@yuva-devlab/auth-server 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,3 +1,4 @@
+import crypto from 'crypto';
 import { UnauthorizedError, ForbiddenError } from '@yuva-devlab/errors';
 import { loggerWithConfig, Logger } from '@yuva-devlab/logger';
 
@@ -6,6 +7,7 @@ var DEFAULT_AUTH_HEADER = "authorization";
 var DEFAULT_API_KEY_HEADER = "x-api-key";
 var DEFAULT_BEARER_PREFIX = "Bearer ";
 var DEFAULT_JWKS_CACHE_TTL_MS = 36e5;
+var DEFAULT_API_KEY_CACHE_TTL_MS = 3e5;
 var DEFAULT_PUBLIC_PATHS = Object.freeze([
   "/health",
   "/ready",
@@ -30,32 +32,19 @@ var JwksValidator = class {
   issuer;
   cacheTtlMs;
   keyCache = /* @__PURE__ */ new Map();
-  /**
-   * Initializes the JWKS validator.
-   *
-   * @param config - JWKS configuration parameters
-   */
-  constructor(config) {
-    this.jwksUri = config.jwksUri;
+  jwksSetCache = null;
+  constructor(config = {}) {
+    this.jwksUri = config.jwksUri ?? (config.issuer ? `${config.issuer}/.well-known/jwks.json` : void 0) ?? (typeof process !== "undefined" ? process.env?.DEVLAB_JWKS_URI ?? (process.env?.DEVLAB_AUTH_URL ? `${process.env.DEVLAB_AUTH_URL}/.well-known/jwks.json` : void 0) : void 0) ?? "";
     this.audience = config.audience;
     this.issuer = config.issuer;
     this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_JWKS_CACHE_TTL_MS;
-    logger.debug("[constructor] JwksValidator initialized", {
-      jwksUri: this.jwksUri,
-      issuer: this.issuer,
-      audience: this.audience
-    });
   }
-  /**
-   * Decodes a JWT token without verifying cryptographic signature.
-   *
-   * @param token - Base64Url encoded JWT string
-   * @returns Header and payload objects
-   */
   parseUnverified(token) {
     const parts = token.split(".");
     if (parts.length !== 3) {
-      throw new UnauthorizedError("Malformed JWT token format");
+      throw new UnauthorizedError(
+        "Malformed JWT token format: expected 3 segments"
+      );
     }
     try {
       const header = JSON.parse(
@@ -64,68 +53,226 @@ var JwksValidator = class {
       const payload = JSON.parse(
         Buffer.from(parts[1], "base64url").toString("utf-8")
       );
-      return { header, payload };
+      return {
+        header,
+        payload,
+        rawHeader: parts[0],
+        rawPayload: parts[1],
+        signature: parts[2]
+      };
     } catch {
-      throw new UnauthorizedError("Unable to decode JWT payload");
+      throw new UnauthorizedError("Unable to decode JWT header or payload");
+    }
+  }
+  async fetchJwks() {
+    if (!this.jwksUri) {
+      throw new UnauthorizedError(
+        "JwksValidator: jwksUri, issuer, or DEVLAB_AUTH_URL must be configured"
+      );
+    }
+    const now = Date.now();
+    if (this.jwksSetCache && this.jwksSetCache.expiresAt > now) {
+      return this.jwksSetCache.keys;
+    }
+    try {
+      const res = await fetch(this.jwksUri, {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (!res.ok) {
+        throw new Error(`JWKS endpoint returned HTTP ${res.status}`);
+      }
+      const body = await res.json();
+      const keys = body.keys ?? [];
+      this.jwksSetCache = { keys, expiresAt: now + this.cacheTtlMs };
+      return keys;
+    } catch (err) {
+      logger.error("[fetchJwks] Failed to fetch JWKS public keys", {
+        uri: this.jwksUri,
+        err
+      });
+      if (this.jwksSetCache?.keys) return this.jwksSetCache.keys;
+      throw new UnauthorizedError("Authentication service JWKS unreachable");
+    }
+  }
+  async resolveKeyObject(kid) {
+    const now = Date.now();
+    const cacheKey = kid ?? "__default__";
+    const cached = this.keyCache.get(cacheKey);
+    if (cached && cached.expiresAt > now) {
+      return cached.keyObject;
+    }
+    const jwks = await this.fetchJwks();
+    const matched = kid ? jwks.find((k) => k.kid === kid) : jwks[0];
+    if (!matched) {
+      throw new UnauthorizedError(
+        `No matching JWK public key found for kid: ${kid ?? "default"}`
+      );
+    }
+    try {
+      const keyObject = crypto.createPublicKey({
+        key: matched,
+        format: "jwk"
+      });
+      this.keyCache.set(cacheKey, {
+        keyObject,
+        expiresAt: now + this.cacheTtlMs
+      });
+      return keyObject;
+    } catch (err) {
+      logger.error("[resolveKeyObject] Failed to parse JWK public key", {
+        kid,
+        err
+      });
+      throw new UnauthorizedError("Invalid JWK public key format");
     }
   }
-  /**
-   * Verifies standard claims (exp, nbf, iss, aud) on a JWT token.
-   *
-   * @param token - Bearer access token
-   * @returns Validated JwtPayload claims
-   */
   async verifyToken(token) {
-    const { payload } = this.parseUnverified(token);
+    const { header, payload, rawHeader, rawPayload, signature } = this.parseUnverified(token);
+    if (header.alg && header.alg !== "RS256") {
+      throw new UnauthorizedError(
+        `Unsupported signing algorithm: ${header.alg}. Expected RS256`
+      );
+    }
+    const kid = typeof header.kid === "string" ? header.kid : void 0;
+    const keyObject = await this.resolveKeyObject(kid);
+    const data = Buffer.from(`${rawHeader}.${rawPayload}`);
+    const sigBuffer = Buffer.from(signature, "base64url");
+    const isSignatureValid = crypto.verify(
+      "RSA-SHA256",
+      data,
+      keyObject,
+      sigBuffer
+    );
+    if (!isSignatureValid) {
+      logger.warn("[verifyToken] Cryptographic signature check failed", {
+        sub: payload.sub,
+        kid
+      });
+      throw new UnauthorizedError("Invalid token signature");
+    }
     const nowSeconds = Math.floor(Date.now() / 1e3);
     if (typeof payload.exp === "number" && nowSeconds >= payload.exp) {
-      logger.warn("[verifyToken] Token has expired", {
-        exp: payload.exp,
-        now: nowSeconds
-      });
       throw new UnauthorizedError("Authentication token has expired");
     }
     if (typeof payload.nbf === "number" && nowSeconds < payload.nbf) {
-      logger.warn("[verifyToken] Token not yet valid", {
-        nbf: payload.nbf,
-        now: nowSeconds
-      });
       throw new UnauthorizedError("Authentication token is not yet active");
     }
     if (this.issuer && payload.iss && payload.iss !== this.issuer) {
-      logger.warn("[verifyToken] Issuer mismatch", {
-        expected: this.issuer,
-        actual: payload.iss
-      });
-      throw new UnauthorizedError("Token issuer mismatch");
+      throw new UnauthorizedError(
+        `Token issuer mismatch: expected ${this.issuer}, got ${payload.iss}`
+      );
     }
     if (this.audience && payload.aud) {
       const audList = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
       if (!audList.includes(this.audience)) {
-        logger.warn("[verifyToken] Audience mismatch", {
-          expected: this.audience,
-          actual: payload.aud
-        });
-        throw new UnauthorizedError("Token audience mismatch");
+        throw new UnauthorizedError(
+          `Token audience mismatch: expected ${this.audience}`
+        );
       }
     }
-    logger.debug("[verifyToken] Successfully validated token claims", {
-      sub: payload.sub
-    });
     return payload;
   }
-  /**
-   * Clears cached public keys from memory.
-   */
   clearKeyCache() {
     this.keyCache.clear();
+    this.jwksSetCache = null;
     logger.info("[clearKeyCache] JWKS public key cache cleared");
   }
 };
-var logger2 = loggerWithConfig(new Logger("AuthGuards"));
+var logger2 = loggerWithConfig(new Logger("M2mApiKeyValidator"));
+var M2mApiKeyValidator = class {
+  authUrl;
+  cacheTtlMs;
+  requiredClientId;
+  requiredScopes;
+  keyCache = /* @__PURE__ */ new Map();
+  constructor(config = {}) {
+    this.authUrl = config.authUrl ?? config.portalUrl ?? process.env.DEVLAB_AUTH_URL ?? process.env.DEVLAB_PORTAL_URL;
+    this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_API_KEY_CACHE_TTL_MS;
+    this.requiredClientId = config.requiredClientId ?? config.requiredAppId;
+    this.requiredScopes = config.requiredScopes;
+  }
+  async validateKey(rawKey) {
+    const trimmed = rawKey.trim();
+    if (!trimmed.startsWith("dlk_")) {
+      throw new UnauthorizedError("Malformed API key: expected 'dlk_' prefix");
+    }
+    if (!this.authUrl) {
+      throw new UnauthorizedError(
+        "M2mApiKeyValidator: authUrl or DEVLAB_AUTH_URL must be configured for validation"
+      );
+    }
+    const now = Date.now();
+    const cached = this.keyCache.get(trimmed);
+    if (cached && cached.expiresAt > now) {
+      return this.enforceKeyConstraints(cached.result);
+    }
+    try {
+      const url = `${this.authUrl}/api/v1/api-keys/validate`;
+      const res = await fetch(url, {
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${trimmed}`
+        },
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (!res.ok) {
+        throw new Error(
+          `Authentication validation endpoint returned HTTP ${res.status}`
+        );
+      }
+      const body = await res.json();
+      if (!body.valid) {
+        throw new UnauthorizedError(body.reason ?? "Invalid machine API key");
+      }
+      this.keyCache.set(trimmed, {
+        result: body,
+        expiresAt: now + this.cacheTtlMs
+      });
+      return this.enforceKeyConstraints(body);
+    } catch (err) {
+      if (err instanceof UnauthorizedError || err instanceof ForbiddenError) {
+        throw err;
+      }
+      logger2.error("[validateKey] Network error during API key introspection", {
+        err
+      });
+      throw new UnauthorizedError(
+        "Authentication service unreachable for API key verification"
+      );
+    }
+  }
+  enforceKeyConstraints(result) {
+    if (this.requiredClientId && result.appId && result.appId !== this.requiredClientId) {
+      throw new ForbiddenError(
+        "API key assigned to " + result.appId + ", required " + this.requiredClientId
+      );
+    }
