@venizia/ignis 0.4.2 → 0.4.4

package/dist/esm/components/auth/authenticate/controllers/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAM1E,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAYhC,CAAC;AAEH,eAAO,MAAM,oBAAoB,GAAI,MAAM,yBAAyB;sBAOvC,YAAY;iBAF5B,YAAY;mBAmBD,cAAc,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAbpC,CAAP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwMA,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/factory.js

@@ -0,0 +1,226 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { inject } from '@venizia/ignis-kernel';
+import { controller } from '@venizia/ignis-kernel';
+import { jsonContent, jsonResponse } from '@venizia/ignis-kernel';
+import { throwNotSupported } from '../../../../utilities/index.js';
+import { AnyObjectSchema } from '@venizia/ignis-kernel';
+import { z } from '@hono/zod-openapi';
+import { getError } from '@venizia/ignis-helpers/core';
+import { HTTP } from '@venizia/ignis-helpers/common';
+import { ChangePasswordRequestSchema, SignInRequestSchema, SignUpRequestSchema, } from '@venizia/ignis-kernel';
+import { Authentication, } from '@venizia/ignis-kernel';
+export const JWTTokenPayloadSchema = z.object({
+    userId: z.string().or(z.number()),
+    roles: z.array(z.object({
+        id: z.string().or(z.number()),
+        identifier: z.string(),
+        priority: z.number().int(),
+    })),
+    clientId: z.string().optional(),
+    provider: z.string().optional(),
+    email: z.email().optional(),
+});
+export const defineAuthController = (opts) => {
+    var AuthController_1;
+    const { restPath = '/auth', serviceKey, requireAuthenticatedSignUp = false, payload = {} } = opts;
+    let AuthController = AuthController_1 = class AuthController extends BaseRestController {
+        constructor(authService) {
+            super({
+                scope: AuthController_1.name,
+                path: restPath,
+                isStrict: true,
+            });
+            if (!authService) {
+                throw getError({
+                    message: '[AuthController] Failed to init auth controller | Invalid injectable authentication service!',
+                });
+            }
+            this.service = authService;
+        }
+        binding() {
+            this.defineRoute({
+                configs: {
+                    description: 'Sign In',
+                    path: '/sign-in',
+                    method: HTTP.Methods.POST,
+                    request: {
+                        body: jsonContent({
+                            description: 'Sign-in request body',
+                            required: true,
+                            schema: payload?.signIn?.request?.schema ?? SignInRequestSchema,
+                        }),
+                    },
+                    responses: jsonResponse({
+                        schema: payload?.signIn?.response?.schema ?? AnyObjectSchema,
+                        description: 'Success Response',
+                    }),
+                },
+                handler: async (context) => {
+                    const body = await context.req.json();
+                    const rs = await this.service.signIn(context, body);
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+            this.defineRoute({
+                configs: {
+                    description: 'Sign Up',
+                    path: '/sign-up',
+                    method: HTTP.Methods.POST,
+                    authenticate: {
+                        strategies: !requireAuthenticatedSignUp ? [] : [Authentication.STRATEGY_JWT],
+                    },
+                    request: {
+                        body: jsonContent({
+                            description: 'Sign-up request body',
+                            required: true,
+                            schema: payload?.signUp?.request?.schema ?? SignUpRequestSchema,
+                        }),
+                    },
+                    responses: jsonResponse({
+                        schema: payload?.signUp?.response?.schema ?? AnyObjectSchema,
+                        description: 'Success Response',
+                    }),
+                },
+                handler: async (context) => {
+                    const body = await context.req.json();
+                    const rs = await this.service.signUp(context, body);
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+            this.defineRoute({
+                configs: {
+                    description: 'Change password',
+                    path: '/change-password',
+                    method: HTTP.Methods.POST,
+                    request: {
+                        body: jsonContent({
+                            description: 'Change password request body',
+                            required: true,
+                            schema: payload?.changePassword?.request?.schema ?? ChangePasswordRequestSchema,
+                        }),
+                    },
+                    responses: jsonResponse({
+                        schema: payload?.changePassword?.response?.schema ?? AnyObjectSchema,
+                        description: 'Success Response',
+                    }),
+                    authenticate: { strategies: [Authentication.STRATEGY_JWT] },
