@xeno-js/core 0.1.5 → 0.1.6

package/dist/index.cjs

@@ -1509,15 +1509,15 @@ var init_logger_utils = __esm({
        */
       async addLogger(container, opts) {
         const loggerDependencies = [];
-        const { Guards: Guards46, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards46.isDefined(opts) || opts.console) {
+        const { Guards: Guards47, LOG_LEVEL: LOG_LEVEL7, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards47.isDefined(opts) || opts.console) {
           const { ConsoleLogger: ConsoleLogger2 } = await Promise.resolve().then(() => (init_console_logger(), console_logger_exports));
           container.addSingleton(TOKENS4.CONSOLE_LOGGER, () => new ConsoleLogger2(opts?.level));
           loggerDependencies.push(TOKENS4.CONSOLE_LOGGER);
         }
         const customLoggerFactories = [];
-        if (Guards46.isDefined(opts)) {
-          if (Guards46.isDefined(opts.sentry.config)) {
+        if (Guards47.isDefined(opts)) {
+          if (Guards47.isDefined(opts.sentry.config)) {
             const { SentryLoggerFactory: SentryLoggerFactory2 } = await Promise.resolve().then(() => (init_sentry_logger_factory(), sentry_logger_factory_exports));
             container.addSingleton(TOKENS4.SENTRY_LOGGER, () => {
               const factory = new SentryLoggerFactory2();
@@ -1525,7 +1525,7 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.SENTRY_LOGGER);
           }
-          if (Guards46.isDefined(opts.pino.config)) {
+          if (Guards47.isDefined(opts.pino.config)) {
             const { PinoLoggerFactory: PinoLoggerFactory2 } = await Promise.resolve().then(() => (init_pino_logger_factory(), pino_logger_factory_exports));
             container.addSingleton(TOKENS4.PINO_LOGGER, () => {
               const factory = new PinoLoggerFactory2();
@@ -1533,10 +1533,10 @@ var init_logger_utils = __esm({
             });
             loggerDependencies.push(TOKENS4.PINO_LOGGER);
           }
-          if (!Guards46.isNullOrEmpty(opts.customLoggers)) {
+          if (!Guards47.isNullOrEmpty(opts.customLoggers)) {
             const customLoggers = opts.customLoggers;
             customLoggers.forEach((f) => {
-              if (Guards46.isDefined(f)) {
+              if (Guards47.isDefined(f)) {
                 customLoggerFactories.push(f);
               }
             });
@@ -1709,8 +1709,8 @@ var init_cache_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addCache(container, opts) {
-        const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!opts.inMemory && !Guards46.isDefined(opts.redis)) {
+        const { Guards: Guards47, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!opts.inMemory && !Guards47.isDefined(opts.redis)) {
           throw new Error(
             "No cache strategies are configured. Please provide at least one cache strategy."
           );
@@ -1720,12 +1720,12 @@ var init_cache_utils = __esm({
           TOKENS4.CACHE_KEY_BUILDER,
           (c) => new CacheKeyBuilder(c.resolve(TOKENS4.IDENTITY_ACCESSOR))
         );
-        if (opts.inMemory || !Guards46.isDefined(opts.redis)) {
+        if (opts.inMemory || !Guards47.isDefined(opts.redis)) {
           const { InMemoryCacheExtended: InMemoryCacheExtended2 } = await Promise.resolve().then(() => (init_inmemory_cache(), inmemory_cache_exports));
           container.addSingleton(TOKENS4.CACHE, () => new InMemoryCacheExtended2());
           return;
         }
-        if (Guards46.isDefined(opts.redis)) {
+        if (Guards47.isDefined(opts.redis)) {
           const { RedisCacheFactory: RedisCacheFactory2 } = await Promise.resolve().then(() => (init_redis_cache_factory(), redis_cache_factory_exports));
           container.addSingleton(TOKENS4.CACHE, () => {
             const config = opts.redis;
@@ -1764,6 +1764,17 @@ var init_allow_method_service = __esm({
         }
         return false;
       }
+      getMethods(path) {
+        const cleanPath = this.normalizePath(path.split("?")[0].split("#")[0]);
+        const methods = this.findMethods(cleanPath);
+        return import_shared42.Guards.isDefined(methods) ? methods.join(", ").toUpperCase() : "";
+      }
+      findMethods(cleanPath) {
+        const staticMethods = this._staticRoutes.get(cleanPath);
+        if (import_shared42.Guards.isDefined(staticMethods)) return staticMethods;
+        for (const route of this._dynamicRoutes) if (route.pattern.test(cleanPath)) return route.methods;
+        return void 0;
+      }
       isDynamicPath(path) {
         return path.includes(":") || path.includes("{") && path.includes("}");
       }
