@shohaghinfo/aerojs 0.1.0

package/dist/auth/bouncer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bouncer.d.ts","sourceRoot":"","sources":["../../src/auth/bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,MAAM,WAAW,cAAc;IAC7B,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAClF;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,cAAc,CAAC;AAIzD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErD;;;OAGG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5D;AAID,qBAAa,OAAO;IAClB,OAAO,CAAC,IAAI,CAAkB;IAC9B,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,KAAK,CAAC,CAAkB;IAChC,OAAO,CAAC,QAAQ,CAAqC;gBAEzC,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,eAAe;IAK1D;;OAEG;YACW,SAAS;IAUvB;;OAEG;YACW,eAAe;IAU7B;;;;;OAKG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/C;;;;;OAKG;IACU,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrD;;;;;OAKG;IACU,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMtD;;OAEG;IACU,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIzD;;;;;;;;;;;;;OAaG;IACU,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlE;;;;;;OAMG;IACU,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3E;;;;;;;OAOG;IACU,SAAS,CACpB,WAAW,EAAE,iBAAiB,EAC9B,MAAM,EAAE,MAAM,EACd,GAAG,IAAI,EAAE,GAAG,EAAE,GACb,OAAO,CAAC,IAAI,CAAC;IAqBhB;;OAEG;IACU,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMlD;;OAEG;IACU,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAK1D;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAC,CAAkB;IAEzB,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAKvC,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO;CAG/C;AAED,eAAO,MAAM,cAAc,gBAAuB,CAAC;AAEnD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,UAAU,CAOjE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAS1D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAOhE"}

