@xemahq/identity-client 0.3.2

package/README.md

@@ -0,0 +1,313 @@
+# @xemahq/identity-client
+
+TypeScript client library and NestJS module for integrating microservices with Identity API. Handles service registration, credential management, and JWT token lifecycle automatically.
+
+## Features
+
+- **Automatic Service Registration** — Background registration with identity-api on startup
+- **Token Management** — Automatic caching, refresh at 90% lifetime, concurrent request deduplication
+- **NestJS Module** — Drop-in `IdentityBootstrapModule` with async configuration
+- **Standalone Client** — `IdentityApiClient` for direct API calls outside NestJS
+- **Non-Blocking Startup** — Services start immediately; registration happens in the background
+- **Exponential Backoff** — Resilient retry logic (5s → 5min cap) if identity-api is unavailable
+- **Pre-configured Credentials** — Optional bypass for registration when credentials are provided via env vars
+- **Zero Dependencies** — Uses native `fetch` (no axios)
+
+## Installation
+
+```bash
+npm install @xemahq/identity-client
+```
+
+Requires `.npmrc` with GitHub Packages registry:
+
+```
+@xemahq:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NPM_TOKEN}
+```
+
+## Quick Start (NestJS)
+
+### 1. Import the Module
+
+```typescript
+import { Module } from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { IdentityBootstrapModule } from '@xemahq/identity-client';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({ isGlobal: true }),
+    IdentityBootstrapModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (config: ConfigService) => ({
+        identityApiUrl: config.getOrThrow('IDENTITY_API_URL'),
+        identityApiInternalToken: config.getOrThrow('IDENTITY_API_INTERNAL_TOKEN'),
+        serviceName: 'my-service',
+        serviceDisplayName: 'My Service',
+      }),
+      inject: [ConfigService],
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+### 2. Environment Variables
+
+```env
+IDENTITY_API_URL=http://identity-api:3053
+IDENTITY_API_INTERNAL_TOKEN=your-identity-api-token
+```
+
+### 3. Use the Service
+
+```typescript
+import { Injectable } from '@nestjs/common';
+import { IdentityBootstrapService } from '@xemahq/identity-client';
+import { HttpService } from '@nestjs/axios';
+import { firstValueFrom } from 'rxjs';
+
+@Injectable()
+export class MyService {
+  constructor(
+    private readonly identityBootstrap: IdentityBootstrapService,
+    private readonly httpService: HttpService,
+  ) {}
+
+  async callOtherService() {
+    // Get a valid JWT access token (cached, auto-refreshed)
+    const token = await this.identityBootstrap.getAccessToken();
+
+    const response = await firstValueFrom(
+      this.httpService.get('http://other-service/resource', {
+        headers: { Authorization: `Bearer ${token}` },
+      }),
+    );
+
+    return response.data;
+  }
+}
+```
+
+## Integration with Event Hub
+
+The primary use case is providing JWT tokens to `@xemahq/event-hub-client` via the `tokenProvider` option:
+
+```typescript
+import { IdentityBootstrapModule, IdentityBootstrapService } from '@xemahq/identity-client';
+import { EventHubModule } from '@xemahq/event-hub-client';
+
+@Module({
+  imports: [
+    ConfigModule.forRoot({ isGlobal: true }),
+
+    // 1. Register with identity-api
+    IdentityBootstrapModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (config: ConfigService) => ({
+        identityApiUrl: config.getOrThrow('IDENTITY_API_URL'),
+        identityApiInternalToken: config.getOrThrow('IDENTITY_API_INTERNAL_TOKEN'),
+        serviceName: 'my-service',
+        serviceDisplayName: 'My Service',
+      }),
+      inject: [ConfigService],
+    }),
+
+    // 2. Register with event-hub, using identity-api for tokens
+    EventHubModule.forRootAsync({
+      imports: [ConfigModule],
+      useFactory: (config: ConfigService, identityBootstrap: IdentityBootstrapService) => ({
+        eventHubUrl: config.getOrThrow('EVENT_HUB_URL'),
+        eventHubInternalToken: config.getOrThrow('EVENT_HUB_INTERNAL_TOKEN'),
+        serviceId: 'my-service',
+        serviceName: 'My Service',
+        schemaVersion: '1.0.0',
+        dataTypes: ['order'],
+        tokenProvider: () => identityBootstrap.getAccessToken(),
+      }),
+      inject: [ConfigService, IdentityBootstrapService],
+    }),
+  ],
+})
+export class AppModule {}
+```
+
+## API Reference
+
+### IdentityBootstrapModule
+
+NestJS module for automatic service registration and token management.
