@treatwell/moleculer-essentials 1.0.0

package/dist/mixins/encryptor.mixin.cjs

@@ -0,0 +1,84 @@
+'use strict';
+
+var clientNode = require('@aws-crypto/client-node');
+var index = require('../index-82e1CXJX.cjs');
+
+const kCmm = Symbol("AWS KMS CMM");
+const kClient = Symbol("AWS KMS client");
+function EncryptorMixin({
+  keyId,
+  cacheMaxMessagesEncrypted,
+  cacheMaxAge,
+  cacheCapacity,
+  cacheMaxBytesEncrypted,
+  localMasterKey = process.env.LOCAL_KMS_MASTER_KEY
+}) {
+  return index.wrapMixin({
+    methods: {
+      getEncryptorClient() {
+        return this[kClient];
+      },
+      /**
+       * Get a keyring for a specific key ID
+       * This keyring is wrapped in a caching manager in order to reduce KMS calls.
+       *
+       * More info: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
+       */
+      getEncryptorCmm() {
+        let cmm = this[kCmm];
+        if (!cmm) {
+          let keyring;
+          if (keyId) {
+            keyring = new clientNode.KmsKeyringNode({ generatorKeyId: keyId });
+          } else if (localMasterKey) {
+            const buffer = Buffer.from(localMasterKey, "base64");
+            const unencryptedMasterKey = Buffer.alloc(
+              buffer.byteLength,
+              buffer
+            );
+            keyring = new clientNode.RawAesKeyringNode({
+              keyName: "aes-local-keyring",
+              keyNamespace: "aes-local-keyring-namespace",
+              wrappingSuite: clientNode.RawAesWrappingSuiteIdentifier.AES256_GCM_IV12_TAG16_NO_PADDING,
+              unencryptedMasterKey
+            });
+          } else {
+            throw new Error("Missing KMS key ID in EncryptorMixin");
+          }
+          cmm = new clientNode.NodeCachingMaterialsManager({
+            backingMaterials: keyring,
+            cache: clientNode.getLocalCryptographicMaterialsCache(cacheCapacity),
+            maxAge: cacheMaxAge,
+            maxMessagesEncrypted: cacheMaxMessagesEncrypted || 1,
+            maxBytesEncrypted: cacheMaxBytesEncrypted
+          });
+          this[kCmm] = cmm;
+        }
+        return cmm;
+      },
+      async encrypt(plainData) {
+        const { encrypt } = this.getEncryptorClient();
+        const { result } = await encrypt(this.getEncryptorCmm(), plainData, {});
+        return result;
+      },
+      async decrypt(encryptedData) {
+        const { decrypt } = this.getEncryptorClient();
+        const { plaintext } = await decrypt(
+          this.getEncryptorCmm(),
+          encryptedData,
+          {}
+        );
+        return plaintext;
+      }
+    },
+    created() {
+      this[kClient] = clientNode.buildClient({
+        commitmentPolicy: clientNode.CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
+        maxEncryptedDataKeys: false
+      });
+    }
+  });
+}
+
+exports.EncryptorMixin = EncryptorMixin;
+exports.kCmm = kCmm;

package/dist/mixins/encryptor.mixin.d.cts

@@ -0,0 +1,31 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.cjs';
+import { buildClient, NodeCachingMaterialsManager } from '@aws-crypto/client-node';
+import 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+declare const kCmm: unique symbol;
+type EncryptorMixinSettings = {
+    keyId: string | undefined;
+    cacheMaxAge: number;
+    cacheCapacity: number;
+    cacheMaxBytesEncrypted?: number;
+    cacheMaxMessagesEncrypted?: number;
+    localMasterKey?: string;
+};
+declare function EncryptorMixin({ keyId, cacheMaxMessagesEncrypted, cacheMaxAge, cacheCapacity, cacheMaxBytesEncrypted, localMasterKey, }: EncryptorMixinSettings): Partial<CustomServiceSchema<unknown, {
+    getEncryptorClient(): ReturnType<typeof buildClient>;
+    /**
+     * Get a keyring for a specific key ID
+     * This keyring is wrapped in a caching manager in order to reduce KMS calls.
+     *
+     * More info: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
+     */
+    getEncryptorCmm(): NodeCachingMaterialsManager;
+    encrypt(plainData: Buffer | string): Promise<Buffer>;
+    decrypt(encryptedData: Uint8Array | string): Promise<Buffer>;
+}, unknown, unknown>>;
+
+export { EncryptorMixin, kCmm };
+export type { EncryptorMixinSettings };