+    if (this.requiredScopes && this.requiredScopes.length > 0) {
+      const keyScopes = result.scopes ?? [];
+      const hasWildcard = keyScopes.includes("*");
+      if (!hasWildcard) {
+        const hasAll = this.requiredScopes.every(
+          (scope) => keyScopes.includes(scope)
+        );
+        if (!hasAll) {
+          throw new ForbiddenError(
+            "API key lacks required scopes: [" + this.requiredScopes.join(", ") + "]"
+          );
+        }
+      }
+    }
+    return result;
+  }
+  clearCache() {
+    this.keyCache.clear();
+    logger2.info("[clearCache] API key validation cache cleared");
+  }
+};
+var logger3 = loggerWithConfig(new Logger("AuthGuards"));
 function requireUser(ctx, requiredRoles) {
   if (!ctx.authenticated || !ctx.user) {
-    logger2.warn(
+    logger3.warn(
       "[requireUser] Request rejected: missing authenticated user context"
     );
     throw new UnauthorizedError(
@@ -135,7 +282,7 @@ function requireUser(ctx, requiredRoles) {
   if (requiredRoles && requiredRoles.length > 0) {
     const hasRole = requiredRoles.some((role) => ctx.roles.includes(role));
     if (!hasRole) {
-      logger2.warn("[requireUser] User lacks required roles", {
+      logger3.warn("[requireUser] User lacks required roles", {
         userId: ctx.user.id,
         userRoles: ctx.roles,
         requiredRoles
@@ -149,7 +296,7 @@ function requireUser(ctx, requiredRoles) {
 }
 function requireApiKey(ctx) {
   if (!ctx.authenticated || !ctx.apiKey) {
-    logger2.warn("[requireApiKey] Request rejected: missing machine API key");
+    logger3.warn("[requireApiKey] Request rejected: missing machine API key");
     throw new UnauthorizedError(
       "Authentication required: valid API key required"
     );
@@ -158,19 +305,19 @@ function requireApiKey(ctx) {
 }
 function requireScope(ctx, scope) {
   if (!ctx.roles.includes(scope)) {
-    logger2.warn("[requireScope] Missing required scope", {
+    logger3.warn("[requireScope] Missing required scope", {
       roles: ctx.roles,
       requiredScope: scope
     });
     throw new ForbiddenError(`Missing required scope: '${scope}'`);
   }
 }
-var logger3 = loggerWithConfig(new Logger("AuthMiddleware"));
+var logger4 = loggerWithConfig(new Logger("AuthMiddleware"));
 function createAppKillSwitchMiddleware(getAppStatus) {
   return async (req, res) => {
     const status = await getAppStatus();
     if (status === "INACTIVE" /* INACTIVE */ || status === "MAINTENANCE" /* MAINTENANCE */) {
-      logger3.warn(
+      logger4.warn(
         "[killSwitch] Application is inactive or under maintenance; request rejected",
         {
           url: req.url,
@@ -214,7 +361,7 @@ function createAuthMiddleware(options) {
     if (apiKey && options.validateApiKey) {
       const apiKeyCtx = await options.validateApiKey(apiKey);
       if (apiKeyCtx?.authenticated) {
-        logger3.info("[authenticate] Authenticated via API Key", {
+        logger4.info("[authenticate] Authenticated via API Key", {
           path: urlPath
         });
         req.authContext = apiKeyCtx;
@@ -227,14 +374,14 @@ function createAuthMiddleware(options) {
       const token = authHeader.slice(DEFAULT_BEARER_PREFIX.length).trim();
       const tokenCtx = await options.validateToken(token);
       if (tokenCtx?.authenticated) {
-        logger3.info("[authenticate] Authenticated via Bearer token", {
+        logger4.info("[authenticate] Authenticated via Bearer token", {
           path: urlPath
         });
         req.authContext = tokenCtx;
         return true;
       }
     }
-    logger3.warn("[authenticate] Unauthorized request rejected", {
+    logger4.warn("[authenticate] Unauthorized request rejected", {
       path: urlPath,
       method: req.method
     });
@@ -252,6 +399,6 @@ function createAuthMiddleware(options) {
   };
 }
 
-export { AppStatus, DEFAULT_API_KEY_HEADER, DEFAULT_AUTH_HEADER, DEFAULT_BEARER_PREFIX, DEFAULT_JWKS_CACHE_TTL_MS, DEFAULT_PUBLIC_PATHS, HTTP_STATUS_FORBIDDEN, HTTP_STATUS_SERVICE_UNAVAILABLE, HTTP_STATUS_UNAUTHORIZED, JwksValidator, createAppKillSwitchMiddleware, createAuthMiddleware, requireApiKey, requireScope, requireUser };
+export { AppStatus, DEFAULT_API_KEY_CACHE_TTL_MS, DEFAULT_API_KEY_HEADER, DEFAULT_AUTH_HEADER, DEFAULT_BEARER_PREFIX, DEFAULT_JWKS_CACHE_TTL_MS, DEFAULT_PUBLIC_PATHS, HTTP_STATUS_FORBIDDEN, HTTP_STATUS_SERVICE_UNAVAILABLE, HTTP_STATUS_UNAUTHORIZED, JwksValidator, M2mApiKeyValidator, createAppKillSwitchMiddleware, createAuthMiddleware, requireApiKey, requireScope, requireUser };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/constants/auth.constants.ts","../src/types/auth.types.ts","../src/token/jwt-validator.ts","../src/guards/auth-guards.ts","../src/middleware/auth-middleware.ts"],"names":["AppStatus","logger","loggerWithConfig","Logger","UnauthorizedError"],"mappings":";;;;AAOO,IAAM,mBAAA,GAAsB;AAG5B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,qBAAA,GAAwB;AAG9B,IAAM,yBAAA,GAA4B;AAGlC,IAAM,oBAAA,GAAuB,OAAO,MAAA,CAAO;AAAA,EAChD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,wBAAA,GAA2B;AAGjC,IAAM,qBAAA,GAAwB;AAG9B,IAAM,+BAAA,GAAkC;;;ACxBxC,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AAEL,EAAAA,WAAA,QAAA,CAAA,GAAS,QAAA;AAET,EAAAA,WAAA,UAAA,CAAA,GAAW,UAAA;AAEX,EAAAA,WAAA,aAAA,CAAA,GAAc,aAAA;AANJ,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;ACEZ,IAAM,MAAA,GAAS,gBAAA,CAAiB,IAAI,MAAA,CAAO,eAAe,CAAC,CAAA;AAkBpD,IAAM,gBAAN,MAAoB;AAAA,EACR,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACT,QAAA,uBAAe,GAAA,EAAgD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhE,YAAY,MAAA,EAAoB;AACrC,IAAA,IAAA,CAAK,UAAU,MAAA,CAAO,OAAA;AACtB,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,yBAAA;AAEvC,IAAA,MAAA,CAAO,MAAM,yCAAA,EAA2C;AAAA,MACtD,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,UAAU,IAAA,CAAK;AAAA,KAChB,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,gBAAgB,KAAA,EAGrB;AACA,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,kBAAkB,4BAA4B,CAAA;AAAA,IAC1D;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,QAClB,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAI,WAAW,CAAA,CAAE,SAAS,OAAO;AAAA,OACtD;AACA,MAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AAAA,QACnB,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAI,WAAW,CAAA,CAAE,SAAS,OAAO;AAAA,OACtD;AAEA,MAAA,OAAO,EAAE,QAAQ,OAAA,EAAQ;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAkB,8BAA8B,CAAA;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAa,YAAY,KAAA,EAAoC;AAC3D,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,IAAA,CAAK,gBAAgB,KAAK,CAAA;AAC9C,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAG/C,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,UAAA,IAAc,QAAQ,GAAA,EAAK;AAChE,MAAA,MAAA,CAAO,KAAK,iCAAA,EAAmC;AAAA,QAC7C,KAAK,OAAA,CAAQ,GAAA;AAAA,QACb,GAAA,EAAK;AAAA,OACN,CAAA;AACD,MAAA,MAAM,IAAI,kBAAkB,kCAAkC,CAAA;AAAA,IAChE;AAGA,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,UAAA,GAAa,QAAQ,GAAA,EAAK;AAC/D,MAAA,MAAA,CAAO,KAAK,mCAAA,EAAqC;AAAA,QAC/C,KAAK,OAAA,CAAQ,GAAA;AAAA,QACb,GAAA,EAAK;AAAA,OACN,CAAA;AACD,MAAA,MAAM,IAAI,kBAAkB,wCAAwC,CAAA;AAAA,IACtE;AAGA,IAAA,IAAI,KAAK,MAAA,IAAU,OAAA,CAAQ,OAAO,OAAA,CAAQ,GAAA,KAAQ,KAAK,MAAA,EAAQ;AAC7D,MAAA,MAAA,CAAO,KAAK,+BAAA,EAAiC;AAAA,QAC3C,UAAU,IAAA,CAAK,MAAA;AAAA,QACf,QAAQ,OAAA,CAAQ;AAAA,OACjB,CAAA;AACD,MAAA,MAAM,IAAI,kBAAkB,uBAAuB,CAAA;AAAA,IACrD;AAGA,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAK;AAChC,MAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,IAAI,OAAA,CAAQ,GAAA,GAAM,CAAC,OAAA,CAAQ,GAAG,CAAA;AACvE,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,EAAG;AACpC,QAAA,MAAA,CAAO,KAAK,iCAAA,EAAmC;AAAA,UAC7C,UAAU,IAAA,CAAK,QAAA;AAAA,UACf,QAAQ,OAAA,CAAQ;AAAA,SACjB,CAAA;AACD,QAAA,MAAM,IAAI,kBAAkB,yBAAyB,CAAA;AAAA,MACvD;AAAA,IACF;AAEA,IAAA,MAAA,CAAO,MAAM,mDAAA,EAAqD;AAAA,MAChE,KAAK,OAAA,CAAQ;AAAA,KACd,CAAA;AACD,IAAA,OAAO,OAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKO,aAAA,GAAsB;AAC3B,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,MAAA,CAAO,KAAK,+CAA+C,CAAA;AAAA,EAC7D;AACF;ACvIA,IAAMC,OAAAA,GAASC,gBAAAA,CAAiB,IAAIC,MAAAA,CAAO,YAAY,CAAC,CAAA;AAgBjD,SAAS,WAAA,CACd,KACA,aAAA,EACU;AACV,EAAA,IAAI,CAAC,GAAA,CAAI,aAAA,IAAiB,CAAC,IAAI,IAAA,EAAM;AACnC,IAAAF,OAAAA,CAAO,IAAA;AAAA,MACL;AAAA,KACF;AACA,IAAA,MAAM,IAAIG,iBAAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,OAAA,GAAU,cAAc,IAAA,CAAK,CAAC,SAAS,GAAA,CAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAC,CAAA;AACrE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAAH,OAAAA,CAAO,KAAK,yCAAA,EAA2C;AAAA,QACrD,MAAA,EAAQ,IAAI,IAAA,CAAK,EAAA;AAAA,QACjB,WAAW,GAAA,CAAI,KAAA;AAAA,QACf;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,0CAAA,EAA6C,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,OACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,GAAA,CAAI,IAAA;AACb;AASO,SAAS,cAAc,GAAA,EAA0B;AACtD,EAAA,IAAI,CAAC,GAAA,CAAI,aAAA,IAAiB,CAAC,IAAI,MAAA,EAAQ;AACrC,IAAAA,OAAAA,CAAO,KAAK,2DAA2D,CAAA;AACvE,IAAA,MAAM,IAAIG,iBAAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,GAAA,CAAI,MAAA;AACb;AASO,SAAS,YAAA,CAAa,KAAkB,KAAA,EAAqB;AAClE,EAAA,IAAI,CAAC,GAAA,CAAI,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EAAG;AAC9B,IAAAH,OAAAA,CAAO,KAAK,uCAAA,EAAyC;AAAA,MACnD,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D;AACF;ACxEA,IAAMA,OAAAA,GAASC,gBAAAA,CAAiB,IAAIC,MAAAA,CAAO,gBAAgB,CAAC,CAAA;AA+BrD,SAAS,8BACd,YAAA,EACA;AACA,EAAA,OAAO,OACL,KACA,GAAA,KACqB;AACrB,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAGlC,IAAA,IAAI,wCAAiC,MAAA,KAAA,aAAA,oBAAkC;AACrE,MAAAF,OAAAA,CAAO,IAAA;AAAA,QACL,6EAAA;AAAA,QACA;AAAA,UACE,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,SAAA,EAAW;AAAA;AACb,OACF;AAEA,MAAA,GAAA,CAAI,UAAA,GAAa,+BAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,MAAA,GAAA,CAAI,GAAA;AAAA,QACF,KAAK,SAAA,CAAU;AAAA,UACb,KAAA,EAAO;AAAA,YACL,IAAA,EAAM,iBAAA;AAAA,YACN,OAAA,EACE,6CACI,2DAAA,GACA,6DAAA;AAAA,YACN;AAAA;AACF,SACD;AAAA,OACH;