@venizia/ignis 0.4.2 → 0.4.4

package/dist/components/auth/authenticate/index.js

@@ -1,24 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-// `common`, `middlewares` and `providers` moved to the kernel in full; `strategy-registry.ts`
-// moved out of `strategies` too (see `./strategies/index.ts`).
-__exportStar(require("@venizia/ignis-kernel"), exports);
-__exportStar(require("./component"), exports);
-__exportStar(require("./controllers"), exports);
-__exportStar(require("./services"), exports);
-__exportStar(require("./strategies"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/components/auth/authenticate/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8FAA8F;AAC9F,+DAA+D;AAC/D,wDAAsC;AAEtC,8CAA4B;AAC5B,gDAA8B;AAC9B,6CAA2B;AAC3B,+CAA6B","sourcesContent":["// `common`, `middlewares` and `providers` moved to the kernel in full; `strategy-registry.ts`\n// moved out of `strategies` too (see `./strategies/index.ts`).\nexport * from '@venizia/ignis-kernel';\n\nexport * from './component';\nexport * from './controllers';\nexport * from './services';\nexport * from './strategies';\n"]}

package/dist/components/auth/authenticate/services/basic/index.d.ts

@@ -1,2 +0,0 @@
-export * from './service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/basic/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/basic/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/components/auth/authenticate/services/basic/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/basic/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/basic/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B","sourcesContent":["export * from './service';\n"]}

package/dist/components/auth/authenticate/services/basic/service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/basic/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,kFAAkF;AAClF,qBAAa,iBAAiB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,WAAW;IAKnE,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAJjD,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBAInE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAcjD,2EAA2E;IAC3E,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA6DxF,wEAAwE;IAClE,MAAM,CAAC,IAAI,EAAE;QACjB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,CAAC;CAgBvB"}

package/dist/components/auth/authenticate/services/basic/service.js

@@ -1,106 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var BasicTokenService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BasicTokenService = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const core_1 = require("@venizia/ignis-helpers/core");
-const common_1 = require("@venizia/ignis-helpers/common");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-/** Extracts and verifies Basic auth credentials from the Authorization header. */
-let BasicTokenService = BasicTokenService_1 = class BasicTokenService extends ignis_kernel_2.BaseService {
-    constructor(options) {
-        super({ scope: BasicTokenService_1.name });
-        this.options = options;
-        if (!options?.verifyCredentials) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[BasicTokenService] Invalid verifyCredentials function',
-            });
-        }
-        this.verifyCredentials = options.verifyCredentials;
-    }
-    /** Extracts username:password from Base64-encoded Authorization header. */
-    extractCredentials(context) {
-        const authHeaderValue = context.req.header('Authorization');
-        if (!authHeaderValue) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_3.AuthenticationErrors.HEADER_MISSING,
-                message: 'Unauthorized! Missing authorization header',
-            });
-        }
-        if (!authHeaderValue.startsWith(ignis_kernel_3.Authentication.TYPE_BASIC)) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_3.AuthenticationErrors.SCHEME_INVALID,
-                message: 'Unauthorized! Invalid authorization schema, expected Basic',
-            });
-        }
-        const parts = authHeaderValue.split(' ');
-        if (parts.length !== 2) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_3.AuthenticationErrors.HEADER_MALFORMED,
-                message: 'Unauthorized! Invalid authorization header format',
-            });
-        }
-        const [, base64Credentials] = parts;
-        // The rejection reason stays in the LOG, never in the response: telling a caller which half of its credential was malformed is a probing oracle.
-        const reject = (reason) => {
-            this.logger
-                .for(this.extractCredentials.name)
-                .debug('Failed to decode credentials | Reason: %s', reason);
-            throw (0, core_1.getError)({
-                error: ignis_kernel_3.AuthenticationErrors.CREDENTIALS_MALFORMED,
-                message: 'Unauthorized! Invalid base64 credentials format',
-            });
-        };
-        let decoded;
-        try {
-            decoded = Buffer.from(base64Credentials, 'base64').toString('utf-8');
-        }
-        catch (error) {
-            return reject(`Base64 decode failed | Error: ${error}`);
-        }
-        const colonIndex = decoded.indexOf(':');
-        if (colonIndex === -1) {
-            return reject('Missing colon separator');
-        }
-        const username = decoded.substring(0, colonIndex);
-        const password = decoded.substring(colonIndex + 1);
-        if (!username) {
-            return reject('Empty username');
-        }
-        return { username, password };
-    }
-    /** Verifies credentials via the user-provided verification function. */
-    async verify(opts) {
-        const user = await this.verifyCredentials(opts);
-        if (!user) {
-            this.logger
-                .for(this.verify.name)
-                .debug('Invalid credentials for username: %s', opts.credentials.username);
-            throw (0, core_1.getError)({
-                error: ignis_kernel_3.AuthenticationErrors.CREDENTIALS_INVALID,
-                message: 'Unauthorized! Invalid username or password',
-            });
-        }
-        return user;
-    }
-};
-exports.BasicTokenService = BasicTokenService;
-exports.BasicTokenService = BasicTokenService = BasicTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_3.AuthenticateBindingKeys.BASIC_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], BasicTokenService);
-//# sourceMappingURL=service.js.map