@@ -2768,8 +2779,8 @@ var init_auth_utils = __esm({
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const pipelines = [];
         const strategies = [];
-        const { Guards: Guards46 } = await import("@xeno-js/shared");
-        if (Guards46.isDefined(opts.policies)) {
+        const { Guards: Guards47 } = await import("@xeno-js/shared");
+        if (Guards47.isDefined(opts.policies)) {
           const { PolicyRegistry: PolicyRegistry2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.POLICY_REGISTRY, () => new PolicyRegistry2());
           const policyRegistry = opts.policies;
@@ -2778,16 +2789,16 @@ var init_auth_utils = __esm({
           for (const [intent, policy] of Object.entries(policyRegistry)) {
             const intentLower = intent.toLowerCase();
             registryInstance.addPolicy(intentLower, policy);
-            if (!Guards46.isNullOrEmpty(policy.roles)) {
+            if (!Guards47.isNullOrEmpty(policy.roles)) {
               Policies.add("roles");
             }
-            if (!Guards46.isNullOrEmpty(policy.permissions)) {
+            if (!Guards47.isNullOrEmpty(policy.permissions)) {
               Policies.add("permissions");
             }
-            if (!Guards46.isNullOrEmpty(policy.userId)) {
+            if (!Guards47.isNullOrEmpty(policy.userId)) {
               Policies.add("userId");
             }
-            if (!Guards46.isNullOrEmpty(policy.tenantId)) {
+            if (!Guards47.isNullOrEmpty(policy.tenantId)) {
               Policies.add("tenantId");
             }
           }
@@ -2836,10 +2847,10 @@ var init_auth_utils = __esm({
             strategies.push(TOKENS4.TENANT_AUTHORIZATION_PIPELINE);
           }
         }
-        if (!Guards46.isNullOrEmpty(opts.customAuthorizationStrategy)) {
+        if (!Guards47.isNullOrEmpty(opts.customAuthorizationStrategy)) {
           const customStrategies = opts.customAuthorizationStrategy;
           customStrategies.forEach((strategyToken, index) => {
-            if (Guards46.isDefined(strategyToken)) {
+            if (Guards47.isDefined(strategyToken)) {
               const token = `CUSTOM_AUTHORIZATION_STRATEGY_${index}`;
               container.addSingleton(token, (c) => {
                 return strategyToken(c);
@@ -3042,7 +3053,7 @@ var init_db_module = __esm({
     "use strict";
     DbModule = class {
       async configure(container, opts) {
-        const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        const { Guards: Guards47, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { DbUtils: DbUtils2 } = await Promise.resolve().then(() => (init_db_utils(), db_utils_exports));
         const db = opts.enableSqlLite ? await DbUtils2.addSqlLite(opts) : await DbUtils2.addDbClient(opts);
         const { TransactionState: TransactionState2 } = await Promise.resolve().then(() => (init_transaction_state(), transaction_state_exports));
@@ -3059,7 +3070,7 @@ var init_db_module = __esm({
           return new Proxy(db, {
             get(_target, prop, receiver) {
               const activeState = ttx.state;
-              if (Guards46.isDefined(activeState)) {
+              if (Guards47.isDefined(activeState)) {
                 if (prop === "transaction") {
                   return activeState.transaction.bind(activeState);
                 }
@@ -3096,14 +3107,14 @@ var init_http_utils = __esm({
        */
       async addAxios(container, opts) {
         const { NodeAxiosFactory: NodeAxiosFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
-        const { Guards: Guards46 } = await import("@xeno-js/shared");
-        if (!Guards46.isDefined(opts.token)) {
+        const { Guards: Guards47 } = await import("@xeno-js/shared");
+        if (!Guards47.isDefined(opts.token)) {
           throw new Error("HttpConfig.token is required and must be defined.");
         }
         container.addSingleton(opts.token, () => {
           const factory = new NodeAxiosFactory2();
           const instance = factory.create(opts.client);
-          if (!Guards46.hasMethod(instance, "get") || !Guards46.hasMethod(instance, "post") || !Guards46.hasMethod(instance, "put") || !Guards46.hasMethod(instance, "patch") || !Guards46.hasMethod(instance, "delete")) {
+          if (!Guards47.hasMethod(instance, "get") || !Guards47.hasMethod(instance, "post") || !Guards47.hasMethod(instance, "put") || !Guards47.hasMethod(instance, "patch") || !Guards47.hasMethod(instance, "delete")) {
             throw new Error(
               "The created HTTP client instance does not implement the required methods of IHttpClient."
