;
+exports.ActorTokenModule = ActorTokenModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            typeorm_1.TypeOrmModule.forFeature([actorToken_entity_1.ActorTokenEntity, actorTokenState_entity_1.ActorTokenStateEntity, actorAppAccess_entity_1.ActorAppAccessEntity]),
+        ],
+        providers: [
+            actorToken_service_1.ActorTokenService,
+            actorToken_query_service_1.ActorTokenQueryService,
+            actorTokenState_repository_1.ActorTokenStateRepository,
+            actorToken_facade_1.ActorTokenFacade,
+            {
+                provide: actorToken_repository_1.ActorTokenRepository,
+                useFactory: (ds) => new actorToken_repository_1.ActorTokenRepository(ds),
+                inject: [(0, typeorm_1.getDataSourceToken)()],
+            },
+        ],
+        exports: [actorToken_facade_1.ActorTokenFacade],
+    })
+], ActorTokenModule);

package/dist/modules/actorTokenModule/actorToken.repository.d.ts

@@ -0,0 +1,11 @@
+import { DataSource, Repository, UpdateResult } from "typeorm";
+import { ActorTokenEntity } from "./actorToken.entity";
+export declare class ActorTokenRepository extends Repository<ActorTokenEntity> {
+    private readonly dataSource;
+    constructor(dataSource: DataSource);
+    findByKeyId(keyId: string): Promise<ActorTokenEntity | null>;
+    findByKeyIdAndProject(keyId: string, projectId: string): Promise<ActorTokenEntity | null>;
+    findById(actorTokenId: string): Promise<ActorTokenEntity | null>;
+    updateLastUsed(actorTokenId: string): Promise<UpdateResult>;
+}
+//# sourceMappingURL=actorToken.repository.d.ts.map

package/dist/modules/actorTokenModule/actorToken.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actorToken.repository.d.ts","sourceRoot":"","sources":["../../../src/modules/actorTokenModule/actorToken.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAU,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,qBACa,oBAAqB,SAAQ,UAAU,CAAC,gBAAgB,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IASnD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAI5D,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMnC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAQhE,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CAG5D"}

package/dist/modules/actorTokenModule/actorToken.repository.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const actorToken_entity_1 = require("./actorToken.entity");
+let ActorTokenRepository = class ActorTokenRepository extends typeorm_1.Repository {
+    dataSource;
+    constructor(dataSource) {
+        super(actorToken_entity_1.ActorTokenEntity, dataSource.createEntityManager());
+        this.dataSource = dataSource;
+    }
+    findByKeyId(keyId) {
+        return this.findOne({ where: { keyId, deletedAt: (0, typeorm_1.IsNull)() } });
+    }
+    findByKeyIdAndProject(keyId, projectId) {
+        return this.findOne({
+            where: { keyId, projectId, deletedAt: (0, typeorm_1.IsNull)() },
+        });
+    }
+    findById(actorTokenId) {
+        return this.findOne({ where: { actorTokenId, deletedAt: (0, typeorm_1.IsNull)() } });
+    }
+    updateLastUsed(actorTokenId) {
+        return this.update({ actorTokenId }, { lastUsedAt: new Date() });
+    }
+};
+exports.ActorTokenRepository = ActorTokenRepository;
+exports.ActorTokenRepository = ActorTokenRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], ActorTokenRepository);

package/dist/modules/actorTokenModule/actorToken.service.d.ts

@@ -0,0 +1,26 @@
+import { GeneratedCredential } from "../../common/utils/secretHash";
+import { EntityManager, UpdateResult } from "typeorm";
+import { ActorTokenEntity } from "./actorToken.entity";
+import { ActorTokenCreateDto, ActorTokenPatchDto, CreatedActorToken } from "./dto/actorToken.dto";
+import { ActorTokenRepository } from "./actorToken.repository";
+import { EActorTokenPrefix } from "./enum/EActorTokenPrefix.enum";
+export declare class ActorTokenService {
+    private readonly _actorTokenRepository;
+    private readonly _logger;
+    private readonly _authCache;
+    constructor(_actorTokenRepository: ActorTokenRepository);
+    generateActorToken(environmentPrefix?: EActorTokenPrefix): GeneratedCredential;
+    authenticateActorToken(accessToken: string): Promise<ActorTokenEntity | null>;
+    getActiveActorByKeyId(keyId: string): Promise<ActorTokenEntity | null>;
+    findByKeyIdAndProject(keyId: string, projectId: string): Promise<ActorTokenEntity | null>;
+    private _isUsable;
+    private _touch;
+    private _repo;
+    findByIdAndProject(actorTokenId: string, projectId: string, manager?: EntityManager): Promise<ActorTokenEntity | null>;
+    listByProjectId(projectId: string): Promise<ActorTokenEntity[]>;
+    createActorToken(projectId: string, data: ActorTokenCreateDto, manager?: EntityManager): Promise<CreatedActorToken>;
+    updateLock(actorTokenId: string, projectId: string, manager: EntityManager): Promise<ActorTokenEntity | null>;
+    patchActorToken(actorTokenId: string, projectId: string, data: ActorTokenPatchDto, manager?: EntityManager): Promise<ActorTokenEntity>;
+    removeActorToken(actorTokenId: string, projectId: string, manager?: EntityManager): Promise<UpdateResult>;
+}
+//# sourceMappingURL=actorToken.service.d.ts.map