package/dist/components/auth/authenticate/services/basic/service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/basic/service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAA+C;AAC/C,wDAAoD;AACpD,sDAAuD;AACvD,0DAAqD;AAErD,wDAM+B;AAE/B,kFAAkF;AAClF,IAAa,iBAAiB,yBAA9B,MAAa,iBAAuC,SAAQ,0BAAW;IAGrE,YAEY,OAAqC;QAE/C,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAF/B,YAAO,GAAP,OAAO,CAA8B;QAI/C,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;IAED,2EAA2E;IAC3E,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAE5D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,6BAAc,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,mDAAmD;aAC7D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC;QAEpC,iJAAiJ;QACjJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAS,EAAE;YACvC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;iBACjC,KAAK,CAAC,2CAA2C,EAAE,MAAM,CAAC,CAAC;YAE9D,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,MAAM,CAAC,IAGZ;QACC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;iBACrB,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAE5E,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,mBAAmB;gBAC/C,OAAO,EAAE,4CAA4C;aACtD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AArGY,8CAAiB;4BAAjB,iBAAiB;IAIzB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,aAAa,EAAE,CAAC,CAAA;;GAJ9C,iBAAiB,CAqG7B","sourcesContent":["import { type TContext } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BaseService } from '@venizia/ignis-kernel';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport { type Env } from 'hono';\nimport {\n  Authentication,\n  AuthenticationErrors,\n  AuthenticateBindingKeys,\n  type IAuthUser,\n  type TBasicTokenServiceOptions,\n} from '@venizia/ignis-kernel';\n\n/** Extracts and verifies Basic auth credentials from the Authorization header. */\nexport class BasicTokenService<E extends Env = Env> extends BaseService {\n  protected verifyCredentials: TBasicTokenServiceOptions<E>['verifyCredentials'];\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.BASIC_OPTIONS })\n    protected options: TBasicTokenServiceOptions<E>,\n  ) {\n    super({ scope: BasicTokenService.name });\n\n    if (!options?.verifyCredentials) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[BasicTokenService] Invalid verifyCredentials function',\n      });\n    }\n\n    this.verifyCredentials = options.verifyCredentials;\n  }\n\n  /** Extracts username:password from Base64-encoded Authorization header. */\n  extractCredentials(context: TContext<E, string>): { username: string; password: string } {\n    const authHeaderValue = context.req.header('Authorization');\n\n    if (!authHeaderValue) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MISSING,\n        message: 'Unauthorized! Missing authorization header',\n      });\n    }\n\n    if (!authHeaderValue.startsWith(Authentication.TYPE_BASIC)) {\n      throw getError({\n        error: AuthenticationErrors.SCHEME_INVALID,\n        message: 'Unauthorized! Invalid authorization schema, expected Basic',\n      });\n    }\n\n    const parts = authHeaderValue.split(' ');\n    if (parts.length !== 2) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MALFORMED,\n        message: 'Unauthorized! Invalid authorization header format',\n      });\n    }\n\n    const [, base64Credentials] = parts;\n\n    // The rejection reason stays in the LOG, never in the response: telling a caller which half of its credential was malformed is a probing oracle.\n    const reject = (reason: string): never => {\n      this.logger\n        .for(this.extractCredentials.name)\n        .debug('Failed to decode credentials | Reason: %s', reason);\n\n      throw getError({\n        error: AuthenticationErrors.CREDENTIALS_MALFORMED,\n        message: 'Unauthorized! Invalid base64 credentials format',\n      });\n    };\n\n    let decoded: string;\n    try {\n      decoded = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n    } catch (error) {\n      return reject(`Base64 decode failed | Error: ${error}`);\n    }\n\n    const colonIndex = decoded.indexOf(':');\n    if (colonIndex === -1) {\n      return reject('Missing colon separator');\n    }\n\n    const username = decoded.substring(0, colonIndex);\n    const password = decoded.substring(colonIndex + 1);\n\n    if (!username) {\n      return reject('Empty username');\n    }\n\n    return { username, password };\n  }\n\n  /** Verifies credentials via the user-provided verification function. */\n  async verify(opts: {\n    credentials: { username: string; password: string };\n    context: TContext<E, string>;\n  }): Promise<IAuthUser> {\n    const user = await this.verifyCredentials(opts);\n\n    if (!user) {\n      this.logger\n        .for(this.verify.name)\n        .debug('Invalid credentials for username: %s', opts.credentials.username);\n\n      throw getError({\n        error: AuthenticationErrors.CREDENTIALS_INVALID,\n        message: 'Unauthorized! Invalid username or password',\n      });\n    }\n\n    return user;\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/abstract.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwC,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEjE,gGAAgG;AAChG,8BAAsB,0BAA0B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,WAAW;IACvF,oDAAoD;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,wBAQ9B;IAEH,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAQ;IAC5C,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClD,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAa;IAEnE,iFAAiF;IACjF,SAAS,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,CAAQ;IAErD,mIAAmI;IACnI,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE;QACzC,YAAY,CAAC,EAAE,gBAAgB,CAAC;QAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnC,4KAA4K;QAC5K,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB,GAAG,IAAI;IAmBR,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA8B3E,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuBxE,QAAQ,CAAC,IAAI,EAAE;QACnB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;QACvC,gGAAgG;QAChG,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBnB,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,MAAM;IAWnE,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAqC9D,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAW/D;;;;;;;;;;OAUG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO;IAwCX,cAAc,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAA;KAAE,GAAG,gBAAgB;IAiCrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAErE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpB,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;IAE1E,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,kBAAkB;CAClE"}