package/dist/auth/bouncer.js

@@ -0,0 +1,243 @@
+/**
+ * @file bouncer.ts
+ * @description RBAC Authorization Engine (Bouncer Pattern) for AeroJS.
+ *
+ * Supports:
+ * - Role-based checks: ctx.bouncer.is('admin')
+ * - Ability checks: ctx.bouncer.can('billing:approve-discount')
+ * - Policy-based authorization: ctx.bouncer.authorize(DiscountPolicy, 'approve', discount)
+ * - Data-scoped checks: enforcing branch-level data isolation
+ *
+ * Hospital use:
+ *   - Section 22: Discount approval matrix (cashier 0%, supervisor 5%, MS 15%, CEO any)
+ *   - Section 37: Maker-Checker dual control for refunds, POs, supplier payments
+ *   - Section 25: Branch-scoped data access (operator sees only own branch)
+ */
+import { ForbiddenError, UnauthorizedError } from '../core/errors.js';
+// ─── Bouncer Core ─────────────────────────────────────────────────────────────
+export class Bouncer {
+    user;
+    _roles = null;
+    _permissions = null;
+    store;
+    policies = new Map();
+    constructor(user, store) {
+        this.user = user;
+        this.store = store;
+    }
+    /**
+     * Lazily loads roles from the permission store.
+     */
+    async loadRoles() {
+        if (this._roles !== null)
+            return this._roles;
+        if (!this.user || !this.store) {
+            this._roles = this.user?.role ? [this.user.role] : [];
+        }
+        else {
+            this._roles = await this.store.getRoles(this.user.id);
+        }
+        return this._roles;
+    }
+    /**
+     * Lazily loads permissions from the permission store.
+     */
+    async loadPermissions() {
+        if (this._permissions !== null)
+            return this._permissions;
+        if (!this.user || !this.store) {
+            this._permissions = [];
+        }
+        else {
+            this._permissions = await this.store.getPermissions(this.user.id);
+        }
+        return this._permissions;
+    }
+    /**
+     * Check if the authenticated user has a specific role.
+     *
+     * @example
+     * if (await ctx.bouncer.is('supervisor')) { ... }
+     */
+    async is(role) {
+        if (!this.user)
+            return false;
+        const roles = await this.loadRoles();
+        return roles.includes(role);
+    }
+    /**
+     * Check if the user has any of the given roles.
+     *
+     * @example
+     * if (await ctx.bouncer.isAny(['ms', 'director', 'ceo'])) { ... }
+     */
+    async isAny(roles) {
+        if (!this.user)
+            return false;
+        const userRoles = await this.loadRoles();
+        return roles.some((r) => userRoles.includes(r));
+    }
+    /**
+     * Check if the user has a specific permission.
+     *
+     * @example
+     * if (await ctx.bouncer.can('billing:refund')) { ... }
+     */
+    async can(permission) {
+        if (!this.user)
+            return false;
+        const permissions = await this.loadPermissions();
+        return permissions.includes('*') || permissions.includes(permission);
+    }
+    /**
+     * Check if the user CANNOT perform an action.
+     */
+    async cannot(permission) {
+        return !(await this.can(permission));
+    }
+    /**
+     * Hospital-specific: Check discount approval authority.
+     *
+     * Rules (Section 22):
+     *   cashier     → 0%
+     *   supervisor  → up to 5%
+     *   ms          → up to 15%
+     *   director/ceo → unlimited
+     *
+     * @example
+     * if (!await ctx.bouncer.canApproveDiscount(12.5)) {
+     *   ctx.throw(403, 'Discount exceeds your authority');
+     * }
+     */
+    async canApproveDiscount(percent) {
+        if (!this.user)
+            return false;
+        const roles = await this.loadRoles();
+        if (roles.includes('ceo') || roles.includes('director') || roles.includes('admin'))
+            return true;
+        if (roles.includes('ms') || roles.includes('medical_superintendent'))
+            return percent <= 15;
+        if (roles.includes('supervisor') || roles.includes('incharge'))
+            return percent <= 5;
+        return percent <= 0; // cashier — no discount authority
+    }
+    /**
+     * Hospital-specific: Check if user belongs to a specific branch.
