@zola_do/authorization 0.2.15 → 0.2.16

package/README.md

@@ -155,6 +155,8 @@ export class ProfileController {
 
 ## Guards
 
+> **Reference:** See [GUARDS.md](./GUARDS.md) for guard ordering, optional throttler subpath, JWT algorithm pinning, and CSRF notes.
+
 ### JwtGuard
 
 Default global guard that validates Bearer tokens:
@@ -433,8 +435,22 @@ import { JwtRefreshTokenStrategy } from '@zola_do/authorization';
 | `JWT_ACCESS_TOKEN_EXPIRES`  | Access token TTL             | `15m`    |
 | `JWT_REFRESH_TOKEN_SECRET`  | Refresh token signing secret | Required |
 | `JWT_REFRESH_TOKEN_EXPIRES` | Refresh token TTL            | `7d`     |
+| `JWT_ALGORITHM`             | HMAC signing algorithm (`HS256`, `HS384`, `HS512`) | `HS256` |
 | `API_KEY`                   | API key for ApiKeyGuard      | Optional |
 
+`AuthorizationModule` calls `validateJwtEnv()` on startup. Import `validateJwtEnv` for explicit checks before bootstrap, or pass `{ required: false }` to skip when JWT is intentionally disabled.
+
+### Client IP behind a reverse proxy
+
+```typescript
+import { getClientIp } from '@zola_do/authorization';
+
+app.getHttpAdapter().getInstance().set('trust proxy', 1);
+const ip = getClientIp(req);
+```
+
+Used by `ThrottlerBehindProxyGuard`, `@zola_do/crud` `GlobalExceptionFilter`, and `@zola_do/audit` logging.
+
 ### Token Expiration Format
 
 ```

package/dist/authorization.module.d.ts

@@ -1,2 +1,4 @@
-export declare class AuthorizationModule {
+import { OnModuleInit } from '@nestjs/common';
+export declare class AuthorizationModule implements OnModuleInit {
+    onModuleInit(): void;
 }

package/dist/authorization.module.js

@@ -8,9 +8,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationModule = void 0;
 const common_1 = require("@nestjs/common");
+const validate_jwt_env_helper_1 = require("./helper/validate-jwt-env.helper");
 const jwt_1 = require("@nestjs/jwt");
 const passport_1 = require("@nestjs/passport");
 const auth_helper_1 = require("./helper/auth.helper");
+const jwt_options_helper_1 = require("./helper/jwt-options.helper");
 const jwt_strategy_1 = require("./strategy/jwt.strategy");
 const jwt_refresh_token_strategy_1 = require("./strategy/jwt-refresh-token.strategy");
 const jwt_refresh_guard_1 = require("./guards/jwt-refresh.guard");
@@ -19,6 +21,9 @@ const core_1 = require("@nestjs/core");
 const api_key_guard_1 = require("./guards/api-key.guard");
 const optional_jwt_guard_1 = require("./guards/optional-jwt.guard");
 let AuthorizationModule = class AuthorizationModule {
+    onModuleInit() {
+        (0, validate_jwt_env_helper_1.validateJwtEnv)();
+    }
 };
 exports.AuthorizationModule = AuthorizationModule;
 exports.AuthorizationModule = AuthorizationModule = __decorate([
@@ -26,7 +31,9 @@ exports.AuthorizationModule = AuthorizationModule = __decorate([
     (0, common_1.Module)({
         imports: [
             passport_1.PassportModule.register({ defaultStrategy: 'jwt', property: 'user' }),
-            jwt_1.JwtModule.register({}),
+            jwt_1.JwtModule.register({
+                signOptions: { algorithm: (0, jwt_options_helper_1.resolveJwtAlgorithm)() },
+            }),
         ],
         controllers: [],
         providers: [

package/dist/authorization.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,qCAAoD;AACpD,+CAAkD;AAClD,sDAAkD;AAClD,0DAAsD;AACtD,sFAAgF;AAChF,kEAA6D;AAC7D,kDAA8C;AAC9C,uCAAoD;AACpD,0DAAqD;AACrD,oEAA+D;AAuBxD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IArB/B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrE,eAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;SACvB;QACD,WAAW,EAAE,EAAE;QACf,SAAS,EAAE;YACT,wBAAU;YACV,0BAAW;YACX,gBAAU;YACV,oDAAuB;YACvB,gBAAS;YACT,oBAAQ;YACR,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,oBAAQ,EAAE;YAC1C,mCAAe;YACf,2BAAW;YACX,qCAAgB;SACjB;QACD,OAAO,EAAE,CAAC,gBAAS,EAAE,wBAAU,EAAE,gBAAU,EAAE,oBAAQ,CAAC;KACvD,CAAC;GACW,mBAAmB,CAAG"}
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../src/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA8D;AAC9D,8EAAkE;AAClE,qCAAoD;AACpD,+CAAkD;AAClD,sDAAkD;AAClD,oEAAkE;AAClE,0DAAsD;AACtD,sFAAgF;AAChF,kEAA6D;AAC7D,kDAA8C;AAC9C,uCAAoD;AACpD,0DAAqD;AACrD,oEAA+D;AAyBxD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAY;QACV,IAAA,wCAAc,GAAE,CAAC;IACnB,CAAC;CACF,CAAA;AAJY,kDAAmB;8BAAnB,mBAAmB;IAvB/B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YACrE,eAAS,CAAC,QAAQ,CAAC;gBACjB,WAAW,EAAE,EAAE,SAAS,EAAE,IAAA,wCAAmB,GAAE,EAAE;aAClD,CAAC;SACH;QACD,WAAW,EAAE,EAAE;QACf,SAAS,EAAE;YACT,wBAAU;YACV,0BAAW;YACX,gBAAU;YACV,oDAAuB;YACvB,gBAAS;YACT,oBAAQ;YACR,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,oBAAQ,EAAE;YAC1C,mCAAe;YACf,2BAAW;YACX,qCAAgB;SACjB;QACD,OAAO,EAAE,CAAC,gBAAS,EAAE,wBAAU,EAAE,gBAAU,EAAE,oBAAQ,CAAC;KACvD,CAAC;GACW,mBAAmB,CAI/B"}

package/dist/guards/api-key.guard.d.ts

