@taico/taico 0.0.2

package/dist/auth/crypto/dto/jwks-response.dto.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksResponseDto = exports.JwkResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class JwkResponseDto {
+    kty;
+    use;
+    kid;
+    alg;
+    n;
+    e;
+    x;
+    y;
+    crv;
+}
+exports.JwkResponseDto = JwkResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Key type, for example RSA or EC.',
+        example: 'RSA',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "kty", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Key usage indicating how the key can be used.',
+        example: 'sig',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "use", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique identifier for the key used for rotation.',
+        example: '1234567890abcdef',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "kid", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Algorithm intended for use with this key.',
+        example: 'RS256',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "alg", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'RSA modulus encoded using base64url.',
+        example: 'xGOr-H7A...',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "n", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'RSA public exponent encoded using base64url.',
+        example: 'AQAB',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "e", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Public coordinate X for EC keys encoded using base64url.',
+        example: 'WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "x", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Public coordinate Y for EC keys encoded using base64url.',
+        example: 'y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "y", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Curve name for EC keys.',
+        example: 'P-256',
+    }),
+    __metadata("design:type", String)
+], JwkResponseDto.prototype, "crv", void 0);
+class JwksResponseDto {
+    keys;
+}
+exports.JwksResponseDto = JwksResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Collection of JSON Web Keys currently valid for signature verification.',
+        type: [JwkResponseDto],
+    }),
+    __metadata("design:type", Array)
+], JwksResponseDto.prototype, "keys", void 0);
+//# sourceMappingURL=jwks-response.dto.js.map

package/dist/auth/crypto/dto/jwks-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-response.dto.js","sourceRoot":"","sources":["../../../../src/auth/crypto/dto/jwks-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AAEnE,MAAa,cAAc;IAKzB,GAAG,CAAU;IAMb,GAAG,CAAU;IAMb,GAAG,CAAU;IAMb,GAAG,CAAU;IAMb,CAAC,CAAU;IAMX,CAAC,CAAU;IAMX,CAAC,CAAU;IAMX,CAAC,CAAU;IAMX,GAAG,CAAU;CACd;AAtDD,wCAsDC;AAjDC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,KAAK;KACf,CAAC;;2CACW;AAMb;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,KAAK;KACf,CAAC;;2CACW;AAMb;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,kBAAkB;KAC5B,CAAC;;2CACW;AAMb;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,OAAO;KACjB,CAAC;;2CACW;AAMb;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,aAAa;KACvB,CAAC;;yCACS;AAMX;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,MAAM;KAChB,CAAC;;yCACS;AAMX;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,6CAA6C;KACvD,CAAC;;yCACS;AAMX;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,6CAA6C;KACvD,CAAC;;yCACS;AAMX;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,OAAO;KACjB,CAAC;;2CACW;AAGf,MAAa,eAAe;IAM1B,IAAI,CAAoB;CACzB;AAPD,0CAOC;AADC;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,yEAAyE;QAC3E,IAAI,EAAE,CAAC,cAAc,CAAC;KACvB,CAAC;;6CACsB"}

package/dist/auth/crypto/jwks-key.entity.d.ts

@@ -0,0 +1,13 @@
+export declare class JwksKeyEntity {
+    id: string;
+    kid: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+    algorithm: string;
+    isActive: boolean;
+    expiresAt: Date;
+    rowVersion: number;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt?: Date | null;
+}

