@taico/taico 0.0.2

package/dist/auth/guards/decorators/current-auth.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentAuth = void 0;
+const common_1 = require("@nestjs/common");
+exports.CurrentAuth = (0, common_1.createParamDecorator)((data, context) => {
+    const res = context.switchToHttp().getResponse();
+    const authCtx = res.locals.auth;
+    return authCtx;
+});
+//# sourceMappingURL=current-auth.decorator.js.map

package/dist/auth/guards/decorators/current-auth.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-auth.decorator.js","sourceRoot":"","sources":["../../../../src/auth/guards/decorators/current-auth.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAI3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,IAAa,EAAE,OAAyB,EAAe,EAAE;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAmB,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC,CACF,CAAC"}

package/dist/auth/guards/decorators/current-run-id.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentRunId: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/auth/guards/decorators/current-run-id.decorator.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentRunId = void 0;
+const common_1 = require("@nestjs/common");
+const headers_constants_1 = require("../constants/headers.constants");
+exports.CurrentRunId = (0, common_1.createParamDecorator)((data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    const runId = request.headers[headers_constants_1.RUN_ID_HEADER];
+    return runId || undefined;
+});
+//# sourceMappingURL=current-run-id.decorator.js.map

package/dist/auth/guards/decorators/current-run-id.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-run-id.decorator.js","sourceRoot":"","sources":["../../../../src/auth/guards/decorators/current-run-id.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AACxE,sEAA+D;AAElD,QAAA,YAAY,GAAG,IAAA,6BAAoB,EAC9C,CAAC,IAAa,EAAE,GAAqB,EAAsB,EAAE;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAa,CAAC,CAAC;IAC7C,OAAO,KAAK,IAAI,SAAS,CAAC;AAC5B,CAAC,CACF,CAAC"}

package/dist/auth/guards/decorators/current-user.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/auth/guards/decorators/current-user.decorator.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+exports.CurrentUser = (0, common_1.createParamDecorator)((data, context) => {
+    const res = context.switchToHttp().getResponse();
+    const authCtx = res.locals.auth;
+    return {
+        actorId: authCtx.claims.actor_id,
+        actorSlug: authCtx.claims.actor_slug,
+        actorType: authCtx.claims.actor_type,
+    };
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/auth/guards/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../../src/auth/guards/decorators/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAiB3D,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,IAAa,EAAE,OAAyB,EAAe,EAAE;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAmB,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;QAChC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;QACpC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC,CACF,CAAC"}

package/dist/auth/guards/decorators/public.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/auth/guards/decorators/public.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.IS_PUBLIC_KEY = 'isPublic';
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;
+//# sourceMappingURL=public.decorator.js.map

package/dist/auth/guards/decorators/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../../src/auth/guards/decorators/public.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,aAAa,GAAG,UAAU,CAAC;AACjC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,qBAAa,EAAE,IAAI,CAAC,CAAC;AAAhD,QAAA,MAAM,UAA0C"}

package/dist/auth/guards/decorators/require-scopes.decorator.d.ts

@@ -0,0 +1,8 @@
+export declare const REQUIRED_SCOPES_KEY = "auth:required_scopes";
+export type ScopeMode = 'all' | 'any';
+export interface RequiredScopesMetadata {
+    scopes: string[];
+    mode: ScopeMode;
+}
+export declare function RequireScopes(...scopes: string[]): MethodDecorator & ClassDecorator;
+export declare function RequireScopes(meta: RequiredScopesMetadata): MethodDecorator & ClassDecorator;