+
+```typescript
+IdentityBootstrapModule.forRootAsync({
+  imports: [ConfigModule],
+  useFactory: (config: ConfigService) => ({
+    // Required
+    identityApiUrl: string;            // Base URL of identity-api
+    identityApiInternalToken: string;  // Internal bearer token for registration
+    serviceName: string;               // Service ID (becomes OAuth2 client_id)
+    serviceDisplayName: string;        // Human-readable name
+
+    // Optional
+    serviceDescription?: string;       // Service description
+    maxRegistrationAttempts?: number;   // Max retries (default: Infinity)
+    baseRetryDelay?: number;           // Backoff base delay in ms (default: 5000)
+    maxRetryDelay?: number;            // Backoff cap in ms (default: 300000)
+
+    // Pre-configured credentials (skip auto-registration)
+    clientId?: string;                 // OAuth2 client_id
+    clientSecret?: string;             // OAuth2 client_secret
+    tokenEndpoint?: string;            // Keycloak token endpoint URL
+  }),
+  inject: [ConfigService],
+});
+```
+
+The module registers globally and exports `IdentityBootstrapService`.
+
+### IdentityBootstrapService
+
+Manages service account lifecycle. Injected automatically when using `IdentityBootstrapModule`.
+
+```typescript
+class IdentityBootstrapService {
+  // Get a valid JWT access token (cached, auto-refreshed)
+  getAccessToken(): Promise<string>;
+
+  // Wait for registration to complete (with optional timeout)
+  waitForReady(timeoutMs?: number): Promise<boolean>;
+
+  // Check if credentials are available
+  hasCredentials(): boolean;
+
+  // Get the service's OAuth2 client_id
+  getClientId(): string | null;
+}
+```
+
+**Startup behavior:**
+1. If `clientId`, `clientSecret`, and `tokenEndpoint` are provided → uses them directly (no registration)
+2. Otherwise, starts background registration with identity-api:
+   - Calls `POST /internal/services/register` with `regenerateSecret: false`
+   - If the service already exists and no secret is returned, retries with `regenerateSecret: true`
+   - Verifies credentials by obtaining an initial token
+   - Retries with exponential backoff on failure
+
+### IdentityApiClient
+
+Standalone HTTP client for direct identity-api calls. Does not require NestJS.