@@ -1,4 +1,5 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 export declare class ApiKeyGuard implements CanActivate {
     canActivate(context: ExecutionContext): Promise<boolean>;
+    private timingSafeCompare;
 }

package/dist/guards/api-key.guard.js

@@ -8,20 +8,21 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiKeyGuard = void 0;
 const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
 let ApiKeyGuard = class ApiKeyGuard {
     async canActivate(context) {
         try {
             const request = context.switchToHttp().getRequest();
             const headers = request.headers;
             const apiKey = headers['x-api-key'];
-            if (!apiKey) {
+            if (!apiKey || typeof apiKey !== 'string') {
                 throw new common_1.UnauthorizedException('api_key_not_provided');
             }
-            const API_KEY = process.env.API_KEY;
-            if (!API_KEY) {
+            const configuredKey = process.env.API_KEY;
+            if (!configuredKey) {
                 throw new common_1.UnauthorizedException('api_key_not_configured');
             }
-            if (apiKey !== API_KEY) {
+            if (!this.timingSafeCompare(apiKey, configuredKey)) {
                 throw new common_1.UnauthorizedException('invalid_api_key');
             }
             return true;
@@ -30,6 +31,14 @@ let ApiKeyGuard = class ApiKeyGuard {
             throw error;
         }
     }
+    timingSafeCompare(provided, expected) {
+        const providedBuffer = Buffer.from(provided);
+        const expectedBuffer = Buffer.from(expected);
+        if (providedBuffer.length !== expectedBuffer.length) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(providedBuffer, expectedBuffer);
+    }
 };
 exports.ApiKeyGuard = ApiKeyGuard;
 exports.ApiKeyGuard = ApiKeyGuard = __decorate([

package/dist/guards/api-key.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.guard.js","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AAGjB,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YACpC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAGD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAzBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CAyBvB"}
+{"version":3,"file":"api-key.guard.js","sourceRoot":"","sources":["../../src/guards/api-key.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AACxB,mCAAyC;AAGlC,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;QAC1D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAnCY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CAmCvB"}

package/dist/guards/jwt.guard.d.ts

@@ -1,8 +1,10 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { AuthHelper } from '../helper/auth.helper';
 export declare class JwtGuard implements CanActivate {
     private readonly reflector;
-    constructor(reflector: Reflector);
+    private readonly authHelper;
+    constructor(reflector: Reflector, authHelper: AuthHelper);
     canActivate(context: ExecutionContext): Promise<boolean>;
     private extractTokenFromHeader;
 }

package/dist/guards/jwt.guard.js

@@ -13,10 +13,11 @@ exports.JwtGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const allow_anonymous_decorator_1 = require("../decorators/allow-anonymous.decorator");
-const jsonwebtoken = require("jsonwebtoken");
+const auth_helper_1 = require("../helper/auth.helper");
 let JwtGuard = class JwtGuard {
-    constructor(reflector) {
+    constructor(reflector, authHelper) {
         this.reflector = reflector;
+        this.authHelper = authHelper;
     }
     async canActivate(context) {
         var _a;
@@ -38,7 +39,7 @@ let JwtGuard = class JwtGuard {
             if (!secret) {
                 throw new common_1.UnauthorizedException('ConfigurationError', 'JWT_ACCESS_TOKEN_SECRET is not configured');
             }
-            const user = jsonwebtoken.verify(token, secret);
+            const user = await this.authHelper.verify(token, secret);
             request.user = user;
             return true;
         }
@@ -55,6 +56,7 @@ let JwtGuard = class JwtGuard {
 exports.JwtGuard = JwtGuard;
 exports.JwtGuard = JwtGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [core_1.Reflector])
+    __metadata("design:paramtypes", [core_1.Reflector,
+        auth_helper_1.AuthHelper])
 ], JwtGuard);
 //# sourceMappingURL=jwt.guard.js.map

package/dist/guards/jwt.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.guard.js","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,uCAAyC;AACzC,uFAAmF;AACnF,6CAA6C;AAGtC,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACnB,YAA6B,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IAAG,CAAC;IAErD,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAIpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,SAAS,0CAAE,iBAAiB,CAC1D,oDAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAC7B,mBAAmB,EACnB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEhD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAnDY,4BAAQ;mBAAR,QAAQ;IADpB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,QAAQ,CAmDpB"}
