@overlordai/server 1.0.1

package/dist/auth/auth.service.js

@@ -0,0 +1,307 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const bcrypt = __importStar(require("bcrypt"));
+const otplib_1 = require("otplib");
+const uuid_1 = require("uuid");
+const developer_repository_1 = require("../database/repositories/developer.repository");
+const redis_service_1 = require("../redis/redis.service");
+let AuthService = AuthService_1 = class AuthService {
+    jwtService;
+    developerRepo;
+    redis;
+    logger = new common_1.Logger(AuthService_1.name);
+    constructor(jwtService, developerRepo, redis) {
+        this.jwtService = jwtService;
+        this.developerRepo = developerRepo;
+        this.redis = redis;
+    }
+    onModuleInit() {
+        const defaultSecrets = ['default-jwt-secret', 'default-worker-jwt-secret'];
+        const jwtSecret = process.env.JWT_SECRET;
+        const workerJwtSecret = process.env.WORKER_JWT_SECRET;
+        const isProduction = process.env.NODE_ENV === 'production';
+        const jwtSecretIsDefault = !jwtSecret || defaultSecrets.includes(jwtSecret);
+        const workerSecretIsDefault = !workerJwtSecret || defaultSecrets.includes(workerJwtSecret);
+        if (isProduction) {
+            if (jwtSecretIsDefault) {
+                throw new Error('JWT_SECRET must be set to a non-default value in production');
+            }
+            if (workerSecretIsDefault) {
+                throw new Error('WORKER_JWT_SECRET must be set to a non-default value in production');
+            }
+        }
+        else {
+            if (jwtSecretIsDefault) {
+                this.logger.warn('JWT_SECRET is not set or is using the default value. This is insecure and must be changed before deploying to production.');
+            }
+            if (workerSecretIsDefault) {
+                this.logger.warn('WORKER_JWT_SECRET is not set or is using the default value. This is insecure and must be changed before deploying to production.');
+            }
+        }
+    }
+    async login(username, password, totpCode) {
+        // 1. Find developer by name
+        const developer = this.developerRepo.findByName(username);
+        // 2. Reject if not found or inactive
+        if (!developer) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        if (developer.status !== 'active') {
+            throw new common_1.UnauthorizedException('Account is inactive');
+        }
+        if (!developer.passwordHash) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        // 3. bcrypt.compare password
+        const passwordValid = await bcrypt.compare(password, developer.passwordHash);
+        if (!passwordValid) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        // 4. If totp_secret IS NULL, sign scoped token for TOTP setup
+        if (!developer.totpSecret) {
+            const payload = {
+                sub: developer.id,
+                name: developer.name,
+                role: developer.role,
+                jti: (0, uuid_1.v4)(),
+                scope: 'totp_setup',
+            };
+            const accessToken = this.jwtService.sign(payload, {
+                secret: process.env.JWT_SECRET || 'default-jwt-secret',
+                expiresIn: '15m',
+            });
+            return { accessToken, totpSetup: true };
+        }
+        // 5. If totp_secret exists and no totpCode, throw 401 TOTP_REQUIRED
+        if (!totpCode) {
+            throw new common_1.UnauthorizedException('TOTP_REQUIRED');
+        }
+        // 6. Verify TOTP code
+        const totpValid = otplib_1.authenticator.verify({
+            token: totpCode,
+            secret: developer.totpSecret,
+        });
+        if (!totpValid) {
+            throw new common_1.UnauthorizedException('Invalid TOTP code');
+        }
+        // 7. Sign access + refresh tokens
+        const accessToken = this.signUserJwt(developer);
+        const refreshToken = this.signRefreshToken(developer);
+        return { accessToken, refreshToken };
+    }
+    async refresh(refreshToken) {
+        // 1. Verify signature
+        let payload;
+        try {
+            payload = this.jwtService.verify(refreshToken, {
+                secret: process.env.JWT_SECRET || 'default-jwt-secret',
+            });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        if (payload.type !== 'refresh') {
+            throw new common_1.UnauthorizedException('Invalid token type');
+        }
+        // 2. Atomically blacklist the old refresh token (SET NX).
+        //    If SET NX returns null, the token was already used — reject.
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const remainingTtl = payload.exp - nowSeconds;
+        if (remainingTtl > 0) {
+            const result = await this.redis.getClient().set(`rt:${payload.jti}`, '1', 'EX', remainingTtl, 'NX');
+            if (result === null) {
+                throw new common_1.UnauthorizedException('Token has been revoked');
+            }
+        }
+        else {
+            throw new common_1.UnauthorizedException('Token has been revoked');
+        }
+        // 3. Check developer still active
+        const developer = this.developerRepo.findById(payload.sub);