package/dist/auth/guards/decorators/require-scopes.decorator.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REQUIRED_SCOPES_KEY = void 0;
+exports.RequireScopes = RequireScopes;
+const common_1 = require("@nestjs/common");
+exports.REQUIRED_SCOPES_KEY = 'auth:required_scopes';
+function RequireScopes(...args) {
+    if (args.length === 1 && typeof args[0] === 'object') {
+        const meta = args[0];
+        return (0, common_1.SetMetadata)(exports.REQUIRED_SCOPES_KEY, {
+            scopes: meta.scopes ?? [],
+            mode: meta.mode ?? 'all',
+        });
+    }
+    return (0, common_1.SetMetadata)(exports.REQUIRED_SCOPES_KEY, {
+        scopes: args,
+        mode: 'all',
+    });
+}
+//# sourceMappingURL=require-scopes.decorator.js.map

package/dist/auth/guards/decorators/require-scopes.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-scopes.decorator.js","sourceRoot":"","sources":["../../../../src/auth/guards/decorators/require-scopes.decorator.ts"],"names":[],"mappings":";;;AAuBA,sCAeC;AAtCD,2CAA6C;AAEhC,QAAA,mBAAmB,GAAG,sBAAsB,CAAC;AAqB1D,SAAgB,aAAa,CAC3B,GAAG,IAAyC;IAE5C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,OAAO,IAAA,oBAAW,EAAC,2BAAmB,EAAE;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;SACQ,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAA,oBAAW,EAAC,2BAAmB,EAAE;QACtC,MAAM,EAAE,IAAgB;QACxB,IAAI,EAAE,KAAK;KACqB,CAAC,CAAC;AACtC,CAAC"}

package/dist/auth/guards/errors/access-token.errors.d.ts

@@ -0,0 +1,21 @@
+export declare const AccessTokenErrorCodes: {
+    MISSING_ACCESS_TOKEN: "MISSING_ACCESS_TOKEN";
+    INVALID_ACCESS_TOKEN: "INVALID_ACCESS_TOKEN";
+    INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE";
+};
+type AccessTokenErrorCode = (typeof AccessTokenErrorCodes)[keyof typeof AccessTokenErrorCodes];
+export declare abstract class AccessTokenDomainError extends Error {
+    readonly code: AccessTokenErrorCode;
+    readonly context?: Record<string, unknown> | undefined;
+    constructor(message: string, code: AccessTokenErrorCode, context?: Record<string, unknown> | undefined);
+}
+export declare class MissingAccessTokenError extends AccessTokenDomainError {
+    constructor();
+}
+export declare class InvalidAccessTokenError extends AccessTokenDomainError {
+    constructor(message: string);
+}
+export declare class InsufficientScopeError extends AccessTokenDomainError {
+    constructor(message: string);
+}
+export {};

package/dist/auth/guards/errors/access-token.errors.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsufficientScopeError = exports.InvalidAccessTokenError = exports.MissingAccessTokenError = exports.AccessTokenDomainError = exports.AccessTokenErrorCodes = void 0;
+const errors_1 = require("@taico/errors");
+exports.AccessTokenErrorCodes = {
+    MISSING_ACCESS_TOKEN: errors_1.ErrorCodes.MISSING_ACCESS_TOKEN,
+    INVALID_ACCESS_TOKEN: errors_1.ErrorCodes.INVALID_ACCESS_TOKEN,
+    INSUFFICIENT_SCOPE: errors_1.ErrorCodes.INSUFFICIENT_SCOPE,
+};
+class AccessTokenDomainError extends Error {
+    code;
+    context;
+    constructor(message, code, context) {
+        super(message);
+        this.code = code;
+        this.context = context;
+        this.name = this.constructor.name;
+    }
+}
+exports.AccessTokenDomainError = AccessTokenDomainError;
+class MissingAccessTokenError extends AccessTokenDomainError {
+    constructor() {
+        super('Missing access token', exports.AccessTokenErrorCodes.MISSING_ACCESS_TOKEN);
+    }
+}
+exports.MissingAccessTokenError = MissingAccessTokenError;
+class InvalidAccessTokenError extends AccessTokenDomainError {
+    constructor(message) {
+        super(message, exports.AccessTokenErrorCodes.INVALID_ACCESS_TOKEN);
+    }
+}
+exports.InvalidAccessTokenError = InvalidAccessTokenError;
+class InsufficientScopeError extends AccessTokenDomainError {
+    constructor(message) {
+        super(message, exports.AccessTokenErrorCodes.INSUFFICIENT_SCOPE);
+    }
+}
+exports.InsufficientScopeError = InsufficientScopeError;
+//# sourceMappingURL=access-token.errors.js.map