+     * Enforces Section 25 — branch data scoping.
+     *
+     * @example
+     * await ctx.bouncer.assertBranch(patient.branchId);
+     */
+    async assertBranch(resourceBranchId) {
+        if (!this.user)
+            throw new UnauthorizedError('Not authenticated');
+        const roles = await this.loadRoles();
+        // Head office roles can see all branches
+        if (roles.includes('admin') || roles.includes('ceo') || roles.includes('director'))
+            return;
+        if (this.user.branchId && String(this.user.branchId) !== String(resourceBranchId)) {
+            throw new ForbiddenError('Access denied: resource belongs to a different branch');
+        }
+    }
+    /**
+     * Policy-based authorization.
+     * Instantiates the policy class and calls the named action method.
+     *
+     * @example
+     * await ctx.bouncer.authorize(DiscountPolicy, 'approve', discount);
+     * await ctx.bouncer.authorize(RefundPolicy, 'check', invoice);
+     */
+    async authorize(PolicyClass, action, ...args) {
+        if (!this.user)
+            throw new UnauthorizedError('Not authenticated');
+        const policyKey = PolicyClass.name;
+        if (!this.policies.has(policyKey)) {
+            this.policies.set(policyKey, new PolicyClass());
+        }
+        const policy = this.policies.get(policyKey);
+        const method = policy[action];
+        if (typeof method !== 'function') {
+            throw new Error(`[AeroJS Bouncer] Policy "${policyKey}" does not define action "${action}"`);
+        }
+        const allowed = await method.call(policy, this.user, ...args);
+        if (!allowed) {
+            throw new ForbiddenError(`Not authorized to perform "${action}" action`);
+        }
+    }
+    /**
+     * Throws ForbiddenError if the user does NOT have the given role.
+     */
+    async assertIs(role) {
+        if (!(await this.is(role))) {
+            throw new ForbiddenError(`Role "${role}" is required`);
+        }
+    }
+    /**
+     * Throws ForbiddenError if the user does NOT have the given permission.
+     */
+    async assertCan(permission) {
+        if (!(await this.can(permission))) {
+            throw new ForbiddenError(`Permission "${permission}" is required`);
+        }
+    }
+}
+// ─── Bouncer Manager ──────────────────────────────────────────────────────────
+export class BouncerManager {
+    store;
+    configure(store) {
+        this.store = store;
+        return this;
+    }
+    forUser(user) {
+        return new Bouncer(user, this.store);
+    }
+}
+export const bouncerManager = new BouncerManager();
+/**
+ * Middleware that attaches ctx.bouncer to every request.
+ * Should be placed AFTER authPlugin so ctx.auth is available.
+ *
+ * @example
+ * app.use(bouncerPlugin(bouncerManager));
+ */
+export function bouncerPlugin(manager) {
+    return async (ctx, next) => {
+        const authCtx = ctx.auth;
+        const user = authCtx ? authCtx.user() : null;
+        ctx.bouncer = manager.forUser(user);
+        await next();
+    };
+}
+/**
+ * Route-level middleware to require a specific role.
+ *
+ * @example
+ * router.delete('/invoices/:id', handler).middleware(requireRole('supervisor'));
+ */
+export function requireRole(...roles) {
+    return async (ctx, next) => {
+        const bouncer = ctx.bouncer;
+        if (!bouncer)
+            throw new Error('[AeroJS Bouncer] bouncerPlugin is not mounted');
+        if (!(await bouncer.isAny(roles))) {
+            throw new ForbiddenError(`Requires one of roles: ${roles.join(', ')}`);
+        }
+        await next();
+    };
+}
+/**
+ * Route-level middleware to require a specific permission.
+ *
+ * @example
+ * router.post('/billing/refund', handler).middleware(requirePermission('billing:refund'));
+ */
+export function requirePermission(permission) {
+    return async (ctx, next) => {
+        const bouncer = ctx.bouncer;
+        if (!bouncer)
+            throw new Error('[AeroJS Bouncer] bouncerPlugin is not mounted');
+        await bouncer.assertCan(permission);
+        await next();
+    };
+}
+//# sourceMappingURL=bouncer.js.map