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAoBO,SAAS,qBAAqB,OAAA,EAAsC;AACzE,EAAA,MAAM,WAAA,uBAAkB,GAAA,CAAI;AAAA,IAC1B,GAAG,oBAAA;AAAA,IACH,GAAI,OAAA,CAAQ,WAAA,IAAe;AAAC,GAC7B,CAAA;AAED,EAAA,OAAO,OACL,KACA,GAAA,KACqB;AACrB,IAAA,MAAM,OAAA,GAAA,CAAW,IAAI,GAAA,IAAO,GAAA,EAAK,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAGlD,IAAA,IAAI,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA,EAAG;AAC5B,MAAA,GAAA,CAAI,WAAA,GAAc;AAAA,QAChB,aAAA,EAAe,KAAA;AAAA,QACf,OAAO,EAAC;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AACpD,IAAA,MAAM,SAAS,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,CAAU,MAAK,GAAI,MAAA;AAElE,IAAA,IAAI,MAAA,IAAU,QAAQ,cAAA,EAAgB;AACpC,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,cAAA,CAAe,MAAM,CAAA;AACrD,MAAA,IAAI,WAAW,aAAA,EAAe;AAC5B,QAAAA,OAAAA,CAAO,KAAK,0CAAA,EAA4C;AAAA,UACtD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,GAAA,CAAI,WAAA,GAAc,SAAA;AAClB,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA;AAC/C,IAAA,MAAM,aAAa,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,CAAQ,MAAK,GAAI,MAAA;AAElE,IAAA,IACE,UAAA,EAAY,UAAA,CAAW,qBAAqB,CAAA,IAC5C,QAAQ,aAAA,EACR;AACA,MAAA,MAAM,QAAQ,UAAA,CAAW,KAAA,CAAM,qBAAA,CAAsB,MAAM,EAAE,IAAA,EAAK;AAClE,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,aAAA,CAAc,KAAK,CAAA;AAClD,MAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,QAAAA,OAAAA,CAAO,KAAK,+CAAA,EAAiD;AAAA,UAC3D,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,GAAA,CAAI,WAAA,GAAc,QAAA;AAClB,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAAA,OAAAA,CAAO,KAAK,8CAAA,EAAgD;AAAA,MAC1D,IAAA,EAAM,OAAA;AAAA,MACN,QAAQ,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,GAAA,CAAI,UAAA,GAAa,wBAAA;AACjB,IAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,IAAA,GAAA,CAAI,GAAA;AAAA,MACF,KAAK,SAAA,CAAU;AAAA,QACb,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD;AAAA,KACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * @file packages/auth-server/src/constants/auth.constants.ts\n * @description Centralized constants and header keys for server-side authentication.\n * @module @yuva-devlab/auth-server\n */\n\n/** Standard Authorization HTTP header name (lowercase for case-insensitive lookup) */\nexport const DEFAULT_AUTH_HEADER = \"authorization\";\n\n/** Standard machine-to-machine API key HTTP header name */\nexport const DEFAULT_API_KEY_HEADER = \"x-api-key\";\n\n/** Standard Bearer token prefix */\nexport const DEFAULT_BEARER_PREFIX = \"Bearer \";\n\n/** Default cache time-to-live for fetched RS256 JWKS public keys (1 hour) */\nexport const DEFAULT_JWKS_CACHE_TTL_MS = 3_600_000;\n\n/** Default public endpoints bypassing mandatory authentication */\nexport const DEFAULT_PUBLIC_PATHS = Object.freeze([\n  \"/health\",\n  \"/ready\",\n  \"/live\",\n  \"/metrics\",\n]);\n\n/** HTTP Status Code for unauthenticated requests */\nexport const HTTP_STATUS_UNAUTHORIZED = 401;\n\n/** HTTP Status Code for unauthorized / forbidden role requests */\nexport const HTTP_STATUS_FORBIDDEN = 403;\n\n/** HTTP Status Code returned when an application is deactivated or killed */\nexport const HTTP_STATUS_SERVICE_UNAVAILABLE = 503;\n","/**\n * @file packages/auth-server/src/types/auth.types.ts\n * @description Type definitions and contracts for server authentication, JWKS, and app lifecycle.\n * @module @yuva-devlab/auth-server\n */\n\n/**\n * Operational state of an application on the DevLab platform.\n */\nexport enum AppStatus {\n  /** Application is fully operational and serving traffic */\n  ACTIVE = \"ACTIVE\",\n  /** Application has been administratively disabled / deactivated (Kill-Switch triggered) */\n  INACTIVE = \"INACTIVE\",\n  /** Application is undergoing scheduled maintenance */\n  MAINTENANCE = \"MAINTENANCE\",\n}\n\n/**\n * Authenticated user profile representation.\n */\nexport interface AuthUser {\n  /** Canonical user UUID */\n  readonly id: string;\n  /** Primary user email address */\n  readonly email?: string;\n  /** Granted role slugs */\n  readonly roles: readonly string[];\n  /** Tenant isolation partition ID */\n  readonly tenantId?: string;\n  /** Arbitrary profile metadata */\n  readonly metadata?: Record<string, unknown>;\n}\n\n/**\n * Machine-to-machine API key credential.\n */\nexport interface ApiKey {\n  /** Primary API key UUID */\n  readonly id: string;\n  /** Secure key string */\n  readonly key: string;\n  /** Human-readable key name or description */\n  readonly name: string;\n  /** Scoped roles granted to this key */\n  readonly roles: readonly string[];\n  /** Tenant ID partition */\n  readonly tenantId?: string;\n  /** Active status flag */\n  readonly isEnabled: boolean;\n}\n\n/**\n * Evaluated authentication context attached to inbound requests.\n */\nexport interface AuthContext {\n  /** Whether the request carries valid credentials */\n  readonly authenticated: boolean;\n  /** Authenticated user if authenticated via session/JWT */\n  readonly user?: AuthUser;\n  /** Authenticated API key if authenticated via machine credential */\n  readonly apiKey?: ApiKey;\n  /** Consolidated roles granted across user or API key */\n  readonly roles: readonly string[];\n  /** Whether the host application is currently active on the platform */\n  readonly isAppActive: boolean;\n  /** Detailed app status */\n  readonly appStatus?: AppStatus;\n  /** Tenant partition ID */\n  readonly tenantId?: string;\n  /** Distributed trace request identifier */\n  readonly requestId?: string;\n}\n\n/**\n * Configuration for verifying RS256 JWTs against a remote JWKS endpoint.\n */\nexport interface JwksConfig {\n  /** JWKS endpoint URI exposing JSON Web Keys */\n  readonly jwksUri: string;\n  /** Expected audience claim */\n  readonly audience?: string;\n  /** Expected issuer claim */\n  readonly issuer?: string;\n  /** In-memory cache duration for public keys in milliseconds */\n  readonly cacheTtlMs?: number;\n}\n\n/**\n * Decoded JWT claims payload.\n */\nexport interface JwtPayload {\n  readonly sub: string;\n  readonly iss?: string;\n  readonly aud?: string | readonly string[];\n  readonly exp?: number;\n  readonly nbf?: number;\n  readonly iat?: number;\n  readonly email?: string;\n  readonly roles?: readonly string[];\n  readonly tenantId?: string;\n  readonly [key: string]: unknown;\n}\n","/**\n * @file packages/auth-server/src/token/jwt-validator.ts\n * @description In-memory cached RS256 JWKS validator for authenticating JWT session tokens.\n * @module @yuva-devlab/auth-server\n */\n\nimport { UnauthorizedError } from \"@yuva-devlab/errors\";\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport { DEFAULT_JWKS_CACHE_TTL_MS } from \"../constants\";\nimport type { JwksConfig, JwtPayload } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"JwksValidator\"));\n\n/**\n * Validates JWT access tokens against an in-memory cached JWKS public key set.\n *\n * @example\n * ```typescript\n * import { JwksValidator } from \"@yuva-devlab/auth-server\";\n *\n * const validator = new JwksValidator({\n *   jwksUri: \"https://auth.devlab.io/.well-known/jwks.json\",\n *   issuer: \"https://auth.devlab.io\",\n *   audience: \"api.devlab.io\",\n * });\n *\n * const claims = await validator.verifyToken(token);\n * ```\n */\nexport class JwksValidator {\n  private readonly jwksUri: string;\n  private readonly audience?: string;\n  private readonly issuer?: string;\n  private readonly cacheTtlMs: number;\n  private keyCache = new Map<string, { key: string; expiresAt: number }>();\n\n  /**\n   * Initializes the JWKS validator.\n   *\n   * @param config - JWKS configuration parameters\n   */\n  public constructor(config: JwksConfig) {\n    this.jwksUri = config.jwksUri;\n    this.audience = config.audience;\n    this.issuer = config.issuer;\n    this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_JWKS_CACHE_TTL_MS;\n\n    logger.debug(\"[constructor] JwksValidator initialized\", {\n      jwksUri: this.jwksUri,\n      issuer: this.issuer,\n      audience: this.audience,\n    });\n  }\n\n  /**\n   * Decodes a JWT token without verifying cryptographic signature.\n   *\n   * @param token - Base64Url encoded JWT string\n   * @returns Header and payload objects\n   */\n  public parseUnverified(token: string): {\n    header: Record<string, unknown>;\n    payload: JwtPayload;\n  } {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) {\n      throw new UnauthorizedError(\"Malformed JWT token format\");\n    }\n\n    try {\n      const header = JSON.parse(\n        Buffer.from(parts[0]!, \"base64url\").toString(\"utf-8\"),\n      ) as Record<string, unknown>;\n      const payload = JSON.parse(\n        Buffer.from(parts[1]!, \"base64url\").toString(\"utf-8\"),\n      ) as JwtPayload;\n\n      return { header, payload };\n    } catch {\n      throw new UnauthorizedError(\"Unable to decode JWT payload\");\n    }\n  }\n\n  /**\n   * Verifies standard claims (exp, nbf, iss, aud) on a JWT token.\n   *\n   * @param token - Bearer access token\n   * @returns Validated JwtPayload claims\n   */\n  public async verifyToken(token: string): Promise<JwtPayload> {\n    const { payload } = this.parseUnverified(token);\n    const nowSeconds = Math.floor(Date.now() / 1000);\n\n    // 1. Validate Expiration (exp)\n    if (typeof payload.exp === \"number\" && nowSeconds >= payload.exp) {\n      logger.warn(\"[verifyToken] Token has expired\", {\n        exp: payload.exp,\n        now: nowSeconds,\n      });\n      throw new UnauthorizedError(\"Authentication token has expired\");\n    }\n\n    // 2. Validate Not Before (nbf)\n    if (typeof payload.nbf === \"number\" && nowSeconds < payload.nbf) {\n      logger.warn(\"[verifyToken] Token not yet valid\", {\n        nbf: payload.nbf,\n        now: nowSeconds,\n      });\n      throw new UnauthorizedError(\"Authentication token is not yet active\");\n    }\n\n    // 3. Validate Issuer (iss)\n    if (this.issuer && payload.iss && payload.iss !