package/dist/mixins/encryptor.mixin.d.mts

@@ -0,0 +1,31 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.mjs';
+import { buildClient, NodeCachingMaterialsManager } from '@aws-crypto/client-node';
+import 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+declare const kCmm: unique symbol;
+type EncryptorMixinSettings = {
+    keyId: string | undefined;
+    cacheMaxAge: number;
+    cacheCapacity: number;
+    cacheMaxBytesEncrypted?: number;
+    cacheMaxMessagesEncrypted?: number;
+    localMasterKey?: string;
+};
+declare function EncryptorMixin({ keyId, cacheMaxMessagesEncrypted, cacheMaxAge, cacheCapacity, cacheMaxBytesEncrypted, localMasterKey, }: EncryptorMixinSettings): Partial<CustomServiceSchema<unknown, {
+    getEncryptorClient(): ReturnType<typeof buildClient>;
+    /**
+     * Get a keyring for a specific key ID
+     * This keyring is wrapped in a caching manager in order to reduce KMS calls.
+     *
+     * More info: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
+     */
+    getEncryptorCmm(): NodeCachingMaterialsManager;
+    encrypt(plainData: Buffer | string): Promise<Buffer>;
+    decrypt(encryptedData: Uint8Array | string): Promise<Buffer>;
+}, unknown, unknown>>;
+
+export { EncryptorMixin, kCmm };
+export type { EncryptorMixinSettings };

package/dist/mixins/encryptor.mixin.mjs

@@ -0,0 +1,81 @@
+import { buildClient, CommitmentPolicy, KmsKeyringNode, RawAesKeyringNode, RawAesWrappingSuiteIdentifier, NodeCachingMaterialsManager, getLocalCryptographicMaterialsCache } from '@aws-crypto/client-node';
+import { w as wrapMixin } from '../index-DNJWwcZu.mjs';
+
+const kCmm = Symbol("AWS KMS CMM");
+const kClient = Symbol("AWS KMS client");
+function EncryptorMixin({
+  keyId,
+  cacheMaxMessagesEncrypted,
+  cacheMaxAge,
+  cacheCapacity,
+  cacheMaxBytesEncrypted,
+  localMasterKey = process.env.LOCAL_KMS_MASTER_KEY
+}) {
+  return wrapMixin({
+    methods: {
+      getEncryptorClient() {
+        return this[kClient];
+      },
+      /**
+       * Get a keyring for a specific key ID
+       * This keyring is wrapped in a caching manager in order to reduce KMS calls.
+       *
+       * More info: https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/data-key-caching.html
+       */
+      getEncryptorCmm() {
+        let cmm = this[kCmm];
+        if (!cmm) {
+          let keyring;
+          if (keyId) {
+            keyring = new KmsKeyringNode({ generatorKeyId: keyId });
+          } else if (localMasterKey) {
+            const buffer = Buffer.from(localMasterKey, "base64");
+            const unencryptedMasterKey = Buffer.alloc(
+              buffer.byteLength,
+              buffer
+            );
+            keyring = new RawAesKeyringNode({
+              keyName: "aes-local-keyring",
+              keyNamespace: "aes-local-keyring-namespace",
+              wrappingSuite: RawAesWrappingSuiteIdentifier.AES256_GCM_IV12_TAG16_NO_PADDING,
+              unencryptedMasterKey
+            });
+          } else {
+            throw new Error("Missing KMS key ID in EncryptorMixin");
+          }
+          cmm = new NodeCachingMaterialsManager({
+            backingMaterials: keyring,
+            cache: getLocalCryptographicMaterialsCache(cacheCapacity),
+            maxAge: cacheMaxAge,
+            maxMessagesEncrypted: cacheMaxMessagesEncrypted || 1,
+            maxBytesEncrypted: cacheMaxBytesEncrypted
+          });
+          this[kCmm] = cmm;
+        }
+        return cmm;
+      },
+      async encrypt(plainData) {
+        const { encrypt } = this.getEncryptorClient();
+        const { result } = await encrypt(this.getEncryptorCmm(), plainData, {});
+        return result;
+      },
+      async decrypt(encryptedData) {
+        const { decrypt } = this.getEncryptorClient();
+        const { plaintext } = await decrypt(
+          this.getEncryptorCmm(),
+          encryptedData,
+          {}
+        );
+        return plaintext;
+      }
+    },
+    created() {
+      this[kClient] = buildClient({
+        commitmentPolicy: CommitmentPolicy.REQUIRE_ENCRYPT_REQUIRE_DECRYPT,
+        maxEncryptedDataKeys: false
+      });
+    }
+  });
+}
+
+export { EncryptorMixin, kCmm };