package/dist/modules/actorTokenModule/actorToken.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actorToken.service.d.ts","sourceRoot":"","sources":["../../../src/modules/actorTokenModule/actorToken.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,mBAAmB,EAGpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,aAAa,EAAU,YAAY,EAAE,MAAM,SAAS,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAQlE,qBACa,iBAAiB;IAYhB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAXlD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAS9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0C;gBAExC,qBAAqB,EAAE,oBAAoB;IAExE,kBAAkB,CAChB,iBAAiB,GAAE,iBAA0C,GAC5D,mBAAmB;IAWhB,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IA0C7B,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAe5E,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAKnC,OAAO,CAAC,SAAS;IAuBjB,OAAO,CAAC,MAAM;IAad,OAAO,CAAC,KAAK;IAMb,kBAAkB,CAChB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAMnC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAazD,gBAAgB,CACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,iBAAiB,CAAC;IAmB7B,UAAU,CACR,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAa7B,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,EACxB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,gBAAgB,CAAC;IA8B5B,gBAAgB,CACd,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,YAAY,CAAC;CAOzB"}

package/dist/modules/actorTokenModule/actorToken.service.js

@@ -0,0 +1,169 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ActorTokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const ttlCache_1 = require("../../common/utils/ttlCache");
+const secretHash_1 = require("../../common/utils/secretHash");
+const typeorm_1 = require("typeorm");
+const exceptions_1 = require("../../utils/exceptions");
+const actorToken_entity_1 = require("./actorToken.entity");
+const actorToken_repository_1 = require("./actorToken.repository");
+const EActorTokenPrefix_enum_1 = require("./enum/EActorTokenPrefix.enum");
+const EActorTokenStatus_enum_1 = require("./enum/EActorTokenStatus.enum");
+let ActorTokenService = ActorTokenService_1 = class ActorTokenService {
+    _actorTokenRepository;
+    _logger = new common_1.Logger(ActorTokenService_1.name);
+    _authCache = new ttlCache_1.TtlCache(60_000);
+    constructor(_actorTokenRepository) {
+        this._actorTokenRepository = _actorTokenRepository;
+    }
+    generateActorToken(environmentPrefix = EActorTokenPrefix_enum_1.EActorTokenPrefix.Live) {
+        return (0, secretHash_1.generateCredential)(environmentPrefix);
+    }
+    async authenticateActorToken(accessToken) {
+        const parts = (0, secretHash_1.splitCredential)(accessToken);
+        if (!parts) {
+            return null;
+        }
+        const cached = this._authCache.get(accessToken);
+        if (cached) {
+            return cached;
+        }
+        const actorToken = await this._actorTokenRepository.findByKeyId(parts.keyId);
+        const isValid = (0, secretHash_1.verifySecretHash)(actorToken?.secretHash ?? secretHash_1.DUMMY_SECRET_HASH, parts.secret);
+        if (!actorToken || !isValid) {
+            return null;
+        }
+        if (!this._isUsable(actorToken, parts.keyId)) {
+            return null;
+        }
+        this._authCache.set(accessToken, actorToken);
+        this._touch(actorToken.actorTokenId);
+        return actorToken;
+    }
+    async getActiveActorByKeyId(keyId) {
+        const actorToken = await this._actorTokenRepository.findByKeyId(keyId);
+        if (!actorToken) {
+            return null;
+        }
+        if (!this._isUsable(actorToken, keyId)) {
+            return null;
+        }
+        this._touch(actorToken.actorTokenId);
+        return actorToken;
+    }
+    findByKeyIdAndProject(keyId, projectId) {
+        return this._actorTokenRepository.findByKeyIdAndProject(keyId, projectId);
+    }
+    _isUsable(actorToken, keyId) {
+        if (actorToken.status !== EActorTokenStatus_enum_1.EActorTokenStatus.Active) {
+            this._logger.warn("Rejected non-active actor token", {