== this.issuer) {\n      logger.warn(\"[verifyToken] Issuer mismatch\", {\n        expected: this.issuer,\n        actual: payload.iss,\n      });\n      throw new UnauthorizedError(\"Token issuer mismatch\");\n    }\n\n    // 4. Validate Audience (aud)\n    if (this.audience && payload.aud) {\n      const audList = Array.isArray(payload.aud) ? payload.aud : [payload.aud];\n      if (!audList.includes(this.audience)) {\n        logger.warn(\"[verifyToken] Audience mismatch\", {\n          expected: this.audience,\n          actual: payload.aud,\n        });\n        throw new UnauthorizedError(\"Token audience mismatch\");\n      }\n    }\n\n    logger.debug(\"[verifyToken] Successfully validated token claims\", {\n      sub: payload.sub,\n    });\n    return payload;\n  }\n\n  /**\n   * Clears cached public keys from memory.\n   */\n  public clearKeyCache(): void {\n    this.keyCache.clear();\n    logger.info(\"[clearKeyCache] JWKS public key cache cleared\");\n  }\n}\n","/**\n * @file packages/auth-server/src/guards/auth-guards.ts\n * @description Authorization assertions and scope/role enforcement guards.\n * @module @yuva-devlab/auth-server\n */\n\nimport { ForbiddenError, UnauthorizedError } from \"@yuva-devlab/errors\";\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport type { ApiKey, AuthContext, AuthUser } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"AuthGuards\"));\n\n/**\n * Asserts that the request is authenticated with an active user session and optional role requirements.\n *\n * @param ctx - Inbound request auth context\n * @param requiredRoles - Optional list of required roles (user must possess at least one)\n * @returns Authenticated AuthUser\n * @throws UnauthorizedError if not authenticated as a user\n * @throws ForbiddenError if user lacks the required roles\n *\n * @example\n * ```typescript\n * const user = requireUser(ctx, [\"admin\", \"operator\"]);\n * ```\n */\nexport function requireUser(\n  ctx: AuthContext,\n  requiredRoles?: readonly string[],\n): AuthUser {\n  if (!ctx.authenticated || !ctx.user) {\n    logger.warn(\n      \"[requireUser] Request rejected: missing authenticated user context\",\n    );\n    throw new UnauthorizedError(\n      \"Authentication required: valid user session required\",\n    );\n  }\n\n  if (requiredRoles && requiredRoles.length > 0) {\n    const hasRole = requiredRoles.some((role) => ctx.roles.includes(role));\n    if (!hasRole) {\n      logger.warn(\"[requireUser] User lacks required roles\", {\n        userId: ctx.user.id,\n        userRoles: ctx.roles,\n        requiredRoles,\n      });\n      throw new ForbiddenError(\n        `Insufficient privileges: requires one of [${requiredRoles.join(\", \")}]`,\n      );\n    }\n  }\n\n  return ctx.user;\n}\n\n/**\n * Asserts that the request is authenticated via a machine-to-machine API key.\n *\n * @param ctx - Inbound request auth context\n * @returns Authenticated ApiKey\n * @throws UnauthorizedError if not authenticated via an API key\n */\nexport function requireApiKey(ctx: AuthContext): ApiKey {\n  if (!ctx.authenticated || !ctx.apiKey) {\n    logger.warn(\"[requireApiKey] Request rejected: missing machine API key\");\n    throw new UnauthorizedError(\n      \"Authentication required: valid API key required\",\n    );\n  }\n\n  return ctx.apiKey;\n}\n\n/**\n * Asserts that the authenticated context (user or API key) possesses a specific operational scope.\n *\n * @param ctx - Inbound request auth context\n * @param scope - Required scope or permission string\n * @throws ForbiddenError if scope is missing\n */\nexport function requireScope(ctx: AuthContext, scope: string): void {\n  if (!ctx.roles.includes(scope)) {\n    logger.warn(\"[requireScope] Missing required scope\", {\n      roles: ctx.roles,\n      requiredScope: scope,\n    });\n    throw new ForbiddenError(`Missing required scope: '${scope}'`);\n  }\n}\n","/**\n * @file packages/auth-server/src/middleware/auth-middleware.ts\n * @description Universal HTTP middleware providing platform kill-switch enforcement and credential validation.\n * @module @yuva-devlab/auth-server\n */\n\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport {\n  DEFAULT_API_KEY_HEADER,\n  DEFAULT_AUTH_HEADER,\n  DEFAULT_BEARER_PREFIX,\n  DEFAULT_PUBLIC_PATHS,\n  HTTP_STATUS_SERVICE_UNAVAILABLE,\n  HTTP_STATUS_UNAUTHORIZED,\n} from \"../constants\";\nimport { AppStatus, type AuthContext } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"AuthMiddleware\"));\n\n/**\n * Minimal HTTP request and response interfaces for framework neutrality (Express, Fastify, Node http).\n */\nexport interface GenericHttpRequest {\n  url?: string;\n  method?: string;\n  headers: Record<string, string | string[] | undefined>;\n  authContext?: AuthContext;\n}\n\nexport interface GenericHttpResponse {\n  statusCode?: number;\n  setHeader(name: string, value: string): void;\n  end(body?: string): void;\n}\n\n/**\n * Creates a kill-switch middleware that intercepts all traffic if an application is deactivated.\n *\n * @param getAppStatus - Callback returning current platform status of the application\n * @returns Middleware function returning true if allowed to proceed, false if blocked (503)\n *\n * @example\n * ```typescript\n * const killSwitch = createAppKillSwitchMiddleware(() => appState.status);\n * const allowed = await killSwitch(req, res);\n * if (!allowed) return;\n * ```\n */\nexport function createAppKillSwitchMiddleware(\n  getAppStatus: () => Promise<AppStatus> | AppStatus,\n) {\n  return async (\n    req: GenericHttpRequest,\n    res: GenericHttpResponse,\n  ): Promise<boolean> => {\n    const status = await getAppStatus();\n\n    // If application has been administratively disabled or put into maintenance\n    if (status === AppStatus.INACTIVE || status === AppStatus.MAINTENANCE) {\n      logger.warn(\n        \"[killSwitch] Application is inactive or under maintenance; request rejected\",\n        {\n          url: req.url,\n          method: req.method,\n          appStatus: status,\n        },\n      );\n\n      res.statusCode = HTTP_STATUS_SERVICE_UNAVAILABLE;\n      res.setHeader(\"Content-Type\", \"application/json\");\n      res.end(\n        JSON.stringify({\n          error: {\n            code: \"APP_DEACTIVATED\",\n            message:\n              status === AppStatus.MAINTENANCE\n                ? \"Application is currently undergoing scheduled maintenance\"\n                : \"Application has been deactivated by platform administrators\",\n            status,\n          },\n        }),\n      );\n      return false;\n    }\n\n    return true;\n  };\n}\n\n/**\n * Options configuring request authentication middleware.\n */\nexport interface CreateAuthMiddlewareOptions {\n  /** Whitelisted public endpoints bypassing authentication */\n  publicPaths?: readonly string[];\n  /** Function resolving an API key against store */\n  validateApiKey?: (key: string) => Promise<AuthContext | null>;\n  /** Function resolving a Bearer session token against JWKS or session store */\n  validateToken?: (token: string) => Promise<AuthContext | null>;\n}\n\n/**\n * Universal authentication middleware verifying API keys and Bearer tokens.\n *\n * @param options - Configuration options\n * @returns Middleware handler\n */\nexport function createAuthMiddleware(options: CreateAuthMiddlewareOptions) {\n  const publicPaths = new Set([\n    ...DEFAULT_PUBLIC_PATHS,\n    ...(options.publicPaths ?? []),\n  ]);\n\n  return async (\n    req: GenericHttpRequest,\n    res: GenericHttpResponse,\n  ): Promise<boolean> => {\n    const urlPath = (req.url || \"/\").split(\"?\")[0] || \"/\";\n\n    // 1. Bypass authentication for whitelisted public paths\n    if (publicPaths.has(urlPath)) {\n      req.authContext = {\n        authenticated: false,\n        roles: [],\n        isAppActive: true,\n      };\n      return true;\n    }\n\n    // 2. Check for Machine-to-Machine API Key\n    const rawApiKey = req.headers[DEFAULT_API_KEY_HEADER];\n    const apiKey = typeof rawApiKey === \"string\" ? rawApiKey.trim() : undefined;\n\n    if (apiKey && options.validateApiKey) {\n      const apiKeyCtx = await options.validateApiKey(apiKey);\n      if (apiKeyCtx?.authenticated) {\n        logger.info(\"[authenticate] Authenticated via API Key\", {\n          path: urlPath,\n        });\n        req.authContext = apiKeyCtx;\n        return true;\n      }\n    }\n\n    // 3. Check for Bearer Token\n    const rawAuth = req.headers[DEFAULT_AUTH_HEADER];\n    const authHeader = typeof rawAuth === \"string\" ? rawAuth.trim() : undefined;\n\n    if (\n      authHeader?.startsWith(DEFAULT_BEARER_PREFIX) &&\n      options.validateToken\n    ) {\n      const token = authHeader.slice(DEFAULT_BEARER_PREFIX.length).trim();\n      const tokenCtx = await options.validateToken(token);\n      if (tokenCtx?.authenticated) {\n        logger.info(\"[authenticate] Authenticated via Bearer token\", {\n          path: urlPath,\n        });\n        req.authContext = tokenCtx;\n        return true;\n      }\n    }\n\n    // 4. Reject with 401 Unauthorized\n    logger.warn(\"[authenticate] Unauthorized request rejected\", {\n      path: urlPath,\n      method: req.method,\n    });\n\n    res.statusCode = HTTP_STATUS_UNAUTHORIZED;\n    res.setHeader(\"Content-Type\", \"application/json\");\n    res.end(\n      JSON.stringify({\n        error: {\n          code: \"UNAUTHORIZED\",\n          message:\n            \"Missing or invalid authentication credentials (Bearer token or API key required)\",\n        },\n      }),\n    );\n    return false;\n  };\n}\n"]}