+
+```typescript
+import { IdentityApiClient } from '@xemahq/identity-client';
+
+const client = new IdentityApiClient({
+  baseUrl: 'http://identity-api:3053',
+  internalToken: 'your-token',
+  timeoutMs: 10000, // optional, default: 10000
+});
+
+// Register a service and get credentials
+const credentials = await client.registerService({
+  name: 'my-service',
+  displayName: 'My Service',
+  serviceType: 'BACKEND',
+  regenerateSecret: false,
+});
+// → { clientId, clientSecret, tokenEndpoint, roles }
+
+// Full response with metadata
+const response = await client.registerServiceFull({
+  name: 'my-service',
+  displayName: 'My Service',
+  serviceType: 'BACKEND',
+  regenerateSecret: false,
+});
+// → { id, clientSecret, tokenEndpoint, roles, alreadyExisted, secretRegenerated }
+
+// Verify organization membership
+const membership = await client.verifyMembership(userId, orgId);
+// → { isMember, role }
+
+// Create system organization (idempotent)
+const org = await client.ensureSystemOrg({
+  name: 'system',
+  displayName: 'System Organization',
+});
+
+// Get system organization by name
+const systemOrg = await client.getSystemOrg('system');
+```
+
+### Error Handling
+
+All client methods throw `IdentityApiError` on failure:
+
+```typescript
+import { IdentityApiError } from '@xemahq/identity-client';
+
+try {
+  await client.registerService({ ... });
+} catch (error) {
+  if (error instanceof IdentityApiError) {
+    console.error(error.statusCode); // HTTP status
+    console.error(error.message);    // Error message
+  }
+}
+```
+
+## Pre-configured Credentials
+
+For production multi-replica deployments, you can skip auto-registration by providing credentials via environment variables. This avoids the secret regeneration race condition when multiple pods start simultaneously.
+
+```typescript
+IdentityBootstrapModule.forRootAsync({
+  imports: [ConfigModule],
+  useFactory: (config: ConfigService) => ({
+    identityApiUrl: config.getOrThrow('IDENTITY_API_URL'),
+    identityApiInternalToken: config.getOrThrow('IDENTITY_API_INTERNAL_TOKEN'),
+    serviceName: 'my-service',
+    serviceDisplayName: 'My Service',
+    // Pre-configured credentials — skip registration entirely
+    clientId: config.get('SERVICE_CLIENT_ID'),
+    clientSecret: config.get('SERVICE_CLIENT_SECRET'),
+    tokenEndpoint: config.get('SERVICE_TOKEN_ENDPOINT'),
+  }),
+  inject: [ConfigService],
+});
+```
+
+When all three (`clientId`, `clientSecret`, `tokenEndpoint`) are provided, `IdentityBootstrapService` validates them on startup and enters ready state immediately. If validation fails, the module throws (hard fail).
+
+## Exports
+
+```typescript
+// Classes
+export { IdentityApiClient } from './client';
+export { IdentityApiError } from './client';
+
+// NestJS module
+export { IdentityBootstrapModule } from './nestjs';
+export { IdentityBootstrapService } from './nestjs';
+export { IDENTITY_BOOTSTRAP_CONFIG } from './nestjs';
+
+// Types
+export type {
+  IdentityApiClientOptions,
+  IdentityBootstrapConfig,
+  IdentityBootstrapModuleAsyncOptions,
+  RegisterServiceRequest,
+  RegisterServiceResponse,
+  ServiceCredentials,
+  ServiceType,
+  VerifyMembershipParams,
+  VerifyMembershipResponse,
+  EnsureSystemOrgRequest,
+  Organization,
+  ApiEnvelope,
+} from './types';
+```
+
+## License
+
+MIT

package/dist/client.d.ts

@@ -0,0 +1,22 @@
+import type { EnsureSystemOrgRequest, IdentityApiClientOptions, OnBehalfOfTokenRequest, OnBehalfOfTokenResponse, Organization, RegisterServiceRequest, RegisterServiceResponse, ServiceCredentials, VerifyMembershipResponse } from './types';
+export declare class IdentityApiClient {
+    private readonly baseUrl;
+    private readonly internalToken;
+    private readonly timeoutMs;
+    constructor(options: IdentityApiClientOptions);
+    registerService(request: RegisterServiceRequest): Promise<ServiceCredentials>;