+{"version":3,"file":"jwt.guard.js","sourceRoot":"","sources":["../../src/guards/jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,uCAAyC;AACzC,uFAAmF;AACnF,uDAAmD;AAG5C,IAAM,QAAQ,GAAd,MAAM,QAAQ;IACnB,YACmB,SAAoB,EACpB,UAAsB;QADtB,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAIpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,SAAS,0CAAE,iBAAiB,CAC1D,oDAAwB,EACxB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAC7B,mBAAmB,EACnB,sBAAsB,CACvB,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAtDY,4BAAQ;mBAAR,QAAQ;IADpB,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACR,wBAAU;GAH9B,QAAQ,CAsDpB"}

package/dist/guards/optional-jwt.guard.js

@@ -28,10 +28,7 @@ let OptionalJwtGuard = class OptionalJwtGuard {
             }
             const secret = process.env.JWT_ACCESS_TOKEN_SECRET;
             if (!secret) {
-                if (process.env.NODE_ENV === 'production') {
-                    console.warn('JWT_ACCESS_TOKEN_SECRET is not configured');
-                }
-                return true;
+                throw new common_1.UnauthorizedException('ConfigurationError', 'JWT_ACCESS_TOKEN_SECRET is not configured');
             }
             const user = await this.authHelper.verify(token, secret);
             request.user = user;

package/dist/guards/optional-jwt.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"optional-jwt.guard.js","sourceRoot":"","sources":["../../src/guards/optional-jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA2E;AAE3E,uDAAmD;AAG5C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBAGZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AAtCY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAE8B,wBAAU;GADxC,gBAAgB,CAsC5B"}
+{"version":3,"file":"optional-jwt.guard.js","sourceRoot":"","sources":["../../src/guards/optional-jwt.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,uDAAmD;AAG5C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAC7B,oBAAoB,EACpB,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAEzD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAgB;;QAC7C,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAA,MAAA,OAAO,CAAC,OAAO,CAAC,aAAa,0CAAE,KAAK,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC;QACtE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;CACF,CAAA;AApCY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAE8B,wBAAU;GADxC,gBAAgB,CAoC5B"}

package/dist/guards/permissions.guard.js

@@ -14,7 +14,7 @@ function PermissionsGuard(permissions) {
             }
             const user = request.user;
             const userPermissions = user === null || user === void 0 ? void 0 : user.permissions;
-            const isAllowed = requiredPermissions.some((requiredPermission) => userPermissions === null || userPermissions === void 0 ? void 0 : userPermissions.find((x) => x == requiredPermission.trim()));
+            const isAllowed = requiredPermissions.some((requiredPermission) => userPermissions === null || userPermissions === void 0 ? void 0 : userPermissions.find((x) => x === requiredPermission.trim()));
             return isAllowed;
         }
     }

package/dist/guards/permissions.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;AAEA,4CA0BC;AA1BD,SAAgB,gBAAgB,CAAC,WAAmB;IAClD,MAAM,qBAAqB;QACzB,WAAW,CAAC,OAAyB;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAC/B,MAAM,eAAe,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAC;YAE1C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAChE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,EAAE,CAAC,CACrE,CAAC;YAEF,OAAO,SAAS,CAAC;QACnB,CAAC;KACF;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"permissions.guard.js","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":";;AAEA,4CA0BC;AA1BD,SAAgB,gBAAgB,CAAC,WAAmB;IAClD,MAAM,qBAAqB;QACzB,WAAW,CAAC,OAAyB;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAQ,OAAO,CAAC,IAAI,CAAC;YAC/B,MAAM,eAAe,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAC;YAE1C,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,EAAE,CAChE,eAAe,aAAf,eAAe,uBAAf,eAAe,CAAE,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAkB,CAAC,IAAI,EAAE,CAAC,CACtE,CAAC;YAEF,OAAO,SAAS,CAAC;QACnB,CAAC;KACF;IAED,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/dist/guards/throttler-behind-proxy.guard.js

@@ -9,10 +9,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ThrottlerBehindProxyGuard = void 0;
 const throttler_1 = require("@nestjs/throttler");
 const common_1 = require("@nestjs/common");
+const get_client_ip_helper_1 = require("../helper/get-client-ip.helper");
 let ThrottlerBehindProxyGuard = class ThrottlerBehindProxyGuard extends throttler_1.ThrottlerGuard {