package/dist/auth/crypto/jwks-key.entity.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksKeyEntity = void 0;
+const typeorm_1 = require("typeorm");
+let JwksKeyEntity = class JwksKeyEntity {
+    id;
+    kid;
+    publicKeyPem;
+    privateKeyPem;
+    algorithm;
+    isActive;
+    expiresAt;
+    rowVersion;
+    createdAt;
+    updatedAt;
+    deletedAt;
+};
+exports.JwksKeyEntity = JwksKeyEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], JwksKeyEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', unique: true }),
+    __metadata("design:type", String)
+], JwksKeyEntity.prototype, "kid", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'public_key_pem' }),
+    __metadata("design:type", String)
+], JwksKeyEntity.prototype, "publicKeyPem", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', name: 'private_key_pem' }),
+    __metadata("design:type", String)
+], JwksKeyEntity.prototype, "privateKeyPem", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], JwksKeyEntity.prototype, "algorithm", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'boolean', name: 'is_active', default: true }),
+    __metadata("design:type", Boolean)
+], JwksKeyEntity.prototype, "isActive", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'datetime', name: 'expires_at' }),
+    __metadata("design:type", Date)
+], JwksKeyEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.VersionColumn)({ name: 'row_version' }),
+    __metadata("design:type", Number)
+], JwksKeyEntity.prototype, "rowVersion", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ type: 'datetime', name: 'created_at' }),
+    __metadata("design:type", Date)
+], JwksKeyEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ type: 'datetime', name: 'updated_at' }),
+    __metadata("design:type", Date)
+], JwksKeyEntity.prototype, "updatedAt", void 0);
+__decorate([
+    (0, typeorm_1.DeleteDateColumn)({ type: 'datetime', name: 'deleted_at', nullable: true }),
+    __metadata("design:type", Object)
+], JwksKeyEntity.prototype, "deletedAt", void 0);
+exports.JwksKeyEntity = JwksKeyEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: 'jwks_keys' })
+], JwksKeyEntity);
+//# sourceMappingURL=jwks-key.entity.js.map

package/dist/auth/crypto/jwks-key.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-key.entity.js","sourceRoot":"","sources":["../../../src/auth/crypto/jwks-key.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAQiB;AAGV,IAAM,aAAa,GAAnB,MAAM,aAAa;IAExB,EAAE,CAAU;IAGZ,GAAG,CAAU;IAGb,YAAY,CAAU;IAGtB,aAAa,CAAU;IAGvB,SAAS,CAAU;IAGnB,QAAQ,CAAW;IAGnB,SAAS,CAAQ;IAGjB,UAAU,CAAU;IAGpB,SAAS,CAAQ;IAGjB,SAAS,CAAQ;IAGjB,SAAS,CAAe;CACzB,CAAA;AAjCY,sCAAa;AAExB;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;yCACnB;AAGZ;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;;0CAC1B;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;;mDAC3B;AAGtB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;;oDAC3B;AAGvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;gDACN;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;+CAC3C;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BACrC,IAAI;gDAAC;AAGjB;IADC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;;iDACnB;AAGpB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC/C,IAAI;gDAAC;AAGjB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC/C,IAAI;gDAAC;AAGjB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACnD;wBAhCb,aAAa;IADzB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;GACjB,aAAa,CAiCzB"}

package/dist/auth/crypto/jwks.controller.d.ts

@@ -0,0 +1,18 @@
+import { JwksService } from './jwks.service';
+export declare class JwksController {
+    private readonly jwksService;
+    constructor(jwksService: JwksService);
+    getJwks(): Promise<{
+        keys: {
+            kty: string | undefined;
+            use: string | undefined;
+            kid: string | undefined;
+            alg: string | undefined;
+            n: string | undefined;
+            e: string | undefined;
+            x: string | undefined;
+            y: string | undefined;
+            crv: string | undefined;
+        }[];
+    }>;
+}