+    registerServiceFull(request: RegisterServiceRequest): Promise<RegisterServiceResponse>;
+    verifyMembership(userId: string, orgId: string, realm?: string): Promise<VerifyMembershipResponse>;
+    ensureSystemOrg(request: EnsureSystemOrgRequest): Promise<Organization>;
+    getSystemOrg(name: string): Promise<Organization>;
+    listOrgIds(realm: string): Promise<string[]>;
+    mintOnBehalfOfToken(request: OnBehalfOfTokenRequest): Promise<OnBehalfOfTokenResponse>;
+    private get;
+    private post;
+    private request;
+}
+export declare class IdentityApiError extends Error {
+    readonly statusCode: number;
+    readonly responseBody?: string | undefined;
+    constructor(message: string, statusCode: number, responseBody?: string | undefined);
+}

package/dist/client.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityApiError = exports.IdentityApiClient = void 0;
+class IdentityApiClient {
+    baseUrl;
+    internalToken;
+    timeoutMs;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/$/, '');
+        this.internalToken = options.internalToken;
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+    }
+    async registerService(request) {
+        const body = {
+            serviceType: 'BACKEND',
+            ...request,
+        };
+        const response = await this.post('/internal/services/register', body);
+        return {
+            clientId: response.id,
+            clientSecret: response.clientSecret,
+            tokenEndpoint: response.tokenEndpoint,
+            roles: response.roles,
+            keycloakBaseUrl: response.keycloakBaseUrl,
+            allowedRealms: response.allowedRealms,
+            primaryRealm: response.primaryRealm,
+            internalTokenScope: response.internalTokenScope,
+        };
+    }
+    async registerServiceFull(request) {
+        const body = {
+            serviceType: 'BACKEND',
+            ...request,
+        };
+        return this.post('/internal/services/register', body);
+    }
+    async verifyMembership(userId, orgId, realm) {
+        const params = new URLSearchParams({ userId, orgId });
+        if (realm) {
+            params.set('realm', realm);
+        }
+        return this.get(`/internal/verify-membership?${params.toString()}`);
+    }
+    async ensureSystemOrg(request) {
+        return this.post('/internal/organizations/ensure-system', request);
+    }
+    async getSystemOrg(name) {
+        return this.get(`/internal/organizations/system?name=${encodeURIComponent(name)}`);
+    }
+    async listOrgIds(realm) {
+        return this.get(`/internal/organizations/all-ids?realm=${encodeURIComponent(realm)}`);
+    }
+    async mintOnBehalfOfToken(request) {
+        return this.post('/internal/tokens/on-behalf-of', request);
+    }
+    async get(path) {
+        const response = await this.request('GET', path);
+        const envelope = (await response.json());
+        return envelope.data;
+    }
+    async post(path, body) {
+        const response = await this.request('POST', path, body);
+        const envelope = (await response.json());
+        return envelope.data;
+    }
+    async request(method, path, body) {
+        const url = `${this.baseUrl}${path}`;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await fetch(url, {
+                method,
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${this.internalToken}`,
+                },
+                body: body ? JSON.stringify(body) : undefined,
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw new IdentityApiError(`identity-api ${method} ${path} failed: ${response.status} ${response.statusText}`, response.status, text);
+            }
+            return response;
+        }
+        catch (error) {
+            if (error instanceof IdentityApiError)
+                throw error;
+            if (error.name === 'AbortError') {