package/dist/auth/guards/errors/access-token.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.errors.js","sourceRoot":"","sources":["../../../../src/auth/guards/errors/access-token.errors.ts"],"names":[],"mappings":";;;AAAA,0CAA2C;AAE9B,QAAA,qBAAqB,GAAG;IACnC,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;IACrD,oBAAoB,EAAE,mBAAU,CAAC,oBAAoB;IACrD,kBAAkB,EAAE,mBAAU,CAAC,kBAAkB;CAClD,CAAC;AASF,MAAsB,sBAAuB,SAAQ,KAAK;IAG7C;IACA;IAHX,YACE,OAAe,EACN,IAA0B,EAC1B,OAAiC;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAsB;QAC1B,YAAO,GAAP,OAAO,CAA0B;QAG1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AATD,wDASC;AAGD,MAAa,uBAAwB,SAAQ,sBAAsB;IACjE;QACE,KAAK,CAAC,sBAAsB,EAAE,6BAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC;CACF;AAJD,0DAIC;AAGD,MAAa,uBAAwB,SAAQ,sBAAsB;IACjE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC;CACF;AAJD,0DAIC;AAGD,MAAa,sBAAuB,SAAQ,sBAAsB;IAChE,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,wDAIC"}

package/dist/auth/guards/extractors/token-cookie.extractor.d.ts

@@ -0,0 +1,3 @@
+import { Request } from 'express';
+export declare function extractTokenFromCookie(req: Request): string | null;
+export declare function tokenFromCookies(cookies?: Record<string, string>): string | null;

package/dist/auth/guards/extractors/token-cookie.extractor.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractTokenFromCookie = extractTokenFromCookie;
+exports.tokenFromCookies = tokenFromCookies;
+const constants_1 = require("../../core/constants");
+function extractTokenFromCookie(req) {
+    const token = req.cookies?.[constants_1.COOKIE_KEYS.ACCESS_TOKEN] || '';
+    return token.length > 0 ? token : null;
+}
+function tokenFromCookies(cookies) {
+    if (!cookies)
+        return null;
+    const token = cookies[constants_1.COOKIE_KEYS.ACCESS_TOKEN] || '';
+    return token.length > 0 ? token : null;
+}
+//# sourceMappingURL=token-cookie.extractor.js.map

package/dist/auth/guards/extractors/token-cookie.extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cookie.extractor.js","sourceRoot":"","sources":["../../../../src/auth/guards/extractors/token-cookie.extractor.ts"],"names":[],"mappings":";;AAOA,wDAIC;AAED,4CAMC;AAdD,oDAAmD;AAEnD,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,uBAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAE5D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAgB,gBAAgB,CAC9B,OAAgC;IAEhC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAW,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IACtD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/auth/guards/extractors/token-header.extractor.d.ts

@@ -0,0 +1,2 @@
+import { IncomingHttpHeaders } from 'http';
+export declare function tokenFromHeaders(headers: IncomingHttpHeaders): string | null;

package/dist/auth/guards/extractors/token-header.extractor.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenFromHeaders = tokenFromHeaders;
+function tokenFromHeaders(headers) {
+    const raw = headers['authorization'];
+    if (typeof raw !== 'string' || raw.length === 0)
+        return null;
+    const [scheme, ...rest] = raw.split(' ');
+    if (!scheme || rest.length === 0)
+        return null;
+    if (scheme.toLowerCase() !== 'bearer')
+        return null;
+    const token = rest.join(' ').trim();
+    return token.length > 0 ? token : null;
+}
+//# sourceMappingURL=token-header.extractor.js.map