package/dist/auth/crypto/jwks.controller.js

@@ -0,0 +1,59 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwks_service_1 = require("./jwks.service");
+const jwks_response_dto_1 = require("./dto/jwks-response.dto");
+let JwksController = class JwksController {
+    jwksService;
+    constructor(jwksService) {
+        this.jwksService = jwksService;
+    }
+    async getJwks() {
+        const jwks = await this.jwksService.getPublicKeys();
+        return {
+            keys: jwks.map((key) => ({
+                kty: key.kty,
+                use: key.use,
+                kid: key.kid,
+                alg: key.alg,
+                n: key.n,
+                e: key.e,
+                x: key.x,
+                y: key.y,
+                crv: key.crv,
+            })),
+        };
+    }
+};
+exports.JwksController = JwksController;
+__decorate([
+    (0, common_1.Get)('jwks.json'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get JSON Web Key Set (JWKS)',
+        description: 'Returns the public keys used to verify JWT signatures. This endpoint provides all valid (non-expired) keys to support key rotation.',
+    }),
+    (0, swagger_1.ApiOkResponse)({
+        description: 'JWKS retrieved successfully',
+        type: jwks_response_dto_1.JwksResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], JwksController.prototype, "getJwks", null);
+exports.JwksController = JwksController = __decorate([
+    (0, swagger_1.ApiTags)('JWKS'),
+    (0, common_1.Controller)('.well-known'),
+    __metadata("design:paramtypes", [jwks_service_1.JwksService])
+], JwksController);
+//# sourceMappingURL=jwks.controller.js.map

package/dist/auth/crypto/jwks.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.controller.js","sourceRoot":"","sources":["../../../src/auth/crypto/jwks.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiD;AACjD,6CAAuE;AACvE,iDAA6C;AAC7C,+DAA0D;AAInD,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAYnD,AAAN,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAEpD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACvB,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,GAAG,EAAE,GAAG,CAAC,GAAG;aACb,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF,CAAA;AA9BY,wCAAc;AAanB;IAVL,IAAA,YAAG,EAAC,WAAW,CAAC;IAChB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,qIAAqI;KACxI,CAAC;IACD,IAAA,uBAAa,EAAC;QACb,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,mCAAe;KACtB,CAAC;;;;6CAiBD;yBA7BU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEkB,0BAAW;GAD1C,cAAc,CA8B1B"}

package/dist/auth/crypto/jwks.service.d.ts

@@ -0,0 +1,13 @@
+import { Repository } from 'typeorm';
+import { JwksKeyEntity } from './jwks-key.entity';
+import { JWK } from 'jose';
+export declare class JwksService {
+    private readonly keyRepository;
+    private logger;
+    constructor(keyRepository: Repository<JwksKeyEntity>);
+    getOrCreateActiveKey(): Promise<JwksKeyEntity>;
+    rotateKey(): Promise<JwksKeyEntity>;
+    getPublicKeys(): Promise<JWK[]>;
+    getActiveSigningKey(): Promise<JwksKeyEntity>;
+    cleanupExpiredKeys(gracePeriodDays?: number): Promise<number>;
+}