+                throw new IdentityApiError(`identity-api ${method} ${path} timed out after ${this.timeoutMs}ms`, 0);
+            }
+            throw new IdentityApiError(`identity-api ${method} ${path} failed: ${error instanceof Error ? error.message : String(error)}`, 0);
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+exports.IdentityApiClient = IdentityApiClient;
+class IdentityApiError extends Error {
+    statusCode;
+    responseBody;
+    constructor(message, statusCode, responseBody) {
+        super(message);
+        this.statusCode = statusCode;
+        this.responseBody = responseBody;
+        this.name = 'IdentityApiError';
+    }
+}
+exports.IdentityApiError = IdentityApiError;
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AA2BA,MAAa,iBAAiB;IACX,OAAO,CAAS;IAChB,aAAa,CAAS;IACtB,SAAS,CAAS;IAEnC,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC/C,CAAC;IASD,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,MAAM,IAAI,GAA2B;YACnC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAC9B,6BAA6B,EAC7B,IAAI,CACL,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;SAChD,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,OAA+B;QAE/B,MAAM,IAAI,GAA2B;YACnC,WAAW,EAAE,SAAS;YACtB,GAAG,OAAO;SACX,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CACd,6BAA6B,EAC7B,IAAI,CACL,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,KAAa,EACb,KAAc;QAEd,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CACb,+BAA+B,MAAM,CAAC,QAAQ,EAAE,EAAE,CACnD,CAAC;IACJ,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,uCAAuC,EACvC,OAAO,CACR,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,OAAO,IAAI,CAAC,GAAG,CACb,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,GAAG,CACb,yCAAyC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;IAUD,KAAK,CAAC,mBAAmB,CACvB,OAA+B;QAE/B,OAAO,IAAI,CAAC,IAAI,CACd,+BAA+B,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAIO,KAAK,CAAC,GAAG,CAAI,IAAY;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmB,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,aAAa,EAAE;iBAC9C;gBACD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,EAClF,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,IAAK,KAAe,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3C,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,oBAAoB,IAAI,CAAC,SAAS,IAAI,EACpE,CAAC,CACF,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,gBAAgB,MAAM,IAAI,IAAI,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClG,CAAC,CACF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAlMD,8CAkMC;AAGD,MAAa,gBAAiB,SAAQ,KAAK;IAGvB;IACA;IAHlB,YACE,OAAe,EACC,UAAkB,EAClB,YAAqB;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,eAAU,GAAV,UAAU,CAAQ;QAClB,iBAAY,GAAZ,YAAY,CAAS;QAGrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AATD,4CASC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { IdentityApiClient, IdentityApiError } from './client';
+export { OrgRole, ORG_ADMIN_ROLES, } from './types';
+export type { ApiEnvelope, EnsureSystemOrgRequest, IdentityApiClientOptions, Organization, RegisterServiceRequest, RegisterServiceResponse, ServiceCredentials, ServiceType, VerifyMembershipParams, VerifyMembershipResponse, } from './types';
+export { IdentityBootstrapModule, IdentityBootstrapModuleAsyncOptions, IdentityBootstrapService, IdentityBootstrapConfig, IDENTITY_BOOTSTRAP_CONFIG, } from './nestjs';
+export { OrgAuthModule, OrgAdminGuard, ORG_AUTH_CONFIG, type OrgAuthConfig, type OrgAuthModuleAsyncOptions, } from './nestjs';

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_AUTH_CONFIG = exports.OrgAdminGuard = exports.OrgAuthModule = exports.IDENTITY_BOOTSTRAP_CONFIG = exports.IdentityBootstrapService = exports.IdentityBootstrapModule = exports.ORG_ADMIN_ROLES = exports.OrgRole = exports.IdentityApiError = exports.IdentityApiClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "IdentityApiClient", { enumerable: true, get: function () { return client_1.IdentityApiClient; } });