             );
@@ -3130,8 +3141,8 @@ var init_http_utils = __esm({
         });
       },
       async addAllowOrigin(container, opts) {
-        const { Guards: Guards46 } = await import("@xeno-js/shared");
-        if (Guards46.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
+        const { Guards: Guards47 } = await import("@xeno-js/shared");
+        if (Guards47.isNullOrEmpty(opts)) throw new Error("At least an allow origin must be passed");
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         const allowOrigin = [];
@@ -3191,13 +3202,13 @@ var init_validation_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js
        */
       async addValidation(container, opts, logger) {
-        const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (!Guards46.isDefined(opts.zod) && Guards46.isNullOrEmpty(opts.customValidationStrategy)) {
+        const { Guards: Guards47, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (!Guards47.isDefined(opts.zod) && Guards47.isNullOrEmpty(opts.customValidationStrategy)) {
           return [];
         }
         const pipelines = [];
         const validationStrategies = [];
-        if (Guards46.isDefined(opts.zod)) {
+        if (Guards47.isDefined(opts.zod)) {
           const config = opts.zod;
           const { ZodValidatorFactory: ZodValidatorFactory2 } = await Promise.resolve().then(() => (init_zod_validator_factory(), zod_validator_factory_exports));
           container.addSingleton(TOKENS4.ZOD_VALIDATOR, () => {
@@ -3211,9 +3222,9 @@ var init_validation_utils = __esm({
           validationStrategies.push(TOKENS4.SCHEMA_VALIDATION_STRATEGY);
         }
         const customValidationFactory = [];
-        if (!Guards46.isNullOrEmpty(opts.customValidationStrategy)) {
+        if (!Guards47.isNullOrEmpty(opts.customValidationStrategy)) {
           for (const strategyToken of opts.customValidationStrategy) {
-            if (Guards46.isDefined(strategyToken)) {
+            if (Guards47.isDefined(strategyToken)) {
               customValidationFactory.push(strategyToken);
             }
           }
@@ -3316,8 +3327,8 @@ var init_pipeline_utils = __esm({
        */
       async addCommand(container, opts) {
         const pipelines = [];
-        const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        if (Guards46.isDefined(opts.idempotency)) {
+        const { Guards: Guards47, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (Guards47.isDefined(opts.idempotency)) {
           const { IdempotencyStore: IdempotencyStore2 } = await Promise.resolve().then(() => (init_idempotency_store(), idempotency_store_exports));
           container.addSingleton(
             TOKENS4.IDEMPOTENCY_STORE,
@@ -3337,7 +3348,7 @@ var init_pipeline_utils = __esm({
           });
           pipelines.push(TOKENS4.IDEMPOTENCY_PIPELINE);
         }
-        if (Guards46.isDefined(opts.concurrency)) {
+        if (Guards47.isDefined(opts.concurrency)) {
           const { ConcurrencyRetryPipeline: ConcurrencyRetryPipeline2 } = await Promise.resolve().then(() => (init_application(), application_exports));
           container.addSingleton(TOKENS4.CONCURRENCY_RETRY_PIPELINE, () => {
             const config = opts.concurrency;
@@ -3417,13 +3428,13 @@ var init_cqrs_module = __esm({
           return new PerformancePipeline2(logger, thresholdMs);
         });
         pipelines.push(TOKENS4.PERFORMANCE_PIPELINE);
-        const { Guards: Guards46 } = await import("@xeno-js/shared");
-        if (Guards46.isDefined(opts.authorization.policies) || Guards46.isDefined(opts.authorization.customAuthorizationStrategy)) {
+        const { Guards: Guards47 } = await import("@xeno-js/shared");
+        if (Guards47.isDefined(opts.authorization.policies) || Guards47.isDefined(opts.authorization.customAuthorizationStrategy)) {
           const { AuthUtils: AuthUtils2 } = await Promise.resolve().then(() => (init_auth_utils(), auth_utils_exports));
           const authPipelines = await AuthUtils2.addAuthZ(container, opts.authorization);
           pipelines.push(...authPipelines);
         }
-        if (Guards46.isDefined(opts.validation.zod) || Guards46.isDefined(opts.validation.customValidationStrategy)) {
+        if (Guards47.isDefined(opts.validation.zod) || Guards47.isDefined(opts.validation.customValidationStrategy)) {
           const { ValidationUtils: ValidationUtils2 } = await Promise.resolve().then(() => (init_validation_utils(), validation_utils_exports));
           const logger = container.resolve(TOKENS4.LOGGER);
           const validationPipelines = await ValidationUtils2.addValidation(
@@ -3435,11 +3446,11 @@ var init_cqrs_module = __esm({
         }
         const commandPipelines = pipelines;
         const queryPipelines = pipelines;
-        if ((Guards46.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
+        if ((Guards47.isDefined(opts.commandBus.idempotency) || opts.queryBus.isEnabled) && opts.isCache) {
           const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
           await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