package/dist/components/auth/authenticate/services/bearer/abstract.service.js

@@ -1,220 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AbstractBearerTokenService = void 0;
-const ignis_helpers_1 = require("@venizia/ignis-helpers");
-const common_1 = require("@venizia/ignis-helpers/common");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-/** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */
-class AbstractBearerTokenService extends ignis_kernel_1.BaseService {
-    constructor() {
-        super(...arguments);
-        this.aes = null;
-        this.applicationSecret = null;
-        this.fieldCodecs = new Map();
-        /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */
-        this.signOptions = null;
-    }
-    /** Standard JWT fields that are never encrypted. */
-    static { this.JWT_COMMON_FIELDS = new Set([
-        'iss',
-        'sub',
-        'aud',
-        'jti',
-        'nbf',
-        'exp',
-        'iat',
-    ]); }
-    /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */
-    configurePayloadEncryption(opts) {
-        const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher, sign } = opts;
-        this.signOptions = sign ?? null;
-        if (fieldCodecs) {
-            for (const codec of fieldCodecs) {
-                this.fieldCodecs.set(codec.key, codec);
-            }
-        }
-        if (!applicationSecret) {
-            return;
-        }
-        this.aes = cipher ?? ignis_helpers_1.AES.withAlgorithm(aesAlgorithm);
-        this.applicationSecret = applicationSecret;
-    }
-    extractCredentials(context) {
-        const request = context.req;
-        const authHeaderValue = request.header('Authorization');
-        if (!authHeaderValue) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.HEADER_MISSING,
-                message: 'Unauthorized user! Missing authorization header',
-            });
-        }
-        if (!authHeaderValue.startsWith(ignis_kernel_1.Authentication.TYPE_BEARER)) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.SCHEME_INVALID,
-                message: 'Unauthorized user! Invalid schema of request token!',
-            });
-        }
-        const parts = authHeaderValue.split(' ');
-        if (parts.length !== 2) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.HEADER_MALFORMED,
-                message: `Authorization header value is invalid format. It must follow the pattern: 'Bearer xx.yy.zz' where xx.yy.zz is a valid JWT token.`,
-            });
-        }
-        const [tokenType, tokenValue] = parts;
-        return { type: tokenType, token: tokenValue };
-    }
-    async verify(opts) {
-        const { token } = opts;
-        if (!token) {
-            this.logger.for(this.verify.name).error('Missing token for validating request!');
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.TOKEN_MISSING,
-                message: '[verify] Invalid request token!',
-            });
-        }
-        try {
-            return await this.doVerify(token);
-        }
-        catch (error) {
-            // No log here - `cause` carries the reason (JWTExpired, signature mismatch) to the error handler, which logs the request once. An expired token is the caller's problem, hence `warn`.
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.TOKEN_INVALID,
-                message: '[verify] Invalid or expired token',
-                logLevel: 'warn',
-                cause: error,
-            });
-        }
-    }
-    async generate(opts) {
-        const { payload, claims, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;
-        if (!payload) {
-            throw (0, core_1.getError)({
-                error: ignis_kernel_1.AuthenticationErrors.TOKEN_PAYLOAD_INVALID,
-                message: '[generate] Invalid token payload!',
-            });
-        }
-        const signer = await this.getSigner({ payload, getTokenExpiresFn, claims });
-        try {
-            const rs = await signer.sign(await this.getSigningKey());
-            return rs;
-        }
-        catch (error) {
-            this.logger.for(this.generate.name).error('Failed to generate token | Error: %s', error);
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[generate] Failed to generate token',