+        if (!developer || developer.status !== 'active') {
+            throw new common_1.UnauthorizedException('Account is inactive');
+        }
+        // 5. Sign new access token and refresh token
+        const accessToken = this.signUserJwt(developer);
+        const newRefreshToken = this.signRefreshToken(developer);
+        return { accessToken, refreshToken: newRefreshToken };
+    }
+    async logout(refreshToken) {
+        // 1. Decode token to get jti, exp, and sub
+        let payload;
+        try {
+            payload = this.jwtService.verify(refreshToken, {
+                secret: process.env.JWT_SECRET || 'default-jwt-secret',
+            });
+        }
+        catch {
+            // If token is already expired or invalid, nothing to blacklist
+            return;
+        }
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const remainingTtl = payload.exp - nowSeconds;
+        if (remainingTtl > 0) {
+            // 2. Blacklist the refresh token
+            await this.redis.getClient().set(`rt:${payload.jti}`, '1', 'EX', remainingTtl, 'NX');
+            // 3. Set a per-user logout timestamp so PTY revalidation can detect
+            // that the user logged out after their access token was issued.
+            // TTL matches access token lifetime (15 min) — after that the access
+            // token would expire naturally and PTY revalidation closes the socket.
+            await this.redis.getClient().set(`logout:${payload.sub}`, String(nowSeconds), 'EX', 900);
+        }
+    }
+    signUserJwt(developer) {
+        const payload = {
+            sub: developer.id,
+            name: developer.name,
+            role: developer.role,
+            jti: (0, uuid_1.v4)(),
+        };
+        return this.jwtService.sign(payload, {
+            secret: process.env.JWT_SECRET || 'default-jwt-secret',
+            expiresIn: '15m',
+        });
+    }
+    signRefreshToken(developer) {
+        const payload = {
+            sub: developer.id,
+            jti: (0, uuid_1.v4)(),
+            type: 'refresh',
+        };
+        return this.jwtService.sign(payload, {
+            secret: process.env.JWT_SECRET || 'default-jwt-secret',
+            expiresIn: '7d',
+        });
+    }
+    signWorkerJwt(machineId, tokenId) {
+        const payload = {
+            sub: machineId,
+            tokenId,
+        };
+        return this.jwtService.sign(payload, {
+            secret: process.env.WORKER_JWT_SECRET || 'default-worker-jwt-secret',
+            expiresIn: '7d',
+        });
+    }
+    signChannelToken(taskId, aud) {
+        const payload = {
+            taskId,
+            aud,
+            jti: (0, uuid_1.v4)(),
+        };
+        return this.jwtService.sign(payload, {
+            secret: process.env.WORKER_JWT_SECRET || 'default-worker-jwt-secret',
+            expiresIn: 30,
+        });
+    }
+    async validateChannelToken(token, expectedAud) {
+        let payload;
+        try {
+            payload = this.jwtService.verify(token, {
+                secret: process.env.WORKER_JWT_SECRET || 'default-worker-jwt-secret',
+            });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid channel token');
+        }
+        if (payload.aud !== expectedAud) {
+            throw new common_1.UnauthorizedException(`Channel token audience mismatch: expected ${expectedAud}`);
+        }
+        // Atomically check and mark jti as used (SET NX) to prevent replay
+        const jtiKey = `channel_token:${payload.jti}`;
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        const remainingTtl = payload.exp ? payload.exp - nowSeconds : 30;
+        if (remainingTtl <= 0) {
+            throw new common_1.UnauthorizedException('Channel token has expired');
+        }
+        const result = await this.redis
+            .getClient()
+            .set(jtiKey, 'used', 'EX', remainingTtl, 'NX');
+        if (result === null) {
+            throw new common_1.UnauthorizedException('Channel token has already been used');
+        }
+        return payload;
+    }
+    /**
+     * Verify a Worker JWT and return its payload.
+     * Throws UnauthorizedException on invalid/expired token.
+     */
+    verifyWorkerJwt(token) {
+        try {
+            return this.jwtService.verify(token, {
+                secret: process.env.WORKER_JWT_SECRET || 'default-worker-jwt-secret',
+            });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid worker JWT');
+        }
+    }
+    /**
+     * Verify a User JWT and return its payload.
+     * Throws UnauthorizedException on invalid/expired token.
+     */
+    verifyUserJwt(token) {
+        try {
+            return this.jwtService.verify(token, {
+                secret: process.env.JWT_SECRET || 'default-jwt-secret',
+            });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid user JWT');
+        }
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = AuthService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService,
+        developer_repository_1.DeveloperRepository,
+        redis_service_1.RedisService])
+], AuthService);
+//# sourceMappingURL=auth.service.js.map