         }
-        if (Guards46.isDefined(opts.commandBus.idempotency) || Guards46.isDefined(opts.commandBus.concurrency)) {
+        if (Guards47.isDefined(opts.commandBus.idempotency) || Guards47.isDefined(opts.commandBus.concurrency)) {
           const { PipelineUtils: PipelineUtils2 } = await Promise.resolve().then(() => (init_pipeline_utils(), pipeline_utils_exports));
           const newCommandPipelines = await PipelineUtils2.addCommand(container, {
             ...opts.commandBus,
@@ -3622,7 +3633,10 @@ var init_allow_method_middleware = __esm({
               spanId: tracing?.spanId ?? import_shared62.GuidHelper.generate(),
               timestamp: (/* @__PURE__ */ new Date()).toISOString()
             },
-            import_shared62.STATUS_CODES.NOT_ALLOWED
+            import_shared62.STATUS_CODES.NOT_ALLOWED,
+            {
+              Allow: this._allowMethod.getMethods(req.path)
+            }
           );
         }
         return await next();
@@ -3755,11 +3769,13 @@ var init_cors_middleware = __esm({
     "use strict";
     import_shared65 = require("@xeno-js/shared");
     CORSMiddleware = class {
-      constructor(_requestContext) {
+      constructor(_requestContext, _withCredentials = "false") {
         this._requestContext = _requestContext;
+        this._withCredentials = _withCredentials;
       }
       _requestContext;
-      async execute(req, _headers, next) {
+      _withCredentials;
+      async execute(_req, _headers, next) {
         const { network } = this._requestContext.getContext() ?? {};
         const origin = network?.origin;
         const response = await next();
@@ -3767,7 +3783,7 @@ var init_cors_middleware = __esm({
           response.headers = {
             ...response.headers ?? {},
             "Access-Control-Allow-Origin": origin,
-            "Access-Control-Allow-Credentials": "true",
+            "Access-Control-Allow-Credentials": this._withCredentials,
             "Vary": "Origin"
           };
         return response;
@@ -3911,10 +3927,16 @@ var init_options_middleware = __esm({
     "use strict";
     import_shared68 = require("@xeno-js/shared");
     OptionsMiddleware = class {
-      constructor(_requestContext) {
+      constructor(_requestContext, _alloewMethod, _allowHeaders = [], _withCredentials = "false") {
         this._requestContext = _requestContext;
+        this._alloewMethod = _alloewMethod;
+        this._allowHeaders = _allowHeaders;
+        this._withCredentials = _withCredentials;
       }
       _requestContext;
+      _alloewMethod;
+      _allowHeaders;
+      _withCredentials;
       async execute(req, _headers, next) {
         if (req.method.toUpperCase() === "OPTIONS") {
           const network = this._requestContext.getNetworkContext();
@@ -3922,11 +3944,11 @@ var init_options_middleware = __esm({
           const headers = {};
           if (import_shared68.Guards.isDefined(origin)) {
             headers["Access-Control-Allow-Origin"] = origin;
-            headers["Access-Control-Allow-Credentials"] = "true";
+            headers["Access-Control-Allow-Credentials"] = this._withCredentials;
             headers["Vary"] = "Origin";
           }
-          headers["Access-Control-Allow-Methods"] = "POST,GET,PUT,PATCH,DELETE,OPTIONS";
-          headers["Access-Control-Allow-Headers"] = "X-CSRF-Token, Accept, Accept-Version, Content-Type, Authorization, X-Correlation-Id";
+          headers["Access-Control-Allow-Methods"] = this._alloewMethod.getMethods(req.path);
+          headers["Access-Control-Allow-Headers"] = this._allowHeaders.join(", ");
           return import_shared68.HttpHelper.success(null, import_shared68.STATUS_CODES.NO_CONTENT, {}, headers);
         }
         return await next();
@@ -3942,26 +3964,29 @@ var init_rate_limiter_middleware = __esm({
     "use strict";
     import_shared69 = require("@xeno-js/shared");
     RateLimitMiddleware = class {
-      constructor(_ctxAccessor, _cache, _logger, _opts) {
+      constructor(_ctxAccessor, _cache, _keyBuilder, _logger, _opts) {
         this._ctxAccessor = _ctxAccessor;
         this._cache = _cache;
+        this._keyBuilder = _keyBuilder;
         this._logger = _logger;
         this._opts = _opts;
       }
       _ctxAccessor;
       _cache;
+      _keyBuilder;
       _logger;
       _opts;
       async execute(req, _headers, next) {
+        const cacheKey = this._keyBuilder.buildRateLimitKey(req.path);
         const { network, tracing } = this._ctxAccessor.getContext() ?? {};
-        if (!import_shared69.Guards.isDefined(network?.clientIp))
+        if (!import_shared69.Guards.isDefined(cacheKey))
           return import_shared69.HttpHelper.error(
             {
               success: false,
               error: {
                 code: import_shared69.ERROR_CODES.SYSTEM_ERROR,
-                message: "IP undefined. Please contact the administrator.",
-                details: `IP undefined. Please contact the administrator.`,