+                },
+                handler: async (context) => {
+                    const body = await context.req.json();
+                    const rs = await this.service.changePassword(context, body);
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+            // Re-issues an access token using the caller's currently valid JWT — no separate refresh token. Implementers must enforce their own rotation/revocation policy if needed.
+            this.defineRoute({
+                configs: {
+                    description: 'Refresh access token',
+                    path: '/token/refresh',
+                    method: HTTP.Methods.POST,
+                    responses: jsonResponse({
+                        schema: payload?.refreshToken?.response?.schema ?? AnyObjectSchema,
+                        description: 'Success Response',
+                    }),
+                    authenticate: { strategies: [Authentication.STRATEGY_JWT] },
+                },
+                handler: async (context) => {
+                    if (!this.service.refreshToken) {
+                        return throwNotSupported({
+                            scope: AuthController_1.name,
+                            feature: 'refreshToken',
+                            logger: this.logger,
+                        });
+                    }
+                    const rs = await this.service.refreshToken(context);
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+            this.defineRoute({
+                configs: {
+                    path: '/who-am-i',
+                    method: HTTP.Methods.GET,
+                    request: {
+                        query: z.object({
+                            withUserInformation: z
+                                .enum(['true', 'false', '1', '0'])
+                                .transform((value) => value === 'true' || value === '1')
+                                .optional()
+                                .openapi({
+                                description: 'Whether to attach user information to currentUser',
+                            }),
+                        }),
+                    },
+                    responses: {
+                        [HTTP.ResultCodes.RS_2.Ok]: jsonContent({
+                            description: 'Success Response',
+                            schema: JWTTokenPayloadSchema.extend({
+                                userInformation: (payload?.getUserInformation?.response?.schema ?? AnyObjectSchema)
+                                    .optional()
+                                    .openapi({
+                                    description: 'Attached when withUserInformation is truthy',
+                                }),
+                            }),
+                        }),
+                    },
+                    authenticate: { strategies: [Authentication.STRATEGY_JWT] },
+                },
+                handler: async (context) => {
+                    const { withUserInformation = false } = context.req.valid('query');
+                    const currentUser = context.get(Authentication.CURRENT_USER);
+                    let rs = currentUser;
+                    if (withUserInformation) {
+                        if (!this.service.getUserInformation) {
+                            return throwNotSupported({
+                                scope: AuthController_1.name,
+                                feature: 'getUserInformation',
+                                logger: this.logger,
+                            });
+                        }
+                        const userInformation = await this.service.getUserInformation(context, {});
+                        rs = Object.assign({}, currentUser, { userInformation });
+                    }
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+            this.defineRoute({
+                configs: {
+                    description: 'Get current user information',
+                    path: '/me',
+                    method: HTTP.Methods.GET,
+                    responses: jsonResponse({
+                        schema: payload?.getUserInformation?.response?.schema ?? AnyObjectSchema,
+                        description: 'Success Response',
+                    }),
+                    authenticate: { strategies: [Authentication.STRATEGY_JWT] },
+                },
+                handler: async (context) => {
+                    if (!this.service.getUserInformation) {
+                        return throwNotSupported({
+                            scope: AuthController_1.name,
+                            feature: 'getUserInformation',
+                            logger: this.logger,
+                        });
+                    }
+                    const rs = await this.service.getUserInformation(context, {});
+                    return context.json(rs, HTTP.ResultCodes.RS_2.Ok);
+                },
+            });
+        }
+    };
+    AuthController = AuthController_1 = __decorate([
+        controller({ path: restPath }),
+        __metadata("design:paramtypes", [Object])
+    ], AuthController);
+    inject({ key: serviceKey })(AuthController, undefined, 0);
+    return AuthController;
+};
+//# sourceMappingURL=factory.js.map