package/dist/auth/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAyC;AACzC,+CAAiC;AACjC,mCAAuC;AACvC,+BAAoC;AACpC,wFAAoF;AACpF,0DAAsD;AA6B/C,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,UAAsB,EACtB,aAAkC,EAClC,KAAmB;QAFnB,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAqB;QAClC,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,YAAY;QACV,MAAM,cAAc,GAAG,CAAC,oBAAoB,EAAE,2BAA2B,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACzC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D,MAAM,kBAAkB,GAAG,CAAC,SAAS,IAAI,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,qBAAqB,GACzB,CAAC,eAAe,IAAI,cAAc,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAE/D,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YACD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,kBAAkB,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2HAA2H,CAC5H,CAAC;YACJ,CAAC;YACD,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kIAAkI,CACnI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,QAAgB,EAChB,QAAiB;QAKjB,4BAA4B;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE1D,qCAAqC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,6BAA6B;QAC7B,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,OAAO,CACxC,QAAQ,EACR,SAAS,CAAC,YAAY,CACvB,CAAC;QAEF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,8DAA8D;QAC9D,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAwB;gBACnC,GAAG,EAAE,SAAS,CAAC,EAAE;gBACjB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,GAAG,EAAE,IAAA,SAAM,GAAE;gBACb,KAAK,EAAE,YAAY;aACpB,CAAC;YAEF,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;gBAChD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;gBACtD,SAAS,EAAE,KAAK;aACjB,CAAC,CAAC;YAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,sBAAsB;QACtB,MAAM,SAAS,GAAG,sBAAa,CAAC,MAAM,CAAC;YACrC,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,SAAS,CAAC,UAAU;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAED,kCAAkC;QAClC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEtD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,sBAAsB;QACtB,IAAI,OAAgE,CAAC;QACrE,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC;QAC9C,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAC7C,MAAM,OAAO,CAAC,GAAG,EAAE,EACnB,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,IAAI,CACL,CAAC;YACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,6CAA6C;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEzD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,2CAA2C;QAC3C,IAAI,OAAkD,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE;gBAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC;QAE9C,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iCAAiC;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAC9B,MAAM,OAAO,CAAC,GAAG,EAAE,EACnB,GAAG,EACH,IAAI,EACJ,YAAY,EACZ,IAAI,CACL,CAAC;YAEF,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAC9B,UAAU,OAAO,CAAC,GAAG,EAAE,EACvB,MAAM,CAAC,UAAU,CAAC,EAClB,IAAI,EACJ,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,WAAW,CAAC,SAIX;QACC,MAAM,OAAO,GAAmB;YAC9B,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,GAAG,EAAE,IAAA,SAAM,GAAE;SACd,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YACnC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;YACtD,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,SAAyB;QACxC,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,GAAG,EAAE,IAAA,SAAM,GAAE;YACb,IAAI,EAAE,SAAS;SAChB,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YACnC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;YACtD,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,SAAiB,EAAE,OAAe;QAC9C,MAAM,OAAO,GAAqB;YAChC,GAAG,EAAE,SAAS;YACd,OAAO;SACR,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YACnC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B;YACpE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,GAAqB;QACpD,MAAM,OAAO,GAAwB;YACnC,MAAM;YACN,GAAG;YACH,GAAG,EAAE,IAAA,SAAM,GAAE;SACd,CAAC;QAEF,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YACnC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B;YACpE,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,WAA6B;QAE7B,IAAI,OAA+C,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAyC,KAAK,EAAE;gBAC9E,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAqB,CAC7B,6CAA6C,WAAW,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,MAAM,GAAG,iBAAiB,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAEjE,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK;aAC5B,SAAS,EAAE;aACX,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;QAEjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAmB,KAAK,EAAE;gBACrD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B;aACrE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,KAAa;QACzB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAiB,KAAK,EAAE;gBACnD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;aACvD,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF,CAAA;AArUY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKoB,gBAAU;QACP,0CAAmB;QAC3B,4BAAY;GAN3B,WAAW,CAqUvB"}