package/dist/auth/crypto/jwks.service.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JwksService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const jwks_key_entity_1 = require("./jwks-key.entity");
+const jose_1 = require("jose");
+const env_config_1 = require("../../config/env.config");
+const ALG = 'RS256';
+let JwksService = JwksService_1 = class JwksService {
+    keyRepository;
+    logger = new common_1.Logger(JwksService_1.name);
+    constructor(keyRepository) {
+        this.keyRepository = keyRepository;
+    }
+    async getOrCreateActiveKey() {
+        const now = new Date();
+        const activeKey = await this.keyRepository.findOne({
+            where: {
+                isActive: true,
+                expiresAt: (0, typeorm_2.MoreThan)(now),
+            },
+            order: {
+                createdAt: 'DESC',
+            },
+        });
+        if (activeKey) {
+            this.logger.debug(`Using existing active key: ${activeKey.kid}`);
+            return activeKey;
+        }
+        this.logger.log('No active key found, creating new key');
+        return this.rotateKey();
+    }
+    async rotateKey() {
+        this.logger.log('Rotating JWKS key');
+        await this.keyRepository.update({ isActive: true }, { isActive: false });
+        const { publicKey, privateKey } = await (0, jose_1.generateKeyPair)(ALG, {
+            modulusLength: 2048,
+            extractable: true,
+        });
+        const publicKeyPem = await (0, jose_1.exportSPKI)(publicKey);
+        const privateKeyPem = await (0, jose_1.exportPKCS8)(privateKey);
+        const publicJwk = await (0, jose_1.exportJWK)(publicKey);
+        const kid = await (0, jose_1.calculateJwkThumbprint)(publicJwk);
+        const config = (0, env_config_1.getConfig)();
+        const expiresAt = new Date();
+        expiresAt.setHours(expiresAt.getHours() + config.jwksKeySigningTtlHours);
+        const newKey = this.keyRepository.create({
+            kid,
+            publicKeyPem: publicKeyPem,
+            privateKeyPem: privateKeyPem,
+            algorithm: ALG,
+            isActive: true,
+            expiresAt,
+        });
+        const savedKey = await this.keyRepository.save(newKey);
+        this.logger.log(`Created new key: ${savedKey.kid}, expires at: ${savedKey.expiresAt.toISOString()}`);
+        return savedKey;
+    }
+    async getPublicKeys() {
+        const config = (0, env_config_1.getConfig)();
+        const now = new Date();
+        const cutoffDate = new Date(now);
+        cutoffDate.setHours(cutoffDate.getHours() - config.jwksKeyVerifyingTtlHours);
+        const validKeys = await this.keyRepository.find({
+            where: {
+                expiresAt: (0, typeorm_2.MoreThan)(cutoffDate),
+            },
+            order: {
+                createdAt: 'DESC',
+            },
+        });
+        this.logger.debug(`Found ${validKeys.length} valid keys for JWKS endpoint`);
+        const jwks = await Promise.all(validKeys.map(async (key) => {
+            const publicKey = await (0, jose_1.importSPKI)(key.publicKeyPem, key.algorithm);
+            const publicJwk = await (0, jose_1.exportJWK)(publicKey);
+            publicJwk.use = 'sig';
+            publicJwk.alg = key.algorithm;
+            publicJwk.kid = key.kid;
+            return publicJwk;
+        }));
+        return jwks;
+    }
+    async getActiveSigningKey() {
+        return this.getOrCreateActiveKey();
+    }
+    async cleanupExpiredKeys(gracePeriodDays = 7) {
+        const cutoffDate = new Date();
+        cutoffDate.setDate(cutoffDate.getDate() - gracePeriodDays);
+        const result = await this.keyRepository.softDelete({
+            expiresAt: (0, typeorm_2.LessThan)(cutoffDate),
+        });
+        const deletedCount = result.affected || 0;
+        if (deletedCount > 0) {
+            this.logger.log(`Soft deleted ${deletedCount} expired keys`);
+        }
+        return deletedCount;
+    }
+};
+exports.JwksService = JwksService;
+exports.JwksService = JwksService = JwksService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(jwks_key_entity_1.JwksKeyEntity)),
+    __metadata("design:paramtypes", [typeorm_2.Repository])
+], JwksService);
+//# sourceMappingURL=jwks.service.js.map