package/dist/auth/bouncer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bouncer.js","sourceRoot":"","sources":["../../src/auth/bouncer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA2BtE,iFAAiF;AAEjF,MAAM,OAAO,OAAO;IACV,IAAI,CAAkB;IACtB,MAAM,GAAoB,IAAI,CAAC;IAC/B,YAAY,GAAoB,IAAI,CAAC;IACrC,KAAK,CAAmB;IACxB,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAErD,YAAY,IAAqB,EAAE,KAAuB;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,EAAE,CAAC,IAAY;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,KAAK,CAAC,KAAe;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,GAAG,CAAC,UAAkB;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,OAAO,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,UAAkB;QACpC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,KAAK,CAAC,kBAAkB,CAAC,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAErC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAChG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,OAAO,IAAI,EAAE,CAAC;QAC3F,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,IAAI,CAAC,CAAC;QACpF,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC,kCAAkC;IACzD,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,YAAY,CAAC,gBAAiC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAErC,yCAAyC;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO;QAE3F,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,cAAc,CAAC,uDAAuD,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,SAAS,CACpB,WAA8B,EAC9B,MAAc,EACd,GAAG,IAAW;QAEd,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QAEjE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAE9B,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,6BAA6B,MAAM,GAAG,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,8BAA8B,MAAM,UAAU,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,QAAQ,CAAC,IAAY;QAChC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,cAAc,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CAAC,UAAkB;QACvC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CAAC,eAAe,UAAU,eAAe,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,OAAO,cAAc;IACjB,KAAK,CAAmB;IAEzB,SAAS,CAAC,KAAsB;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,IAAqB;QAClC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAI,GAAW,CAAC,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5C,GAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAG,KAAe;IAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAI,GAAW,CAAC,OAAkB,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,cAAc,CAAC,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAI,GAAW,CAAC,OAAkB,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/E,MAAM,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/guards/api-token-guard.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @file api-token-guard.ts
+ * @description Database-backed API Token Authentication Guard for AeroJS.
+ * Tokens are stored in DB, can be revoked individually, and carry scopes.
+ * Hospital use: LIS analyzer integration, FHIR gateway, Corporate TPA API access.
+ */
+import type { AeroContext } from '../../core/context.js';
+import type { GuardContract, AuthUser } from './guard.js';
+export interface ApiToken {
+    id: string | number;
+    userId: string | number;
+    token: string;
+    name: string;
+    abilities: string[];
+    lastUsedAt?: Date | null;
+    expiresAt?: Date | null;
+    revokedAt?: Date | null;
+}
+export interface ApiTokenGuardConfig {
+    /**
+     * Callback to find a token record by its hash.
+     */
+    findToken: (hashedToken: string) => Promise<ApiToken | null>;
+    /**
+     * Callback to fetch the associated user by userId.
+     */
+    findUser: (userId: string | number) => Promise<AuthUser | null>;
+    /**
+     * Callback to update last_used_at timestamp after successful auth.
+     */
+    touchToken?: (tokenId: string | number) => Promise<void>;
+}
+export interface GeneratedToken {
+    plainToken: string;
+    hashedToken: string;
+    prefix: string;
+}
+export declare class ApiTokenGuard implements GuardContract {
+    private _user;
+    private _token;
+    private _checked;
+    private readonly config;
+    private ctx;
+    constructor(ctx: AeroContext, config: ApiTokenGuardConfig);
+    user(): AuthUser | null;
+    token(): ApiToken | null;
+    check(): boolean;
+    /**
+     * Checks if the token has a specific ability/scope.
+     * Hospital use: ctx.auth.use('api').can('lab:write')
+     */
+    can(ability: string): boolean;
+    private extractToken;
+    /**
+     * Hashes a plain token using SHA-256 for secure database storage.
+     */
+    private hashToken;
+    authenticate(): Promise<AuthUser>;
+    silentCheck(): Promise<boolean>;
+    /**
+     * Generates a new plain token and its SHA-256 hash.
+     * Store hashedToken in DB, show plainToken once to the user.
+     *
+     * Hospital use: Generate integration token for LIS analyzer, TPA system.
+     */
+    static generate(prefix?: string): GeneratedToken;
+}
+//# sourceMappingURL=api-token-guard.d.ts.map