+Object.defineProperty(exports, "IdentityApiError", { enumerable: true, get: function () { return client_1.IdentityApiError; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "OrgRole", { enumerable: true, get: function () { return types_1.OrgRole; } });
+Object.defineProperty(exports, "ORG_ADMIN_ROLES", { enumerable: true, get: function () { return types_1.ORG_ADMIN_ROLES; } });
+var nestjs_1 = require("./nestjs");
+Object.defineProperty(exports, "IdentityBootstrapModule", { enumerable: true, get: function () { return nestjs_1.IdentityBootstrapModule; } });
+Object.defineProperty(exports, "IdentityBootstrapService", { enumerable: true, get: function () { return nestjs_1.IdentityBootstrapService; } });
+Object.defineProperty(exports, "IDENTITY_BOOTSTRAP_CONFIG", { enumerable: true, get: function () { return nestjs_1.IDENTITY_BOOTSTRAP_CONFIG; } });
+var nestjs_2 = require("./nestjs");
+Object.defineProperty(exports, "OrgAuthModule", { enumerable: true, get: function () { return nestjs_2.OrgAuthModule; } });
+Object.defineProperty(exports, "OrgAdminGuard", { enumerable: true, get: function () { return nestjs_2.OrgAdminGuard; } });
+Object.defineProperty(exports, "ORG_AUTH_CONFIG", { enumerable: true, get: function () { return nestjs_2.ORG_AUTH_CONFIG; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mCAA+D;AAAtD,2GAAA,iBAAiB,OAAA;AAAE,0GAAA,gBAAgB,OAAA;AAC5C,iCAGiB;AAFf,gGAAA,OAAO,OAAA;AACP,wGAAA,eAAe,OAAA;AAgBjB,mCAMkB;AALhB,iHAAA,uBAAuB,OAAA;AAEvB,kHAAA,wBAAwB,OAAA;AAExB,mHAAA,yBAAyB,OAAA;AAI3B,mCAMkB;AALhB,uGAAA,aAAa,OAAA;AACb,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA"}

package/dist/nestjs/identity-bootstrap.module.d.ts

@@ -0,0 +1,13 @@
+import { DynamicModule, Type, ForwardReference, InjectionToken } from '@nestjs/common';
+import { IdentityBootstrapConfig } from './identity-bootstrap.service';
+type ModuleImport = Type<unknown> | ForwardReference<unknown> | DynamicModule | Promise<DynamicModule>;
+export interface IdentityBootstrapModuleAsyncOptions {
+    imports?: ModuleImport[];
+    useFactory: (...args: any[]) => Promise<IdentityBootstrapConfig> | IdentityBootstrapConfig;
+    inject?: InjectionToken[];
+}
+export declare class IdentityBootstrapModule {
+    static forRoot(config: IdentityBootstrapConfig): DynamicModule;
+    static forRootAsync(options: IdentityBootstrapModuleAsyncOptions): DynamicModule;
+}
+export {};

package/dist/nestjs/identity-bootstrap.module.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var IdentityBootstrapModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityBootstrapModule = void 0;
+const common_1 = require("@nestjs/common");
+const identity_bootstrap_service_1 = require("./identity-bootstrap.service");
+let IdentityBootstrapModule = IdentityBootstrapModule_1 = class IdentityBootstrapModule {
+    static forRoot(config) {
+        const configProvider = {
+            provide: identity_bootstrap_service_1.IDENTITY_BOOTSTRAP_CONFIG,
+            useValue: config,
+        };
+        return {
+            module: IdentityBootstrapModule_1,
+            global: true,
+            providers: [configProvider, identity_bootstrap_service_1.IdentityBootstrapService],
+            exports: [identity_bootstrap_service_1.IdentityBootstrapService],
+        };
+    }
+    static forRootAsync(options) {
+        const configProvider = {
+            provide: identity_bootstrap_service_1.IDENTITY_BOOTSTRAP_CONFIG,
+            useFactory: options.useFactory,
+            inject: options.inject || [],
+        };
+        return {
+            module: IdentityBootstrapModule_1,
+            global: true,
+            imports: options.imports || [],
+            providers: [configProvider, identity_bootstrap_service_1.IdentityBootstrapService],
+            exports: [identity_bootstrap_service_1.IdentityBootstrapService],
+        };
+    }
+};