+{"version":3,"sources":["../src/constants/auth.constants.ts","../src/types/auth.types.ts","../src/token/jwt-validator.ts","../src/token/m2m-validator.ts","../src/guards/auth-guards.ts","../src/middleware/auth-middleware.ts"],"names":["AppStatus","logger","loggerWithConfig","Logger","UnauthorizedError","ForbiddenError"],"mappings":";;;;;AAOO,IAAM,mBAAA,GAAsB;AAG5B,IAAM,sBAAA,GAAyB;AAG/B,IAAM,qBAAA,GAAwB;AAG9B,IAAM,yBAAA,GAA4B;AAGlC,IAAM,4BAAA,GAA+B;AAGrC,IAAM,oBAAA,GAAuB,OAAO,MAAA,CAAO;AAAA,EAChD,SAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,wBAAA,GAA2B;AAGjC,IAAM,qBAAA,GAAwB;AAG9B,IAAM,+BAAA,GAAkC;;;AC3BxC,IAAK,SAAA,qBAAAA,UAAAA,KAAL;AAEL,EAAAA,WAAA,QAAA,CAAA,GAAS,QAAA;AAET,EAAAA,WAAA,UAAA,CAAA,GAAW,UAAA;AAEX,EAAAA,WAAA,aAAA,CAAA,GAAc,aAAA;AANJ,EAAA,OAAAA,UAAAA;AAAA,CAAA,EAAA,SAAA,IAAA,EAAA;ACGZ,IAAM,MAAA,GAAS,gBAAA,CAAiB,IAAI,MAAA,CAAO,eAAe,CAAC,CAAA;AAkBpD,IAAM,gBAAN,MAAoB;AAAA,EACR,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,UAAA;AAAA,EACT,QAAA,uBAAe,GAAA,EAAuB;AAAA,EACtC,YAAA,GAGG,IAAA;AAAA,EAEJ,WAAA,CAAY,MAAA,GAA8B,EAAC,EAAG;AACnD,IAAA,IAAA,CAAK,OAAA,GACH,MAAA,CAAO,OAAA,KACN,MAAA,CAAO,MAAA,GAAS,GAAG,MAAA,CAAO,MAAM,CAAA,sBAAA,CAAA,GAA2B,MAAA,CAAA,KAC3D,OAAO,OAAA,KAAY,cACf,OAAA,CAAQ,GAAA,EAAK,eAAA,KACb,OAAA,CAAQ,GAAA,EAAK,eAAA,GACV,CAAA,EAAG,OAAA,CAAQ,GAAA,CAAI,eAAe,CAAA,sBAAA,CAAA,GAC9B,MAAA,CAAA,GACJ,MAAA,CAAA,IACJ,EAAA;AACF,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA;AACvB,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA;AACrB,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,yBAAA;AAAA,EACzC;AAAA,EAEO,gBAAgB,KAAA,EAMrB;AACA,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,KAAA;AAAA,QAClB,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAI,WAAW,CAAA,CAAE,SAAS,OAAO;AAAA,OACtD;AACA,MAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AAAA,QACnB,MAAA,CAAO,KAAK,KAAA,CAAM,CAAC,GAAI,WAAW,CAAA,CAAE,SAAS,OAAO;AAAA,OACtD;AACA,MAAA,OAAO;AAAA,QACL,MAAA;AAAA,QACA,OAAA;AAAA,QACA,SAAA,EAAW,MAAM,CAAC,CAAA;AAAA,QAClB,UAAA,EAAY,MAAM,CAAC,CAAA;AAAA,QACnB,SAAA,EAAW,MAAM,CAAC;AAAA,OACpB;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAkB,wCAAwC,CAAA;AAAA,IACtE;AAAA,EACF;AAAA,EAEA,MAAc,SAAA,GAA2C;AACvD,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,IAAA,CAAK,YAAA,IAAgB,IAAA,CAAK,YAAA,CAAa,YAAY,GAAA,EAAK;AAC1D,MAAA,OAAO,KAAK,YAAA,CAAa,IAAA;AAAA,IAC3B;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,EAAS;AAAA,QACpC,OAAA,EAAS,EAAE,MAAA,EAAQ,kBAAA,EAAmB;AAAA,QACtC,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACjC,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,MAC7D;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,EAAC;AAC3B,MAAA,IAAA,CAAK,eAAe,EAAE,IAAA,EAAM,SAAA,EAAW,GAAA,GAAM,KAAK,UAAA,EAAW;AAC7D,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,MAAM,8CAAA,EAAgD;AAAA,QAC3D,KAAK,IAAA,CAAK,OAAA;AAAA,QACV;AAAA,OACD,CAAA;AACD,MAAA,IAAI,IAAA,CAAK,YAAA,EAAc,IAAA,EAAM,OAAO,KAAK,YAAA,CAAa,IAAA;AACtD,MAAA,MAAM,IAAI,kBAAkB,yCAAyC,CAAA;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAc,iBAAiB,GAAA,EAAyC;AACtE,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,MAAM,WAAW,GAAA,IAAO,aAAA;AACxB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,QAAQ,CAAA;AAEzC,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,EAAK;AACpC,MAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IAChB;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,SAAA,EAAU;AAClC,IAAA,MAAM,OAAA,GAAU,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,GAAA,KAAQ,GAAG,CAAA,GAAI,IAAA,CAAK,CAAC,CAAA;AAE9D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,CAAA,0CAAA,EAA6C,OAAO,SAAS,CAAA;AAAA,OAC/D;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,OAAO,eAAA,CAAgB;AAAA,QACvC,GAAA,EAAK,OAAA;AAAA,QACL,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,IAAA,CAAK,QAAA,CAAS,IAAI,QAAA,EAAU;AAAA,QAC1B,SAAA;AAAA,QACA,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB,CAAA;AACD,MAAA,OAAO,SAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,MAAA,CAAO,MAAM,mDAAA,EAAqD;AAAA,QAChE,GAAA;AAAA,QACA;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAI,kBAAkB,+BAA+B,CAAA;AAAA,IAC7D;AAAA,EACF;AAAA,EAEA,MAAa,YAAY,KAAA,EAAoC;AAC3D,IAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,SAAA,EAAW,YAAY,SAAA,EAAU,GACxD,IAAA,CAAK,eAAA,CAAgB,KAAK,CAAA;AAE5B,IAAA,IAAI,MAAA,CAAO,GAAA,IAAO,MAAA,CAAO,GAAA,KAAQ,OAAA,EAAS;AACxC,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,CAAA,+BAAA,EAAkC,OAAO,GAAG,CAAA,gBAAA;AAAA,OAC9C;AAAA,IACF;AAEA,IAAA,MAAM,MAAM,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAC1D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,gBAAA,CAAiB,GAAG,CAAA;AAEjD,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,SAAS,CAAA,CAAA,EAAI,UAAU,CAAA,CAAE,CAAA;AACrD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,IAAA,CAAK,SAAA,EAAW,WAAW,CAAA;AACpD,IAAA,MAAM,mBAAmB,MAAA,CAAO,MAAA;AAAA,MAC9B,YAAA;AAAA,MACA,IAAA;AAAA,MACA,SAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,MAAA,MAAA,CAAO,KAAK,oDAAA,EAAsD;AAAA,QAChE,KAAK,OAAA,CAAQ,GAAA;AAAA,QACb;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAI,kBAAkB,yBAAyB,CAAA;AAAA,IACvD;AAEA,IAAA,MAAM,aAAa,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,GAAA,KAAQ,GAAI,CAAA;AAC/C,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,UAAA,IAAc,QAAQ,GAAA,EAAK;AAChE,MAAA,MAAM,IAAI,kBAAkB,kCAAkC,CAAA;AAAA,IAChE;AAEA,IAAA,IAAI,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,UAAA,GAAa,QAAQ,GAAA,EAAK;AAC/D,MAAA,MAAM,IAAI,kBAAkB,wCAAwC,CAAA;AAAA,IACtE;AAEA,IAAA,IAAI,KAAK,MAAA,IAAU,OAAA,CAAQ,OAAO,OAAA,CAAQ,GAAA,KAAQ,KAAK,MAAA,EAAQ;AAC7D,MAAA,MAAM,IAAI,iBAAA;AAAA,QACR,CAAA,gCAAA,EAAmC,IAAA,CAAK,MAAM,CAAA,MAAA,EAAS,QAAQ,GAAG,CAAA;AAAA,OACpE;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAK;AAChC,MAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,OAAA,CAAQ,GAAG,IAAI,OAAA,CAAQ,GAAA,GAAM,CAAC,OAAA,CAAQ,GAAG,CAAA;AACvE,MAAA,IAAI,CAAC,OAAA,CAAQ,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,EAAG;AACpC,QAAA,MAAM,IAAI,iBAAA;AAAA,UACR,CAAA,kCAAA,EAAqC,KAAK,QAAQ,CAAA;AAAA,SACpD;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEO,aAAA,GAAsB;AAC3B,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,MAAA,CAAO,KAAK,+CAA+C,CAAA;AAAA,EAC7D;AACF;ACrNA,IAAMC,OAAAA,GAASC,gBAAAA,CAAiB,IAAIC,MAAAA,CAAO,oBAAoB,CAAC,CAAA;AAUzD,IAAM,qBAAN,MAAyB;AAAA,EACb,OAAA;AAAA,EACA,UAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,QAAA,uBAAe,GAAA,EAA0B;AAAA,EAEnD,WAAA,CAAY,MAAA,GAA6B,EAAC,EAAG;AAClD,IAAA,IAAA,CAAK,OAAA,GACH,OAAO,OAAA,IACP,MAAA,CAAO,aACP,OAAA,CAAQ,GAAA,CAAI,eAAA,IACZ,OAAA,CAAQ,GAAA,CAAI,iBAAA;AACd,IAAA,IAAA,CAAK,UAAA,GAAa,OAAO,UAAA,IAAc,4BAAA;AACvC,IAAA,IAAA,CAAK,gBAAA,GAAmB,MAAA,CAAO,gBAAA,IAAoB,MAAA,CAAO,aAAA;AAC1D,IAAA,IAAA,CAAK,iBAAiB,MAAA,CAAO,cAAA;AAAA,EAC/B;AAAA,EAEA,MAAa,YAAY,MAAA,EAAiD;AACxE,IAAA,MAAM,OAAA,GAAU,OAAO,IAAA,EAAK;AAC5B,IAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAIC,kBAAkB,2CAA2C,CAAA;AAAA,IACzE;AAEA,IAAA,IAAI,CAAC,KAAK,OAAA,EAAS;AACjB,MAAA,MAAM,IAAIA,iBAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA;AACxC,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,SAAA,GAAY,GAAA,EAAK;AACpC,MAAA,OAAO,IAAA,CAAK,qBAAA,CAAsB,MAAA,CAAO,MAAM,CAAA;AAAA,IACjD;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,yBAAA,CAAA;AAC3B,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK;AAAA,QAC3B,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,kBAAA;AAAA,UACR,aAAA,EAAe,UAAU,OAAO,CAAA;AAAA,SAClC;AAAA,QACA,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,GAAI;AAAA,OACjC,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,iDAAA,EAAoD,IAAI,MAAM,CAAA;AAAA,SAChE;AAAA,MACF;AAEA,MAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,QAAA,MAAM,IAAIA,iBAAAA,CAAkB,IAAA,CAAK,MAAA,IAAU,yBAAyB,CAAA;AAAA,MACtE;AAEA,MAAA,IAAA,CAAK,QAAA,CAAS,IAAI,OAAA,EAAS;AAAA,QACzB,MAAA,EAAQ,IAAA;AAAA,QACR,SAAA,EAAW,MAAM,IAAA,CAAK;AAAA,OACvB,CAAA;AAED,MAAA,OAAO,IAAA,CAAK,sBAAsB,IAAI,CAAA;AAAA,IACxC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAeA,iBAAAA,IAAqB,GAAA,YAAe,cAAA,EAAgB;AACrE,QAAA,MAAM,GAAA;AAAA,MACR;AACA,MAAAH,OAAAA,CAAO,MAAM,0DAAA,EAA4D;AAAA,QACvE;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAIG,iBAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,sBACN,MAAA,EACwB;AACxB,IAAA,IACE,KAAK,gBAAA,IACL,MAAA,CAAO,SACP,MAAA,CAAO,KAAA,KAAU,KAAK,gBAAA,EACtB;AACA,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,sBAAA,GACE,MAAA,CAAO,KAAA,GACP,aAAA,GACA,IAAA,CAAK;AAAA,OACT;AAAA,IACF;AAEA,IAAA,IAAI,IAAA,CAAK,cAAA,IAAkB,IAAA,CAAK,cAAA,CAAe,SAAS,CAAA,EAAG;AACzD,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,MAAA,IAAU,EAAC;AACpC,MAAA,MAAM,WAAA,GAAc,SAAA,CAAU,QAAA,CAAS,GAAG,CAAA;AAC1C,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,MAAM,MAAA,GAAS,KAAK,cAAA,CAAe,KAAA;AAAA,UAAM,CAAC,KAAA,KACxC,SAAA,CAAU,QAAA,CAAS,KAAK;AAAA,SAC1B;AACA,QAAA,IAAI,CAAC,MAAA,EAAQ;AACX,UAAA,MAAM,IAAI,cAAA;AAAA,YACR,kCAAA,GACE,IAAA,CAAK,cAAA,CAAe,IAAA,CAAK,IAAI,CAAA,GAC7B;AAAA,WACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEO,UAAA,GAAmB;AACxB,IAAA,IAAA,CAAK,SAAS,KAAA,EAAM;AACpB,IAAAH,OAAAA,CAAO,KAAK,+CAA+C,CAAA;AAAA,EAC7D;AACF;AC/HA,IAAMA,OAAAA,GAASC,gBAAAA,CAAiB,IAAIC,MAAAA,CAAO,YAAY,CAAC,CAAA;AAgBjD,SAAS,WAAA,CACd,KACA,aAAA,EACU;AACV,EAAA,IAAI,CAAC,GAAA,CAAI,aAAA,IAAiB,CAAC,IAAI,IAAA,EAAM;AACnC,IAAAF,OAAAA,CAAO,IAAA;AAAA,MACL;AAAA,KACF;AACA,IAAA,MAAM,IAAIG,iBAAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,aAAA,IAAiB,aAAA,CAAc,MAAA,GAAS,CAAA,EAAG;AAC7C,IAAA,MAAM,OAAA,GAAU,cAAc,IAAA,CAAK,CAAC,SAAS,GAAA,CAAI,KAAA,CAAM,QAAA,CAAS,IAAI,CAAC,CAAA;AACrE,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAAH,OAAAA,CAAO,KAAK,yCAAA,EAA2C;AAAA,QACrD,MAAA,EAAQ,IAAI,IAAA,CAAK,EAAA;AAAA,QACjB,WAAW,GAAA,CAAI,KAAA;AAAA,QACf;AAAA,OACD,CAAA;AACD,MAAA,MAAM,IAAII,cAAAA;AAAA,QACR,CAAA,0CAAA,EAA6C,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,OACvE;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,GAAA,CAAI,IAAA;AACb;AASO,SAAS,cAAc,GAAA,EAA0B;AACtD,EAAA,IAAI,CAAC,GAAA,CAAI,aAAA,IAAiB,CAAC,IAAI,MAAA,EAAQ;AACrC,IAAAJ,OAAAA,CAAO,KAAK,2DAA2D,CAAA;AACvE,IAAA,MAAM,IAAIG,iBAAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO,GAAA,CAAI,MAAA;AACb;AASO,SAAS,YAAA,CAAa,KAAkB,KAAA,EAAqB;AAClE,EAAA,IAAI,CAAC,GAAA,CAAI,KAAA,CAAM,QAAA,CAAS,KAAK,CAAA,EAAG;AAC9B,IAAAH,OAAAA,CAAO,KAAK,uCAAA,EAAyC;AAAA,MACnD,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,aAAA,EAAe;AAAA,KAChB,CAAA;AACD,IAAA,MAAM,IAAII,cAAAA,CAAe,CAAA,yBAAA,EAA4B,KAAK,CAAA,CAAA,CAAG,CAAA;AAAA,EAC/D;AACF;ACxEA,IAAMJ,OAAAA,GAASC,gBAAAA,CAAiB,IAAIC,MAAAA,CAAO,gBAAgB,CAAC,CAAA;AA+BrD,SAAS,8BACd,YAAA,EACA;AACA,EAAA,OAAO,OACL,KACA,GAAA,KACqB;AACrB,IAAA,MAAM,MAAA,GAAS,MAAM,YAAA,EAAa;AAGlC,IAAA,IAAI,wCAAiC,MAAA,KAAA,aAAA,oBAAkC;AACrE,MAAAF,OAAAA,CAAO,IAAA;AAAA,QACL,6EAAA;AAAA,QACA;AAAA,UACE,KAAK,GAAA,CAAI,GAAA;AAAA,UACT,QAAQ,GAAA,CAAI,MAAA;AAAA,UACZ,SAAA,EAAW;AAAA;AACb,OACF;AAEA,MAAA,GAAA,CAAI,UAAA,GAAa,+BAAA;AACjB,MAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,MAAA,GAAA,CAAI,GAAA;AAAA,QACF,KAAK,SAAA,CAAU;AAAA,UACb,KAAA,EAAO;AAAA,YACL,IAAA,EAAM,iBAAA;AAAA,YACN,OAAA,EACE,6CACI,2DAAA,GACA,6DAAA;AAAA,YACN;AAAA;AACF,SACD;AAAA,OACH;AACA,MAAA,OAAO,KAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AACF;AAoBO,SAAS,qBAAqB,OAAA,EAAsC;AACzE,EAAA,MAAM,WAAA,uBAAkB,GAAA,CAAI;AAAA,IAC1B,GAAG,oBAAA;AAAA,IACH,GAAI,OAAA,CAAQ,WAAA,IAAe;AAAC,GAC7B,CAAA;AAED,EAAA,OAAO,OACL,KACA,GAAA,KACqB;AACrB,IAAA,MAAM,OAAA,GAAA,CAAW,IAAI,GAAA,IAAO,GAAA,EAAK,MAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAGlD,IAAA,IAAI,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA,EAAG;AAC5B,MAAA,GAAA,CAAI,WAAA,GAAc;AAAA,QAChB,aAAA,EAAe,KAAA;AAAA,QACf,OAAO,EAAC;AAAA,QACR,WAAA,EAAa;AAAA,OACf;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAGA,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AACpD,IAAA,MAAM,SAAS,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,CAAU,MAAK,GAAI,MAAA;AAElE,IAAA,IAAI,MAAA,IAAU,QAAQ,cAAA,EAAgB;AACpC,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,cAAA,CAAe,MAAM,CAAA;AACrD,MAAA,IAAI,WAAW,aAAA,EAAe;AAC5B,QAAAA,OAAAA,CAAO,KAAK,0CAAA,EAA4C;AAAA,UACtD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,GAAA,CAAI,WAAA,GAAc,SAAA;AAClB,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,mBAAmB,CAAA;AAC/C,IAAA,MAAM,aAAa,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,CAAQ,MAAK,GAAI,MAAA;AAElE,IAAA,IACE,UAAA,EAAY,UAAA,CAAW,qBAAqB,CAAA,IAC5C,QAAQ,aAAA,EACR;AACA,MAAA,MAAM,QAAQ,UAAA,CAAW,KAAA,CAAM,qBAAA,CAAsB,MAAM,EAAE,IAAA,EAAK;AAClE,MAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,aAAA,CAAc,KAAK,CAAA;AAClD,MAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,QAAAA,OAAAA,CAAO,KAAK,+CAAA,EAAiD;AAAA,UAC3D,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,GAAA,CAAI,WAAA,GAAc,QAAA;AAClB,QAAA,OAAO,IAAA;AAAA,MACT;AAAA,IACF;AAGA,IAAAA,OAAAA,CAAO,KAAK,8CAAA,EAAgD;AAAA,MAC1D,IAAA,EAAM,OAAA;AAAA,MACN,QAAQ,GAAA,CAAI;AAAA,KACb,CAAA;AAED,IAAA,GAAA,CAAI,UAAA,GAAa,wBAAA;AACjB,IAAA,GAAA,CAAI,SAAA,CAAU,gBAAgB,kBAAkB,CAAA;AAChD,IAAA,GAAA,CAAI,GAAA;AAAA,MACF,KAAK,SAAA,CAAU;AAAA,QACb,KAAA,EAAO;AAAA,UACL,IAAA,EAAM,cAAA;AAAA,UACN,OAAA,EACE;AAAA;AACJ,OACD;AAAA,KACH;AACA,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACF","file":"index.js","sourcesContent":["/**\n * @file packages/auth-server/src/constants/auth.constants.ts\n * @description Centralized constants and header keys for server-side authentication.\n * @module @yuva-devlab/auth-server\n */\n\n/** Standard Authorization HTTP header name (lowercase for case-insensitive lookup) */\nexport const DEFAULT_AUTH_HEADER = \"authorization\";\n\n/** Standard machine-to-machine API key HTTP header name */\nexport const DEFAULT_API_KEY_HEADER = \"x-api-key\";\n\n/** Standard Bearer token prefix */\nexport const DEFAULT_BEARER_PREFIX = \"Bearer \";\n\n/** Default cache time-to-live for fetched RS256 JWKS public keys (1 hour) */\nexport const DEFAULT_JWKS_CACHE_TTL_MS = 3_600_000;\n\n/** Default cache time-to-live for validated M2M API keys (5 minutes) */\nexport const DEFAULT_API_KEY_CACHE_TTL_MS = 300_000;\n\n/** Default public endpoints bypassing mandatory authentication */\nexport const DEFAULT_PUBLIC_PATHS = Object.freeze([\n  \"/health\",\n  \"/ready\",\n  \"/live\",\n  \"/metrics\",\n]);\n\n/** HTTP Status Code for unauthenticated requests */\nexport const HTTP_STATUS_UNAUTHORIZED = 401;\n\n/** HTTP Status Code for unauthorized / forbidden role requests */\nexport const HTTP_STATUS_FORBIDDEN = 403;\n\n/** HTTP Status Code returned when an application is deactivated or killed */\nexport const HTTP_STATUS_SERVICE_UNAVAILABLE = 503;\n","/**\n * @file packages/auth-server/src/types/auth.types.ts\n * @description Type definitions and contracts for server authentication, JWKS, and app lifecycle.\n * @module @yuva-devlab/auth-server\n */\n\n/**\n * Operational state of an application on the DevLab platform.\n */\nexport enum AppStatus {\n  /** Application is fully operational and serving traffic */\n  ACTIVE = \"ACTIVE\",\n  /** Application has been administratively disabled / deactivated (Kill-Switch triggered) */\n  INACTIVE = \"INACTIVE\",\n  /** Application is undergoing scheduled maintenance */\n  MAINTENANCE = \"MAINTENANCE\",\n}\n\n/**\n * Authenticated user profile representation.\n */\nexport interface AuthUser {\n  /** Canonical user UUID */\n  readonly id: string;\n  /** Primary user email address */\n  readonly email?: string;\n  /** Granted role slugs */\n  readonly roles: readonly string[];\n  /** Tenant isolation partition ID */\n  readonly tenantId?: string;\n  /** Arbitrary profile metadata */\n  readonly metadata?: Record<string, unknown>;\n}\n\n/**\n * Machine-to-machine API key credential.\n */\nexport interface ApiKey {\n  /** Primary API key UUID */\n  readonly id: string;\n  /** Secure key string */\n  readonly key: string;\n  /** Human-readable key name or description */\n  readonly name: string;\n  /** Scoped roles granted to this key */\n  readonly roles: readonly string[];\n  /** Tenant ID partition */\n  readonly tenantId?: string;\n  /** Active status flag */\n  readonly isEnabled: boolean;\n}\n\n/**\n * Evaluated authentication context attached to inbound requests.\n */\nexport interface AuthContext {\n  /** Whether the request carries valid credentials */\n  readonly authenticated: boolean;\n  /** Authenticated user if authenticated via session/JWT */\n  readonly user?: AuthUser;\n  /** Authenticated API key if authenticated via machine credential */\n  readonly apiKey?: ApiKey;\n  /** Consolidated roles granted across user or API key */\n  readonly roles: readonly string[];\n  /** Whether the host application is currently active on the platform */\n  readonly isAppActive: boolean;\n  /** Detailed app status */\n  readonly appStatus?: AppStatus;\n  /** Tenant partition ID */\n  readonly tenantId?: string;\n  /** Distributed trace request identifier */\n  readonly requestId?: string;\n}\n\n/**\n * Configuration for verifying RS256 JWTs against a remote JWKS endpoint.\n */\nexport interface JwksConfig {\n  /** JWKS endpoint URI exposing JSON Web Keys */\n  readonly jwksUri: string;\n  /** Expected audience claim */\n  readonly audience?: string;\n  /** Expected issuer claim */\n  readonly issuer?: string;\n  /** In-memory cache duration for public keys in milliseconds */\n  readonly cacheTtlMs?: number;\n}\n\n/**\n * Decoded JWT claims payload.\n */\n\n/**\n * Result of validating a Machine-to-Machine API key against the DevLab Portal.\n */\nexport interface ApiKeyValidationResult {\n  /** Whether the API key is active, valid, and unexpired */\n  readonly valid: boolean;\n  /** Primary API key UUID */\n  readonly keyId?: string;\n  /** Name assigned to this machine key */\n  readonly name?: string;\n  /** Target application slug this key belongs to */\n  readonly appId?: string;\n  /** Target application display name */\n  readonly appName?: string;\n  /** Scopes and permissions granted to this key */\n  readonly scopes?: readonly string[];\n  /** Allowed requests per minute limit */\n  readonly rateLimitRpm?: number;\n  /** Human-readable rejection reason if invalid */\n  readonly reason?: string;\n}\n\n/**\n * Configuration options for Machine-to-Machine API key validation.\n */\nexport interface M2mConfig {\n  /** Base URL of the authentication server / identity provider */\n  readonly authUrl?: string;\n  /** Legacy alias for authUrl */\n  readonly portalUrl?: string;\n  /** In-memory cache duration for validated API keys in milliseconds */\n  readonly cacheTtlMs?: number;\n  /** Expected client or application identifier */\n  readonly requiredClientId?: string;\n  /** Legacy alias for requiredClientId */\n  readonly requiredAppId?: string;\n  /** Required operational scopes that must be granted to the API key */\n  readonly requiredScopes?: readonly string[];\n}\n\nexport interface JwtPayload {\n  readonly sub: string;\n  readonly iss?: string;\n  readonly aud?: string | readonly string[];\n  readonly exp?: number;\n  readonly nbf?: number;\n  readonly iat?: number;\n  readonly email?: string;\n  readonly name?: string;\n  readonly role?: string;\n  readonly roles?: readonly string[];\n  readonly tenantId?: string;\n  readonly tenant_id?: string;\n  readonly tenant_slug?: string;\n  readonly tenant_name?: string;\n  readonly apps?: readonly string[];\n  readonly appId?: string;\n  readonly [key: string]: unknown;\n}\n","/**\n * @file packages/auth-server/src/token/jwt-validator.ts\n * @description RS256 JWKS validator providing cryptographic signature verification and claims checking.\n * @module @yuva-devlab/auth-server\n */\n\nimport crypto from \"node:crypto\";\nimport { UnauthorizedError } from \"@yuva-devlab/errors\";\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport { DEFAULT_JWKS_CACHE_TTL_MS } from \"../constants\";\nimport type { JwksConfig, JwtPayload } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"JwksValidator\"));\n\ninterface CachedKey {\n  readonly keyObject: crypto.KeyObject;\n  readonly expiresAt: number;\n}\n\ninterface JwkRecord {\n  readonly kid?: string;\n  readonly kty: string;\n  readonly alg?: string;\n  readonly use?: string;\n  readonly [key: string]: unknown;\n}\n\n/**\n * Validates JWT access tokens against an in-memory cached JWKS public key set.