@xemahq/platform-common 0.13.0 → 0.14.0

package/dist/nestjs/jwt-verification.guard.js

@@ -18,30 +18,16 @@ const common_1 = require("@nestjs/common");
 const decorator_metadata_1 = require("./decorator-metadata");
 const public_decorator_1 = require("./public.decorator");
 const auth_module_options_1 = require("./auth/auth-module-options");
-const idp_tenant_resolver_1 = require("./auth/idp-tenant-resolver");
 const request_context_1 = require("../lib/request-context");
 const oidc_guard_1 = require("@xemahq/oidc-guard");
+const realm_token_verifier_1 = require("./auth/realm-token-verifier");
 const PUBLIC_PATH_PREFIXES = ['/health', '/api/docs', '/api/openapi.json'];
 const PUBLIC_WEBHOOK_PREFIX = '/webhooks';
-let JwtVerificationGuard = class JwtVerificationGuard {
-    static { JwtVerificationGuard_1 = this; }
-    authOptions;
+let JwtVerificationGuard = JwtVerificationGuard_1 = class JwtVerificationGuard {
     logger = new common_1.Logger(JwtVerificationGuard_1.name);
-    jwks = new oidc_guard_1.JwksVerifier(600_000);
-    issuerMetadata = new oidc_guard_1.IssuerMetadataResolver();
-    tenantResolver;
-    oidcVerifier;
-    static SINGLE_REALM_CACHE_KEY = '__single__';
-    multiRealmConfig = null;
-    resolvingConfig = null;
+    verifier;
     constructor(authOptions) {
-        this.authOptions = authOptions;
-        this.tenantResolver = (0, idp_tenant_resolver_1.selectTenantResolver)(process.env.IDP_KIND);
-        this.oidcVerifier = new oidc_guard_1.OidcTokenVerifier({
-            jwks: this.jwks,
-            issuerMetadata: this.issuerMetadata,
-            tenantResolver: this.tenantResolver,
-        });
+        this.verifier = new realm_token_verifier_1.RealmTokenVerifier(authOptions);
     }
     async canActivate(context) {
         const isPublic = (0, decorator_metadata_1.readDecoratorOverride)(public_decorator_1.IS_PUBLIC_KEY, [
@@ -73,69 +59,8 @@ let JwtVerificationGuard = class JwtVerificationGuard {
         }
     }
     async verifyToken(token) {
-        const { payload } = this.decodeOrThrow(token);
-        const multiRealm = await this.resolveMultiRealmConfig();
-        if (multiRealm) {
-            await this.verifyMultiRealm(token, multiRealm);
-        }
-        else {
-            await this.verifySingleRealm(token, payload);
-        }
-        return payload;
-    }
-    decodeOrThrow(token) {
-        try {
-            return this.jwks.decode(token);
-        }
-        catch (error) {
-            if (error instanceof oidc_guard_1.JwksVerificationError) {
-                throw new common_1.UnauthorizedException(error.message);
-            }
-            throw error;
-        }
-    }
-    async verifyMultiRealm(token, config) {
-        try {
-            await this.oidcVerifier.verify(token, {
-                discoveryBaseUrls: config.discoveryBaseUrls,
-                allowedRealms: config.allowedRealms,
-                expectedIssuers: this.configuredIssuers(),
-            });
-        }
-        catch (error) {
-            if (error instanceof oidc_guard_1.JwksVerificationError) {
-                throw new common_1.UnauthorizedException(error.message);
-            }
-            throw error;
-        }
-    }
-    async verifySingleRealm(token, payload) {
-        const expectedIssuer = this.authOptions?.issuer;
-        if (expectedIssuer) {
-            if (!payload.iss) {
-                throw new common_1.UnauthorizedException('Token missing required issuer claim');
-            }
-            const allowedIssuers = this.configuredIssuers();
-            const tenants = [
-                ...new Set(allowedIssuers
-                    .map((iss) => this.tenantResolver.tenantFromIssuer(iss))
-                    .filter((tenant) => tenant !== null)),
-            ];
-            const issuerMatched = allowedIssuers.includes(payload.iss) ||
-                tenants.some((tenant) => this.tenantResolver.issuerBelongsToTenant(payload.iss, tenant));
-            if (!issuerMatched) {
-                throw new common_1.UnauthorizedException('Invalid token issuer');
-            }
-        }
-        const jwksUrl = this.authOptions?.jwksUrl;
-        if (!jwksUrl) {
-            throw new Error('AuthModule jwksUrl is not configured');
-        }
         try {
-            await this.jwks.verify(token, {
-                cacheKey: JwtVerificationGuard_1.SINGLE_REALM_CACHE_KEY,
-                jwksUrl,
-            });
+            return await this.verifier.verify(token);
         }
         catch (error) {
             if (error instanceof oidc_guard_1.JwksVerificationError) {
@@ -144,78 +69,10 @@ let JwtVerificationGuard = class JwtVerificationGuard {
             throw error;
         }
     }
-    configuredIssuers() {