     async getTracker(req) {
-        var _a;
-        return ((_a = req.ips) === null || _a === void 0 ? void 0 : _a.length) ? req.ips[0] : req.ip;
+        return (0, get_client_ip_helper_1.getClientIp)(req);
     }
 };
 exports.ThrottlerBehindProxyGuard = ThrottlerBehindProxyGuard;

package/dist/guards/throttler-behind-proxy.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"throttler-behind-proxy.guard.js","sourceRoot":"","sources":["../../src/guards/throttler-behind-proxy.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,iDAAmD;AACnD,2CAA4C;AAMrC,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,0BAAc;IACjD,KAAK,CAAC,UAAU,CAAC,GAAwB;;QACjD,OAAO,CAAA,MAAA,GAAG,CAAC,GAAG,0CAAE,MAAM,EAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/C,CAAC;CACF,CAAA;AAJY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CAIrC"}
+{"version":3,"file":"throttler-behind-proxy.guard.js","sourceRoot":"","sources":["../../src/guards/throttler-behind-proxy.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,iDAAmD;AACnD,2CAA4C;AAC5C,yEAA6D;AAMtD,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,0BAAc;IACjD,KAAK,CAAC,UAAU,CAAC,GAAwB;QACjD,OAAO,IAAA,kCAAW,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;CACF,CAAA;AAJY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CAIrC"}

package/dist/guards/webhook-signature.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, Type } from '@nestjs/common';
+export type WebhookSignatureGuardOptions = {
+    secretEnvVar?: string;
+    headerName?: string;
+    algorithm?: 'sha256' | 'sha512';
+};
+export declare function WebhookSignatureGuard(options?: WebhookSignatureGuardOptions): Type<CanActivate>;

package/dist/guards/webhook-signature.guard.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebhookSignatureGuard = WebhookSignatureGuard;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+function WebhookSignatureGuard(options = {}) {
+    var _a, _b, _c;
+    const secretEnvVar = (_a = options.secretEnvVar) !== null && _a !== void 0 ? _a : 'WEBHOOK_SIGNING_SECRET';
+    const headerName = ((_b = options.headerName) !== null && _b !== void 0 ? _b : 'x-webhook-signature').toLowerCase();
+    const algorithm = (_c = options.algorithm) !== null && _c !== void 0 ? _c : 'sha256';
+    let WebhookSignatureGuardMixin = class WebhookSignatureGuardMixin {
+        canActivate(context) {
+            var _a, _b;
+            const req = context.switchToHttp().getRequest();
+            const secret = process.env[secretEnvVar];
+            if (!secret) {
+                throw new common_1.UnauthorizedException('webhook_secret_not_configured');
+            }
+            const provided = (_a = req.headers) === null || _a === void 0 ? void 0 : _a[headerName];
+            if (!provided || typeof provided !== 'string') {
+                throw new common_1.UnauthorizedException('webhook_signature_missing');
+            }
+            const rawBody = (_b = req.rawBody) !== null && _b !== void 0 ? _b : req.body;
+            const payload = typeof rawBody === 'string'
+                ? rawBody
+                : Buffer.isBuffer(rawBody)
+                    ? rawBody
+                    : JSON.stringify(rawBody !== null && rawBody !== void 0 ? rawBody : {});
+            const expected = (0, crypto_1.createHmac)(algorithm, secret)
+                .update(payload)
+                .digest('hex');
+            const providedBuffer = Buffer.from(provided);
+            const expectedBuffer = Buffer.from(expected);
+            if (providedBuffer.length !== expectedBuffer.length) {
+                throw new common_1.UnauthorizedException('invalid_webhook_signature');
+            }
+            if (!(0, crypto_1.timingSafeEqual)(providedBuffer, expectedBuffer)) {
+                throw new common_1.UnauthorizedException('invalid_webhook_signature');
+            }
+            return true;
+        }
+    };
+    WebhookSignatureGuardMixin = __decorate([
+        (0, common_1.Injectable)()
+    ], WebhookSignatureGuardMixin);
+    return WebhookSignatureGuardMixin;
+}
+//# sourceMappingURL=webhook-signature.guard.js.map