package/dist/auth/guards/api-token-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/api-token-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI1D,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE7D;;OAEG;IACH,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhE;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,aAAc,YAAW,aAAa;IACjD,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,GAAG,CAAc;gBAEb,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,mBAAmB;IAKlD,IAAI,IAAI,QAAQ,GAAG,IAAI;IAIvB,KAAK,IAAI,QAAQ,GAAG,IAAI;IAIxB,KAAK,IAAI,OAAO;IAIvB;;;OAGG;IACI,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAKpC,OAAO,CAAC,YAAY;IAapB;;OAEG;IACH,OAAO,CAAC,SAAS;IAIJ,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC;IAgCjC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAS5C;;;;;OAKG;WACW,QAAQ,CAAC,MAAM,SAAU,GAAG,cAAc;CAMzD"}

package/dist/auth/guards/api-token-guard.js

@@ -0,0 +1,107 @@
+/**
+ * @file api-token-guard.ts
+ * @description Database-backed API Token Authentication Guard for AeroJS.
+ * Tokens are stored in DB, can be revoked individually, and carry scopes.
+ * Hospital use: LIS analyzer integration, FHIR gateway, Corporate TPA API access.
+ */
+import { UnauthorizedError } from '../../core/errors.js';
+import crypto from 'node:crypto';
+export class ApiTokenGuard {
+    _user = null;
+    _token = null;
+    _checked = false;
+    config;
+    ctx;
+    constructor(ctx, config) {
+        this.ctx = ctx;
+        this.config = config;
+    }
+    user() {
+        return this._user;
+    }
+    token() {
+        return this._token;
+    }
+    check() {
+        return this._user !== null;
+    }
+    /**
+     * Checks if the token has a specific ability/scope.
+     * Hospital use: ctx.auth.use('api').can('lab:write')
+     */
+    can(ability) {
+        if (!this._token)
+            return false;
+        return this._token.abilities.includes('*') || this._token.abilities.includes(ability);
+    }
+    extractToken() {
+        // Authorization: Bearer aero_xxxxx
+        const authHeader = this.ctx.req.get('authorization');
+        if (authHeader) {
+            const parts = authHeader.split(' ');
+            if (parts.length === 2 && /^Bearer$/i.test(parts[0])) {
+                return parts[1] ?? null;
+            }
+        }
+        // Fallback: X-API-Token header
+        return this.ctx.req.get('x-api-token') ?? null;
+    }
+    /**
+     * Hashes a plain token using SHA-256 for secure database storage.
+     */
+    hashToken(plain) {
+        return crypto.createHash('sha256').update(plain).digest('hex');
+    }
+    async authenticate() {
+        if (this._checked) {
+            if (!this._user)
+                throw new UnauthorizedError('Invalid API token');
+            return this._user;
+        }
+        this._checked = true;
+        const plain = this.extractToken();
+        if (!plain)
+            throw new UnauthorizedError('API token not provided');
+        const hashed = this.hashToken(plain);
+        const tokenRecord = await this.config.findToken(hashed);
+        if (!tokenRecord)
+            throw new UnauthorizedError('Invalid API token');
+        if (tokenRecord.revokedAt)
+            throw new UnauthorizedError('API token has been revoked');
+        if (tokenRecord.expiresAt && tokenRecord.expiresAt < new Date()) {
+            throw new UnauthorizedError('API token has expired');
+        }
+        const user = await this.config.findUser(tokenRecord.userId);
+        if (!user)
+            throw new UnauthorizedError('Token owner not found');
+        // Touch last_used_at asynchronously (fire and forget)
+        if (this.config.touchToken) {
+            this.config.touchToken(tokenRecord.id).catch(() => { });
+        }
+        this._user = user;
+        this._token = tokenRecord;
+        return user;
+    }
+    async silentCheck() {
+        try {
+            await this.authenticate();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Generates a new plain token and its SHA-256 hash.
+     * Store hashedToken in DB, show plainToken once to the user.
+     *
+     * Hospital use: Generate integration token for LIS analyzer, TPA system.
+     */
+    static generate(prefix = 'aero_') {
+        const random = crypto.randomBytes(40).toString('hex');
+        const plainToken = `${prefix}${random}`;
+        const hashedToken = crypto.createHash('sha256').update(plainToken).digest('hex');
+        return { plainToken, hashedToken, prefix };
+    }
+}
+//# sourceMappingURL=api-token-guard.js.map

package/dist/auth/guards/api-token-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-guard.js","sourceRoot":"","sources":["../../../src/auth/guards/api-token-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,MAAM,MAAM,aAAa,CAAC;AAoCjC,MAAM,OAAO,aAAa;IAChB,KAAK,GAAoB,IAAI,CAAC;IAC9B,MAAM,GAAoB,IAAI,CAAC;IAC/B,QAAQ,GAAG,KAAK,CAAC;IACR,MAAM,CAAsB;IACrC,GAAG,CAAc;IAEzB,YAAY,GAAgB,EAAE,MAA2B;QACvD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACI,GAAG,CAAC,OAAe;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC/B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxF,CAAC;IAEO,YAAY;QAClB,mCAAmC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACtD,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,+BAA+B;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,KAAa;QAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,YAAY;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;YAClE,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAC;QAEhE,sDAAsD;QACtD,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,WAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,OAAO;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC7C,CAAC;CACF"}