+exports.IdentityBootstrapModule = IdentityBootstrapModule;
+exports.IdentityBootstrapModule = IdentityBootstrapModule = IdentityBootstrapModule_1 = __decorate([
+    (0, common_1.Module)({})
+], IdentityBootstrapModule);
+//# sourceMappingURL=identity-bootstrap.module.js.map

package/dist/nestjs/identity-bootstrap.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-bootstrap.module.js","sourceRoot":"","sources":["../../src/nestjs/identity-bootstrap.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AACxB,6EAIsC;AA+D/B,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAIlC,MAAM,CAAC,OAAO,CAAC,MAA+B;QAC5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,sDAAyB;YAClC,QAAQ,EAAE,MAAM;SACjB,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,cAAc,EAAE,qDAAwB,CAAC;YACrD,OAAO,EAAE,CAAC,qDAAwB,CAAC;SACpC,CAAC;IACJ,CAAC;IAKD,MAAM,CAAC,YAAY,CACjB,OAA4C;QAE5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,sDAAyB;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS,EAAE,CAAC,cAAc,EAAE,qDAAwB,CAAC;YACrD,OAAO,EAAE,CAAC,qDAAwB,CAAC;SACpC,CAAC;IACJ,CAAC;CACF,CAAA;AAtCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAsCnC"}

package/dist/nestjs/identity-bootstrap.service.d.ts

@@ -0,0 +1,76 @@
+import { OnModuleInit, OnModuleDestroy } from '@nestjs/common';
+export declare const IDENTITY_BOOTSTRAP_CONFIG: unique symbol;
+export interface IdentityBootstrapConfig {
+    identityApiUrl: string;
+    identityApiInternalToken: string;
+    serviceName: string;
+    serviceDisplayName: string;
+    serviceDescription?: string;
+    keycloakUrl?: string;
+    keycloakRealm?: string;
+    clientId?: string;
+    clientSecret?: string;
+    tokenEndpoint?: string;
+    maxRegistrationAttempts?: number;
+    baseRetryDelay?: number;
+    maxRetryDelay?: number;
+}
+export declare class IdentityBootstrapService implements OnModuleInit, OnModuleDestroy {
+    private readonly config;
+    private readonly logger;
+    private readonly client;
+    private clientId;
+    private clientSecret;
+    private tokenEndpoint;
+    private keycloakBaseUrl;
+    private allowedRealms;
+    private primaryRealm;
+    private registrationTokenScope;
+    private accessToken;
+    private tokenExpiresAt;
+    private tokenRefreshPromise;
+    private lastCredentialFetchAt;
+    private static readonly RECOVERY_DEBOUNCE_MS;
+    private static readonly DISTRIBUTED_RECOVERY_DEBOUNCE_MS;
+    private readonly userTokenCache;
+    private readonly userTokenInflight;
+    private registrationStarted;
+    private registrationAttempts;
+    private registrationTimer;
+    private readonly maxRegistrationAttempts;
+    private readonly baseRetryDelay;
+    private readonly maxRetryDelay;
+    private readyResolve;
+    private readonly readyPromise;
+    private isReady;
+    constructor(config: IdentityBootstrapConfig);
+    onModuleInit(): Promise<void>;
+    onModuleDestroy(): void;
+    getAccessToken(): Promise<string>;
+    getUserAccessToken(params: {
+        userId: string;
+        orgId: string;
+        realm?: string;
+        audience?: string;
+    }): Promise<string>;
+    private mintUserAccessToken;
+    waitForReady(timeoutMs?: number): Promise<boolean>;
+    hasCredentials(): boolean;
+    getClientId(): string | null;
+    getKeycloakBaseUrl(): string | null;
+    getAllowedRealms(): string[];
+    isMember(orgId: string, userId: string, realm?: string): Promise<boolean>;
+    listOrgIds(): Promise<string[]>;
+    private startBackgroundRegistration;
+    private attemptRegistration;
+    private requireRegistrationMetadata;
+    private resolveUserTokenRealm;
+    private scheduleRetry;
+    private clientSecretWasSelfRegistered;
+    private refreshToken;
+    private refreshTokenWithRecovery;
+    private fetchCurrentCredentials;
+    private checkCredentialRecoveryState;
+    private recordCredentialRecovery;
+    private resolveReady;
+}