package/dist/esm/components/auth/authenticate/controllers/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/factory.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAuB,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,cAAc,GAGf,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;KAC3B,CAAC,CACH;IACD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAA+B,EAAE,EAAE;;IACtE,MAAM,EAAE,QAAQ,GAAG,OAAO,EAAE,UAAU,EAAE,0BAA0B,GAAG,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAElG,IACM,cAAc,sBADpB,MACM,cAAe,SAAQ,kBAAkB;QAG7C,YAAY,WAAyB;YACnC,KAAK,CAAC;gBACJ,KAAK,EAAE,gBAAc,CAAC,IAAI;gBAC1B,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,QAAQ,CAAC;oBACb,OAAO,EACL,8FAA8F;iBACjG,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC7B,CAAC;QAEQ,OAAO;YACd,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,WAAW,EAAE,SAAS;oBACtB,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzB,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW,CAAC;4BAChB,WAAW,EAAE,sBAAsB;4BACnC,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,mBAAmB;yBAChE,CAAC;qBACH;oBACD,SAAS,EAAE,YAAY,CAAC;wBACtB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe;wBAC5D,WAAW,EAAE,kBAAkB;qBAChC,CAAC;iBACH;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,WAAW,EAAE,SAAS;oBACtB,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzB,YAAY,EAAE;wBACZ,UAAU,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;qBAC7E;oBACD,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW,CAAC;4BAChB,WAAW,EAAE,sBAAsB;4BACnC,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,mBAAmB;yBAChE,CAAC;qBACH;oBACD,SAAS,EAAE,YAAY,CAAC;wBACtB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe;wBAC5D,WAAW,EAAE,kBAAkB;qBAChC,CAAC;iBACH;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,WAAW,EAAE,iBAAiB;oBAC9B,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzB,OAAO,EAAE;wBACP,IAAI,EAAE,WAAW,CAAC;4BAChB,WAAW,EAAE,8BAA8B;4BAC3C,QAAQ,EAAE,IAAI;4BACd,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,2BAA2B;yBAChF,CAAC;qBACH;oBACD,SAAS,EAAE,YAAY,CAAC;wBACtB,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe;wBACpE,WAAW,EAAE,kBAAkB;qBAChC,CAAC;oBACF,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE;iBAC5D;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACtC,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC5D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,0KAA0K;YAC1K,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,WAAW,EAAE,sBAAsB;oBACnC,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;oBACzB,SAAS,EAAE,YAAY,CAAC;wBACtB,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe;wBAClE,WAAW,EAAE,kBAAkB;qBAChC,CAAC;oBACF,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE;iBAC5D;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;wBAC/B,OAAO,iBAAiB,CAAC;4BACvB,KAAK,EAAE,gBAAc,CAAC,IAAI;4BAC1B,OAAO,EAAE,cAAc;4BACvB,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;oBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;oBACxB,OAAO,EAAE;wBACP,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;4BACd,mBAAmB,EAAE,CAAC;iCACnB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;iCACjC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC;iCACvD,QAAQ,EAAE;iCACV,OAAO,CAAC;gCACP,WAAW,EAAE,mDAAmD;6BACjE,CAAC;yBACL,CAAC;qBACH;oBACD,SAAS,EAAE;wBACT,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC;4BACtC,WAAW,EAAE,kBAAkB;4BAC/B,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;gCACnC,eAAe,EAAE,CAAC,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe,CAAC;qCAChF,QAAQ,EAAE;qCACV,OAAO,CAAC;oCACP,WAAW,EAAE,6CAA6C;iCAC3D,CAAC;6BACL,CAAC;yBACH,CAAC;qBACH;oBACD,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE;iBAC5D;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,MAAM,EAAE,mBAAmB,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAEtD,OAAO,CAAC,CAAC;oBAEZ,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;oBAC7D,IAAI,EAAE,GAAG,WAAW,CAAC;oBAErB,IAAI,mBAAmB,EAAE,CAAC;wBACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;4BACrC,OAAO,iBAAiB,CAAC;gCACvB,KAAK,EAAE,gBAAc,CAAC,IAAI;gCAC1B,OAAO,EAAE,oBAAoB;gCAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;6BACpB,CAAC,CAAC;wBACL,CAAC;wBAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;wBAC3E,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC3D,CAAC;oBAED,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,WAAW,CAAC;gBACf,OAAO,EAAE;oBACP,WAAW,EAAE,8BAA8B;oBAC3C,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;oBACxB,SAAS,EAAE,YAAY,CAAC;wBACtB,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe;wBACxE,WAAW,EAAE,kBAAkB;qBAChC,CAAC;oBACF,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE;iBAC5D;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;wBACrC,OAAO,iBAAiB,CAAC;4BACvB,KAAK,EAAE,gBAAc,CAAC,IAAI;4BAC1B,OAAO,EAAE,oBAAoB;4BAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,CAAC,CAAC;oBACL,CAAC;oBAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACpD,CAAC;aACF,CAAC,CAAC;QACL,CAAC;KACF,CAAA;IA1MK,cAAc;QADnB,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;;OACzB,cAAc,CA0MnB;IAED,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAE1D,OAAO,cAAc,CAAC;AACxB,CAAC,CAAC","sourcesContent":["import { BaseRestController } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { controller } from '@venizia/ignis-kernel';\nimport { jsonContent, jsonResponse } from '@venizia/ignis-kernel';\nimport { throwNotSupported } from '@/utilities';\nimport { AnyObjectSchema } from '@venizia/ignis-kernel';\nimport { z } from '@hono/zod-openapi';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport { HTTP, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport {\n  ChangePasswordRequestSchema,\n  SignInRequestSchema,\n  SignUpRequestSchema,\n} from '@venizia/ignis-kernel';\nimport {\n  Authentication,\n  type IAuthService,\n  type TDefineAuthControllerOpts,\n} from '@venizia/ignis-kernel';\n\nexport const JWTTokenPayloadSchema = z.object({\n  userId: z.string().or(z.number()),\n  roles: z.array(\n    z.object({\n      id: z.string().or(z.number()),\n      identifier: z.string(),\n      priority: z.number().int(),\n    }),\n  ),\n  clientId: z.string().optional(),\n  provider: z.string().optional(),\n  email: z.email().optional(),\n});\n\nexport const defineAuthController = (opts: TDefineAuthControllerOpts) => {\n  const { restPath = '/auth', serviceKey, requireAuthenticatedSignUp = false, payload = {} } = opts;\n\n  @controller({ path: restPath })\n  class AuthController extends BaseRestController {\n    service: IAuthService;\n\n    constructor(authService: IAuthService) {\n      super({\n        scope: AuthController.name,\n        path: restPath,\n        isStrict: true,\n      });\n\n      if (!authService) {\n        throw getError({\n          