package/dist/mixins/global-store.mixin.cjs

@@ -0,0 +1,56 @@
+'use strict';
+
+var index = require('../index-82e1CXJX.cjs');
+
+function GlobalStoreMixin() {
+  return index.wrapMixin({
+    methods: {
+      /**
+       * Global store to share the adapters between services on the same broker.
+       */
+      getStore(storeName) {
+        const symbol = Symbol.for(storeName);
+        if (!this.broker[symbol]) {
+          this.broker[symbol] = /* @__PURE__ */ new Map();
+        }
+        return this.broker[symbol];
+      },
+      /**
+       * Return the client from the global store
+       * and add the adapter to the list of adapters.
+       */
+      getFromStore(storeName, key) {
+        const res = this.getStore(storeName).get(key);
+        if (res) {
+          res.services.add(this);
+        }
+        return res ? res.client : null;
+      },
+      /**
+       * Service MUST call this when they deregister.
+       * This function will close the client if it's the last adapter.
+       */
+      async removeServiceFromStore(storeName, key) {
+        const res = this.getStore(storeName).get(key);
+        if (res) {
+          res.services.delete(this);
+          if (res.services.size > 0) {
+            return false;
+          }
+          this.getStore(storeName).delete(key);
+          await res.onClose();
+        }
+        return true;
+      },
+      /**
+       * Set the client in global store.
+       */
+      setClientToStore(storeName, key, client, onClose) {
+        const services = (/* @__PURE__ */ new Set()).add(this);
+        this.getStore(storeName).set(key, { client, services, onClose });
+      }
+    }
+  });
+}
+
+exports.GlobalStoreMixin = GlobalStoreMixin;

package/dist/mixins/global-store.mixin.d.cts

@@ -0,0 +1,39 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.cjs';
+import 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+type Wrapper<T> = {
+    services: Set<unknown>;
+    client: T;
+    onClose: () => Promise<void> | void;
+};
+/**
+ * Global store mixin to share instances between services on the same broker.
+ * To reuse an instance, it must match both:
+ * - `storeName`, the name of the store (e.g. `mongodb`, `redis`, etc.)
+ * - `key`, the key of the instance (e.g. `mongodb://localhost:27017`)
+ */
+declare function GlobalStoreMixin<T = unknown>(): Partial<CustomServiceSchema<unknown, {
+    /**
+     * Global store to share the adapters between services on the same broker.
+     */
+    getStore(storeName: string): Map<string, Wrapper<T>>;
+    /**
+     * Return the client from the global store
+     * and add the adapter to the list of adapters.
+     */
+    getFromStore(storeName: string, key: string): null | T;
+    /**
+     * Service MUST call this when they deregister.
+     * This function will close the client if it's the last adapter.
+     */
+    removeServiceFromStore(storeName: string, key: string): Promise<boolean>;
+    /**
+     * Set the client in global store.
+     */
+    setClientToStore(storeName: string, key: string, client: T, onClose: Wrapper<T>["onClose"]): void;
+}, unknown, unknown>>;
+
+export { GlobalStoreMixin };

package/dist/mixins/global-store.mixin.d.mts

@@ -0,0 +1,39 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.mjs';
+import 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+type Wrapper<T> = {
+    services: Set<unknown>;
+    client: T;
+    onClose: () => Promise<void> | void;
+};
+/**
+ * Global store mixin to share instances between services on the same broker.
+ * To reuse an instance, it must match both:
+ * - `storeName`, the name of the store (e.g. `mongodb`, `redis`, etc.)
+ * - `key`, the key of the instance (e.g. `mongodb://localhost:27017`)
+ */
+declare function GlobalStoreMixin<T = unknown>(): Partial<CustomServiceSchema<unknown, {
+    /**
+     * Global store to share the adapters between services on the same broker.
+     */
+    getStore(storeName: string): Map<string, Wrapper<T>>;
+    /**
+     * Return the client from the global store
+     * and add the adapter to the list of adapters.
+     */
+    getFromStore(storeName: string, key: string): null | T;
+    /**
+     * Service MUST call this when they deregister.
+     * This function will close the client if it's the last adapter.
+     */
+    removeServiceFromStore(storeName: string, key: string): Promise<boolean>;
+    /**
+     * Set the client in global store.
+     */
+    setClientToStore(storeName: string, key: string, client: T, onClose: Wrapper<T>["onClose"]): void;
+}, unknown, unknown>>;
+
+export { GlobalStoreMixin };