package/dist/guards/webhook-signature.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signature.guard.js","sourceRoot":"","sources":["../../src/guards/webhook-signature.guard.ts"],"names":[],"mappings":";;;;;;;;AAeA,sDA+CC;AA9DD,2CAMwB;AACxB,mCAAqD;AAQrD,SAAgB,qBAAqB,CACnC,UAAwC,EAAE;;IAE1C,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,wBAAwB,CAAC;IACtE,MAAM,UAAU,GAAG,CAAC,MAAA,OAAO,CAAC,UAAU,mCAAI,qBAAqB,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/E,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,SAAS,mCAAI,QAAQ,CAAC;IAGhD,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;QAC9B,WAAW,CAAC,OAAyB;;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,OAAO,GAAG,MAAA,GAAG,CAAC,OAAO,mCAAI,GAAG,CAAC,IAAI,CAAC;YACxC,MAAM,OAAO,GACX,OAAO,OAAO,KAAK,QAAQ;gBACzB,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACxB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;YAEtC,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,SAAS,EAAE,MAAM,CAAC;iBAC3C,MAAM,CAAC,OAAO,CAAC;iBACf,MAAM,CAAC,KAAK,CAAC,CAAC;YAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,cAAc,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,IAAA,wBAAe,EAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAA;IApCK,0BAA0B;QAD/B,IAAA,mBAAU,GAAE;OACP,0BAA0B,CAoC/B;IAED,OAAO,0BAA0B,CAAC;AACpC,CAAC"}

package/dist/helper/auth.helper.js

@@ -14,12 +14,13 @@ const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
 const bcrypt = require("bcrypt");
 const crypto_1 = require("crypto");
+const jwt_options_helper_1 = require("./jwt-options.helper");
 let AuthHelper = class AuthHelper {
     constructor(jwt) {
         this.jwt = jwt;
     }
     async verify(token, secret) {
-        const decoded = this.jwt.verify(token, { secret });
+        const decoded = this.jwt.verify(token, (0, jwt_options_helper_1.buildJwtVerifyOptions)(secret));
         if (!decoded) {
             throw new common_1.UnauthorizedException('invalid_token');
         }
@@ -29,27 +30,27 @@ let AuthHelper = class AuthHelper {
         return this.jwt.decode(token, null);
     }
     generateAccessToken(payload) {
-        return this.jwt.sign(Object.assign({}, payload), {
+        return this.jwt.sign(Object.assign({}, payload), (0, jwt_options_helper_1.buildJwtSignOptions)({
             secret: process.env.JWT_ACCESS_TOKEN_SECRET,
             expiresIn: process.env.JWT_ACCESS_TOKEN_EXPIRES,
-        });
+        }));
     }
     generateRefreshToken(payload) {
-        return this.jwt.sign(Object.assign({}, payload), {
+        return this.jwt.sign(Object.assign({}, payload), (0, jwt_options_helper_1.buildJwtSignOptions)({
             secret: process.env.JWT_REFRESH_TOKEN_SECRET,
             expiresIn: process.env.JWT_REFRESH_TOKEN_EXPIRES,
-        });
+        }));
     }
     async generateToken(account) {
         const [accessToken, refreshToken] = await Promise.all([
-            this.jwt.signAsync({ id: account.id, email: account.email }, {
+            this.jwt.signAsync({ id: account.id, email: account.email }, (0, jwt_options_helper_1.buildJwtSignOptions)({
                 secret: process.env.JWT_ACCESS_TOKEN_SECRET,
                 expiresIn: process.env.JWT_ACCESS_TOKEN_EXPIRES,
-            }),
-            this.jwt.signAsync({ id: account.id }, {
+            })),
+            this.jwt.signAsync({ id: account.id }, (0, jwt_options_helper_1.buildJwtSignOptions)({
                 secret: process.env.JWT_REFRESH_TOKEN_SECRET,
                 expiresIn: process.env.JWT_REFRESH_TOKEN_EXPIRES,
-            }),
+            })),
         ]);
         return { accessToken, refreshToken };
     }

package/dist/helper/auth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../src/helper/auth.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyC;AACzC,iCAAiC;AACjC,mCAAmC;AAI5B,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;IAAG,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAExD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAGM,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAGM,mBAAmB,CAAC,OAAY;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;SAC/D,CACF,CAAC;IACJ,CAAC;IAGM,oBAAoB,CAAC,OAAY;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;SAChE,CACF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,OAAY;QACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxC;gBACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;aAC/D,CACF;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB;gBACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;aAChE,CACF;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAGM,kBAAkB,CACvB,aAAqB,EACrB,WAAmB;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAGM,cAAc,CAAC,QAAgB;QACpC,MAAM,IAAI,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAGM,WAAW;QAEhB,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAEM,yBAAyB,CAC9B,QAAgB,EAChB,QAAgB,EAChB,GAAW,EACX,QAAgB;QAEhB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAwDS,QAAQ;;;;;;;;;;;;;gEAaoC,QAAQ;;;;;;;;;;;;;;;;;;;;;gBAqBxD,QAAQ;;;;;;;;;;;;;;;;;;;;;;gBAsBR,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqGlB,CAAC;IACA,CAAC;CACF,CAAA;AAhTY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAEuB,gBAAU;GADjC,UAAU,CAgTtB"}