-            });
-        }
-    }
-    serializeField(opts) {
-        const { key, value } = opts;
-        const codec = this.fieldCodecs.get(key);
-        if (codec) {
-            return codec.serialize({ value });
-        }
-        return JSON.stringify(value);
-    }
-    encryptPayload(payload) {
-        if (!this.aes || !this.applicationSecret) {
-            return payload;
-        }
-        const rs = {};
-        const keys = Object.keys(payload);
-        for (const key of keys) {
-            const value = payload[key];
-            if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {
-                rs[key] = value;
-                continue;
-            }
-            // NOTE: Skip undefined or null values because they cannot be encrypted
-            if (value === undefined || value === null) {
-                continue;
-            }
-            const encryptedKey = this.aes.encrypt({
-                message: key,
-                secret: this.applicationSecret,
-            });
-            const serialized = this.serializeField({ key, value });
-            rs[encryptedKey] = this.aes.encrypt({
-                message: serialized,
-                secret: this.applicationSecret,
-            });
-        }
-        return rs;
-    }
-    deserializeField(opts) {
-        const { key, value } = opts;
-        const codec = this.fieldCodecs.get(key);
-        if (codec) {
-            return codec.deserialize({ raw: value });
-        }
-        return JSON.parse(value);
-    }
-    /**
-     * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.
-     *
-     * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride
-     * through the AES envelope in the clear and an application-shaped payload can carry them - an
-     * issuer identity any payload could overwrite would not be an identity. A conflicting payload
-     * claim is overwritten and reported.
-     *
-     * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller
-     * that legitimately needs one says so.
-     */
-    applySignClaims(opts) {
-        const { signer, payload, claims } = opts;
-        const configured = this.signOptions;
-        const issuer = claims?.issuer ?? configured?.issuer;
-        const audience = claims?.audience ?? configured?.audience;
-        const logger = this.logger.for(this.applySignClaims.name);
-        if (issuer !== undefined) {
-            if (payload.iss !== undefined && payload.iss !== issuer) {
-                logger.warn('Payload iss overridden by the configured issuer | payload: %s | configured: %s', payload.iss, issuer);
-            }
-            signer.setIssuer(issuer);
-        }
-        if (audience !== undefined) {
-            if (payload.aud !== undefined) {
-                logger.warn('Payload aud overridden | payload: %j | applied: %j', payload.aud, audience);
-            }
-            signer.setAudience(audience);
-        }
-        if (claims?.subject !== undefined) {
-            signer.setSubject(claims.subject);
-        }
-        if (claims?.jwtId !== undefined) {
-            signer.setJti(claims.jwtId);
-        }
-        return signer;
-    }
-    decryptPayload(opts) {
-        const { payload, protectedHeader } = opts.result;
-        if (!this.aes || !this.applicationSecret) {
-            return payload;
-        }
-        this.logger
-            .for(this.decryptPayload.name)
-            .debug('JWT Token | payload: %j | header: %j', payload, protectedHeader);
-        const rs = {};
-        for (const key in payload) {
-            if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {
-                rs[key] = payload[key];
-                continue;
-            }
-            const decryptedKey = this.aes.decrypt({
-                message: key,
-                secret: this.applicationSecret,
-            });
-            const decryptedValue = this.aes.decrypt({
-                message: payload[key],
-                secret: this.applicationSecret,
-            });
-            rs[decryptedKey] = this.deserializeField({ key: decryptedKey, value: decryptedValue });
-        }
-        return rs;
-    }
-}
-exports.AbstractBearerTokenService = AbstractBearerTokenService;
-//# sourceMappingURL=abstract.service.js.map