+                keyId,
+                projectId: actorToken.projectId,
+                status: actorToken.status,
+            });
+            return false;
+        }
+        if (actorToken.expiresAt && new Date(actorToken.expiresAt) < new Date()) {
+            this._logger.warn("Rejected expired actor token", {
+                keyId,
+                projectId: actorToken.projectId,
+                expiresAt: actorToken.expiresAt,
+            });
+            return false;
+        }
+        return true;
+    }
+    _touch(actorTokenId) {
+        void this._actorTokenRepository
+            .updateLastUsed(actorTokenId)
+            .catch((err) => this._logger.error("Failed to update lastUsedAt", err));
+    }
+    _repo(manager) {
+        return manager
+            ? manager.getRepository(actorToken_entity_1.ActorTokenEntity)
+            : this._actorTokenRepository;
+    }
+    findByIdAndProject(actorTokenId, projectId, manager) {
+        return this._repo(manager).findOne({
+            where: { actorTokenId, projectId, deletedAt: (0, typeorm_1.IsNull)() },
+        });
+    }
+    listByProjectId(projectId) {
+        return this._actorTokenRepository.find({
+            where: { projectId, deletedAt: (0, typeorm_1.IsNull)() },
+            order: { createdAt: "DESC" },
+        });
+    }
+    async createActorToken(projectId, data, manager) {
+        const generated = this.generateActorToken();
+        const entity = new actorToken_entity_1.ActorTokenEntity();
+        entity.projectId = projectId;
+        entity.keyId = generated.keyId;
+        entity.secretHash = generated.secretHash;
+        entity.name = data.name;
+        entity.actorType = data.actorType;
+        entity.status = EActorTokenStatus_enum_1.EActorTokenStatus.Active;
+        entity.expiresAt = data.expiresAt ? new Date(data.expiresAt) : null;
+        entity.metadata = data.metadata ?? null;
+        entity.accessScopeId = data.accessScopeId ?? null;
+        const saved = await this._repo(manager).save(entity);
+        return { entity: saved, accessToken: generated.credential };
+    }
+    updateLock(actorTokenId, projectId, manager) {
+        const alias = actorToken_entity_1.ActorTokenEntity.entityName();
+        return manager
+            .createQueryBuilder(actorToken_entity_1.ActorTokenEntity, alias)
+            .where(`${alias}.actorTokenId = :actorTokenId AND ${alias}.projectId = :projectId`, { actorTokenId, projectId })
+            .andWhere(`${alias}.deletedAt IS NULL`)
+            .setLock("pessimistic_read")
+            .getOne();
+    }
+    async patchActorToken(actorTokenId, projectId, data, manager) {
+        const repo = this._repo(manager);
+        const entity = await repo.findOne({
+            where: { actorTokenId, projectId, deletedAt: (0, typeorm_1.IsNull)() },
+        });
+        if (!entity) {
+            throw (0, exceptions_1.badRequestException)(this._logger, {
+                errorMsgUser: "Could not update actor token",
+                errorMsgSystem: "ActorTokenService:patchActorToken:not_found",
+            });
+        }
+        if (data.name !== undefined)
+            entity.name = data.name;
+        if (data.status !== undefined)
+            entity.status = data.status;
+        if (data.expiresAt !== undefined) {
+            entity.expiresAt = data.expiresAt ? new Date(data.expiresAt) : null;
+        }
+        if (data.metadata !== undefined)
+            entity.metadata = data.metadata;
+        if (data.accessScopeId !== undefined) {
+            entity.accessScopeId = data.accessScopeId;
+        }
+        return repo.save(entity);
+    }
+    removeActorToken(actorTokenId, projectId, manager) {
+        return this._repo(manager).softDelete({
+            actorTokenId,
+            projectId,
+            deletedAt: (0, typeorm_1.IsNull)(),
+        });
+    }
+};
+exports.ActorTokenService = ActorTokenService;
+exports.ActorTokenService = ActorTokenService = ActorTokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [actorToken_repository_1.ActorTokenRepository])
+], ActorTokenService);