package/dist/auth/guards/extractors/token-header.extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-header.extractor.js","sourceRoot":"","sources":["../../../../src/auth/guards/extractors/token-header.extractor.ts"],"names":[],"mappings":";;AAMA,4CAWC;AAXD,SAAgB,gBAAgB,CAAC,OAA4B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAG7D,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC"}

package/dist/auth/guards/guards/access-token.guard.d.ts

@@ -0,0 +1,11 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AccessTokenValidationService } from '../validation/access-token-validation.service';
+import { Reflector } from '@nestjs/core';
+export declare class AccessTokenGuard implements CanActivate {
+    private readonly validator;
+    private readonly reflector;
+    private readonly logger;
+    constructor(validator: AccessTokenValidationService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private safeErr;
+}

package/dist/auth/guards/guards/access-token.guard.js

@@ -0,0 +1,84 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AccessTokenGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenGuard = void 0;
+const common_1 = require("@nestjs/common");
+const access_token_validation_service_1 = require("../validation/access-token-validation.service");
+const access_token_errors_1 = require("../errors/access-token.errors");
+const token_header_extractor_1 = require("../extractors/token-header.extractor");
+const token_cookie_extractor_1 = require("../extractors/token-cookie.extractor");
+const core_1 = require("@nestjs/core");
+const public_decorator_1 = require("../decorators/public.decorator");
+const jwt_errors_1 = require("../../core/errors/jwt.errors");
+let AccessTokenGuard = AccessTokenGuard_1 = class AccessTokenGuard {
+    validator;
+    reflector;
+    logger = new common_1.Logger(AccessTokenGuard_1.name);
+    constructor(validator, reflector) {
+        this.validator = validator;
+        this.reflector = reflector;
+    }
+    async canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        const req = context.switchToHttp().getRequest();
+        const res = context.switchToHttp().getResponse();
+        const token = (0, token_header_extractor_1.tokenFromHeaders)(req.headers) || (0, token_cookie_extractor_1.tokenFromCookies)(req.cookies);
+        if (!token) {
+            throw new access_token_errors_1.MissingAccessTokenError();
+        }
+        let claims;
+        try {
+            claims = await this.validator.validateAccessToken(token);
+        }
+        catch (error) {
+            if (error instanceof jwt_errors_1.TokenExpiredError) {
+                throw new access_token_errors_1.InvalidAccessTokenError('Token expired');
+            }
+            else if (error instanceof jwt_errors_1.InvalidTokenSignaturedError) {
+                throw new access_token_errors_1.InvalidAccessTokenError('Invalid signature');
+            }
+            this.logger.warn(`Access token validation failed: ${this.safeErr(error)}`);
+            throw new access_token_errors_1.InvalidAccessTokenError(`Invalid or expired access token: ${error}`);
+        }
+        const authContext = {
+            token,
+            claims,
+            scopes: claims.scope,
+            subject: claims.sub,
+        };
+        res.locals.auth = authContext;
+        return true;
+    }
+    safeErr(err) {
+        if (err instanceof Error)
+            return err.message || err.name;
+        try {
+            return JSON.stringify(err);
+        }
+        catch {
+            return String(err);
+        }
+    }
+};
+exports.AccessTokenGuard = AccessTokenGuard;
+exports.AccessTokenGuard = AccessTokenGuard = AccessTokenGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [access_token_validation_service_1.AccessTokenValidationService,
+        core_1.Reflector])
+], AccessTokenGuard);
+//# sourceMappingURL=access-token.guard.js.map