package/dist/mixins/global-store.mixin.mjs

@@ -0,0 +1,54 @@
+import { w as wrapMixin } from '../index-DNJWwcZu.mjs';
+
+function GlobalStoreMixin() {
+  return wrapMixin({
+    methods: {
+      /**
+       * Global store to share the adapters between services on the same broker.
+       */
+      getStore(storeName) {
+        const symbol = Symbol.for(storeName);
+        if (!this.broker[symbol]) {
+          this.broker[symbol] = /* @__PURE__ */ new Map();
+        }
+        return this.broker[symbol];
+      },
+      /**
+       * Return the client from the global store
+       * and add the adapter to the list of adapters.
+       */
+      getFromStore(storeName, key) {
+        const res = this.getStore(storeName).get(key);
+        if (res) {
+          res.services.add(this);
+        }
+        return res ? res.client : null;
+      },
+      /**
+       * Service MUST call this when they deregister.
+       * This function will close the client if it's the last adapter.
+       */
+      async removeServiceFromStore(storeName, key) {
+        const res = this.getStore(storeName).get(key);
+        if (res) {
+          res.services.delete(this);
+          if (res.services.size > 0) {
+            return false;
+          }
+          this.getStore(storeName).delete(key);
+          await res.onClose();
+        }
+        return true;
+      },
+      /**
+       * Set the client in global store.
+       */
+      setClientToStore(storeName, key, client, onClose) {
+        const services = (/* @__PURE__ */ new Set()).add(this);
+        this.getStore(storeName).set(key, { client, services, onClose });
+      }
+    }
+  });
+}
+
+export { GlobalStoreMixin };

package/dist/mixins/jwt.mixin.cjs

@@ -0,0 +1,118 @@
+'use strict';
+
+var jsonwebtoken = require('jsonwebtoken');
+var jwksRsa = require('jwks-rsa');
+var moleculer = require('moleculer');
+var index = require('../index-82e1CXJX.cjs');
+
+function JwtSignerMixin(opts) {
+  const { privateKey, signOptions, renewBefore, disableAction } = opts;
+  let jwt = null;
+  let expiryDate = null;
+  return index.wrapMixin({
+    methods: {
+      generateJwt(payload = {}) {
+        const options = {
+          algorithm: "ES512",
+          notBefore: "-2s",
+          ...signOptions
+        };
+        return new Promise(
+          (resolve, reject) => jsonwebtoken.sign(
+            payload,
+            privateKey,
+            options,
+            (err, token) => err || !token ? reject(err) : resolve(token)
+          )
+        );
+      }
+    },
+    actions: {
+      getToken: disableAction ? false : {
+        visibility: "public",
+        params: {
+          type: "object",
+          additionalProperties: false,
+          required: [],
+          properties: {}
+        },
+        async handler() {
+          if (renewBefore && jwt && expiryDate && expiryDate - Date.now() > renewBefore) {
+            return jwt;
+          }
+          jwt = await this.generateJwt();
+          if (typeof signOptions.expiresIn === "number") {
+            expiryDate = Date.now() + signOptions.expiresIn * 1e3;
+          }
+          return jwt;
+        }
+      }
+    }
+  });
+}
+function JwtVerifierMixin(opts) {
+  const { jwksOptions, validClaim } = opts;
+  const jwksClient = new jwksRsa.JwksClient(jwksOptions);
+  return index.wrapMixin({
+    methods: {
+      getJwksClient() {
+        return jwksClient;
+      },
+      /**
+       * Used with jsonwebtoken verify function. Retrieves the signing public key
+       * from the kid defined in the JWT header.
+       */
+      async getVerifyPublicKey(header, callback) {
+        try {
+          const key = await this.getJwksClient().getSigningKey(header.kid);
+          callback(null, key.getPublicKey());
+        } catch (err) {
+          callback(err);
+        }
+      },
+      /**
+       * Will validate the JWT token signature but also some claims like the issuer.
+       */
+      verifyJwt(token) {
+        return new Promise((resolve, reject) => {
+          jsonwebtoken.verify(
+            token,
+            (header, callback) => this.getVerifyPublicKey(header, callback),
+            validClaim,
+            (err) => err ? reject(err) : resolve()
+          );
+        });
+      },
+      async verifyAuthorizationHeader(ctx, value) {
+        if (!value || typeof value !== "string" || !value.startsWith("Bearer ")) {
+          throw new moleculer.Errors.MoleculerError(
+            "Incorrect bearer format authorization",
+            401,
+            "Unauthorized"
+          );
+        }
+        const token = value.slice(7);
+        if (!token) {
+          throw new moleculer.Errors.MoleculerError(
+            "Incorrect token",
+            401,
+            "Unauthorized"
+          );
+        }
+        try {
+          await this.verifyJwt(token);
+        } catch (err) {
+          ctx.logger.warn("Unable to verify JWT", { err });
+          throw new moleculer.Errors.MoleculerError(
+            "Unable to verify JWT",
+            401,
+            "Unauthorized"
+          );
+        }
+      }
+    }
+  });
+}
+
+exports.JwtSignerMixin = JwtSignerMixin;
+exports.JwtVerifierMixin = JwtVerifierMixin;