package/dist/modules/actorTokenModule/actorTokenState.entity.d.ts

@@ -0,0 +1,31 @@
+import { BaseTimeEntity } from "../../common/entities/base.entity";
+import { ActorTokenEntity } from "./actorToken.entity";
+export interface ITopicSubscription {
+    name: string;
+    topicId?: string;
+    roomId?: string;
+    identifiers?: string[];
+    loadBalance?: boolean;
+    loadBalanceGroup?: string;
+    filters?: string[];
+}
+export interface IConnectionState {
+    topics?: ITopicSubscription[];
+    presence?: {
+        isOnline: boolean;
+        lastSeen?: string;
+        metadata?: Record<string, unknown>;
+    };
+}
+export declare class ActorTokenStateEntity extends BaseTimeEntity {
+    static entityName(): string;
+    actorTokenStateId: string;
+    generateId(): void;
+    actorTokenId: string;
+    connectionState?: IConnectionState | null;
+    krakenNodeId?: string | null;
+    connectedAt: Date | null;
+    lastActivityAt: Date | null;
+    actorToken: ActorTokenEntity;
+}
+//# sourceMappingURL=actorTokenState.entity.d.ts.map

package/dist/modules/actorTokenModule/actorTokenState.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actorTokenState.entity.d.ts","sourceRoot":"","sources":["../../../src/modules/actorTokenModule/actorTokenState.entity.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAOvD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,CAAC;CACH;AAYD,qBAEa,qBAAsB,SAAQ,cAAc;IACvD,MAAM,CAAC,UAAU;IAKjB,iBAAiB,EAAE,MAAM,CAAC;IAG1B,UAAU;IAKV,YAAY,EAAE,MAAM,CAAC;IAGrB,eAAe,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAS1C,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG7B,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAGzB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAK5B,UAAU,EAAG,gBAAgB,CAAC;CAC/B"}

package/dist/modules/actorTokenModule/actorTokenState.entity.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenStateEntity = void 0;
+const typeorm_1 = require("typeorm");
+const base_entity_1 = require("../../common/entities/base.entity");
+const guid_1 = require("../../utils/guid");
+const actorToken_entity_1 = require("./actorToken.entity");
+const entityName = "actor_token_state";
+let ActorTokenStateEntity = class ActorTokenStateEntity extends base_entity_1.BaseTimeEntity {
+    static entityName() {
+        return entityName;
+    }
+    actorTokenStateId;
+    generateId() {
+        this.actorTokenStateId = (0, guid_1.generateDBUuid)();
+    }
+    actorTokenId;
+    connectionState;
+    krakenNodeId;
+    connectedAt;
+    lastActivityAt;
+    actorToken;
+};
+exports.ActorTokenStateEntity = ActorTokenStateEntity;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid", name: "actor_token_state_id" }),
+    __metadata("design:type", String)
+], ActorTokenStateEntity.prototype, "actorTokenStateId", void 0);
+__decorate([
+    (0, typeorm_1.BeforeInsert)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], ActorTokenStateEntity.prototype, "generateId", null);
+__decorate([
+    (0, typeorm_1.Column)({ type: "uuid", name: "actor_token_id" }),
+    __metadata("design:type", String)
+], ActorTokenStateEntity.prototype, "actorTokenId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "jsonb", nullable: true, name: "connection_state" }),
+    __metadata("design:type", Object)
+], ActorTokenStateEntity.prototype, "connectionState", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: "varchar",
+        length: 255,
+        nullable: true,
+        name: "kraken_node_id",
+    }),
+    __metadata("design:type", Object)
+], ActorTokenStateEntity.prototype, "krakenNodeId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "timestamptz", nullable: true, name: "connected_at" }),
+    __metadata("design:type", Object)
+], ActorTokenStateEntity.prototype, "connectedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "timestamptz", nullable: true, name: "last_activity_at" }),
+    __metadata("design:type", Object)
+], ActorTokenStateEntity.prototype, "lastActivityAt", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => actorToken_entity_1.ActorTokenEntity, { onDelete: "CASCADE" }),
+    (0, typeorm_1.JoinColumn)({ name: "actor_token_id" }),
+    __metadata("design:type", actorToken_entity_1.ActorTokenEntity)
+], ActorTokenStateEntity.prototype, "actorToken", void 0);
+exports.ActorTokenStateEntity = ActorTokenStateEntity = __decorate([
+    (0, typeorm_1.Entity)(entityName),
+    (0, typeorm_1.Index)(["actorTokenId"])
+], ActorTokenStateEntity);