+                message: import_shared69.ERROR_CODE_MESSAGES[import_shared69.ERROR_CODES.SYSTEM_ERROR],
+                details: `Bad Request: Unable to identify client context for rate limiting.`,
                 path: req.path
               },
               correlationId: tracing?.correlationId ?? import_shared69.GuidHelper.generate(),
@@ -3975,18 +4000,16 @@ var init_rate_limiter_middleware = __esm({
               "Retry-After": [String(this._opts.windowSeconds)]
             }
           );
-        const clientIp = network?.clientIp;
-        const cacheKey = `rate_limit:${clientIp}`;
         const currentHits = await this._cache.increment(cacheKey, this._opts.windowSeconds);
         if (currentHits > this._opts.maxRequests) {
-          this._logger.warn(`[RateLimit] IP ${clientIp} blocked on ${req.path}`);
+          this._logger.warn(`[RateLimit] key ${cacheKey} has been  blocked on ${req.path}`);
           return import_shared69.HttpHelper.error(
             {
               success: false,
               error: {
                 code: import_shared69.ERROR_CODES.TOO_MANY_REQUESTS,
-                message: "Rate limit exceeded.",
-                details: `IP ${clientIp} throttled.`,
+                message: import_shared69.ERROR_CODE_MESSAGES[import_shared69.ERROR_CODES.TOO_MANY_REQUESTS],
+                details: `Rate limit exceeded. Key ${cacheKey} throttled.`,
                 path: req.path
               },
               correlationId: tracing?.correlationId ?? import_shared69.GuidHelper.generate(),
@@ -4187,16 +4210,60 @@ var init_presentation = __esm({
   }
 });
 
+// src/infrastructure/cache/rate-limit-key-builder.cache.ts
+var import_shared72, RateLimitKeyBuilder;
+var init_rate_limit_key_builder_cache = __esm({
+  "src/infrastructure/cache/rate-limit-key-builder.cache.ts"() {
+    "use strict";
+    import_shared72 = require("@xeno-js/shared");
+    RateLimitKeyBuilder = class {
+      constructor(_contextAccessor) {
+        this._contextAccessor = _contextAccessor;
+      }
+      _contextAccessor;
+      buildRateLimitKey(resource) {
+        const ctx = this._contextAccessor.getContext();
+        const tenantId = ctx?.identity?.tenantId;
+        const userId = ctx?.identity?.userId;
+        const clientIp = ctx?.network?.clientIp;
+        if (!import_shared72.Guards.isNullOrEmpty(tenantId) && !import_shared72.Guards.isNullOrEmpty(userId))
+          return `ratelimit:tenant:${tenantId}:user:${userId}:${resource}`;
+        if (!import_shared72.Guards.isNullOrEmpty(tenantId) && !import_shared72.Guards.isNullOrEmpty(clientIp))
+          return `ratelimit:tenant:${tenantId}:ip:${clientIp}:${resource}`;
+        if (!import_shared72.Guards.isNullOrEmpty(userId)) return `ratelimit:user:${userId}:${resource}`;
+        if (!import_shared72.Guards.isNullOrEmpty(clientIp)) return `ratelimit:ip:${clientIp}:${resource}`;
+        return void 0;
+      }
+    };
+  }
+});
+
+// src/infrastructure/cache/index.ts
+var cache_exports = {};
+__export(cache_exports, {
+  InMemoryCacheExtended: () => InMemoryCacheExtended,
+  RateLimitKeyBuilder: () => RateLimitKeyBuilder,
+  RedisCache: () => RedisCache
+});
+var init_cache = __esm({
+  "src/infrastructure/cache/index.ts"() {
+    "use strict";
+    init_inmemory_cache();
+    init_rate_limit_key_builder_cache();
+    init_redis_cache();
+  }
+});
+
 // src/infrastructure/modules/middleware.module.ts
 var middleware_module_exports = {};
 __export(middleware_module_exports, {
   MiddlewareModule: () => MiddlewareModule
 });
-var import_shared72, MiddlewareModule;
+var import_shared73, MiddlewareModule;
 var init_middleware_module = __esm({
   "src/infrastructure/modules/middleware.module.ts"() {
     "use strict";
-    import_shared72 = require("@xeno-js/shared");
+    import_shared73 = require("@xeno-js/shared");
     MiddlewareModule = class {
       async configure(container, opts) {
         const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
@@ -4240,10 +4307,12 @@ var init_middleware_module = __esm({
             c.resolve(TOKENS4.LOGGER)
           )
         );
-        if (!import_shared72.Guards.isNullOrEmpty(opts.allowOrigins)) {
-          const withCredentials = import_shared72.Guards.isDefined(opts.httpConfig.withCredentials) ? opts.httpConfig.withCredentials : false;
-          if (withCredentials && opts.allowOrigins.includes("*"))
-            throw new Error("Wildcard CORS origin is not allowed when withCredentials is set to true");
+        if (!import_shared73.Guards.isNullOrEmpty(opts.allowOrigins)) {
+          const withCredentials2 = opts.httpConfig.withCredentials ?? false;
+          if (withCredentials2 && opts.allowOrigins.includes("*"))
+            throw new Error(
+              "Wildcard CORS origin is not allowed when withCredentials is set to true in addHttpCore"
+            );
           const { AllowOrigin: AllowOrigin2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton("ALLOW_ORIGIN", () => {
             return new AllowOrigin2(opts.allowOrigins);