-        const raw = this.authOptions?.issuer;
-        if (!raw)
-            return [];
-        return raw
-            .split(',')
-            .map((s) => s.trim())
-            .filter((s) => s.length > 0);
-    }
-    async resolveMultiRealmConfig() {
-        if (this.multiRealmConfig)
-            return this.multiRealmConfig;
-        if (this.resolvingConfig)
-            return this.resolvingConfig;
-        this.resolvingConfig = (async () => {
-            try {
-                const keycloakBaseUrl = await this.resolveKeycloakBaseUrl();
-                const allowedRealms = await this.resolveAllowedRealms();
-                if (keycloakBaseUrl && allowedRealms.length > 0) {
-                    const localBaseUrls = keycloakBaseUrl
-                        .split(',')
-                        .map((s) => s.trim().replace(/\/$/, ''));
-                    const federated = this.authOptions?.federatedRealmTrust;
-                    const discoveryBaseUrls = [
-                        ...new Set([
-                            ...localBaseUrls,
-                            ...(federated?.discoveryBaseUrls ?? []).map((s) => s.trim().replace(/\/$/, '')),
-                        ]),
-                    ];
-                    const mergedRealms = [
-                        ...new Set([...allowedRealms, ...(federated?.allowedRealms ?? [])]),
-                    ];
-                    this.multiRealmConfig = {
-                        discoveryBaseUrls,
-                        allowedRealms: mergedRealms,
-                    };
-                    this.logger.log(`Multi-realm mode enabled: realms=[${mergedRealms.join(', ')}], base URLs=[${discoveryBaseUrls.join(', ')}]` +
-                        (federated
-                            ? ` (incl. ${federated.discoveryBaseUrls.length} federated base URL(s))`
-                            : ''));
-                    return this.multiRealmConfig;
-                }
-                return null;
-            }
-            finally {
-                this.resolvingConfig = null;
-            }
-        })();
-        return this.resolvingConfig;
-    }
-    async resolveKeycloakBaseUrl() {
-        if (this.authOptions?.keycloakBaseUrl)
-            return this.authOptions.keycloakBaseUrl;
-        if (this.authOptions?.keycloakBaseUrlProvider) {
-            return (await this.authOptions.keycloakBaseUrlProvider()) ?? undefined;
-        }
-        return undefined;
-    }
-    async resolveAllowedRealms() {
-        if (this.authOptions?.allowedRealms &&
-            this.authOptions.allowedRealms.length > 0) {
-            return this.authOptions.allowedRealms;
-        }
-        if (this.authOptions?.allowedRealmsProvider) {
-            return await this.authOptions.allowedRealmsProvider();
-        }
-        return [];
-    }
     attachRealmToContext(request, payload) {
         if (!payload.iss)
             return;
-        const realmName = this.tenantResolver.tenantFromIssuer(payload.iss);
+        const realmName = this.verifier.tenantResolver.tenantFromIssuer(payload.iss);
         if (!realmName)
             return;
         const ctx = request[request_context_1.REQUEST_CONTEXT];

package/dist/nestjs/jwt-verification.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,oEAAkE;AAClE,4DAAyD;AAEzD,mDAK4B;AAc5B,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC;AA8BnC,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;;IAiDZ;IAhDF,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAQ/C,IAAI,GAAG,IAAI,yBAAY,CAAC,OAAO,CAAC,CAAC;IAMjC,cAAc,GAAG,IAAI,mCAAsB,EAAE,CAAC;IAQ9C,cAAc,CAAuB;IAOrC,YAAY,CAAoB;IAGzC,MAAM,CAAU,sBAAsB,GAAG,YAAY,CAAC;IAGtD,gBAAgB,GAGb,IAAI,CAAC;IAER,eAAe,GAGJ,IAAI,CAAC;IAExB,YAGmB,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;QAKhD,IAAI,CAAC,cAAc,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,IAAI,8BAAiB,CAAC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,gCAAa,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAG7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAG9C,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB;gBAAE,MAAM,KAAK,CAAC;YAExD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAE9C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAExD,IAAI,UAAU,EAAE,CAAC;YAEf,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YAEN,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAOO,aAAa,CAAC,KAAa;QAIjC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAWO,KAAK,CAAC,gBAAgB,CAC5B,KAAa,EACb,MAAgE;QAEhE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE;gBACpC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,aAAa,EAAE,MAAM,CAAC,aAAa;gBAKnC,eAAe,EAAE,IAAI,CAAC,iBAAiB,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,KAAa,EACb,OAAmB;QAGnB,