message:\n            '[AuthController] Failed to init auth controller | Invalid injectable authentication service!',\n        });\n      }\n\n      this.service = authService;\n    }\n\n    override binding(): ValueOrPromise<void> {\n      this.defineRoute({\n        configs: {\n          description: 'Sign In',\n          path: '/sign-in',\n          method: HTTP.Methods.POST,\n          request: {\n            body: jsonContent({\n              description: 'Sign-in request body',\n              required: true,\n              schema: payload?.signIn?.request?.schema ?? SignInRequestSchema,\n            }),\n          },\n          responses: jsonResponse({\n            schema: payload?.signIn?.response?.schema ?? AnyObjectSchema,\n            description: 'Success Response',\n          }),\n        },\n        handler: async (context) => {\n          const body = await context.req.json();\n          const rs = await this.service.signIn(context, body);\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n\n      this.defineRoute({\n        configs: {\n          description: 'Sign Up',\n          path: '/sign-up',\n          method: HTTP.Methods.POST,\n          authenticate: {\n            strategies: !requireAuthenticatedSignUp ? [] : [Authentication.STRATEGY_JWT],\n          },\n          request: {\n            body: jsonContent({\n              description: 'Sign-up request body',\n              required: true,\n              schema: payload?.signUp?.request?.schema ?? SignUpRequestSchema,\n            }),\n          },\n          responses: jsonResponse({\n            schema: payload?.signUp?.response?.schema ?? AnyObjectSchema,\n            description: 'Success Response',\n          }),\n        },\n        handler: async (context) => {\n          const body = await context.req.json();\n          const rs = await this.service.signUp(context, body);\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n\n      this.defineRoute({\n        configs: {\n          description: 'Change password',\n          path: '/change-password',\n          method: HTTP.Methods.POST,\n          request: {\n            body: jsonContent({\n              description: 'Change password request body',\n              required: true,\n              schema: payload?.changePassword?.request?.schema ?? ChangePasswordRequestSchema,\n            }),\n          },\n          responses: jsonResponse({\n            schema: payload?.changePassword?.response?.schema ?? AnyObjectSchema,\n            description: 'Success Response',\n          }),\n          authenticate: { strategies: [Authentication.STRATEGY_JWT] },\n        },\n        handler: async (context) => {\n          const body = await context.req.json();\n          const rs = await this.service.changePassword(context, body);\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n\n      // Re-issues an access token using the caller's currently valid JWT — no separate refresh token. Implementers must enforce their own rotation/revocation policy if needed.\n      this.defineRoute({\n        configs: {\n          description: 'Refresh access token',\n          path: '/token/refresh',\n          method: HTTP.Methods.POST,\n          responses: jsonResponse({\n            schema: payload?.refreshToken?.response?.schema ?? AnyObjectSchema,\n            description: 'Success Response',\n          }),\n          authenticate: { strategies: [Authentication.STRATEGY_JWT] },\n        },\n        handler: async (context) => {\n          if (!this.service.refreshToken) {\n            return throwNotSupported({\n              scope: AuthController.name,\n              feature: 'refreshToken',\n              logger: this.logger,\n            });\n          }\n\n          const rs = await this.service.refreshToken(context);\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n\n      this.defineRoute({\n        configs: {\n          path: '/who-am-i',\n          method: HTTP.Methods.GET,\n          request: {\n            query: z.object({\n              withUserInformation: z\n                .enum(['true', 'false', '1', '0'])\n                .transform((value) => value === 'true' || value === '1')\n                .optional()\n                .openapi({\n                  description: 'Whether to attach user information to currentUser',\n                }),\n            }),\n          },\n          responses: {\n            [HTTP.ResultCodes.RS_2.Ok]: jsonContent({\n              description: 'Success Response',\n              schema: JWTTokenPayloadSchema.extend({\n                userInformation: (payload?.getUserInformation?.response?.schema ?? AnyObjectSchema)\n                  .optional()\n                  .openapi({\n                    description: 'Attached when withUserInformation is truthy',\n                  }),\n              }),\n            }),\n          },\n          authenticate: { strategies: [Authentication.STRATEGY_JWT] },\n        },\n        handler: async (context) => {\n          const { withUserInformation = false } = context.req.valid<{\n            withUserInformation?: boolean;\n          }>('query');\n\n          const currentUser = context.get(Authentication.CURRENT_USER);\n          let rs = currentUser;\n\n          if (withUserInformation) {\n            if (!this.service.getUserInformation) {\n              return throwNotSupported({\n                scope: AuthController.name,\n                feature: 'getUserInformation',\n                logger: this.logger,\n              });\n            }\n\n            const userInformation = await this.service.getUserInformation(context, {});\n            rs = Object.assign({}, currentUser, { userInformation });\n          }\n\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n\n      this.defineRoute({\n        configs: {\n          description: 'Get current user information',\n          path: '/me',\n          method: HTTP.Methods.GET,\n          responses: jsonResponse({\n            schema: payload?.getUserInformation?.response?.schema ?? AnyObjectSchema,\n            description: 'Success Response',\n          }),\n          authenticate: { strategies: [Authentication.STRATEGY_JWT] },\n        },\n        handler: async (context) => {\n          if (!this.service.getUserInformation) {\n            return throwNotSupported({\n              scope: AuthController.name,\n              feature: 'getUserInformation',\n              logger: this.logger,\n            });\n          }\n\n          const rs = await this.service.getUserInformation(context, {});\n          return context.json(rs, HTTP.ResultCodes.RS_2.Ok);\n        },\n      });\n    }\n  }\n\n  inject({ key: serviceKey })(AuthController, undefined, 0);\n\n  return AuthController;\n};\n"]}