package/dist/auth/crypto/jwks.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.service.js","sourceRoot":"","sources":["../../../src/auth/crypto/jwks.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,6CAAmD;AACnD,qCAAyD;AACzD,uDAAkD;AAClD,+BAQc;AACd,wDAAkD;AAGlD,MAAM,GAAG,GAAG,OAAgB,CAAC;AAGtB,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAKH;IAJX,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAE9C,YAEmB,aAAwC;QAAxC,kBAAa,GAAb,aAAa,CAA2B;IACxD,CAAC;IAKJ,KAAK,CAAC,oBAAoB;QAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE;gBACL,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAA,kBAAQ,EAAC,GAAG,CAAC;aACzB;YACD,KAAK,EAAE;gBACL,SAAS,EAAE,MAAM;aAClB;SACF,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,SAAS,CAAC;QACnB,CAAC;QAGD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAKD,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAGrC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAGzE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAA,sBAAe,EAAC,GAAG,EAAE;YAC3D,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QAGH,MAAM,YAAY,GAAG,MAAM,IAAA,iBAAU,EAAC,SAAS,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,MAAM,IAAA,kBAAW,EAAC,UAAU,CAAC,CAAC;QAGpD,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,IAAA,6BAAsB,EAAC,SAAS,CAAC,CAAC;QAGpD,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAG3B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAGzE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YACvC,GAAG;YACH,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,aAAa;YAC5B,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,IAAI;YACd,SAAS;SACV,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,oBAAoB,QAAQ,CAAC,GAAG,iBAAiB,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CACpF,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAOD,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAKvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,UAAU,CAAC,QAAQ,CACjB,UAAU,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,wBAAwB,CACxD,CAAC;QAGF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAC9C,KAAK,EAAE;gBACL,SAAS,EAAE,IAAA,kBAAQ,EAAC,UAAU,CAAC;aAChC;YACD,KAAK,EAAE;gBACL,SAAS,EAAE,MAAM;aAClB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,SAAS,CAAC,MAAM,+BAA+B,CAAC,CAAC;QAG5E,MAAM,IAAI,GAAU,MAAM,OAAO,CAAC,GAAG,CACnC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC1B,MAAM,SAAS,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YAGpE,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC;YAC7C,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;YACtB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;YAC9B,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YAExB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAKD,KAAK,CAAC,mBAAmB;QACvB,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACrC,CAAC;IAMD,KAAK,CAAC,kBAAkB,CAAC,kBAA0B,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;YACjD,SAAS,EAAE,IAAA,kBAAQ,EAAC,UAAU,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;QAC1C,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,YAAY,eAAe,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF,CAAA;AA3JY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,0BAAgB,EAAC,+BAAa,CAAC,CAAA;qCACA,oBAAU;GALjC,WAAW,CA2JvB"}

package/dist/auth/crypto/token-signer.service.d.ts

@@ -0,0 +1,8 @@
+import { JwksService } from './jwks.service';
+import { AccessTokenClaims } from '../core/types/access-token-claims.type';
+export declare class TokenSignerService {
+    private readonly jwksService;
+    private logger;
+    constructor(jwksService: JwksService);
+    signToken(claims: AccessTokenClaims): Promise<string>;
+}

package/dist/auth/crypto/token-signer.service.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TokenSignerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenSignerService = void 0;
+const common_1 = require("@nestjs/common");
+const jwks_service_1 = require("./jwks.service");
+const jose_1 = require("jose");
+let TokenSignerService = TokenSignerService_1 = class TokenSignerService {
+    jwksService;
+    logger = new common_1.Logger(TokenSignerService_1.name);
+    constructor(jwksService) {
+        this.jwksService = jwksService;
+    }
+    async signToken(claims) {
+        const signingKey = await this.jwksService.getActiveSigningKey();
+        const privateKey = await (0, jose_1.importPKCS8)(signingKey.privateKeyPem, signingKey.algorithm);
+        const jwt = await new jose_1.SignJWT(claims)
+            .setProtectedHeader({
+            alg: signingKey.algorithm,
+            kid: signingKey.kid,
+            typ: 'JWT',
+        })
+            .sign(privateKey);
+        return jwt;
+    }
+};
+exports.TokenSignerService = TokenSignerService;
+exports.TokenSignerService = TokenSignerService = TokenSignerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwks_service_1.JwksService])
+], TokenSignerService);
+//# sourceMappingURL=token-signer.service.js.map