+{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../src/helper/auth.helper.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyC;AACzC,iCAAiC;AACjC,mCAAmC;AAEnC,6DAG8B;AAGvB,IAAM,UAAU,GAAhB,MAAM,UAAU;IACrB,YAA6B,GAAe;QAAf,QAAG,GAAH,GAAG,CAAY;IAAG,CAAC;IAEzC,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAA,0CAAqB,EAAC,MAAM,CAAC,CAAC,CAAC;QAE3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAGM,KAAK,CAAC,MAAM,CAAC,KAAa;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAGM,mBAAmB,CAAC,OAAY;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;IAGM,oBAAoB,CAAC,OAAY;QACtC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,mBACb,OAAO,GACZ,IAAA,wCAAmB,EAAC;YAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,OAAY;QACrC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EACxC,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;gBAC3C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAuC;aAC/D,CAAC,CACH;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB,IAAA,wCAAmB,EAAC;gBAClB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBAC5C,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAwC;aAChE,CAAC,CACH;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAGM,kBAAkB,CACvB,aAAqB,EACrB,WAAmB;QAEnB,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAGM,cAAc,CAAC,QAAgB;QACpC,MAAM,IAAI,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAE5C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAGM,WAAW;QAEhB,MAAM,YAAY,GAAG,IAAA,kBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC;IAEM,yBAAyB,CAC9B,QAAgB,EAChB,QAAgB,EAChB,GAAW,EACX,QAAgB;QAEhB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAwDS,QAAQ;;;;;;;;;;;;;gEAaoC,QAAQ;;;;;;;;;;;;;;;;;;;;;gBAqBxD,QAAQ;;;;;;;;;;;;;;;;;;;;;;gBAsBR,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqGlB,CAAC;IACA,CAAC;CACF,CAAA;AAhTY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAEuB,gBAAU;GADjC,UAAU,CAgTtB"}

package/dist/helper/get-client-ip.helper.d.ts

@@ -0,0 +1,12 @@
+export type ClientIpRequest = {
+    ip?: string;
+    ips?: string[];
+    headers?: Record<string, string | string[] | undefined>;
+    socket?: {
+        remoteAddress?: string;
+    };
+    connection?: {
+        remoteAddress?: string;
+    };
+};
+export declare function getClientIp(req: ClientIpRequest): string;

package/dist/helper/get-client-ip.helper.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getClientIp = getClientIp;
+function getClientIp(req) {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    if ((_a = req.ips) === null || _a === void 0 ? void 0 : _a.length) {
+        return req.ips[0];
+    }
+    if (req.ip) {
+        return req.ip;
+    }
+    const xff = (_b = req.headers) === null || _b === void 0 ? void 0 : _b['x-forwarded-for'];
+    if (xff) {
+        const raw = Array.isArray(xff) ? xff[0] : xff;
+        const first = (_c = raw.split(',')[0]) === null || _c === void 0 ? void 0 : _c.trim();
+        if (first) {
+            return first;
+        }
+    }
+    const realIp = (_d = req.headers) === null || _d === void 0 ? void 0 : _d['x-real-ip'];
+    if (realIp) {
+        return Array.isArray(realIp) ? realIp[0] : realIp;
+    }
+    return ((_h = (_f = (_e = req.socket) === null || _e === void 0 ? void 0 : _e.remoteAddress) !== null && _f !== void 0 ? _f : (_g = req.connection) === null || _g === void 0 ? void 0 : _g.remoteAddress) !== null && _h !== void 0 ? _h : 'unknown');
+}
+//# sourceMappingURL=get-client-ip.helper.js.map

package/dist/helper/get-client-ip.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-client-ip.helper.js","sourceRoot":"","sources":["../../src/helper/get-client-ip.helper.ts"],"names":[],"mappings":";;AAaA,kCA4BC;AA5BD,SAAgB,WAAW,CAAC,GAAoB;;IAC9C,IAAI,MAAA,GAAG,CAAC,GAAG,0CAAE,MAAM,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,iBAAiB,CAAC,CAAC;IAC7C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAA,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0CAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,GAAG,CAAC,OAAO,0CAAG,WAAW,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,CAAC;IAED,OAAO,CACL,MAAA,MAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCACzB,MAAA,GAAG,CAAC,UAAU,0CAAE,aAAa,mCAC7B,SAAS,CACV,CAAC;AACJ,CAAC"}

package/dist/helper/jwt-options.helper.d.ts

@@ -0,0 +1,17 @@
+import type { Algorithm } from 'jsonwebtoken';
+import { StringValue } from './jwt.type';
+export declare const HMAC_JWT_ALGORITHMS: readonly ["HS256", "HS384", "HS512"];
+export type HmacJwtAlgorithm = (typeof HMAC_JWT_ALGORITHMS)[number];
+export declare function resolveJwtAlgorithm(): HmacJwtAlgorithm;
+export declare function buildJwtSignOptions(opts: {
+    secret: string;
+    expiresIn?: StringValue;
+}): {
+    algorithm: Algorithm;
+    secret: string;
+    expiresIn?: StringValue;
+};
+export declare function buildJwtVerifyOptions(secret: string): {
+    secret: string;
+    algorithms: Algorithm[];
+};

package/dist/helper/jwt-options.helper.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HMAC_JWT_ALGORITHMS = void 0;
+exports.resolveJwtAlgorithm = resolveJwtAlgorithm;