package/dist/auth/guards/guard.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file guard.ts
+ * @description Base Auth Guard interface and shared types for AeroJS Auth System.
+ * Supports Session, JWT, and API Token authentication strategies.
+ */
+export interface AuthUser {
+    id: string | number;
+    role?: string;
+    branchId?: string | number;
+    terminalId?: string | number;
+    [key: string]: unknown;
+}
+export interface GuardContract {
+    /**
+     * Returns the currently authenticated user, or null if not authenticated.
+     */
+    user(): AuthUser | null;
+    /**
+     * Checks if a user is authenticated.
+     */
+    check(): boolean;
+    /**
+     * Returns authenticated user or throws UnauthorizedError.
+     */
+    authenticate(): Promise<AuthUser>;
+    /**
+     * Silently attempts auth without throwing — returns true/false.
+     */
+    silentCheck(): Promise<boolean>;
+}
+export interface LoginOptions {
+    remember?: boolean;
+    rememberDuration?: number;
+}
+//# sourceMappingURL=guard.d.ts.map

package/dist/auth/guards/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,IAAI,QAAQ,GAAG,IAAI,CAAC;IAExB;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC;IAEjB;;OAEG;IACH,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElC;;OAEG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/auth/guards/guard.js

@@ -0,0 +1,7 @@
+/**
+ * @file guard.ts
+ * @description Base Auth Guard interface and shared types for AeroJS Auth System.
+ * Supports Session, JWT, and API Token authentication strategies.
+ */
+export {};
+//# sourceMappingURL=guard.js.map

package/dist/auth/guards/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/auth/guards/guard.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/auth/guards/jwt-guard.d.ts

@@ -0,0 +1,64 @@
+/**
+ * @file jwt-guard.ts
+ * @description JWT Authentication Guard for AeroJS.
+ * Stateless authentication for Doctor Portal API, Mobile App, and external FHIR/HL7 integrations.
+ * Hospital use: Doctor's mobile ward-round app authenticates via Bearer JWT token.
+ */
+import type { AeroContext } from '../../core/context.js';
+import type { GuardContract, AuthUser } from './guard.js';
+import { type JwtSignOptions } from '../../security/jwt.js';
+export interface JwtGuardConfig {
+    /**
+     * Secret key for signing/verifying tokens. Use a long random string in production.
+     */
+    secret: string;
+    /**
+     * Token expiry. Default: '8h' (one hospital shift).
+     */
+    expiresIn?: string | number;
+    /**
+     * Callback to fetch user by ID (sub claim) from your database.
+     */
+    provider: (id: string | number) => Promise<AuthUser | null>;
+    /**
+     * Where to extract the token from. Default: Authorization header.
+     */
+    extractFrom?: 'header' | 'cookie' | 'query';
+    /**
+     * Cookie name if extractFrom = 'cookie'. Default: 'aero_token'.
+     */
+    cookieName?: string;
+    /**
+     * Query parameter name if extractFrom = 'query'. Default: 'token'.
+     */
+    queryParam?: string;
+}
+export interface JwtTokenPair {
+    accessToken: string;
+    expiresIn: number | string;
+    tokenType: 'Bearer';
+}
+export declare class JwtGuard implements GuardContract {
+    private _user;
+    private _checked;
+    private readonly config;
+    private ctx;
+    constructor(ctx: AeroContext, config: JwtGuardConfig);
+    user(): AuthUser | null;
+    check(): boolean;
+    /**
+     * Extracts the raw token string from the request.
+     */
+    private extractToken;
+    /**
+     * Verifies the JWT token and loads the user from the provider.
+     */
+    authenticate(): Promise<AuthUser>;
+    silentCheck(): Promise<boolean>;
+    /**
+     * Generates a signed JWT token pair for a user.
+     * Hospital use: Doctor logs in → receives { accessToken, expiresIn }.
+     */
+    generate(user: AuthUser, options?: JwtSignOptions): JwtTokenPair;
+}
+//# sourceMappingURL=jwt-guard.d.ts.map