@@ -4258,22 +4327,28 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.ALLOW_ORIGIN_MIDDLEWARE);
         }
+        const withCredentials = import_shared73.Guards.isDefined(opts.httpConfig.withCredentials) && opts.httpConfig.withCredentials ? "true" : "false";
         if (opts.optionsMiddleware) {
           const { OptionsMiddleware: OptionsMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
           container.addSingleton(
             TOKENS4.OPTIONS_MIDDLEWARE,
-            (c) => new OptionsMiddleware2(c.resolve(TOKENS4.NETWORK_CONTEXT_ACCESSOR))
+            (c) => new OptionsMiddleware2(
+              c.resolve(TOKENS4.NETWORK_CONTEXT_ACCESSOR),
+              c.resolve(TOKENS4.ALLOW_METHOD),
+              opts.allowHeaders,
+              withCredentials
+            )
           );
           middlewares.push(TOKENS4.OPTIONS_MIDDLEWARE);
         }
         if (opts.cors) {
           const { CORSMiddleware: CORSMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
           container.addSingleton(TOKENS4.CORS_MIDDLEWARE, (c) => {
-            return new CORSMiddleware2(c.resolve(TOKENS4.CONTEXT_ACCESSOR));
+            return new CORSMiddleware2(c.resolve(TOKENS4.CONTEXT_ACCESSOR), withCredentials);
           });
           middlewares.push(TOKENS4.CORS_MIDDLEWARE);
         }
-        if (import_shared72.Guards.isDefined(opts.routeRegistry)) {
+        if (import_shared73.Guards.isDefined(opts.routeRegistry)) {
           const registry = opts.routeRegistry;
           const { AllowMethodFactory: AllowMethodFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
           container.addSingleton(TOKENS4.ALLOW_METHOD, () => new AllowMethodFactory2().create(registry));
@@ -4297,7 +4372,38 @@ var init_middleware_module = __esm({
           );
         });
         middlewares.push(TOKENS4.AUTH_MIDDLEWARE);
-        if (import_shared72.Guards.isDefined(opts.csrf)) {
+        if (import_shared73.Guards.isDefined(opts.rateLimite.maxRequests) || import_shared73.Guards.isDefined(opts.rateLimite.windowSeconds)) {
+          const maxRequests = opts.rateLimite.maxRequests ?? 30;
+          import_shared73.Guards.throwIfNegative(maxRequests, "MaxRequests must be positive");
+          import_shared73.Guards.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
+          const windowSeconds = opts.rateLimite.windowSeconds ?? 30;
+          import_shared73.Guards.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
+          import_shared73.Guards.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
+          if (!opts.isCache) {
+            const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
+            await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
+          }
+          const { RateLimitKeyBuilder: RateLimitKeyBuilder2 } = await Promise.resolve().then(() => (init_cache(), cache_exports));
+          container.addSingleton(
+            "RATE_LIMIT_KEY_BUILDER",
+            (c) => new RateLimitKeyBuilder2(c.resolve(TOKENS4.REQUEST_CONTEXT))
+          );
+          const { RateLimitMiddleware: RateLimitMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
+          container.addSingleton(TOKENS4.RATE_LIMITER_MIDDLEWARE, (c) => {
+            return new RateLimitMiddleware2(
+              c.resolve(TOKENS4.CONTEXT_ACCESSOR),
+              c.resolve(TOKENS4.CACHE),
+              c.resolve("RATE_LIMIT_KEY_BUILDER"),
+              c.resolve(TOKENS4.LOGGER),
+              {
+                maxRequests,
+                windowSeconds
+              }
+            );
+          });
+          middlewares.push(TOKENS4.RATE_LIMITER_MIDDLEWARE);
+        }
+        if (import_shared73.Guards.isDefined(opts.csrf)) {
           const csrf = opts.csrf;
           const { CsrfTokenService: CsrfTokenService2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           container.addSingleton("CSRF_TOKEN_SERVICE", (c) => {
@@ -4321,31 +4427,6 @@ var init_middleware_module = __esm({
           });
           middlewares.push(TOKENS4.CSRF_MIDDLEWARE);
         }
-        if (import_shared72.Guards.isDefined(opts.rateLimite.maxRequests) || import_shared72.Guards.isDefined(opts.rateLimite.windowSeconds)) {
-          const maxRequests = opts.rateLimite.maxRequests ?? 30;
-          import_shared72.Guards.throwIfNegative(maxRequests, "MaxRequests must be positive");
-          import_shared72.Guards.throwIfNotInteger(maxRequests, "MaxRequests must be an integer");
-          const windowSeconds = opts.rateLimite.windowSeconds ?? 30;
-          import_shared72.Guards.throwIfNegative(windowSeconds, "WindowSeconds must be positive");
-          import_shared72.Guards.throwIfNotInteger(windowSeconds, "WindowSeconds must be an integer");
-          if (!opts.isCache) {
-            const { CacheUtils: CacheUtils2 } = await Promise.resolve().then(() => (init_cache_utils(), cache_utils_exports));
-            await CacheUtils2.addCache(container, { inMemory: true, redis: void 0 });
-          }
-          const { RateLimitMiddleware: RateLimitMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