+exports.buildJwtSignOptions = buildJwtSignOptions;
+exports.buildJwtVerifyOptions = buildJwtVerifyOptions;
+exports.HMAC_JWT_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+const DEFAULT_JWT_ALGORITHM = 'HS256';
+function resolveJwtAlgorithm() {
+    var _a;
+    const fromEnv = (_a = process.env.JWT_ALGORITHM) === null || _a === void 0 ? void 0 : _a.trim();
+    const algorithm = (fromEnv || DEFAULT_JWT_ALGORITHM);
+    if (!exports.HMAC_JWT_ALGORITHMS.includes(algorithm)) {
+        throw new Error(`JWT_ALGORITHM must be one of: ${exports.HMAC_JWT_ALGORITHMS.join(', ')}`);
+    }
+    return algorithm;
+}
+function buildJwtSignOptions(opts) {
+    return Object.assign(Object.assign({}, opts), { algorithm: resolveJwtAlgorithm() });
+}
+function buildJwtVerifyOptions(secret) {
+    return {
+        secret,
+        algorithms: [resolveJwtAlgorithm()],
+    };
+}
+//# sourceMappingURL=jwt-options.helper.js.map

package/dist/helper/jwt-options.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-options.helper.js","sourceRoot":"","sources":["../../src/helper/jwt-options.helper.ts"],"names":[],"mappings":";;;AASA,kDAWC;AAED,kDAQC;AAED,sDAKC;AAlCY,QAAA,mBAAmB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAIxE,MAAM,qBAAqB,GAAqB,OAAO,CAAC;AAExD,SAAgB,mBAAmB;;IACjC,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,aAAa,0CAAE,IAAI,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAqB,CAAC;IAEzE,IAAI,CAAC,2BAAmB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iCAAiC,2BAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAGnC;IACC,uCACK,IAAI,KACP,SAAS,EAAE,mBAAmB,EAAe,IAC7C;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAc;IAClD,OAAO;QACL,MAAM;QACN,UAAU,EAAE,CAAC,mBAAmB,EAAe,CAAC;KACjD,CAAC;AACJ,CAAC"}

package/dist/helper/validate-jwt-env.helper.d.ts

@@ -0,0 +1,4 @@
+export type ValidateJwtEnvOptions = {
+    required?: boolean;
+};
+export declare function validateJwtEnv(options?: ValidateJwtEnvOptions): void;

package/dist/helper/validate-jwt-env.helper.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateJwtEnv = validateJwtEnv;
+function validateJwtEnv(options = {}) {
+    const { required = true } = options;
+    if (!required) {
+        return;
+    }
+    if (!process.env.JWT_ACCESS_TOKEN_SECRET) {
+        throw new Error('JWT_ACCESS_TOKEN_SECRET is required');
+    }
+    if (!process.env.JWT_REFRESH_TOKEN_SECRET) {
+        throw new Error('JWT_REFRESH_TOKEN_SECRET is required');
+    }
+}
+//# sourceMappingURL=validate-jwt-env.helper.js.map

package/dist/helper/validate-jwt-env.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-jwt-env.helper.js","sourceRoot":"","sources":["../../src/helper/validate-jwt-env.helper.ts"],"names":[],"mappings":";;AAKA,wCAYC;AAZD,SAAgB,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,EAAE,QAAQ,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -6,9 +6,13 @@ export * from './guards/permissions.guard';
 export * from './helper/auth.helper';
 export * from './guards/jwt-refresh.guard';
 export * from './guards/api-key.guard';
+export * from './guards/webhook-signature.guard';
 export * from './guards/vendor.guard';
 export * from './guards/optional-jwt.guard';
 export * from './strategy/jwt-refresh-token.strategy';
 export * from './strategy/jwt.strategy';
 export * from './models/auth.model';
 export * from './helper/jwt.type';
+export * from './helper/jwt-options.helper';
+export * from './helper/validate-jwt-env.helper';
+export * from './helper/get-client-ip.helper';

package/dist/index.js

@@ -25,10 +25,14 @@ __exportStar(require("./guards/permissions.guard"), exports);
 __exportStar(require("./helper/auth.helper"), exports);
 __exportStar(require("./guards/jwt-refresh.guard"), exports);
 __exportStar(require("./guards/api-key.guard"), exports);
+__exportStar(require("./guards/webhook-signature.guard"), exports);
 __exportStar(require("./guards/vendor.guard"), exports);
 __exportStar(require("./guards/optional-jwt.guard"), exports);
 __exportStar(require("./strategy/jwt-refresh-token.strategy"), exports);
 __exportStar(require("./strategy/jwt.strategy"), exports);
 __exportStar(require("./models/auth.model"), exports);
 __exportStar(require("./helper/jwt.type"), exports);
+__exportStar(require("./helper/jwt-options.helper"), exports);
+__exportStar(require("./helper/validate-jwt-env.helper"), exports);
+__exportStar(require("./helper/get-client-ip.helper"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6D;AAApD,2HAAA,mBAAmB,OAAA;AAC5B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AACjB,yEAAuD;AACvD,sEAAoD;AACpD,6DAA2C;AAC3C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,wDAAsC;AACtC,8DAA4C;AAC5C,wEAAsD;AACtD,0DAAwC;AACxC,sDAAoC;AACpC,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6D;AAApD,2HAAA,mBAAmB,OAAA;AAC5B,gDAA8C;AAArC,qGAAA,QAAQ,OAAA;AACjB,yEAAuD;AACvD,sEAAoD;AACpD,6DAA2C;AAC3C,uDAAqC;AACrC,6DAA2C;AAC3C,yDAAuC;AACvC,mEAAiD;AACjD,wDAAsC;AACtC,8DAA4C;AAC5C,wEAAsD;AACtD,0DAAwC;AACxC,sDAAoC;AACpC,oDAAkC;AAClC,8DAA4C;AAC5C,mEAAiD;AACjD,gEAA8C"}