package/dist/esm/components/auth/authenticate/controllers/index.d.ts

@@ -0,0 +1,4 @@
+export * from './factory.js';
+export * from './jwks/index.js';
+export * from './service-certs/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/controllers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/index.js

@@ -0,0 +1,4 @@
+export * from './factory.js';
+export * from './jwks/index.js';
+export * from './service-certs/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/controllers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC","sourcesContent":["export * from './factory';\nexport * from './jwks';\nexport * from './service-certs';\n"]}

package/dist/esm/components/auth/authenticate/controllers/jwks/controller.d.ts

@@ -0,0 +1,9 @@
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { JWKSIssuerTokenService } from '../../services/index.js';
+export declare class JWKSController extends BaseRestController {
+    private jwksService;
+    constructor(jwksService: JWKSIssuerTokenService);
+    binding(): ValueOrPromise<void>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/esm/components/auth/authenticate/controllers/jwks/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,qBAAa,cAAe,SAAQ,kBAAkB;IAQlD,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,sBAAsB;IASpC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;CAUzC"}

package/dist/esm/components/auth/authenticate/controllers/jwks/controller.js

@@ -0,0 +1,51 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JWKSController_1;
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { inject } from '@venizia/ignis-kernel';
+import { BindingNamespaces } from '@venizia/ignis-kernel';
+import { HTTP } from '@venizia/ignis-helpers/common';
+import { BindingKeys } from '@venizia/ignis-inversion';
+import { JWKSIssuerTokenService } from '../../services/index.js';
+import { RouteConfigs } from './definitions.js';
+let JWKSController = JWKSController_1 = class JWKSController extends BaseRestController {
+    constructor(jwksService) {
+        super({
+            scope: JWKSController_1.name,
+            path: '/certs',
+            isStrict: true,
+        });
+        this.jwksService = jwksService;
+    }
+    binding() {
+        this.defineRoute({
+            configs: RouteConfigs.GET_JWKS_CERTS,
+            handler: async (context) => {
+                const jwks = await this.jwksService.getJWKSAsync();
+                context.header('Cache-Control', 'public, max-age=3600, stale-while-revalidate=86400');
+                return context.json(jwks, HTTP.ResultCodes.RS_2.Ok);
+            },
+        });
+    }
+};
+JWKSController = JWKSController_1 = __decorate([
+    __param(0, inject({
+        key: BindingKeys.build({
+            namespace: BindingNamespaces.SERVICE,
+            key: JWKSIssuerTokenService.name,
+        }),
+    })),
+    __metadata("design:paramtypes", [JWKSIssuerTokenService])
+], JWKSController);
+export { JWKSController };
+//# sourceMappingURL=controller.js.map