package/dist/components/auth/authenticate/services/bearer/abstract.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":";;;AACA,0DAA6C;AAE7C,0DAAqD;AACrD,sDAAuD;AASvD,wDAA0F;AAI1F,gGAAgG;AAChG,MAAsB,0BAAgD,SAAQ,0BAAW;IAAzF;;QAYY,QAAG,GAA0B,IAAI,CAAC;QAClC,sBAAiB,GAAkB,IAAI,CAAC;QACxC,gBAAW,GAAoC,IAAI,GAAG,EAAE,CAAC;QAEnE,iFAAiF;QACvE,gBAAW,GAA2B,IAAI,CAAC;IA6QvD,CAAC;IA7RC,oDAAoD;aACpC,sBAAiB,GAAG,IAAI,GAAG,CAAmB;QAC5D,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;KACN,CAAC,AAR+B,CAQ9B;IASH,mIAAmI;IACzH,0BAA0B,CAAC,IAOpC;QACC,MAAM,EAAE,YAAY,GAAG,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAE5F,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,IAAI,CAAC;QAEhC,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,mBAAG,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;IAED,kBAAkB,CAAC,OAA4B;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,iDAAiD;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,6BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,cAAc;gBAC1C,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,gBAAgB;gBAC5C,OAAO,EAAE,kIAAkI;aAC5I,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjF,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,iCAAiC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uLAAuL;YACvL,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,aAAa;gBACzC,OAAO,EAAE,mCAAmC;gBAC5C,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAKd;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,IAAI,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,KAAK,EAAE,mCAAoB,CAAC,qBAAqB;gBACjD,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAES,cAAc,CAAC,IAAiC;QACxD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,cAAc,CAAC,OAAyB;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,GAA2B,EAAE,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAE3B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,uEAAuE;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvD,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAClC,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAES,gBAAgB,CAAC,IAAoC;QAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACO,eAAe,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAC;QAE1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CACT,gFAAgF,EAChF,OAAO,CAAC,GAAG,EACX,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC3F,CAAC;YAED,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,cAAc,CAAC,IAAmD;QAChE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAEjD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzC,OAAO,OAA2B,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;aAC7B,KAAK,CAAC,sCAAsC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QAE3E,MAAM,EAAE,GAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,0BAA0B,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1D,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpC,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,IAAI,CAAC,iBAAiB;aAC/B,CAAC,CAAC;YAEH,EAAE,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;;AAjRH,gEA8RC","sourcesContent":["import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers';\nimport { AES } from '@venizia/ignis-helpers';\nimport type { ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { HTTP } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport type {\n  IJWTIssueClaims,\n  IJWTSignOptions,\n  IJWTTokenPayload,\n  IPayloadFieldCodec,\n  TContext,\n  TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { Authentication, AuthenticationErrors, BaseService } from '@venizia/ignis-kernel';\nimport type { Env } from 'hono';\nimport type { JWTPayload, JWTVerifyResult, SignJWT } from 'jose';\n\n/** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */\nexport abstract class AbstractBearerTokenService<E extends Env = Env> extends BaseService {\n  /** Standard JWT fields that are never encrypted. */\n  static readonly JWT_COMMON_FIELDS = new Set<keyof JWTPayload>([\n    'iss',\n    'sub',\n    'aud',\n    'jti',\n    'nbf',\n    'exp',\n    'iat',\n  ]);\n\n  protected aes: IPayloadCipher | null = null;\n  protected applicationSecret: string | null = null;\n  protected fieldCodecs: Map<string, IPayloadFieldCodec> = new Map();\n\n  /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */\n  protected signOptions: IJWTSignOptions | null = null;\n\n  /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */\n  protected configurePayloadEncryption(opts: {\n    aesAlgorithm?: AESAlgorithmType;\n    applicationSecret?: string;\n    fieldCodecs?: IPayloadFieldCodec[];\n    /** Overrides the cipher. Pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope; `aesAlgorithm` is then the cipher's own concern and is ignored here. */\n    cipher?: IPayloadCipher;\n    sign?: IJWTSignOptions;\n  }): void {\n    const { aesAlgorithm = 'aes-256-cbc', applicationSecret, fieldCodecs, cipher, sign } = opts;\n\n    this.signOptions = sign ?? null;\n\n    if (fieldCodecs) {\n      for (const codec of fieldCodecs) {\n        this.fieldCodecs.set(codec.key, codec);\n      }\n    }\n\n    if (!applicationSecret) {\n      return;\n    }\n\n    this.aes = cipher ?? AES.withAlgorithm(aesAlgorithm);\n    this.applicationSecret = applicationSecret;\n  }\n\n  extractCredentials(context: TContext<E, string>): { type: string; token: string } {\n    const request = context.req;\n\n    const authHeaderValue = request.header('Authorization');\n    if (!authHeaderValue) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MISSING,\n        message: 'Unauthorized user! Missing authorization header',\n      });\n    }\n\n    if (!authHeaderValue.startsWith(Authentication.TYPE_BEARER)) {\n      throw getError({\n        error: AuthenticationErrors.SCHEME_INVALID,\n        message: 'Unauthorized user! Invalid schema of request token!',\n      });\n    }\n\n    const parts = authHeaderValue.split(' ');\n    if (parts.length !== 2) {\n      throw getError({\n        error: AuthenticationErrors.HEADER_MALFORMED,\n        message: `Authorization header value is invalid format. It must follow the pattern: 'Bearer xx.yy.zz' where xx.yy.zz is a valid JWT token.