-          container.addSingleton(TOKENS4.RATE_LIMITER_MIDDLEWARE, (c) => {
-            return new RateLimitMiddleware2(
-              c.resolve(TOKENS4.CONTEXT_ACCESSOR),
-              c.resolve(TOKENS4.CACHE),
-              c.resolve(TOKENS4.LOGGER),
-              {
-                maxRequests,
-                windowSeconds
-              }
-            );
-          });
-          middlewares.push(TOKENS4.RATE_LIMITER_MIDDLEWARE);
-        }
         const { CompositeMiddleware: CompositeMiddleware2 } = await Promise.resolve().then(() => (init_presentation(), presentation_exports));
         container.addSingleton(TOKENS4.MIDDLEWARE, (c) => {
           const resolvedMiddleware = middlewares.map(
@@ -4405,7 +4486,7 @@ __export(index_exports, {
   BaseAuthorizationStrategy: () => BaseAuthorizationStrategy,
   BaseController: () => BaseController,
   BaseHandler: () => BaseHandler,
-  BaseQuery: () => import_shared79.Query,
+  BaseQuery: () => import_shared80.Query,
   ContainerUtils: () => ContainerUtils,
   ReadDao: () => ReadDao,
   Repository: () => Repository,
@@ -4416,7 +4497,7 @@ module.exports = __toCommonJS(index_exports);
 init_application();
 
 // src/infrastructure/builder/app.builder.ts
-var import_shared73 = require("@xeno-js/shared");
+var import_shared74 = require("@xeno-js/shared");
 
 // src/infrastructure/configuration/configuration.ts
 var import_shared32 = require("@xeno-js/shared");
@@ -4688,10 +4769,10 @@ var AppBuilder = class {
   constructor(container) {
     this._container = container ?? new ServiceContainer();
     this._container.addSingleton(
-      import_shared73.TOKENS.CONFIGURATION_SERVICE,
+      import_shared74.TOKENS.CONFIGURATION_SERVICE,
       () => new EnvironmentConfigurationService()
     );
-    this._configuration = this._container.resolve(import_shared73.TOKENS.CONFIGURATION_SERVICE);
+    this._configuration = this._container.resolve(import_shared74.TOKENS.CONFIGURATION_SERVICE);
     this._middlewareConfig.allowOrigins?.push(
       this._configuration.get("APP_URL") ?? `http://localhost:${this._configuration.getNumber("PORT", 3e3)}`
     );
@@ -4728,6 +4809,7 @@ var AppBuilder = class {
     trustedIpHeader: void 0,
     trustedProxies: [],
     allowOrigins: [],
+    allowHeaders: [],
     cors: true
   };
   _httpConfig = {
@@ -4804,13 +4886,13 @@ var AppBuilder = class {
     if (this._isLoggerModuleQueued) return this;
     this._isLoggerModuleQueued = true;
     const config = {
-      level: import_shared73.LOG_LEVEL.DEBUG,
+      level: import_shared74.LOG_LEVEL.DEBUG,
       console: true,
       sentry: { config: void 0 },
       pino: { config: void 0 },
       customLoggers: void 0
     };
-    if (import_shared73.Guards.isDefined(setupAction) && import_shared73.Guards.isDefined(config))
+    if (import_shared74.Guards.isDefined(setupAction) && import_shared74.Guards.isDefined(config))
       setupAction(config, this._configuration);
     this._modules.push({
       priority: 3,
@@ -4836,7 +4918,7 @@ var AppBuilder = class {
   addCache(setupAction) {
     if (this._isCacheModuleQueued) return this;
     this._isCacheModuleQueued = true;
-    if (import_shared73.Guards.isDefined(setupAction)) setupAction(this._config, this._configuration);
+    if (import_shared74.Guards.isDefined(setupAction)) setupAction(this._config, this._configuration);
     this._modules.push({
       priority: 3,
       name: "CacheModule",
@@ -4945,7 +5027,7 @@ var AppBuilder = class {
    * @link https://github.com/xeno-js/xeno-js 
    */
   addPipeline(setupAction) {
-    if (import_shared73.Guards.isDefined(setupAction)) {
+    if (import_shared74.Guards.isDefined(setupAction)) {
       setupAction(this._pipelineConfig, this._configuration);
     }
     this._queuePipelineModule();
@@ -5079,7 +5161,7 @@ var AppBuilder = class {
         console.error(`\u{1F449} Module: **${queued.name}**`);
         console.error(`\u{1F4DD} Reason: ${errorMessage}
 `);
-        if (error instanceof Error && import_shared73.Guards.isDefined(error.stack)) {
+        if (error instanceof Error && import_shared74.Guards.isDefined(error.stack)) {
           console.error(error.stack);
         }
         throw new Error(`Bootstrap failed at [${queued.name}]: ${errorMessage}`, { cause: error });
@@ -5171,14 +5253,14 @@ var AppBuilder = class {
   }
 };
 
-// src/infrastructure/cache/index.ts
-init_redis_cache();
+// src/infrastructure/index.ts
+init_cache();
 
 // src/infrastructure/context/index.ts
 init_request_context();
 
 // src/infrastructure/datasources/remote.datasource.ts
-var import_shared74 = require("@xeno-js/shared");
+var import_shared75 = require("@xeno-js/shared");
 
 // src/infrastructure/index.ts
 init_factories();
@@ -5208,8 +5290,8 @@ init_pipeline_utils();
 init_validation_utils();
 
 // src/infrastructure/repositories/read-dao.ts
-var import_shared75 = require("@xeno-js/shared");
 var import_shared76 = require("@xeno-js/shared");
+var import_shared77 = require("@xeno-js/shared");
 var ReadDao = class {
   /**
    * Constructs a new ReadDao instance.