\n */\nexport class JwksValidator {\n  private readonly jwksUri: string;\n  private readonly audience?: string;\n  private readonly issuer?: string;\n  private readonly cacheTtlMs: number;\n  private keyCache = new Map<string, CachedKey>();\n  private jwksSetCache: {\n    keys: readonly JwkRecord[];\n    expiresAt: number;\n  } | null = null;\n\n  public constructor(config: Partial<JwksConfig> = {}) {\n    this.jwksUri =\n      config.jwksUri ??\n      (config.issuer ? `${config.issuer}/.well-known/jwks.json` : undefined) ??\n      (typeof process !== \"undefined\"\n        ? (process.env?.DEVLAB_JWKS_URI ??\n          (process.env?.DEVLAB_AUTH_URL\n            ? `${process.env.DEVLAB_AUTH_URL}/.well-known/jwks.json`\n            : undefined))\n        : undefined) ??\n      \"\";\n    this.audience = config.audience;\n    this.issuer = config.issuer;\n    this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_JWKS_CACHE_TTL_MS;\n  }\n\n  public parseUnverified(token: string): {\n    header: Record<string, unknown>;\n    payload: JwtPayload;\n    rawHeader: string;\n    rawPayload: string;\n    signature: string;\n  } {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) {\n      throw new UnauthorizedError(\n        \"Malformed JWT token format: expected 3 segments\",\n      );\n    }\n\n    try {\n      const header = JSON.parse(\n        Buffer.from(parts[0]!, \"base64url\").toString(\"utf-8\"),\n      ) as Record<string, unknown>;\n      const payload = JSON.parse(\n        Buffer.from(parts[1]!, \"base64url\").toString(\"utf-8\"),\n      ) as JwtPayload;\n      return {\n        header,\n        payload,\n        rawHeader: parts[0]!,\n        rawPayload: parts[1]!,\n        signature: parts[2]!,\n      };\n    } catch {\n      throw new UnauthorizedError(\"Unable to decode JWT header or payload\");\n    }\n  }\n\n  private async fetchJwks(): Promise<readonly JwkRecord[]> {\n    if (!this.jwksUri) {\n      throw new UnauthorizedError(\n        \"JwksValidator: jwksUri, issuer, or DEVLAB_AUTH_URL must be configured\",\n      );\n    }\n    const now = Date.now();\n    if (this.jwksSetCache && this.jwksSetCache.expiresAt > now) {\n      return this.jwksSetCache.keys;\n    }\n\n    try {\n      const res = await fetch(this.jwksUri, {\n        headers: { Accept: \"application/json\" },\n        signal: AbortSignal.timeout(5000),\n      });\n\n      if (!res.ok) {\n        throw new Error(`JWKS endpoint returned HTTP ${res.status}`);\n      }\n\n      const body = (await res.json()) as { keys?: readonly JwkRecord[] };\n      const keys = body.keys ?? [];\n      this.jwksSetCache = { keys, expiresAt: now + this.cacheTtlMs };\n      return keys;\n    } catch (err) {\n      logger.error(\"[fetchJwks] Failed to fetch JWKS public keys\", {\n        uri: this.jwksUri,\n        err,\n      });\n      if (this.jwksSetCache?.keys) return this.jwksSetCache.keys;\n      throw new UnauthorizedError(\"Authentication service JWKS unreachable\");\n    }\n  }\n\n  private async resolveKeyObject(kid?: string): Promise<crypto.KeyObject> {\n    const now = Date.now();\n    const cacheKey = kid ?? \"__default__\";\n    const cached = this.keyCache.get(cacheKey);\n\n    if (cached && cached.expiresAt > now) {\n      return cached.keyObject;\n    }\n\n    const jwks = await this.fetchJwks();\n    const matched = kid ? jwks.find((k) => k.kid === kid) : jwks[0];\n\n    if (!matched) {\n      throw new UnauthorizedError(\n        `No matching JWK public key found for kid: ${kid ?? \"default\"}`,\n      );\n    }\n\n    try {\n      const keyObject = crypto.createPublicKey({\n        key: matched as crypto.JsonWebKey,\n        format: \"jwk\",\n      });\n      this.keyCache.set(cacheKey, {\n        keyObject,\n        expiresAt: now + this.cacheTtlMs,\n      });\n      return keyObject;\n    } catch (err) {\n      logger.error(\"[resolveKeyObject] Failed to parse JWK public key\", {\n        kid,\n        err,\n      });\n      throw new UnauthorizedError(\"Invalid JWK public key format\");\n    }\n  }\n\n  public async verifyToken(token: string): Promise<JwtPayload> {\n    const { header, payload, rawHeader, rawPayload, signature } =\n      this.parseUnverified(token);\n\n    if (header.alg && header.alg !== \"RS256\") {\n      throw new UnauthorizedError(\n        `Unsupported signing algorithm: ${header.alg}. Expected RS256`,\n      );\n    }\n\n    const kid = typeof header.kid === \"string\" ? header.kid : undefined;\n    const keyObject = await this.resolveKeyObject(kid);\n\n    const data = Buffer.from(`${rawHeader}.${rawPayload}`);\n    const sigBuffer = Buffer.from(signature, \"base64url\");\n    const isSignatureValid = crypto.verify(\n      \"RSA-SHA256\",\n      data,\n      keyObject,\n      sigBuffer,\n    );\n\n    if (!isSignatureValid) {\n      logger.warn(\"[verifyToken] Cryptographic signature check failed\", {\n        sub: payload.sub,\n        kid,\n      });\n      throw new UnauthorizedError(\"Invalid token signature\");\n    }\n\n    const nowSeconds = Math.floor(Date.now() / 1000);\n    if (typeof payload.exp === \"number\" && nowSeconds >= payload.exp) {\n      throw new UnauthorizedError(\"Authentication token has expired\");\n    }\n\n    if (typeof payload.nbf === \"number\" && nowSeconds < payload.nbf) {\n      throw new UnauthorizedError(\"Authentication token is not yet active\");\n    }\n\n    if (this.issuer && payload.iss && payload.iss !== this.issuer) {\n      throw new UnauthorizedError(\n        `Token issuer mismatch: expected ${this.issuer}, got ${payload.iss}`,\n      );\n    }\n\n    if (this.audience && payload.aud) {\n      const audList = Array.isArray(payload.aud) ? payload.aud : [payload.aud];\n      if (!audList.includes(this.audience)) {\n        throw new UnauthorizedError(\n          `Token audience mismatch: expected ${this.audience}`,\n        );\n      }\n    }\n\n    return payload;\n  }\n\n  public clearKeyCache(): void {\n    this.keyCache.clear();\n    this.jwksSetCache = null;\n    logger.info(\"[clearKeyCache] JWKS public key cache cleared\");\n  }\n}\n","/**\n * @file packages/auth-server/src/token/m2m-validator.ts\n * @description In-memory cached Machine-to-Machine API key validator introspecting the auth provider.\n * @module @yuva-devlab/auth-server\n */\n\nimport { ForbiddenError, UnauthorizedError } from \"@yuva-devlab/errors\";\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport { DEFAULT_API_KEY_CACHE_TTL_MS } from \"../constants\";\nimport type { ApiKeyValidationResult, M2mConfig } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"M2mApiKeyValidator\"));\n\ninterface CachedApiKey {\n  readonly result: ApiKeyValidationResult;\n  readonly expiresAt: number;\n}\n\n/**\n * Validates machine-to-machine API keys against central authentication server with in-memory caching.\n */\nexport class M2mApiKeyValidator {\n  private readonly authUrl?: string;\n  private readonly cacheTtlMs: number;\n  private readonly requiredClientId?: string;\n  private readonly requiredScopes?: readonly string[];\n  private readonly keyCache = new Map<string, CachedApiKey>();\n\n  public constructor(config: Partial<M2mConfig> = {}) {\n    this.authUrl =\n      config.authUrl ??\n      config.portalUrl ??\n      process.env.DEVLAB_AUTH_URL ??\n      process.env.DEVLAB_PORTAL_URL;\n    this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_API_KEY_CACHE_TTL_MS;\n    this.requiredClientId = config.requiredClientId ?? config.requiredAppId;\n    this.requiredScopes = config.requiredScopes;\n  }\n\n  public async validateKey(rawKey: string): Promise<ApiKeyValidationResult> {\n    const trimmed = rawKey.trim();\n    if (!trimmed.startsWith(\"dlk_\")) {\n      throw new UnauthorizedError(\"Malformed API key: expected 'dlk_' prefix\");\n    }\n\n    if (!this.authUrl) {\n      throw new UnauthorizedError(\n        \"M2mApiKeyValidator: authUrl or DEVLAB_AUTH_URL must be configured for validation\",\n      );\n    }\n\n    const now = Date.now();\n    const cached = this.keyCache.get(trimmed);\n    if (cached && cached.expiresAt > now) {\n      return this.enforceKeyConstraints(cached.result);\n    }\n\n    try {\n      const url = `${this.authUrl}/api/v1/api-keys/validate`;\n      const res = await fetch(url, {\n        headers: {\n          Accept: \"application/json\",\n          Authorization: `Bearer ${trimmed}`,\n        },\n        signal: AbortSignal.timeout(5000),\n      });\n\n      if (!res.ok) {\n        throw new Error(\n          `Authentication validation endpoint returned HTTP ${res.status}`,\n        );\n      }\n\n      const body = (await res.json()) as ApiKeyValidationResult;\n      if (!body.valid) {\n        throw new UnauthorizedError(body.reason ?? \"Invalid machine API key\");\n      }\n\n      this.keyCache.set(trimmed, {\n        result: body,\n        expiresAt: now + this.cacheTtlMs,\n      });\n\n      return this.enforceKeyConstraints(body);\n    } catch (err) {\n      if (err instanceof UnauthorizedError || err instanceof ForbiddenError) {\n        throw err;\n      }\n      logger.error(\"[validateKey] Network error during API key introspection\", {\n        err,\n      });\n      throw new UnauthorizedError(\n        \"Authentication service unreachable for API key verification\",\n      );\n    }\n  }\n\n  private enforceKeyConstraints(\n    result: ApiKeyValidationResult,\n  ): ApiKeyValidationResult {\n    if (\n      this.requiredClientId &&\n      result.appId &&\n      result.appId !