package/dist/esm/components/auth/authenticate/controllers/jwks/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAuB,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,IAAa,cAAc,sBAA3B,MAAa,cAAe,SAAQ,kBAAkB;IACpD,YAOU,WAAmC;QAE3C,KAAK,CAAC;YACJ,KAAK,EAAE,gBAAc,CAAC,IAAI;YAC1B,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QANK,gBAAW,GAAX,WAAW,CAAwB;IAO7C,CAAC;IAEQ,OAAO;QACd,IAAI,CAAC,WAAW,CAAC;YACf,OAAO,EAAE,YAAY,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;gBACnD,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;gBACtF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA3BY,cAAc;IAEtB,WAAA,MAAM,CAAC;QACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,sBAAsB,CAAC,IAAI;SACjC,CAAC;KACH,CAAC,CAAA;qCACmB,sBAAsB;GARlC,cAAc,CA2B1B","sourcesContent":["import { BaseRestController } from '@venizia/ignis-kernel';\nimport { inject } from '@venizia/ignis-kernel';\nimport { BindingNamespaces } from '@venizia/ignis-kernel';\nimport { HTTP, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { JWKSIssuerTokenService } from '../../services';\nimport { RouteConfigs } from './definitions';\n\nexport class JWKSController extends BaseRestController {\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: JWKSIssuerTokenService.name,\n      }),\n    })\n    private jwksService: JWKSIssuerTokenService,\n  ) {\n    super({\n      scope: JWKSController.name,\n      path: '/certs',\n      isStrict: true,\n    });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    this.defineRoute({\n      configs: RouteConfigs.GET_JWKS_CERTS,\n      handler: async (context) => {\n        const jwks = await this.jwksService.getJWKSAsync();\n        context.header('Cache-Control', 'public, max-age=3600, stale-while-revalidate=86400');\n        return context.json(jwks, HTTP.ResultCodes.RS_2.Ok);\n      },\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/controllers/jwks/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAGtC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0Bf,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/jwks/definitions.js

@@ -0,0 +1,28 @@
+import { jsonResponse } from '@venizia/ignis-kernel';
+import { z } from '@hono/zod-openapi';
+// The /certs endpoint is intentionally unauthenticated - it serves the public JWKS external verifiers need to validate tokens issued by this service.
+export const RouteConfigs = {
+    GET_JWKS_CERTS: {
+        path: '/',
+        method: 'get',
+        responses: jsonResponse({
+            schema: z
+                .object({
+                keys: z.array(z.object({
+                    kty: z.string(),
+                    kid: z.string().optional(),
+                    use: z.string().optional(),
+                    alg: z.string().optional(),
+                    crv: z.string().optional(),
+                    x: z.string().optional(),
+                    y: z.string().optional(),
+                    n: z.string().optional(),
+                    e: z.string().optional(),
+                })),
+            })
+                .openapi({ description: 'JSON Web Key Set' }),
+            description: 'JSON Web Key Set',
+        }),
+    },
+};
+//# sourceMappingURL=definitions.js.map

package/dist/esm/components/auth/authenticate/controllers/jwks/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC,sJAAsJ;AACtJ,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE;QACd,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,YAAY,CAAC;YACtB,MAAM,EAAE,CAAC;iBACN,MAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,KAAK,CACX,CAAC,CAAC,MAAM,CAAC;oBACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;iBACzB,CAAC,CACH;aACF,CAAC;iBACD,OAAO,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;YAE/C,WAAW,EAAE,kBAAkB;SAChC,CAAC;KACH;CACO,CAAC","sourcesContent":["import { jsonResponse } from '@venizia/ignis-kernel';\nimport { z } from '@hono/zod-openapi';\n\n// The /certs endpoint is intentionally unauthenticated - it serves the public JWKS external verifiers need to validate tokens issued by this service.\nexport const RouteConfigs = {\n  GET_JWKS_CERTS: {\n    path: '/',\n    method: 'get',\n    responses: jsonResponse({\n      schema: z\n        .object({\n          keys: z.array(\n            z.object({\n              kty: z.string(),\n              kid: z.string().optional(),\n              use: z.string().optional(),\n              alg: z.string().optional(),\n              crv: z.string().optional(),\n              x: z.string().optional(),\n              y: z.string().optional(),\n              n: z.string().optional(),\n              e: z.string().optional(),\n            }),\n          ),\n        })\n        .openapi({ description: 'JSON Web Key Set' }),\n\n      description: 'JSON Web Key Set',\n    }),\n  },\n} as const;\n"]}

package/dist/esm/components/auth/authenticate/controllers/jwks/index.d.ts

@@ -0,0 +1,2 @@
+export * from './controller.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/controllers/jwks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/jwks/index.js

@@ -0,0 +1,2 @@
+export * from './controller.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/controllers/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC","sourcesContent":["export * from './controller';\n"]}

package/dist/esm/components/auth/authenticate/controllers/service-certs/controller.d.ts

@@ -0,0 +1,10 @@
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { ServiceAssertionSignerService } from '../../services/service/signer.service.js';
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+export declare class ServiceCertsController extends BaseRestController {
+    private readonly signer;
+    constructor(signer: ServiceAssertionSignerService, path: string);
+    binding(): ValueOrPromise<void>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/esm/components/auth/authenticate/controllers/service-certs/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAGtF,4GAA4G;AAC5G,qBAAa,sBAAuB,SAAQ,kBAAkB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B,EAEtD,IAAI,EAAE,MAAM;IAKL,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;CAUzC"}

package/dist/esm/components/auth/authenticate/controllers/service-certs/controller.js