package/dist/auth/guards/jwt-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/jwt-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG1E,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5D;;OAEG;IACH,WAAW,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IAE5C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC;CACrB;AAED,qBAAa,QAAS,YAAW,aAAa;IAC5C,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,GAAG,CAAc;gBAEb,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc;IAK7C,IAAI,IAAI,QAAQ,GAAG,IAAI;IAIvB,KAAK,IAAI,OAAO;IAIvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmBpB;;OAEG;IACU,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC;IAkCjC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAS5C;;;OAGG;IACI,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,cAAmB,GAAG,YAAY;CAmB5E"}

package/dist/auth/guards/jwt-guard.js

@@ -0,0 +1,104 @@
+/**
+ * @file jwt-guard.ts
+ * @description JWT Authentication Guard for AeroJS.
+ * Stateless authentication for Doctor Portal API, Mobile App, and external FHIR/HL7 integrations.
+ * Hospital use: Doctor's mobile ward-round app authenticates via Bearer JWT token.
+ */
+import { verify, sign } from '../../security/jwt.js';
+import { UnauthorizedError } from '../../core/errors.js';
+export class JwtGuard {
+    _user = null;
+    _checked = false;
+    config;
+    ctx;
+    constructor(ctx, config) {
+        this.ctx = ctx;
+        this.config = config;
+    }
+    user() {
+        return this._user;
+    }
+    check() {
+        return this._user !== null;
+    }
+    /**
+     * Extracts the raw token string from the request.
+     */
+    extractToken() {
+        const { extractFrom = 'header', cookieName = 'aero_token', queryParam = 'token' } = this.config;
+        if (extractFrom === 'cookie') {
+            return this.ctx.cookies[cookieName] ?? null;
+        }
+        if (extractFrom === 'query') {
+            return this.ctx.query[queryParam] ?? null;
+        }
+        // Default: Authorization: Bearer <token>
+        const authHeader = this.ctx.req.get('authorization');
+        if (!authHeader)
+            return null;
+        const parts = authHeader.split(' ');
+        if (parts.length !== 2 || !/^Bearer$/i.test(parts[0]))
+            return null;
+        return parts[1] ?? null;
+    }
+    /**
+     * Verifies the JWT token and loads the user from the provider.
+     */
+    async authenticate() {
+        if (this._checked) {
+            if (!this._user)
+                throw new UnauthorizedError('Invalid or expired token');
+            return this._user;
+        }
+        this._checked = true;
+        const token = this.extractToken();
+        if (!token) {
+            throw new UnauthorizedError('No authentication token provided');
+        }
+        let payload;
+        try {
+            payload = verify(token, this.config.secret);
+        }
+        catch (err) {
+            const msg = err?.name === 'TokenExpiredError' ? 'Token has expired. Please log in again.' : 'Invalid token';
+            throw new UnauthorizedError(msg);
+        }
+        if (!payload.sub) {
+            throw new UnauthorizedError('Token payload missing user identifier');
+        }
+        const user = await this.config.provider(payload.sub);
+        if (!user) {
+            throw new UnauthorizedError('Authenticated user not found');
+        }
+        this._user = user;
+        return user;
+    }
+    async silentCheck() {
+        try {
+            await this.authenticate();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Generates a signed JWT token pair for a user.
+     * Hospital use: Doctor logs in → receives { accessToken, expiresIn }.
+     */
+    generate(user, options = {}) {
+        const expiresIn = options.expiresIn ?? this.config.expiresIn ?? '8h';
+        const token = sign({
+            sub: String(user.id),
+            role: user.role,
+            branchId: user.branchId,
+            ...user,
+        }, this.config.secret, { expiresIn, ...options });
+        return {
+            accessToken: token,
+            expiresIn,
+            tokenType: 'Bearer',
+        };
+    }
+}
+//# sourceMappingURL=jwt-guard.js.map