package/dist/strategy/jwt-refresh-token.strategy.js

@@ -1,22 +1,36 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtRefreshTokenStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
-(0, common_1.Injectable)();
-class JwtRefreshTokenStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, 'jwt-refresh') {
+const jwt_options_helper_1 = require("../helper/jwt-options.helper");
+let JwtRefreshTokenStrategy = class JwtRefreshTokenStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, 'jwt-refresh') {
     constructor() {
         const strategyOptions = {
             jwtFromRequest: (req) => req.body.refresh_token,
             ignoreExpiration: false,
             secretOrKey: process.env.JWT_REFRESH_TOKEN_SECRET,
+            algorithms: [(0, jwt_options_helper_1.resolveJwtAlgorithm)()],
         };
         super(strategyOptions);
     }
     async validate(payload) {
         return payload;
     }
-}
+};
 exports.JwtRefreshTokenStrategy = JwtRefreshTokenStrategy;
+exports.JwtRefreshTokenStrategy = JwtRefreshTokenStrategy = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], JwtRefreshTokenStrategy);
 //# sourceMappingURL=jwt-refresh-token.strategy.js.map

package/dist/strategy/jwt-refresh-token.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-refresh-token.strategy.js","sourceRoot":"","sources":["../../src/strategy/jwt-refresh-token.strategy.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAyD;AAEzD,IAAA,mBAAU,GAAE,CAAC;AACb,MAAa,uBAAwB,SAAQ,IAAA,2BAAgB,EAC3D,uBAAQ,EACR,aAAa,CACd;IACC;QACE,MAAM,eAAe,GAAoB;YACvC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa;YAC/C,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;SAClD,CAAC;QAEF,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAY;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAjBD,0DAiBC"}
+{"version":3,"file":"jwt-refresh-token.strategy.js","sourceRoot":"","sources":["../../src/strategy/jwt-refresh-token.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAyD;AACzD,qEAAmE;AAG5D,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,IAAA,2BAAgB,EAC3D,uBAAQ,EACR,aAAa,CACd;IACC;QACE,MAAM,eAAe,GAAoB;YACvC,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa;YAC/C,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YACjD,UAAU,EAAE,CAAC,IAAA,wCAAmB,GAAE,CAAC;SACpC,CAAC;QAEF,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAY;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAlBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;;GACA,uBAAuB,CAkBnC"}

package/dist/strategy/jwt.strategy.js

@@ -1,22 +1,36 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
-(0, common_1.Injectable)();
-class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
+const jwt_options_helper_1 = require("../helper/jwt-options.helper");
+let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
     constructor() {
         const strategyOptions = {
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false,
             secretOrKey: process.env.JWT_ACCESS_TOKEN_SECRET,
+            algorithms: [(0, jwt_options_helper_1.resolveJwtAlgorithm)()],
         };
         super(strategyOptions);
     }
     async validate(payload) {
         return payload;
     }
-}
+};
 exports.JwtStrategy = JwtStrategy;
+exports.JwtStrategy = JwtStrategy = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], JwtStrategy);
 //# sourceMappingURL=jwt.strategy.js.map

package/dist/strategy/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategy/jwt.strategy.ts"],"names":[],"mappings":";;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAqE;AAErE,IAAA,mBAAU,GAAE,CAAC;AACb,MAAa,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IACzD;QACE,MAAM,eAAe,GAAoB;YACvC,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;SACjD,CAAC;QAEF,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAY;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAdD,kCAcC"}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategy/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAoD;AACpD,+CAAqE;AACrE,qEAAmE;AAG5D,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IACzD;QACE,MAAM,eAAe,GAAoB;YACvC,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;YAChD,UAAU,EAAE,CAAC,IAAA,wCAAmB,GAAE,CAAC;SACpC,CAAC;QAEF,KAAK,CAAC,eAAe,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAY;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAfY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;;GACA,WAAW,CAevB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zola_do/authorization",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "JWT auth, guards, strategies for NestJS",
   "author": "zolaDO",
   "license": "ISC",