== this.requiredClientId\n    ) {\n      throw new ForbiddenError(\n        \"API key assigned to \" +\n          result.appId +\n          \", required \" +\n          this.requiredClientId,\n      );\n    }\n\n    if (this.requiredScopes && this.requiredScopes.length > 0) {\n      const keyScopes = result.scopes ?? [];\n      const hasWildcard = keyScopes.includes(\"*\");\n      if (!hasWildcard) {\n        const hasAll = this.requiredScopes.every((scope) =>\n          keyScopes.includes(scope),\n        );\n        if (!hasAll) {\n          throw new ForbiddenError(\n            \"API key lacks required scopes: [\" +\n              this.requiredScopes.join(\", \") +\n              \"]\",\n          );\n        }\n      }\n    }\n\n    return result;\n  }\n\n  public clearCache(): void {\n    this.keyCache.clear();\n    logger.info(\"[clearCache] API key validation cache cleared\");\n  }\n}\n","/**\n * @file packages/auth-server/src/guards/auth-guards.ts\n * @description Authorization assertions and scope/role enforcement guards.\n * @module @yuva-devlab/auth-server\n */\n\nimport { ForbiddenError, UnauthorizedError } from \"@yuva-devlab/errors\";\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport type { ApiKey, AuthContext, AuthUser } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"AuthGuards\"));\n\n/**\n * Asserts that the request is authenticated with an active user session and optional role requirements.\n *\n * @param ctx - Inbound request auth context\n * @param requiredRoles - Optional list of required roles (user must possess at least one)\n * @returns Authenticated AuthUser\n * @throws UnauthorizedError if not authenticated as a user\n * @throws ForbiddenError if user lacks the required roles\n *\n * @example\n * ```typescript\n * const user = requireUser(ctx, [\"admin\", \"operator\"]);\n * ```\n */\nexport function requireUser(\n  ctx: AuthContext,\n  requiredRoles?: readonly string[],\n): AuthUser {\n  if (!ctx.authenticated || !ctx.user) {\n    logger.warn(\n      \"[requireUser] Request rejected: missing authenticated user context\",\n    );\n    throw new UnauthorizedError(\n      \"Authentication required: valid user session required\",\n    );\n  }\n\n  if (requiredRoles && requiredRoles.length > 0) {\n    const hasRole = requiredRoles.some((role) => ctx.roles.includes(role));\n    if (!hasRole) {\n      logger.warn(\"[requireUser] User lacks required roles\", {\n        userId: ctx.user.id,\n        userRoles: ctx.roles,\n        requiredRoles,\n      });\n      throw new ForbiddenError(\n        `Insufficient privileges: requires one of [${requiredRoles.join(\", \")}]`,\n      );\n    }\n  }\n\n  return ctx.user;\n}\n\n/**\n * Asserts that the request is authenticated via a machine-to-machine API key.\n *\n * @param ctx - Inbound request auth context\n * @returns Authenticated ApiKey\n * @throws UnauthorizedError if not authenticated via an API key\n */\nexport function requireApiKey(ctx: AuthContext): ApiKey {\n  if (!ctx.authenticated || !ctx.apiKey) {\n    logger.warn(\"[requireApiKey] Request rejected: missing machine API key\");\n    throw new UnauthorizedError(\n      \"Authentication required: valid API key required\",\n    );\n  }\n\n  return ctx.apiKey;\n}\n\n/**\n * Asserts that the authenticated context (user or API key) possesses a specific operational scope.\n *\n * @param ctx - Inbound request auth context\n * @param scope - Required scope or permission string\n * @throws ForbiddenError if scope is missing\n */\nexport function requireScope(ctx: AuthContext, scope: string): void {\n  if (!ctx.roles.includes(scope)) {\n    logger.warn(\"[requireScope] Missing required scope\", {\n      roles: ctx.roles,\n      requiredScope: scope,\n    });\n    throw new ForbiddenError(`Missing required scope: '${scope}'`);\n  }\n}\n","/**\n * @file packages/auth-server/src/middleware/auth-middleware.ts\n * @description Universal HTTP middleware providing platform kill-switch enforcement and credential validation.\n * @module @yuva-devlab/auth-server\n */\n\nimport { Logger, loggerWithConfig } from \"@yuva-devlab/logger\";\nimport {\n  DEFAULT_API_KEY_HEADER,\n  DEFAULT_AUTH_HEADER,\n  DEFAULT_BEARER_PREFIX,\n  DEFAULT_PUBLIC_PATHS,\n  HTTP_STATUS_SERVICE_UNAVAILABLE,\n  HTTP_STATUS_UNAUTHORIZED,\n} from \"../constants\";\nimport { AppStatus, type AuthContext } from \"../types\";\n\nconst logger = loggerWithConfig(new Logger(\"AuthMiddleware\"));\n\n/**\n * Minimal HTTP request and response interfaces for framework neutrality (Express, Fastify, Node http).\n */\nexport interface GenericHttpRequest {\n  url?: string;\n  method?: string;\n  headers: Record<string, string | string[] | undefined>;\n  authContext?: AuthContext;\n}\n\nexport interface GenericHttpResponse {\n  statusCode?: number;\n  setHeader(name: string, value: string): void;\n  end(body?: string): void;\n}\n\n/**\n * Creates a kill-switch middleware that intercepts all traffic if an application is deactivated.\n *\n * @param getAppStatus - Callback returning current platform status of the application\n * @returns Middleware function returning true if allowed to proceed, false if blocked (503)\n *\n * @example\n * ```typescript\n * const killSwitch = createAppKillSwitchMiddleware(() => appState.status);\n * const allowed = await killSwitch(req, res);\n * if (!allowed) return;\n * ```\n */\nexport function createAppKillSwitchMiddleware(\n  getAppStatus: () => Promise<AppStatus> | AppStatus,\n) {\n  return async (\n    req: GenericHttpRequest,\n    res: GenericHttpResponse,\n  ): Promise<boolean> => {\n    const status = await getAppStatus();\n\n    // If application has been administratively disabled or put into maintenance\n    if (status === AppStatus.INACTIVE || status === AppStatus.MAINTENANCE) {\n      logger.warn(\n        \"[killSwitch] Application is inactive or under maintenance; request rejected\",\n        {\n          url: req.url,\n          method: req.method,\n          appStatus: status,\n        },\n      );\n\n      res.statusCode = HTTP_STATUS_SERVICE_UNAVAILABLE;\n      res.setHeader(\"Content-Type\", \"application/json\");\n      res.end(\n        JSON.stringify({\n          error: {\n            code: \"APP_DEACTIVATED\",\n            message:\n              status === AppStatus.MAINTENANCE\n                ? \"Application is currently undergoing scheduled maintenance\"\n                : \"Application has been deactivated by platform administrators\",\n            status,\n          },\n        }),\n      );\n      return false;\n    }\n\n    return true;\n  };\n}\n\n/**\n * Options configuring request authentication middleware.\n */\nexport interface CreateAuthMiddlewareOptions {\n  /** Whitelisted public endpoints bypassing authentication */\n  publicPaths?: readonly string[];\n  /** Function resolving an API key against store */\n  validateApiKey?: (key: string) => Promise<AuthContext | null>;\n  /** Function resolving a Bearer session token against JWKS or session store */\n  validateToken?: (token: string) => Promise<AuthContext | null>;\n}\n\n/**\n * Universal authentication middleware verifying API keys and Bearer tokens.\n *\n * @param options - Configuration options\n * @returns Middleware handler\n */\nexport function createAuthMiddleware(options: CreateAuthMiddlewareOptions) {\n  const publicPaths = new Set([\n    ...DEFAULT_PUBLIC_PATHS,\n    ...(options.publicPaths ?? []),\n  ]);\n\n  return async (\n    req: GenericHttpRequest,\n    res: GenericHttpResponse,\n  ): Promise<boolean> => {\n    const urlPath = (req.url || \"/\").split(\"?\")[0] || \"/\";\n\n    // 1. Bypass authentication for whitelisted public paths\n    if (publicPaths.has(urlPath)) {\n      req.authContext = {\n        authenticated: false,\n        roles: [],\n        isAppActive: true,\n      };\n      return true;\n    }\n\n    // 2. Check for Machine-to-Machine API Key\n    const rawApiKey = req.headers[DEFAULT_API_KEY_HEADER];\n    const apiKey = typeof rawApiKey === \"string\" ? rawApiKey.trim() : undefined;\n\n    if (apiKey && options.validateApiKey) {\n      const apiKeyCtx = await options.validateApiKey(apiKey);\n      if (apiKeyCtx?.authenticated) {\n        logger.info(\"[authenticate] Authenticated via API Key\", {\n          path: urlPath,\n        });\n        req.authContext = apiKeyCtx;\n        return true;\n      }\n    }\n\n    // 3. Check for Bearer Token\n    const rawAuth = req.headers[DEFAULT_AUTH_HEADER];\n    const authHeader = typeof rawAuth === \"string\" ? rawAuth.trim() : undefined;\n\n    if (\n      authHeader?.startsWith(DEFAULT_BEARER_PREFIX) &&\n      options.validateToken\n    ) {\n      const token = authHeader.slice(DEFAULT_BEARER_PREFIX.length).trim();\n      const tokenCtx = await options.validateToken(token);\n      if (tokenCtx?.authenticated) {\n        logger.info(\"[authenticate] Authenticated via Bearer token\", {\n          path: urlPath,\n        });\n        req.authContext = tokenCtx;\n        return true;\n      }\n    }\n\n    // 4. Reject with 401 Unauthorized\n    logger.warn(\"[authenticate] Unauthorized request rejected\", {\n      path: urlPath,\n      method: req.method,\n    });\n\n    res.statusCode = HTTP_STATUS_UNAUTHORIZED;\n    res.setHeader(\"Content-Type\", \"application/json\");\n    res.end(\n      JSON.stringify({\n        error: {\n          code: \"UNAUTHORIZED\",\n          message:\n            \"Missing or invalid authentication credentials (Bearer token or API key required)\",\n        },\n      }),\n    );\n    return false;\n  };\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yuva-devlab/auth-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Server-side authentication guards, cached JWKS validator, and kill-switch middleware for DevLab",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -26,8 +26,8 @@
   "license": "MIT",
   "dependencies": {
     "zod": "^3.25.76",
-    "@yuva-devlab/errors": "0.2.0",
-    "@yuva-devlab/logger": "1.2.0"
+    "@yuva-devlab/logger": "1.2.0",
+    "@yuva-devlab/errors": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^24.10.1",
@@ -35,8 +35,8 @@
     "prettier": "^3.9.8",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "@yuva-devlab/eslint-config": "0.1.1",
     "@yuva-devlab/prettier-config": "0.1.1",
+    "@yuva-devlab/eslint-config": "0.1.1",
     "@yuva-devlab/typescript-config": "0.1.1"
   },
   "scripts": {