package/dist/auth/decorators/allow-totp-setup.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const ALLOW_TOTP_SETUP_KEY = "allow_totp_setup";
+export declare const AllowTotpSetup: () => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=allow-totp-setup.decorator.d.ts.map

package/dist/auth/decorators/allow-totp-setup.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-totp-setup.decorator.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/allow-totp-setup.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AACvD,eAAO,MAAM,cAAc,wDAAgD,CAAC"}

package/dist/auth/decorators/allow-totp-setup.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowTotpSetup = exports.ALLOW_TOTP_SETUP_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.ALLOW_TOTP_SETUP_KEY = 'allow_totp_setup';
+const AllowTotpSetup = () => (0, common_1.SetMetadata)(exports.ALLOW_TOTP_SETUP_KEY, true);
+exports.AllowTotpSetup = AllowTotpSetup;
+//# sourceMappingURL=allow-totp-setup.decorator.js.map

package/dist/auth/decorators/allow-totp-setup.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-totp-setup.decorator.js","sourceRoot":"","sources":["../../../src/auth/decorators/allow-totp-setup.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,4BAAoB,EAAE,IAAI,CAAC,CAAC;AAA/D,QAAA,cAAc,kBAAiD"}

package/dist/auth/decorators/project-roles.decorator.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectRole } from '@overlordai/protocol';
+export declare const PROJECT_ROLES_KEY = "projectRoles";
+export declare const ProjectRoles: (...roles: ProjectRole[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=project-roles.decorator.d.ts.map

package/dist/auth/decorators/project-roles.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-roles.decorator.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/project-roles.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAChD,eAAO,MAAM,YAAY,GAAI,GAAG,OAAO,WAAW,EAAE,qDACb,CAAC"}

package/dist/auth/decorators/project-roles.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectRoles = exports.PROJECT_ROLES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.PROJECT_ROLES_KEY = 'projectRoles';
+const ProjectRoles = (...roles) => (0, common_1.SetMetadata)(exports.PROJECT_ROLES_KEY, roles);
+exports.ProjectRoles = ProjectRoles;
+//# sourceMappingURL=project-roles.decorator.js.map

package/dist/auth/decorators/project-roles.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-roles.decorator.js","sourceRoot":"","sources":["../../../src/auth/decorators/project-roles.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAGhC,QAAA,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,YAAY,GAAG,CAAC,GAAG,KAAoB,EAAE,EAAE,CACtD,IAAA,oBAAW,EAAC,yBAAiB,EAAE,KAAK,CAAC,CAAC;AAD3B,QAAA,YAAY,gBACe"}

package/dist/auth/decorators/roles.decorator.d.ts

@@ -0,0 +1,4 @@
+import type { DeveloperRole } from '@overlordai/protocol';
+export declare const ROLES_KEY = "roles";
+export declare const Roles: (...roles: DeveloperRole[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=roles.decorator.d.ts.map

package/dist/auth/decorators/roles.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/roles.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,KAAK,GAAI,GAAG,OAAO,aAAa,EAAE,qDAChB,CAAC"}

package/dist/auth/decorators/roles.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Roles = exports.ROLES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.ROLES_KEY = 'roles';
+const Roles = (...roles) => (0, common_1.SetMetadata)(exports.ROLES_KEY, roles);
+exports.Roles = Roles;
+//# sourceMappingURL=roles.decorator.js.map

package/dist/auth/decorators/roles.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.decorator.js","sourceRoot":"","sources":["../../../src/auth/decorators/roles.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAGhC,QAAA,SAAS,GAAG,OAAO,CAAC;AAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAsB,EAAE,EAAE,CACjD,IAAA,oBAAW,EAAC,iBAAS,EAAE,KAAK,CAAC,CAAC;AADnB,QAAA,KAAK,SACc"}

package/dist/auth/extract-user.middleware.d.ts

@@ -0,0 +1,21 @@
+import { NestMiddleware } from '@nestjs/common';
+import type { Request, Response, NextFunction } from 'express';
+import { JwtService } from '@nestjs/jwt';
+/**
+ * Middleware that attempts to extract the authenticated user from the JWT
+ * in the Authorization header and attach it to `request.user`.
+ *
+ * This runs BEFORE guards (middleware → guards → interceptors in NestJS),
+ * so the RateLimitGuard (APP_GUARD) can use `request.user` for per-user
+ * rate limiting even though JwtAuthGuard hasn't run yet.
+ *
+ * This middleware never rejects requests — if the token is missing, invalid,
+ * or expired, it silently continues. Actual auth enforcement is still done
+ * by JwtAuthGuard on protected routes.
+ */
+export declare class ExtractUserMiddleware implements NestMiddleware {
+    private readonly jwtService;
+    constructor(jwtService: JwtService);
+    use(req: Request, _res: Response, next: NextFunction): void;
+}
+//# sourceMappingURL=extract-user.middleware.d.ts.map