`,\n      });\n    }\n\n    const [tokenType, tokenValue] = parts;\n    return { type: tokenType, token: tokenValue };\n  }\n\n  async verify(opts: { type: string; token: string }): Promise<IJWTTokenPayload> {\n    const { token } = opts;\n    if (!token) {\n      this.logger.for(this.verify.name).error('Missing token for validating request!');\n      throw getError({\n        error: AuthenticationErrors.TOKEN_MISSING,\n        message: '[verify] Invalid request token!',\n      });\n    }\n\n    try {\n      return await this.doVerify(token);\n    } catch (error) {\n      // No log here - `cause` carries the reason (JWTExpired, signature mismatch) to the error handler, which logs the request once. An expired token is the caller's problem, hence `warn`.\n      throw getError({\n        error: AuthenticationErrors.TOKEN_INVALID,\n        message: '[verify] Invalid or expired token',\n        logLevel: 'warn',\n        cause: error,\n      });\n    }\n  }\n\n  async generate(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn?: TGetTokenExpiresFn;\n    /** Per-token registered claims. The supported way to vary `aud` / `sub`; the payload is not. */\n    claims?: IJWTIssueClaims;\n  }): Promise<string> {\n    const { payload, claims, getTokenExpiresFn = this.getDefaultTokenExpiresFn() } = opts;\n\n    if (!payload) {\n      throw getError({\n        error: AuthenticationErrors.TOKEN_PAYLOAD_INVALID,\n        message: '[generate] Invalid token payload!',\n      });\n    }\n\n    const signer = await this.getSigner({ payload, getTokenExpiresFn, claims });\n\n    try {\n      const rs = await signer.sign(await this.getSigningKey());\n      return rs;\n    } catch (error) {\n      this.logger.for(this.generate.name).error('Failed to generate token | Error: %s', error);\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[generate] Failed to generate token',\n      });\n    }\n  }\n\n  protected serializeField(opts: { key: string; value: any }): string {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.serialize({ value });\n    }\n\n    return JSON.stringify(value);\n  }\n\n  encryptPayload(payload: IJWTTokenPayload): Record<string, any> {\n    if (!this.aes || !this.applicationSecret) {\n      return payload;\n    }\n\n    const rs: Record<string, string> = {};\n\n    const keys = Object.keys(payload);\n    for (const key of keys) {\n      const value = payload[key];\n\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = value;\n        continue;\n      }\n\n      // NOTE: Skip undefined or null values because they cannot be encrypted\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      const encryptedKey = this.aes.encrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n\n      const serialized = this.serializeField({ key, value });\n\n      rs[encryptedKey] = this.aes.encrypt({\n        message: serialized,\n        secret: this.applicationSecret,\n      });\n    }\n\n    return rs;\n  }\n\n  protected deserializeField(opts: { key: string; value: string }) {\n    const { key, value } = opts;\n    const codec = this.fieldCodecs.get(key);\n\n    if (codec) {\n      return codec.deserialize({ raw: value });\n    }\n\n    return JSON.parse(value);\n  }\n\n  /**\n   * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.\n   *\n   * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride\n   * through the AES envelope in the clear and an application-shaped payload can carry them - an\n   * issuer identity any payload could overwrite would not be an identity. A conflicting payload\n   * claim is overwritten and reported.\n   *\n   * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller\n   * that legitimately needs one says so.\n   */\n  protected applySignClaims(opts: {\n    signer: SignJWT;\n    payload: Record<string, any>;\n    claims?: IJWTIssueClaims;\n  }): SignJWT {\n    const { signer, payload, claims } = opts;\n    const configured = this.signOptions;\n\n    const issuer = claims?.issuer ?? configured?.issuer;\n    const audience = claims?.audience ?? configured?.audience;\n\n    const logger = this.logger.for(this.applySignClaims.name);\n\n    if (issuer !== undefined) {\n      if (payload.iss !== undefined && payload.iss !== issuer) {\n        logger.warn(\n          'Payload iss overridden by the configured issuer | payload: %s | configured: %s',\n          payload.iss,\n          issuer,\n        );\n      }\n\n      signer.setIssuer(issuer);\n    }\n\n    if (audience !== undefined) {\n      if (payload.aud !== undefined) {\n        logger.warn('Payload aud overridden | payload: %j | applied: %j', payload.aud, audience);\n      }\n\n      signer.setAudience(audience);\n    }\n\n    if (claims?.subject !== undefined) {\n      signer.setSubject(claims.subject);\n    }\n\n    if (claims?.jwtId !== undefined) {\n      signer.setJti(claims.jwtId);\n    }\n\n    return signer;\n  }\n\n  decryptPayload(opts: { result: JWTVerifyResult<IJWTTokenPayload> }): IJWTTokenPayload {\n    const { payload, protectedHeader } = opts.result;\n\n    if (!this.aes || !this.applicationSecret) {\n      return payload as IJWTTokenPayload;\n    }\n\n    this.logger\n      .for(this.decryptPayload.name)\n      .debug('JWT Token | payload: %j | header: %j', payload, protectedHeader);\n\n    const rs: any = {};\n    for (const key in payload) {\n      if (AbstractBearerTokenService.JWT_COMMON_FIELDS.has(key)) {\n        rs[key] = payload[key];\n        continue;\n      }\n\n      const decryptedKey = this.aes.decrypt({\n        message: key,\n        secret: this.applicationSecret,\n      });\n      const decryptedValue = this.aes.decrypt({\n        message: payload[key],\n        secret: this.applicationSecret,\n      });\n\n      rs[decryptedKey] = this.deserializeField({ key: decryptedKey, value: decryptedValue });\n    }\n\n    return rs;\n  }\n\n  protected abstract doVerify(token: string): Promise<IJWTTokenPayload>;\n\n  abstract getSigner(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n    claims?: IJWTIssueClaims;\n  }): Promise<SignJWT>;\n\n  protected abstract getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;\n\n  protected abstract getDefaultTokenExpiresFn(): TGetTokenExpiresFn;\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/index.d.ts