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QAChD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjB,MAAM,IAAI,8BAAqB,CAAC,qCAAqC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAKhD,MAAM,OAAO,GAAG;gBACd,GAAG,IAAI,GAAG,CACR,cAAc;qBACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;qBACvD,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CACzD;aACF,CAAC;YACF,MAAM,aAAa,GACjB,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACtB,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAI,EAAE,MAAM,CAAC,CAChE,CAAC;YACJ,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAGD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC5B,QAAQ,EAAE,sBAAoB,CAAC,sBAAsB;gBACrD,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAGO,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG;aACP,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAIO,KAAK,CAAC,uBAAuB;QAKnC,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QAGxD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QAEtD,IAAI,CAAC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAExD,IAAI,eAAe,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAKhD,MAAM,aAAa,GAAG,eAAe;yBAClC,KAAK,CAAC,GAAG,CAAC;yBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;oBAM3C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC;oBACxD,MAAM,iBAAiB,GAAG;wBACxB,GAAG,IAAI,GAAG,CAAC;4BACT,GAAG,aAAa;4BAChB,GAAG,CAAC,SAAS,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChD,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC5B;yBACF,CAAC;qBACH,CAAC;oBACF,MAAM,YAAY,GAAG;wBACnB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;qBACpE,CAAC;oBAEF,IAAI,CAAC,gBAAgB,GAAG;wBACtB,iBAAiB;wBACjB,aAAa,EAAE,YAAY;qBAC5B,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qCAAqC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAC1G,CAAC,SAAS;4BACR,CAAC,CAAC,WAAW,SAAS,CAAC,iBAAiB,CAAC,MAAM,yBAAyB;4BACxE,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;oBACF,OAAO,IAAI,CAAC,gBAAgB,CAAC;gBAC/B,CAAC;gBAKD,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe;YACnC,OAAO,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,uBAAuB,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,EAAE,CAAC,IAAI,SAAS,CAAC;QACzE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IACE,IAAI,CAAC,WAAW,EAAE,aAAa;YAC/B,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EACzC,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,qBAAqB,EAAE,CAAC;YAC5C,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAIO,oBAAoB,CAAC,OAAgB,EAAE,OAAmB;QAChE,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,CAAC,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AAzVU,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAgDR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GAhDnB,oBAAoB,CA0VhC"}
+{"version":3,"file":"jwt-verification.guard.js","sourceRoot":"","sources":["../../src/nestjs/jwt-verification.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6DAA6D;AAE7D,yDAAmD;AACnD,oEAAiE;AAEjE,4DAAyD;AAEzD,mDAA2D;AAE3D,sEAAiE;AAQjE,MAAM,oBAAoB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAC3E,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAiCnC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACd,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAU/C,QAAQ,CAAqB;IAE9C,YAGE,WAA+B;QAE/B,IAAI,CAAC,QAAQ,GAAG,IAAI,yCAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAU,gCAAa,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAG7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAG9C,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAAqB;gBAAE,MAAM,KAAK,CAAC;YAExD,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAUO,KAAK,CAAC,WAAW,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,kCAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,8BAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAIO,oBAAoB,CAAC,OAAgB,EAAE,OAAmB;QAChE,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAChC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;QACD,IACE,IAAI,KAAK,qBAAqB;YAC9B,IAAI,CAAC,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,EAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AA3GY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAeR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,yCAAmB,CAAC,CAAA;;GAfnB,oBAAoB,CA2GhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/platform-common",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Shared NestJS building blocks for Xema services — auth guards, response redaction, CORS configuration, and crypto helpers.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -62,7 +62,7 @@
     "rxjs": "7.8.2",
     "ts-jest": "^29.4.9",
     "typescript": "5.9.3",
-    "@xemahq/kernel-contracts": "^17.0.0"
+    "@xemahq/kernel-contracts": "^17.1.0"
   },
   "exports": {
     ".": {