package/dist/auth/extract-user.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-user.middleware.d.ts","sourceRoot":"","sources":["../../src/auth/extract-user.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,qBACa,qBAAsB,YAAW,cAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAEnD,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;CAkB5D"}

package/dist/auth/extract-user.middleware.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExtractUserMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+/**
+ * Middleware that attempts to extract the authenticated user from the JWT
+ * in the Authorization header and attach it to `request.user`.
+ *
+ * This runs BEFORE guards (middleware → guards → interceptors in NestJS),
+ * so the RateLimitGuard (APP_GUARD) can use `request.user` for per-user
+ * rate limiting even though JwtAuthGuard hasn't run yet.
+ *
+ * This middleware never rejects requests — if the token is missing, invalid,
+ * or expired, it silently continues. Actual auth enforcement is still done
+ * by JwtAuthGuard on protected routes.
+ */
+let ExtractUserMiddleware = class ExtractUserMiddleware {
+    jwtService;
+    constructor(jwtService) {
+        this.jwtService = jwtService;
+    }
+    use(req, _res, next) {
+        const authHeader = req.headers?.authorization;
+        if (authHeader?.startsWith('Bearer ')) {
+            const token = authHeader.slice(7);
+            // Only attempt for JWTs (contain dots), not PATs (64-char hex)
+            if (token.includes('.')) {
+                try {
+                    const payload = this.jwtService.verify(token, {
+                        secret: process.env.JWT_SECRET || 'default-jwt-secret',
+                    });
+                    req.user = payload;
+                }
+                catch {
+                    // Token invalid/expired — don't populate user, auth guard will handle
+                }
+            }
+        }
+        next();
+    }
+};
+exports.ExtractUserMiddleware = ExtractUserMiddleware;
+exports.ExtractUserMiddleware = ExtractUserMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService])
+], ExtractUserMiddleware);
+//# sourceMappingURL=extract-user.middleware.js.map

package/dist/auth/extract-user.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-user.middleware.js","sourceRoot":"","sources":["../../src/auth/extract-user.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,qCAAyC;AAEzC;;;;;;;;;;;GAWG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,GAAG,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;QAClD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9C,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,+DAA+D;YAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;wBAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,oBAAoB;qBACvD,CAAC,CAAC;oBACF,GAAW,CAAC,IAAI,GAAG,OAAO,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,sEAAsE;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AArBY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAE8B,gBAAU;GADxC,qBAAqB,CAqBjC"}

package/dist/auth/guards/jwt-auth.guard.d.ts

@@ -0,0 +1,14 @@
+import { ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { DeveloperTokenRepository } from '../../database/repositories/developer-token.repository';
+import { DeveloperRepository } from '../../database/repositories/developer.repository';
+declare const JwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+export declare class JwtAuthGuard extends JwtAuthGuard_base {
+    private readonly developerTokenRepo;
+    private readonly developerRepo;
+    private readonly reflector;
+    constructor(developerTokenRepo: DeveloperTokenRepository, developerRepo: DeveloperRepository, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+export {};
+//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/auth/guards/jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,gBAAgB,EAAyB,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;;AAGvF,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,kBAAkB,EAAE,wBAAwB,EAC5C,aAAa,EAAE,mBAAmB,EAClC,SAAS,EAAE,SAAS;IAKjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmF/D"}