package/dist/auth/guards/guards/access-token.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.guard.js","sourceRoot":"","sources":["../../../../src/auth/guards/guards/access-token.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AASA,2CAKwB;AAExB,mGAA6F;AAC7F,uEAGuC;AAEvC,iFAAwE;AACxE,iFAAwE;AACxE,uCAAyC;AACzC,qEAA+D;AAC/D,6DAGsC;AAI/B,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIR;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YACmB,SAAuC,EACvC,SAAoB;QADpB,cAAS,GAAT,SAAS,CAA8B;QACvC,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAG3D,MAAM,KAAK,GACT,IAAA,yCAAgB,EAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAA,yCAAgB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,6CAAuB,EAAE,CAAC;QACtC,CAAC;QAGD,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,KAAK,YAAY,8BAAiB,EAAE,CAAC;gBACvC,MAAM,IAAI,6CAAuB,CAAC,eAAe,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,YAAY,wCAA2B,EAAE,CAAC;gBACxD,MAAM,IAAI,6CAAuB,CAAC,mBAAmB,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mCAAmC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACzD,CAAC;YACF,MAAM,IAAI,6CAAuB,CAC/B,oCAAoC,KAAK,EAAE,CAC5C,CAAC;QACJ,CAAC;QAGD,MAAM,WAAW,GAAgB;YAC/B,KAAK;YACL,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,OAAO,EAAE,MAAM,CAAC,GAAG;SACpB,CAAC;QAEF,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC;QAE9B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,OAAO,CAAC,GAAY;QAC1B,IAAI,GAAG,YAAY,KAAK;YAAE,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF,CAAA;AApEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAKmB,8DAA4B;QAC5B,gBAAS;GAL5B,gBAAgB,CAoE5B"}

package/dist/auth/guards/guards/scopes.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class ScopesGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/auth/guards/guards/scopes.guard.js

@@ -0,0 +1,55 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const require_scopes_decorator_1 = require("../decorators/require-scopes.decorator");
+const public_decorator_1 = require("../decorators/public.decorator");
+const access_token_errors_1 = require("../errors/access-token.errors");
+let ScopesGuard = class ScopesGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic)
+            return true;
+        const meta = this.reflector.getAllAndOverride(require_scopes_decorator_1.REQUIRED_SCOPES_KEY, [context.getHandler(), context.getClass()]);
+        if (!meta || meta.scopes.length === 0)
+            return true;
+        const req = context.switchToHttp().getRequest();
+        const res = context.switchToHttp().getResponse();
+        const auth = res.locals?.auth;
+        if (!auth) {
+            throw new access_token_errors_1.InvalidAccessTokenError('Missing auth context (did AccessTokenGuard run?)');
+        }
+        const tokenScopes = new Set((auth.scopes ?? []).filter(Boolean));
+        const required = meta.scopes;
+        const ok = meta.mode === 'any'
+            ? required.some((s) => tokenScopes.has(s))
+            : required.every((s) => tokenScopes.has(s));
+        if (!ok) {
+            throw new access_token_errors_1.InsufficientScopeError(`Missing required scope(s): ${required.join(', ')} (mode=${meta.mode})`);
+        }
+        return true;
+    }
+};
+exports.ScopesGuard = ScopesGuard;
+exports.ScopesGuard = ScopesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], ScopesGuard);
+//# sourceMappingURL=scopes.guard.js.map

package/dist/auth/guards/guards/scopes.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.guard.js","sourceRoot":"","sources":["../../../../src/auth/guards/guards/scopes.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2E;AAC3E,uCAAyC;AAGzC,qFAGgD;AAChD,qEAA+D;AAE/D,uEAGuC;AAGhC,IAAM,WAAW,GAAjB,MAAM,WAAW;IACO;IAA7B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,WAAW,CAAC,OAAyB;QAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAE3C,8CAAmB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAGnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAI3D,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,IAA+B,CAAC;QAGzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,6CAAuB,CAC/B,kDAAkD,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAE7B,MAAM,EAAE,GACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhD,IAAI,CAAC,EAAE,EAAE,CAAC;YAER,MAAM,IAAI,4CAAsB,CAC9B,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,GAAG,CACxE,CAAC;QACJ,CAAC;QAKD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AApDY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,WAAW,CAoDvB"}

package/dist/auth/guards/guards/ws-access-token-guard.d.ts

@@ -0,0 +1,8 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AccessTokenValidationService } from '../validation/access-token-validation.service';
+export declare class WsAccessTokenGuard implements CanActivate {
+    private readonly validator;
+    private logger;
+    constructor(validator: AccessTokenValidationService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/auth/guards/guards/ws-access-token-guard.js