@@ -0,0 +1,47 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceCertsController_1;
+import { AuthenticateBindingKeys, BaseRestController, BindingNamespaces, inject, } from '@venizia/ignis-kernel';
+import { HTTP } from '@venizia/ignis-helpers/common';
+import { BindingKeys } from '@venizia/ignis-inversion';
+import { ServiceAssertionSignerService } from '../../services/service/signer.service.js';
+import { ServiceCertsRouteConfigs } from './definitions.js';
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+let ServiceCertsController = ServiceCertsController_1 = class ServiceCertsController extends BaseRestController {
+    constructor(signer, path) {
+        super({ scope: ServiceCertsController_1.name, path, isStrict: true });
+        this.signer = signer;
+    }
+    binding() {
+        this.defineRoute({
+            configs: ServiceCertsRouteConfigs.GET_SERVICE_CERTS,
+            handler: async (context) => {
+                const jwks = await this.signer.getPublicJWKS();
+                context.header('Cache-Control', 'public, max-age=600, stale-while-revalidate=86400');
+                return context.json(jwks, HTTP.ResultCodes.RS_2.Ok);
+            },
+        });
+    }
+};
+ServiceCertsController = ServiceCertsController_1 = __decorate([
+    __param(0, inject({
+        key: BindingKeys.build({
+            namespace: BindingNamespaces.SERVICE,
+            key: ServiceAssertionSignerService.name,
+        }),
+    })),
+    __param(1, inject({ key: AuthenticateBindingKeys.SERVICE_CERTS_PATH })),
+    __metadata("design:paramtypes", [ServiceAssertionSignerService, String])
+], ServiceCertsController);
+export { ServiceCertsController };
+//# sourceMappingURL=controller.js.map

package/dist/esm/components/auth/authenticate/controllers/service-certs/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,GACP,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAuB,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,4GAA4G;AAC5G,IAAa,sBAAsB,8BAAnC,MAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,YAOmB,MAAqC,EAEtD,IAAY;QAEZ,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAJnD,WAAM,GAAN,MAAM,CAA+B;IAKxD,CAAC;IAEQ,OAAO;QACd,IAAI,CAAC,WAAW,CAAC;YACf,OAAO,EAAE,wBAAwB,CAAC,iBAAiB;YACnD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;gBACrF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzBY,sBAAsB;IAE9B,WAAA,MAAM,CAAC;QACN,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,6BAA6B,CAAC,IAAI;SACxC,CAAC;KACH,CAAC,CAAA;IAED,WAAA,MAAM,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,kBAAkB,EAAE,CAAC,CAAA;qCADnC,6BAA6B;GAR7C,sBAAsB,CAyBlC","sourcesContent":["import {\n  AuthenticateBindingKeys,\n  BaseRestController,\n  BindingNamespaces,\n  inject,\n} from '@venizia/ignis-kernel';\nimport { HTTP, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { BindingKeys } from '@venizia/ignis-inversion';\nimport { ServiceAssertionSignerService } from '../../services/service/signer.service';\nimport { ServiceCertsRouteConfigs } from './definitions';\n\n/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */\nexport class ServiceCertsController extends BaseRestController {\n  constructor(\n    @inject({\n      key: BindingKeys.build({\n        namespace: BindingNamespaces.SERVICE,\n        key: ServiceAssertionSignerService.name,\n      }),\n    })\n    private readonly signer: ServiceAssertionSignerService,\n    @inject({ key: AuthenticateBindingKeys.SERVICE_CERTS_PATH })\n    path: string,\n  ) {\n    super({ scope: ServiceCertsController.name, path, isStrict: true });\n  }\n\n  override binding(): ValueOrPromise<void> {\n    this.defineRoute({\n      configs: ServiceCertsRouteConfigs.GET_SERVICE_CERTS,\n      handler: async (context) => {\n        const jwks = await this.signer.getPublicJWKS();\n        context.header('Cache-Control', 'public, max-age=600, stale-while-revalidate=86400');\n        return context.json(jwks, HTTP.ResultCodes.RS_2.Ok);\n      },\n    });\n  }\n}\n"]}

package/dist/esm/components/auth/authenticate/controllers/service-certs/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB3B,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/service-certs/definitions.js