package/dist/mixins/jwt.mixin.d.cts

@@ -0,0 +1,43 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.cjs';
+import { SignOptions, PrivateKey, VerifyOptions, JwtHeader, SigningKeyCallback } from 'jsonwebtoken';
+import { Options, JwksClient } from 'jwks-rsa';
+import { Context } from 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+type JwtSignerMixinSettings = {
+    signOptions: SignOptions;
+    privateKey: PrivateKey;
+    /**
+     * Set to false to disable caching of the JWT token.
+     */
+    renewBefore: number | false;
+    /**
+     * Set to true to disable the getToken action.
+     */
+    disableAction?: boolean;
+};
+declare function JwtSignerMixin(opts: JwtSignerMixinSettings): Partial<CustomServiceSchema<unknown, {
+    generateJwt(payload?: string | Buffer | object): Promise<string>;
+}, unknown, unknown>>;
+type JwtVerifierMixinSettings = {
+    jwksOptions: Options;
+    validClaim: VerifyOptions;
+};
+declare function JwtVerifierMixin(opts: JwtVerifierMixinSettings): Partial<CustomServiceSchema<unknown, {
+    getJwksClient(): JwksClient;
+    /**
+     * Used with jsonwebtoken verify function. Retrieves the signing public key
+     * from the kid defined in the JWT header.
+     */
+    getVerifyPublicKey(header: JwtHeader, callback: SigningKeyCallback): Promise<void>;
+    /**
+     * Will validate the JWT token signature but also some claims like the issuer.
+     */
+    verifyJwt(token: string): Promise<void>;
+    verifyAuthorizationHeader(ctx: Context, value: string | undefined): Promise<void>;
+}, unknown, unknown>>;
+
+export { JwtSignerMixin, JwtVerifierMixin };
+export type { JwtSignerMixinSettings, JwtVerifierMixinSettings };

package/dist/mixins/jwt.mixin.d.mts

@@ -0,0 +1,43 @@
+import { a as CustomServiceSchema } from '../context-factory-BWO3xPWE.mjs';
+import { SignOptions, PrivateKey, VerifyOptions, JwtHeader, SigningKeyCallback } from 'jsonwebtoken';
+import { Options, JwksClient } from 'jwks-rsa';
+import { Context } from 'moleculer';
+import 'bson';
+import 'zod/v4';
+import 'ajv/dist/2019.js';
+
+type JwtSignerMixinSettings = {
+    signOptions: SignOptions;
+    privateKey: PrivateKey;
+    /**
+     * Set to false to disable caching of the JWT token.
+     */
+    renewBefore: number | false;
+    /**
+     * Set to true to disable the getToken action.
+     */
+    disableAction?: boolean;
+};
+declare function JwtSignerMixin(opts: JwtSignerMixinSettings): Partial<CustomServiceSchema<unknown, {
+    generateJwt(payload?: string | Buffer | object): Promise<string>;
+}, unknown, unknown>>;
+type JwtVerifierMixinSettings = {
+    jwksOptions: Options;
+    validClaim: VerifyOptions;
+};
+declare function JwtVerifierMixin(opts: JwtVerifierMixinSettings): Partial<CustomServiceSchema<unknown, {
+    getJwksClient(): JwksClient;
+    /**
+     * Used with jsonwebtoken verify function. Retrieves the signing public key
+     * from the kid defined in the JWT header.
+     */
+    getVerifyPublicKey(header: JwtHeader, callback: SigningKeyCallback): Promise<void>;
+    /**
+     * Will validate the JWT token signature but also some claims like the issuer.
+     */
+    verifyJwt(token: string): Promise<void>;
+    verifyAuthorizationHeader(ctx: Context, value: string | undefined): Promise<void>;
+}, unknown, unknown>>;
+
+export { JwtSignerMixin, JwtVerifierMixin };
+export type { JwtSignerMixinSettings, JwtVerifierMixinSettings };