@@ -0,0 +1,93 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var WsAccessTokenGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WsAccessTokenGuard = void 0;
+const common_1 = require("@nestjs/common");
+const access_token_validation_service_1 = require("../validation/access-token-validation.service");
+const token_header_extractor_1 = require("../extractors/token-header.extractor");
+const token_cookie_extractor_1 = require("../extractors/token-cookie.extractor");
+const cookie = __importStar(require("cookie"));
+let WsAccessTokenGuard = WsAccessTokenGuard_1 = class WsAccessTokenGuard {
+    validator;
+    logger = new common_1.Logger(WsAccessTokenGuard_1.name);
+    constructor(validator) {
+        this.validator = validator;
+    }
+    async canActivate(context) {
+        this.logger.log('WsAccessTokenGuard: canActivate called');
+        const client = context.switchToWs().getClient();
+        const handshake = client.handshake;
+        const token = handshake.auth?.token ||
+            (0, token_header_extractor_1.tokenFromHeaders)(handshake.headers) ||
+            (0, token_cookie_extractor_1.tokenFromCookies)(cookie.parse(handshake.headers.cookie || ''));
+        this.logger.log(`Extracted WS token: ${token.replace(/(.{4}).+(.{4})/, '$1...$2')}`);
+        if (!token) {
+            client.disconnect(true);
+            return false;
+        }
+        let claims;
+        try {
+            claims = await this.validator.validateAccessToken(token);
+        }
+        catch {
+            client.disconnect(true);
+            return false;
+        }
+        const authContext = {
+            token,
+            claims,
+            scopes: claims.scope,
+            subject: claims.sub,
+        };
+        client.data.auth = authContext;
+        return true;
+    }
+};
+exports.WsAccessTokenGuard = WsAccessTokenGuard;
+exports.WsAccessTokenGuard = WsAccessTokenGuard = WsAccessTokenGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [access_token_validation_service_1.AccessTokenValidationService])
+], WsAccessTokenGuard);
+//# sourceMappingURL=ws-access-token-guard.js.map

package/dist/auth/guards/guards/ws-access-token-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-access-token-guard.js","sourceRoot":"","sources":["../../../../src/auth/guards/guards/ws-access-token-guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,mGAA6F;AAE7F,iFAAwE;AACxE,iFAAwE;AACxE,+CAAiC;AAK1B,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAGA;IAFrB,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAErD,YAA6B,SAAuC;QAAvC,cAAS,GAAT,SAAS,CAA8B;IAAG,CAAC;IAExE,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QAE1D,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,SAAS,EAAU,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAGnC,MAAM,KAAK,GACT,SAAS,CAAC,IAAI,EAAE,KAAK;YACrB,IAAA,yCAAgB,EAAC,SAAS,CAAC,OAAO,CAAC;YACnC,IAAA,yCAAgB,EAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,uBAAuB,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,CACpE,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAGD,MAAM,WAAW,GAAgB;YAC/B,KAAK;YACL,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,OAAO,EAAE,MAAM,CAAC,GAAG;SACpB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QAE/B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7CY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAI6B,8DAA4B;GAHzD,kBAAkB,CA6C9B"}

package/dist/auth/guards/guards/ws-scopes.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+export declare class WsScopesGuard implements CanActivate {
+    private readonly reflector;
+    constructor(reflector: Reflector);
+    canActivate(ctx: ExecutionContext): boolean;
+}