package/dist/auth/guards/jwt-auth.guard.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const passport_1 = require("@nestjs/passport");
+const crypto = __importStar(require("node:crypto"));
+const developer_token_repository_1 = require("../../database/repositories/developer-token.repository");
+const developer_repository_1 = require("../../database/repositories/developer.repository");
+const allow_totp_setup_decorator_1 = require("../decorators/allow-totp-setup.decorator");
+let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)('jwt') {
+    developerTokenRepo;
+    developerRepo;
+    reflector;
+    constructor(developerTokenRepo, developerRepo, reflector) {
+        super();
+        this.developerTokenRepo = developerTokenRepo;
+        this.developerRepo = developerRepo;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        // Try JWT first
+        try {
+            const result = await super.canActivate(context);
+            if (result) {
+                // Check if the token has a restricted scope
+                const request = context.switchToHttp().getRequest();
+                const user = request.user;
+                if (user?.scope === 'totp_setup') {
+                    const allowTotpSetup = this.reflector.getAllAndOverride(allow_totp_setup_decorator_1.ALLOW_TOTP_SETUP_KEY, [context.getHandler(), context.getClass()]);
+                    if (!allowTotpSetup) {
+                        throw new common_1.UnauthorizedException('This token can only be used for TOTP setup');
+                    }
+                }
+                return true;
+            }
+        }
+        catch (err) {
+            // If it's our own scope rejection, re-throw immediately
+            if (err instanceof common_1.UnauthorizedException &&
+                (err.message === 'This token can only be used for TOTP setup')) {
+                throw err;
+            }
+            // JWT failed — try PAT below
+        }
+        // Fallback: try Personal Access Token
+        const request = context.switchToHttp().getRequest();
+        const authHeader = request.headers?.authorization;
+        if (!authHeader?.startsWith('Bearer ')) {
+            throw new common_1.UnauthorizedException();
+        }
+        const rawToken = authHeader.slice(7);
+        // PAT tokens are 64-char hex strings; JWTs are much longer and contain dots
+        if (rawToken.includes('.') || rawToken.length !== 64) {
+            throw new common_1.UnauthorizedException();
+        }
+        const tokenHash = crypto
+            .createHash('sha256')
+            .update(rawToken)
+            .digest('hex');
+        const tokenRecord = this.developerTokenRepo.findByTokenHash(tokenHash);
+        if (!tokenRecord || tokenRecord.status !== 'active') {
+            throw new common_1.UnauthorizedException();
+        }
+        // Check expiration — reject tokens with unparseable expiresAt values
+        if (tokenRecord.expiresAt) {
+            const expiry = new Date(tokenRecord.expiresAt);
+            if (isNaN(expiry.getTime())) {
+                throw new common_1.UnauthorizedException('Token has invalid expiration');
+            }
+            if (expiry < new Date()) {
+                throw new common_1.UnauthorizedException('Token expired');
+            }
+        }
+        // Load the developer
+        const developer = this.developerRepo.findById(tokenRecord.developerId);
+        if (!developer || developer.status !== 'active') {
+            throw new common_1.UnauthorizedException();
+        }
+        // Attach user to request (same shape as JWT payload)
+        request.user = {
+            sub: developer.id,
+            name: developer.name,
+            role: developer.role,
+            jti: `pat-${tokenRecord.id}`,
+        };
+        return true;
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [developer_token_repository_1.DeveloperTokenRepository,
+        developer_repository_1.DeveloperRepository,
+        core_1.Reflector])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/auth/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAqF;AACrF,uCAAyC;AACzC,+CAA6C;AAC7C,oDAAsC;AACtC,uGAAkG;AAClG,2FAAuF;AACvF,yFAAgF;AAGzE,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAE7B;IACA;IACA;IAHnB,YACmB,kBAA4C,EAC5C,aAAkC,EAClC,SAAoB;QAErC,KAAK,EAAE,CAAC;QAJS,uBAAkB,GAAlB,kBAAkB,CAA0B;QAC5C,kBAAa,GAAb,aAAa,CAAqB;QAClC,cAAS,GAAT,SAAS,CAAW;IAGvC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,gBAAgB;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAsB,CAAC;YACtE,IAAI,MAAM,EAAE,CAAC;gBACX,4CAA4C;gBAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC1B,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;oBACjC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACrD,iDAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;oBACF,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,8BAAqB,CAC7B,4CAA4C,CAC7C,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wDAAwD;YACxD,IACE,GAAG,YAAY,8BAAqB;gBACpC,CAAC,GAAG,CAAC,OAAO,KAAK,4CAA4C,CAAC,EAC9D,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,6BAA6B;QAC/B,CAAC;QAED,sCAAsC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAErC,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,SAAS,GAAG,MAAM;aACrB,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qEAAqE;QACrE,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,MAAM,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,qBAAqB;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,8BAAqB,EAAE,CAAC;QACpC,CAAC;QAED,qDAAqD;QACrD,OAAO,CAAC,IAAI,GAAG;YACb,GAAG,EAAE,SAAS,CAAC,EAAE;YACjB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,GAAG,EAAE,OAAO,WAAW,CAAC,EAAE,EAAE;SAC7B,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA5FY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAG4B,qDAAwB;QAC7B,0CAAmB;QACvB,gBAAS;GAJ5B,YAAY,CA4FxB"}