package/dist/auth/crypto/token-signer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-signer.service.js","sourceRoot":"","sources":["../../../src/auth/crypto/token-signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,iDAA6C;AAE7C,+BAA4C;AAGrC,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAGA;IAFrB,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAErD,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAEzD,KAAK,CAAC,SAAS,CAAC,MAAyB;QACvC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAW,EAClC,UAAU,CAAC,aAAa,EACxB,UAAU,CAAC,SAAS,CACrB,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,cAAO,CAAC,MAAa,CAAC;aACzC,kBAAkB,CAAC;YAClB,GAAG,EAAE,UAAU,CAAC,SAAS;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,EAAE,KAAK;SACX,CAAC;aACD,IAAI,CAAC,UAAU,CAAC,CAAC;QAEpB,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAtBY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAI+B,0BAAW;GAH1C,kBAAkB,CAsB9B"}

package/dist/auth/crypto/token-verifier.service.d.ts

@@ -0,0 +1,8 @@
+import { JwksService } from './jwks.service';
+import { AccessTokenClaims } from '../core/types/access-token-claims.type';
+export declare class TokenVerifierService {
+    private readonly jwksService;
+    private logger;
+    constructor(jwksService: JwksService);
+    verifyAndDecode(token: string): Promise<AccessTokenClaims>;
+}

package/dist/auth/crypto/token-verifier.service.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TokenVerifierService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifierService = void 0;
+const common_1 = require("@nestjs/common");
+const jwks_service_1 = require("./jwks.service");
+const jose_1 = require("jose");
+const env_config_1 = require("../../config/env.config");
+const jwt_errors_1 = require("../core/errors/jwt.errors");
+let TokenVerifierService = TokenVerifierService_1 = class TokenVerifierService {
+    jwksService;
+    logger = new common_1.Logger(TokenVerifierService_1.name);
+    constructor(jwksService) {
+        this.jwksService = jwksService;
+    }
+    async verifyAndDecode(token) {
+        try {
+            const publicKeys = await this.jwksService.getPublicKeys();
+            if (publicKeys.length === 0) {
+                this.logger.error('No public keys available for token verification');
+                throw new common_1.UnauthorizedException('Token verification failed');
+            }
+            const config = (0, env_config_1.getConfig)();
+            const { payload } = await (0, jose_1.jwtVerify)(token, getKeyFactory(publicKeys), {
+                issuer: config.issuerUrl,
+                algorithms: ['RS256'],
+            });
+            const claims = payload;
+            return claims;
+        }
+        catch (error) {
+            if (error instanceof jose_1.errors.JWTExpired) {
+                this.logger.debug('Token introspection failed: expired');
+                throw new jwt_errors_1.TokenExpiredError();
+            }
+            else if (error instanceof jose_1.errors.JWSSignatureVerificationFailed) {
+                this.logger.warn('Token introspection failed: bad signature');
+                throw new jwt_errors_1.InvalidTokenSignaturedError();
+            }
+            else {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                this.logger.warn(`Token introspection failed: ${errorMessage}`);
+                throw new jwt_errors_1.TokenValidationError(errorMessage);
+            }
+        }
+    }
+};
+exports.TokenVerifierService = TokenVerifierService;
+exports.TokenVerifierService = TokenVerifierService = TokenVerifierService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwks_service_1.JwksService])
+], TokenVerifierService);
+function getKeyFactory(publicKeys) {
+    return async (header) => {
+        const key = publicKeys.find((k) => k.kid === header.kid);
+        if (!key) {
+            throw new Error('Key not found');
+        }
+        return key;
+    };
+}
+//# sourceMappingURL=token-verifier.service.js.map