@@ -1,4 +0,0 @@
-export * from './abstract.service';
-export * from './jwks';
-export * from './jws.service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/bearer/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,QAAQ,CAAC;AACvB,cAAc,eAAe,CAAC"}

package/dist/components/auth/authenticate/services/bearer/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./abstract.service"), exports);
-__exportStar(require("./jwks"), exports);
-__exportStar(require("./jws.service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/bearer/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,yCAAuB;AACvB,gDAA8B","sourcesContent":["export * from './abstract.service';\nexport * from './jwks';\nexport * from './jws.service';\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/abstract.service.d.ts

@@ -1,10 +0,0 @@
-import type { Env } from 'hono';
-import { AbstractBearerTokenService } from '../abstract.service';
-/** Base for JWKS token services (Issuer + Verifier): lazy init where a rejected `initialize()` resets `initPromise`, so the next call retries instead of caching the failure. */
-export declare abstract class AbstractJWKSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {
-    protected initialized: boolean;
-    protected initPromise: Promise<void> | null;
-    protected ensureInitialized(): Promise<void>;
-    protected abstract initialize(): Promise<void>;
-}
-//# sourceMappingURL=abstract.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/abstract.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/abstract.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,iLAAiL;AACjL,8BAAsB,wBAAwB,CAC5C,CAAC,SAAS,GAAG,GAAG,GAAG,CACnB,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IACrC,SAAS,CAAC,WAAW,UAAS;IAC9B,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAQ;cAEnC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAalD,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAC/C"}

package/dist/components/auth/authenticate/services/bearer/jwks/abstract.service.js