@@ -5229,23 +5311,23 @@ var ReadDao = class {
   _dataSource;
   _mapper;
   async findById(id, ctx, signal) {
-    import_shared75.AppError.throwIfAborted(signal, "ReadDao.findById");
+    import_shared76.AppError.throwIfAborted(signal, "ReadDao.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (import_shared76.Guards.isNullOrEmpty(result)) return import_shared75.Result.ok();
+    if (import_shared77.Guards.isNullOrEmpty(result)) return import_shared76.Result.ok();
     const entity = this._mapper.toEntity(result);
-    return import_shared75.Result.ok(entity);
+    return import_shared76.Result.ok(entity);
   }
   async findAll(ctx, signal) {
-    import_shared75.AppError.throwIfAborted(signal, "ReadDao.findAll");
+    import_shared76.AppError.throwIfAborted(signal, "ReadDao.findAll");
     const results = await this._dataSource.findAll(ctx, signal);
     const entities = results.map((result) => this._mapper.toEntity(result));
-    return import_shared75.Result.ok(entities);
+    return import_shared76.Result.ok(entities);
   }
 };
 
 // src/infrastructure/repositories/repository.ts
-var import_shared77 = require("@xeno-js/shared");
 var import_shared78 = require("@xeno-js/shared");
+var import_shared79 = require("@xeno-js/shared");
 var Repository = class {
   /**
    * Constructs a new Repository instance.
@@ -5265,35 +5347,35 @@ var Repository = class {
   _dataSource;
   _mapper;
   async findById(id, ctx, signal) {
-    import_shared77.AppError.throwIfAborted(signal, "Repository.findById");
+    import_shared78.AppError.throwIfAborted(signal, "Repository.findById");
     const result = await this._dataSource.findById(id, ctx, signal);
-    if (import_shared78.Guards.isNullOrEmpty(result)) return import_shared77.Result.ok();
+    if (import_shared79.Guards.isNullOrEmpty(result)) return import_shared78.Result.ok();
     const entity = this._mapper.toEntity(result);
-    return import_shared77.Result.ok(entity);
+    return import_shared78.Result.ok(entity);
   }
   async findAll(ctx, signal) {
-    import_shared77.AppError.throwIfAborted(signal, "Repository.findAll");
+    import_shared78.AppError.throwIfAborted(signal, "Repository.findAll");
     const results = await this._dataSource.findAll(ctx, signal);
     const entities = results.map((result) => this._mapper.toEntity(result));
-    return import_shared77.Result.ok(entities);
+    return import_shared78.Result.ok(entities);
   }
   async save(entity, signal) {
     const dto = this._mapper.toDto(entity);
-    import_shared77.AppError.throwIfAborted(signal, "Repository.save");
+    import_shared78.AppError.throwIfAborted(signal, "Repository.save");
     await this._dataSource.insert(dto, signal);
-    return import_shared77.Result.ok();
+    return import_shared78.Result.ok();
   }
   async delete(entity, ctx, signal) {
     const dto = this._mapper.toDto(entity);
-    import_shared77.AppError.throwIfAborted(signal, "Repository.delete");
+    import_shared78.AppError.throwIfAborted(signal, "Repository.delete");
     await this._dataSource.delete(dto, ctx, signal);
-    return import_shared77.Result.ok();
+    return import_shared78.Result.ok();
   }
   async update(id, entity, ctx, signal) {
     const dto = this._mapper.toPartialDto(entity);
-    import_shared77.AppError.throwIfAborted(signal, "Repository.update");
+    import_shared78.AppError.throwIfAborted(signal, "Repository.update");
     await this._dataSource.update(id, dto, ctx, signal);
-    return import_shared77.Result.ok();
+    return import_shared78.Result.ok();
   }
 };
 
@@ -5311,7 +5393,7 @@ __reExport(drizzle_types_exports, require("drizzle-orm"));
 __reExport(index_exports, drizzle_types_exports, module.exports);
 init_presentation();
 __reExport(index_exports, require("@xeno-js/shared"), module.exports);
-var import_shared79 = require("@xeno-js/shared");
+var import_shared80 = require("@xeno-js/shared");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AppBuilder,
@@ -5335,4 +5417,14 @@ var import_shared79 = require("@xeno-js/shared");
  * @link https://github.com/xeno-js/xeno-js
  * @license MIT
  */
+/**
+ * @description The RateLimitKeyBuilder class implements the IRateLimitKeyBuilder interface, providing a method to build rate limit keys based on the user's identity. This class utilizes an instance of IIdentityAccessor to retrieve the current user's identity, allowing for the creation of tenant-specific rate limit keys in multi-tenant applications. If a tenant ID is present in the identity, the rate limit key is prefixed with the tenant ID; otherwise, it defaults to a public rate limit key. This approach ensures that rate limit data is appropriately scoped to the user's context, preventing data leakage between tenants.
+ *
+ * @author Xeno
+ * @version 1.0.0
+ * @since 2025-09-30
+ * @link https://github.com/xeno-js/xeno-vue
+ * @copyright Xeno
+ * @license MIT
+ */
 //# sourceMappingURL=index.cjs.map