package/dist/auth/crypto/token-verifier.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.service.js","sourceRoot":"","sources":["../../../src/auth/crypto/token-verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,iDAA6C;AAE7C,+BAA8C;AAC9C,wDAAkD;AAClD,0DAImC;AAG5B,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAGF;IAFrB,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEvD,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAKzD,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,IAAI,CAAC;YAEH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,sBAAS,GAAE,CAAC;YAC3B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE;gBACpE,MAAM,EAAE,MAAM,CAAC,SAAS;gBACxB,UAAU,EAAE,CAAC,OAAO,CAAC;aACtB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAuC,CAAC;YAGvD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAM,CAAC,UAAU,EAAE,CAAC;gBACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;gBACzD,MAAM,IAAI,8BAAiB,EAAE,CAAC;YAChC,CAAC;iBAAM,IAAI,KAAK,YAAY,aAAM,CAAC,8BAA8B,EAAE,CAAC;gBAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBAC9D,MAAM,IAAI,wCAA2B,EAAE,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,YAAY,EAAE,CAAC,CAAC;gBAChE,MAAM,IAAI,iCAAoB,CAAC,YAAY,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AAzCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAI+B,0BAAW;GAH1C,oBAAoB,CAyChC;AAED,SAAS,aAAa,CAAC,UAAiB;IACtC,OAAO,KAAK,EAAE,MAAW,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAU,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/guards/auth-guards.module.d.ts

@@ -0,0 +1,2 @@
+export declare class AuthGuardsModule {
+}

package/dist/auth/guards/auth-guards.module.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuardsModule = void 0;
+const common_1 = require("@nestjs/common");
+const access_token_validation_service_1 = require("./validation/access-token-validation.service");
+const access_token_guard_1 = require("./guards/access-token.guard");
+const auth_crypto_module_1 = require("../crypto/auth-crypto.module");
+let AuthGuardsModule = class AuthGuardsModule {
+};
+exports.AuthGuardsModule = AuthGuardsModule;
+exports.AuthGuardsModule = AuthGuardsModule = __decorate([
+    (0, common_1.Module)({
+        imports: [auth_crypto_module_1.AuthCryptoModule],
+        providers: [access_token_validation_service_1.AccessTokenValidationService, access_token_guard_1.AccessTokenGuard],
+        controllers: [],
+        exports: [access_token_validation_service_1.AccessTokenValidationService],
+    })
+], AuthGuardsModule);
+//# sourceMappingURL=auth-guards.module.js.map

package/dist/auth/guards/auth-guards.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-guards.module.js","sourceRoot":"","sources":["../../../src/auth/guards/auth-guards.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,kGAA4F;AAC5F,oEAA+D;AAC/D,qEAAgE;AAQzD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAN5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,qCAAgB,CAAC;QAC3B,SAAS,EAAE,CAAC,8DAA4B,EAAE,qCAAgB,CAAC;QAC3D,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,CAAC,8DAA4B,CAAC;KACxC,CAAC;GACW,gBAAgB,CAAG"}

package/dist/auth/guards/constants/headers.constants.d.ts

@@ -0,0 +1 @@
+export declare const RUN_ID_HEADER = "x-taico-run-id";

package/dist/auth/guards/constants/headers.constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUN_ID_HEADER = void 0;
+exports.RUN_ID_HEADER = 'x-taico-run-id';
+//# sourceMappingURL=headers.constants.js.map

package/dist/auth/guards/constants/headers.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.constants.js","sourceRoot":"","sources":["../../../../src/auth/guards/constants/headers.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,aAAa,GAAG,gBAAgB,CAAC"}

package/dist/auth/guards/context/auth-context.types.d.ts

@@ -0,0 +1,13 @@
+import { AccessTokenClaims } from '../../../auth/core/types/access-token-claims.type';
+import { ActorType } from 'src/identity-provider/enums';
+export type AuthContext = {
+    token: string;
+    claims: AccessTokenClaims;
+    scopes: string[];
+    subject: string;
+};
+export type UserContext = {
+    actorId: string;
+    actorSlug: string;
+    actorType: ActorType;
+};

package/dist/auth/guards/context/auth-context.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=auth-context.types.js.map

package/dist/auth/guards/context/auth-context.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.types.js","sourceRoot":"","sources":["../../../../src/auth/guards/context/auth-context.types.ts"],"names":[],"mappings":""}

package/dist/auth/guards/decorators/current-auth.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentAuth: (...dataOrPipes: unknown[]) => ParameterDecorator;