@@ -0,0 +1,31 @@
+import { jsonResponse } from '@venizia/ignis-kernel';
+import { z } from '@hono/zod-openapi';
+/**
+ * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's
+ * assertions. Whoever can reach it learns only which key signs, which is what verification requires.
+ *
+ * The schema names public members only. That is documentation, not a filter - a zod response schema
+ * does not strip anything - so the guard that private material never gets here lives in the signer.
+ */
+export const ServiceCertsRouteConfigs = {
+    GET_SERVICE_CERTS: {
+        path: '/',
+        method: 'get',
+        responses: jsonResponse({
+            schema: z
+                .object({
+                keys: z.array(z.object({
+                    kty: z.string(),
+                    kid: z.string().optional(),
+                    use: z.string().optional(),
+                    alg: z.string().optional(),
+                    crv: z.string().optional(),
+                    x: z.string().optional(),
+                })),
+            })
+                .openapi({ description: 'Service assertion JSON Web Key Set' }),
+            description: 'Service assertion JSON Web Key Set',
+        }),
+    },
+};
+//# sourceMappingURL=definitions.js.map

package/dist/esm/components/auth/authenticate/controllers/service-certs/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,iBAAiB,EAAE;QACjB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,YAAY,CAAC;YACtB,MAAM,EAAE,CAAC;iBACN,MAAM,CAAC;gBACN,IAAI,EAAE,CAAC,CAAC,KAAK,CACX,CAAC,CAAC,MAAM,CAAC;oBACP,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;iBACzB,CAAC,CACH;aACF,CAAC;iBACD,OAAO,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;YACjE,WAAW,EAAE,oCAAoC;SAClD,CAAC;KACH;CACO,CAAC","sourcesContent":["import { jsonResponse } from '@venizia/ignis-kernel';\nimport { z } from '@hono/zod-openapi';\n\n/**\n * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's\n * assertions. Whoever can reach it learns only which key signs, which is what verification requires.\n *\n * The schema names public members only. That is documentation, not a filter - a zod response schema\n * does not strip anything - so the guard that private material never gets here lives in the signer.\n */\nexport const ServiceCertsRouteConfigs = {\n  GET_SERVICE_CERTS: {\n    path: '/',\n    method: 'get',\n    responses: jsonResponse({\n      schema: z\n        .object({\n          keys: z.array(\n            z.object({\n              kty: z.string(),\n              kid: z.string().optional(),\n              use: z.string().optional(),\n              alg: z.string().optional(),\n              crv: z.string().optional(),\n              x: z.string().optional(),\n            }),\n          ),\n        })\n        .openapi({ description: 'Service assertion JSON Web Key Set' }),\n      description: 'Service assertion JSON Web Key Set',\n    }),\n  },\n} as const;\n"]}

package/dist/esm/components/auth/authenticate/controllers/service-certs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './controller.js';
+export * from './definitions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/controllers/service-certs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/esm/components/auth/authenticate/controllers/service-certs/index.js

@@ -0,0 +1,3 @@
+export * from './controller.js';
+export * from './definitions.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/controllers/service-certs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC","sourcesContent":["export * from './controller';\nexport * from './definitions';\n"]}

package/dist/esm/components/auth/authenticate/index.d.ts

@@ -0,0 +1,6 @@
+export * from '@venizia/ignis-kernel';
+export * from './component.js';
+export * from './controllers/index.js';
+export * from './services/index.js';
+export * from './strategies/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC"}

package/dist/esm/components/auth/authenticate/index.js

@@ -0,0 +1,8 @@
+// `common`, `middlewares` and `providers` moved to the kernel in full; `strategy-registry.ts`
+// moved out of `strategies` too (see `./strategies/index.ts`).
+export * from '@venizia/ignis-kernel';
+export * from './component.js';
+export * from './controllers/index.js';
+export * from './services/index.js';
+export * from './strategies/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/index.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,+DAA+D;AAC/D,cAAc,uBAAuB,CAAC;AAEtC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC","sourcesContent":["// `common`, `middlewares` and `providers` moved to the kernel in full; `strategy-registry.ts`\n// moved out of `strategies` too (see `./strategies/index.ts`).\nexport * from '@venizia/ignis-kernel';\n\nexport * from './component';\nexport * from './controllers';\nexport * from './services';\nexport * from './strategies';\n"]}

package/dist/esm/components/auth/authenticate/services/basic/index.d.ts

@@ -0,0 +1,2 @@
+export * from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/components/auth/authenticate/services/basic/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/basic/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC"}

package/dist/esm/components/auth/authenticate/services/basic/index.js

@@ -0,0 +1,2 @@
+export * from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/components/auth/authenticate/services/basic/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/basic/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC","sourcesContent":["export * from './service';\n"]}

package/dist/esm/components/auth/authenticate/services/basic/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/basic/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,kFAAkF;AAClF,qBAAa,iBAAiB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,WAAW;IAKnE,SAAS,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAJjD,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;gBAInE,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAcjD,2EAA2E;IAC3E,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA6DxF,wEAAwE;IAClE,MAAM,CAAC,IAAI,EAAE;QACjB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,GAAG,OAAO,CAAC,SAAS,CAAC;CAgBvB"}