package/dist/modules/actorTokenModule/actorTokenState.repository.d.ts

@@ -0,0 +1,10 @@
+import { Repository } from "typeorm";
+import { ActorTokenStateEntity, IConnectionState } from "./actorTokenState.entity";
+export declare class ActorTokenStateRepository extends Repository<ActorTokenStateEntity> {
+    constructor(repository: Repository<ActorTokenStateEntity>);
+    findByActorTokenId(actorTokenId: string): Promise<ActorTokenStateEntity | null>;
+    upsertState(actorTokenId: string, connectionState: IConnectionState, krakenNodeId?: string): Promise<ActorTokenStateEntity>;
+    clearState(actorTokenId: string): Promise<void>;
+    deleteByActorTokenId(actorTokenId: string): Promise<void>;
+}
+//# sourceMappingURL=actorTokenState.repository.d.ts.map

package/dist/modules/actorTokenModule/actorTokenState.repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actorTokenState.repository.d.ts","sourceRoot":"","sources":["../../../src/modules/actorTokenModule/actorTokenState.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,0BAA0B,CAAC;AAQlC,qBACa,yBAA0B,SAAQ,UAAU,CAAC,qBAAqB,CAAC;gBAG5E,UAAU,EAAE,UAAU,CAAC,qBAAqB,CAAC;IAK/C,kBAAkB,CAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAKlC,WAAW,CACf,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,gBAAgB,EACjC,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,CAAC;IAmB3B,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhE"}

package/dist/modules/actorTokenModule/actorTokenState.repository.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenStateRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const actorTokenState_entity_1 = require("./actorTokenState.entity");
+let ActorTokenStateRepository = class ActorTokenStateRepository extends typeorm_2.Repository {
+    constructor(repository) {
+        super(repository.target, repository.manager, repository.queryRunner);
+    }
+    findByActorTokenId(actorTokenId) {
+        return this.findOne({ where: { actorTokenId } });
+    }
+    async upsertState(actorTokenId, connectionState, krakenNodeId) {
+        const existing = await this.findByActorTokenId(actorTokenId);
+        if (existing) {
+            existing.connectionState = connectionState;
+            if (krakenNodeId !== undefined) {
+                existing.krakenNodeId = krakenNodeId;
+            }
+            return this.save(existing);
+        }
+        const entity = new actorTokenState_entity_1.ActorTokenStateEntity();
+        entity.actorTokenId = actorTokenId;
+        entity.connectionState = connectionState;
+        entity.krakenNodeId = krakenNodeId ?? null;
+        return this.save(entity);
+    }
+    async clearState(actorTokenId) {
+        await this.delete({ actorTokenId });
+    }
+    async deleteByActorTokenId(actorTokenId) {
+        await this.delete({ actorTokenId });
+    }
+};
+exports.ActorTokenStateRepository = ActorTokenStateRepository;
+exports.ActorTokenStateRepository = ActorTokenStateRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(actorTokenState_entity_1.ActorTokenStateEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], ActorTokenStateRepository);

package/dist/modules/actorTokenModule/dto/actorToken.dto.d.ts

@@ -0,0 +1,21 @@
+import { EActorTokenStatus } from "../enum/EActorTokenStatus.enum";
+import { EActorType } from "../enum/EActorType.enum";
+export declare class ActorTokenCreateDto {
+    name: string;
+    actorType: EActorType;
+    expiresAt?: string | null;
+    metadata?: Record<string, unknown>;
+    accessScopeId?: string | null;
+}
+export declare class ActorTokenPatchDto {
+    name?: string;
+    status?: EActorTokenStatus;
+    expiresAt?: string | null;
+    metadata?: Record<string, unknown>;
+    accessScopeId?: string | null;
+}
+export interface CreatedActorToken {
+    entity: import("../actorToken.entity").ActorTokenEntity;
+    accessToken: string;
+}
+//# sourceMappingURL=actorToken.dto.d.ts.map

package/dist/modules/actorTokenModule/dto/actorToken.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actorToken.dto.d.ts","sourceRoot":"","sources":["../../../../src/modules/actorTokenModule/dto/actorToken.dto.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,qBAAa,mBAAmB;IAI9B,IAAI,EAAE,MAAM,CAAC;IASb,SAAS,EAAE,UAAU,CAAC;IAKtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAK1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IASnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAOD,qBAAa,kBAAkB;IAK7B,IAAI,CAAC,EAAE,MAAM,CAAC;IAKd,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAK3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAK1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAGD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/dist/modules/actorTokenModule/dto/actorToken.dto.js