package/dist/auth/guards/guards/ws-scopes.guard.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WsScopesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const require_scopes_decorator_1 = require("../decorators/require-scopes.decorator");
+let WsScopesGuard = class WsScopesGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(ctx) {
+        const client = ctx.switchToWs().getClient();
+        const meta = this.reflector.getAllAndOverride(require_scopes_decorator_1.REQUIRED_SCOPES_KEY, [ctx.getHandler(), ctx.getClass()]);
+        if (!meta || meta.scopes.length === 0)
+            return true;
+        const auth = client.data?.auth;
+        if (!auth)
+            return false;
+        const tokenScopes = new Set(auth.scopes);
+        const required = meta.scopes;
+        const ok = meta.mode === 'any'
+            ? required.some((s) => tokenScopes.has(s))
+            : required.every((s) => tokenScopes.has(s));
+        if (!ok) {
+            client.disconnect(true);
+            return false;
+        }
+        return true;
+    }
+};
+exports.WsScopesGuard = WsScopesGuard;
+exports.WsScopesGuard = WsScopesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], WsScopesGuard);
+//# sourceMappingURL=ws-scopes.guard.js.map

package/dist/auth/guards/guards/ws-scopes.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-scopes.guard.js","sourceRoot":"","sources":["../../../../src/auth/guards/guards/ws-scopes.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2E;AAC3E,uCAAyC;AAEzC,qFAGgD;AAIzC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACK;IAA7B,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,WAAW,CAAC,GAAqB;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,EAAU,CAAC;QAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC3C,8CAAmB,EACnB,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CACnC,CAAC;QAGF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAA+B,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAE7B,MAAM,EAAE,GACN,IAAI,CAAC,IAAI,KAAK,KAAK;YACjB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhCY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,aAAa,CAgCzB"}

package/dist/auth/guards/validation/access-token-validation.service.d.ts

@@ -0,0 +1,7 @@
+import { AccessTokenClaims } from '../../core/types/access-token-claims.type';
+import { TokenVerifierService } from '../../crypto/token-verifier.service';
+export declare class AccessTokenValidationService {
+    private readonly tokenVerifierService;
+    constructor(tokenVerifierService: TokenVerifierService);
+    validateAccessToken(token: string): Promise<AccessTokenClaims>;
+}

package/dist/auth/guards/validation/access-token-validation.service.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenValidationService = void 0;
+const common_1 = require("@nestjs/common");
+const token_verifier_service_1 = require("../../crypto/token-verifier.service");
+let AccessTokenValidationService = class AccessTokenValidationService {
+    tokenVerifierService;
+    constructor(tokenVerifierService) {
+        this.tokenVerifierService = tokenVerifierService;
+    }
+    async validateAccessToken(token) {
+        const jwt = this.tokenVerifierService.verifyAndDecode(token);
+        return jwt;
+    }
+};
+exports.AccessTokenValidationService = AccessTokenValidationService;
+exports.AccessTokenValidationService = AccessTokenValidationService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [token_verifier_service_1.TokenVerifierService])
+], AccessTokenValidationService);
+//# sourceMappingURL=access-token-validation.service.js.map

package/dist/auth/guards/validation/access-token-validation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-validation.service.js","sourceRoot":"","sources":["../../../../src/auth/guards/validation/access-token-validation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAE5C,gFAA2E;AAOpE,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACV;IAA7B,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAE3E,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAErC,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAE7D,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AATY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;qCAEwC,6CAAoB;GAD5D,4BAA4B,CASxC"}

package/dist/auth-journeys/auth-journeys-cleanup.service.d.ts

@@ -0,0 +1,7 @@
+import { AuthJourneysService } from './auth-journeys.service';
+export declare class AuthJourneysCleanupService {
+    private readonly authJourneysService;
+    private readonly logger;
+    constructor(authJourneysService: AuthJourneysService);
+    pruneStaleClients(): Promise<void>;
+}