@@ -1,24 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AbstractJWKSTokenService = void 0;
-const abstract_service_1 = require("../abstract.service");
-/** Base for JWKS token services (Issuer + Verifier): lazy init where a rejected `initialize()` resets `initPromise`, so the next call retries instead of caching the failure. */
-class AbstractJWKSTokenService extends abstract_service_1.AbstractBearerTokenService {
-    constructor() {
-        super(...arguments);
-        this.initialized = false;
-        this.initPromise = null;
-    }
-    async ensureInitialized() {
-        if (this.initialized) {
-            return;
-        }
-        this.initPromise ??= this.initialize().catch((error) => {
-            this.initPromise = null;
-            throw error;
-        });
-        await this.initPromise;
-    }
-}
-exports.AbstractJWKSTokenService = AbstractJWKSTokenService;
-//# sourceMappingURL=abstract.service.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/abstract.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"abstract.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/abstract.service.ts"],"names":[],"mappings":";;;AACA,0DAAiE;AAEjE,iLAAiL;AACjL,MAAsB,wBAEpB,SAAQ,6CAA6B;IAFvC;;QAGY,gBAAW,GAAG,KAAK,CAAC;QACpB,gBAAW,GAAyB,IAAI,CAAC;IAgBrD,CAAC;IAdW,KAAK,CAAC,iBAAiB;QAC/B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACrD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,WAAW,CAAC;IACzB,CAAC;CAGF;AApBD,4DAoBC","sourcesContent":["import type { Env } from 'hono';\nimport { AbstractBearerTokenService } from '../abstract.service';\n\n/** Base for JWKS token services (Issuer + Verifier): lazy init where a rejected `initialize()` resets `initPromise`, so the next call retries instead of caching the failure. */\nexport abstract class AbstractJWKSTokenService<\n  E extends Env = Env,\n> extends AbstractBearerTokenService<E> {\n  protected initialized = false;\n  protected initPromise: Promise<void> | null = null;\n\n  protected async ensureInitialized(): Promise<void> {\n    if (this.initialized) {\n      return;\n    }\n\n    this.initPromise ??= this.initialize().catch((error) => {\n      this.initPromise = null;\n      throw error;\n    });\n\n    await this.initPromise;\n  }\n\n  protected abstract initialize(): Promise<void>;\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/index.d.ts

@@ -1,4 +0,0 @@
-export * from './abstract.service';
-export * from './issuer.service';
-export * from './verifier.service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/services/bearer/jwks/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./abstract.service"), exports);
-__exportStar(require("./issuer.service"), exports);
-__exportStar(require("./verifier.service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qDAAmC;AACnC,mDAAiC;AACjC,qDAAmC","sourcesContent":["export * from './abstract.service';\nexport * from './issuer.service';\nexport * from './verifier.service';\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts

@@ -1,63 +0,0 @@
-import { type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';
-import { type IJWKSIssuerOptions, type IJWTIssueClaims, type IJWTTokenPayload, type TGetTokenExpiresFn } from '@venizia/ignis-kernel';
-import { type Env } from 'hono';
-import type { CryptoKey, JWK } from 'jose';
-import { AbstractJWKSTokenService } from './abstract.service';
-export declare class JWKSIssuerTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
-    protected options: IJWKSIssuerOptions;
-    protected privateKey: TNullable<CryptoKey | Uint8Array>;
-    protected publicKey: TNullable<CryptoKey | Uint8Array>;
-    protected jwks: {
-        keys: JWK[];
-    } | null;
-    constructor(options: IJWKSIssuerOptions);
-    protected initialize(): Promise<void>;
-    protected resolveKeyContent(opts: {
-        keys: IJWKSIssuerOptions['keys'];
-    }): Promise<{
-        priv: string;
-        pub: string;
-    }>;
-    /**
-     * Refuses a JWK carrying private material where a PUBLIC key is expected.
-     *
-     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
-     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
-     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
-     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
-     * round trip returns `d`; without it, export throws. So the only thing standing between a
-     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
-     *
-     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
-     * members are the rest of an RSA private key.
-     */
-    protected assertPublicJWK(opts: {
-        jwk: JWK;
-    }): void;
-    protected parseKeyMaterial(opts: {
-        raw: {
-            priv: string;
-            pub: string;
-        };
-        algorithm: IJWKSIssuerOptions['algorithm'];
-        keys: IJWKSIssuerOptions['keys'];
-    }): Promise<{
-        priv: import("node:crypto").webcrypto.CryptoKey | Uint8Array<ArrayBufferLike>;
-        pub: import("node:crypto").webcrypto.CryptoKey | Uint8Array<ArrayBufferLike>;
-    }>;
-    protected doVerify(token: string): Promise<IJWTTokenPayload>;
-    getSigner(opts: {
-        payload: IJWTTokenPayload;
-        getTokenExpiresFn: TGetTokenExpiresFn;
-        claims?: IJWTIssueClaims;
-    }): Promise<import("jose", { with: { "resolution-mode": "import" } }).SignJWT>;
-    protected getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;
-    protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;
-    getJWKS(): {
-        keys: JWK[];
-    };
-    getJWKSAsync(): Promise<{
-        keys: JWK[];
-    }>;
-}
-//# sourceMappingURL=issuer.service.d.ts.map