@@ -0,0 +1,99 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ActorTokenPatchDto = exports.ActorTokenCreateDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const EActorTokenStatus_enum_1 = require("../enum/EActorTokenStatus.enum");
+const EActorType_enum_1 = require("../enum/EActorType.enum");
+class ActorTokenCreateDto {
+    name;
+    actorType;
+    expiresAt;
+    metadata;
+    accessScopeId;
+}
+exports.ActorTokenCreateDto = ActorTokenCreateDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "Mobile client", maxLength: 255 }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], ActorTokenCreateDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        enum: EActorType_enum_1.EActorType,
+        description: "Decides which type grants apply to this actor, and whether it holds a " +
+            "session across disconnects.",
+    }),
+    (0, class_validator_1.IsEnum)(EActorType_enum_1.EActorType),
+    __metadata("design:type", String)
+], ActorTokenCreateDto.prototype, "actorType", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: "2026-12-31T23:59:59Z" }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsISO8601)({ strict: true }),
+    __metadata("design:type", Object)
+], ActorTokenCreateDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], ActorTokenCreateDto.prototype, "metadata", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: "Bind this actor to a tenant. Its addresses gain the scope's slug as a " +
+            "segment, and it can no longer reach the project-wide address space.",
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", Object)
+], ActorTokenCreateDto.prototype, "accessScopeId", void 0);
+class ActorTokenPatchDto {
+    name;
+    status;
+    expiresAt;
+    metadata;
+    accessScopeId;
+}
+exports.ActorTokenPatchDto = ActorTokenPatchDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ maxLength: 255 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], ActorTokenPatchDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ enum: EActorTokenStatus_enum_1.EActorTokenStatus }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(EActorTokenStatus_enum_1.EActorTokenStatus),
+    __metadata("design:type", String)
+], ActorTokenPatchDto.prototype, "status", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsISO8601)({ strict: true }),
+    __metadata("design:type", Object)
+], ActorTokenPatchDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], ActorTokenPatchDto.prototype, "metadata", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: "null unscopes the actor." }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", Object)
+], ActorTokenPatchDto.prototype, "accessScopeId", void 0);

package/dist/modules/actorTokenModule/enum/EAccessPermission.enum.d.ts

@@ -0,0 +1,6 @@
+export declare enum EAccessPermission {
+    Subscribe = "subscribe",
+    Publish = "publish",
+    PubSub = "pubSub"
+}
+//# sourceMappingURL=EAccessPermission.enum.d.ts.map

package/dist/modules/actorTokenModule/enum/EAccessPermission.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EAccessPermission.enum.d.ts","sourceRoot":"","sources":["../../../../src/modules/actorTokenModule/enum/EAccessPermission.enum.ts"],"names":[],"mappings":"AAOA,oBAAY,iBAAiB;IAC3B,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB"}

package/dist/modules/actorTokenModule/enum/EAccessPermission.enum.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EAccessPermission = void 0;
+var EAccessPermission;
+(function (EAccessPermission) {
+    EAccessPermission["Subscribe"] = "subscribe";
+    EAccessPermission["Publish"] = "publish";
+    EAccessPermission["PubSub"] = "pubSub";
+})(EAccessPermission || (exports.EAccessPermission = EAccessPermission = {}));

package/dist/modules/actorTokenModule/enum/EActorTokenPrefix.enum.d.ts

@@ -0,0 +1,5 @@
+export declare enum EActorTokenPrefix {
+    Live = "at_live",
+    Sandbox = "at_sandbox"
+}
+//# sourceMappingURL=EActorTokenPrefix.enum.d.ts.map

package/dist/modules/actorTokenModule/enum/EActorTokenPrefix.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EActorTokenPrefix.enum.d.ts","sourceRoot":"","sources":["../../../../src/modules/actorTokenModule/enum/EActorTokenPrefix.enum.ts"],"names":[],"mappings":"AAAA,oBAAY,iBAAiB;IAC3B,IAAI,YAAY;IAChB,OAAO,eAAe;CACvB"}