@zyno-io/dk-server-foundation 26.216.430

package/src/app/config.ts

@@ -0,0 +1,119 @@
+import { isDevelopment, isTest } from './const';
+
+export class BaseAppConfig {
+    APP_ENV!: string;
+
+    PORT?: number;
+
+    MYSQL_HOST?: string;
+    MYSQL_PORT?: number;
+    MYSQL_USER?: string;
+    MYSQL_PASSWORD_SECRET?: string;
+    MYSQL_DATABASE?: string;
+    MYSQL_CONNECTION_LIMIT?: number;
+    MYSQL_MIN_IDLE_CONNECTIONS?: number;
+    MYSQL_IDLE_TIMEOUT_SECONDS?: number;
+
+    PG_HOST?: string;
+    PG_PORT?: number;
+    PG_USER?: string;
+    PG_PASSWORD_SECRET?: string;
+    PG_DATABASE?: string;
+    PG_SCHEMA?: string;
+    PG_CONNECTION_LIMIT?: number;
+    PG_IDLE_TIMEOUT_SECONDS?: number;
+
+    AUTH_JWT_ISSUER?: string;
+    AUTH_JWT_EXPIRATION_MINS?: number;
+    AUTH_JWT_COOKIE_NAME?: string;
+    AUTH_JWT_SECRET?: string;
+    AUTH_JWT_SECRET_B64?: string;
+    AUTH_JWT_ED_SECRET?: string;
+    AUTH_JWT_ENABLE_VERIFY: boolean = true;
+
+    AUTH_BASIC_SECRET?: string;
+
+    CRYPTO_SECRET?: string;
+    CRYPTO_IV_LENGTH: number = 12;
+
+    USE_REAL_IP_HEADER?: boolean;
+
+    MAIL_POSTMARK_SECRET?: string;
+
+    REDIS_SENTINEL_HOST?: string;
+    REDIS_SENTINEL_PORT?: number;
+    REDIS_SENTINEL_NAME?: string;
+    REDIS_HOST?: string;
+    REDIS_PORT?: number;
+    REDIS_PREFIX?: string;
+
+    CACHE_REDIS_SENTINEL_HOST?: string;
+    CACHE_REDIS_SENTINEL_PORT?: number;
+    CACHE_REDIS_SENTINEL_NAME?: string;
+    CACHE_REDIS_HOST?: string;
+    CACHE_REDIS_PORT?: number;
+    CACHE_REDIS_PREFIX?: string;
+
+    BROADCAST_REDIS_SENTINEL_HOST?: string;
+    BROADCAST_REDIS_SENTINEL_PORT?: number;
+    BROADCAST_REDIS_SENTINEL_NAME?: string;
+    BROADCAST_REDIS_HOST?: string;
+    BROADCAST_REDIS_PORT?: number;
+    BROADCAST_REDIS_PREFIX?: string;
+
+    BULL_REDIS_SENTINEL_HOST?: string;
+    BULL_REDIS_SENTINEL_PORT?: number;
+    BULL_REDIS_SENTINEL_NAME?: string;
+    BULL_REDIS_HOST?: string;
+    BULL_REDIS_PORT?: number;
+    BULL_REDIS_PREFIX?: string;
+    BULL_QUEUE: string = 'default'; // todo: does a blank string still yield a default?
+
+    MESH_REDIS_SENTINEL_HOST?: string;
+    MESH_REDIS_SENTINEL_PORT?: number;
+    MESH_REDIS_SENTINEL_NAME?: string;
+    MESH_REDIS_HOST?: string;
+    MESH_REDIS_PORT?: number;
+    MESH_REDIS_PREFIX?: string;
+
+    MUTEX_MODE: 'local' | 'redis' = 'local';
+    MUTEX_REDIS_SENTINEL_HOST?: string;
+    MUTEX_REDIS_SENTINEL_PORT?: number;
+    MUTEX_REDIS_SENTINEL_NAME?: string;
+    MUTEX_REDIS_HOST?: string;
+    MUTEX_REDIS_PORT?: number;
+    MUTEX_REDIS_PREFIX?: string;
+
+    ENABLE_OPENAPI_SCHEMA?: boolean;
+
+    // on by default in dev
+    ENABLE_JOB_RUNNER?: boolean;
+
+    SENTRY_DSN?: string;
+    OTEL_EXPORTER_OTLP_ENDPOINT?: string;
+    ALERTS_SLACK_WEBHOOK_URL?: string;
+
+    SRPC_AUTH_SECRET?: string;
+    SRPC_AUTH_CLOCK_DRIFT_MS = 30_000;
+
+    HTTP_REQUEST_LOGGING_MODE: 'none' | 'e2e' | 'finish' | 'errors' = 'e2e';
+
+    HEALTHZ_ENABLE_REQUEST_LOGGING: boolean = false;
+
+    MAIL_FROM?: string;
+    MAIL_FROM_NAME?: string;
+    MAIL_PROVIDER: 'smtp' | 'postmark' = 'smtp';
+    SMTP_HOST: string = '127.0.0.1';
+    SMTP_PORT: number = 1025;
+    SMTP_USER?: string;
+    SMTP_PASSWORD_SECRET?: string;
+    SMTP_TLS: boolean = false;
+    POSTMARK_SECRET?: string;
+}
+
+export function isDevFeatureEnabled(envVar: boolean | string | undefined, defaultInDev: boolean = true): boolean {
+    if (typeof envVar === 'boolean') return envVar;
+    if (envVar === '0' || envVar === 'false') return false;
+    if (envVar === '1' || envVar === 'true') return true;
+    return isDevelopment || isTest ? defaultInDev : false;
+}

package/src/app/const.ts

@@ -0,0 +1,4 @@
+export const isDevelopment =
+    (!process.env.NODE_ENV || process.env.NODE_ENV === 'development') && (!process.env.APP_ENV || process.env.APP_ENV === 'development');
+
+export const isTest = process.env.APP_ENV === 'test';

package/src/app/dev.ts

@@ -0,0 +1,92 @@
+import { App } from '@deepkit/app';
+import { FrameworkModule } from '@deepkit/framework';
+import { HttpRouter } from '@deepkit/http';
+import { Logger, ScopedLogger } from '@deepkit/logger';
+import { ReflectionKind } from '@deepkit/type';
+import { OpenAPIDocument } from 'deepkit-openapi-core';
+import { writeFile } from 'fs/promises';
+import path from 'path';
+import { stringify } from 'yaml';
+
+import { createLogger } from '../services';
+import { getAppConfig } from './resolver';
+import { isDevFeatureEnabled } from './config';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function doDevPostAppStartup(app: App<any>) {
+    try {
+        const { DevConsoleStore } = await import('../devconsole/devconsole.store');
+        const store = DevConsoleStore.get();
+        if (store) {
+            const { DevConsoleSrpcServer } = await import('../devconsole/devconsole.ws');
+            const srpcServer = new DevConsoleSrpcServer(createLogger('DevConsole'));
+            store.onEvent = (type, data) => srpcServer.broadcast(type, data);
+        }
+    } catch (err) {
+        const logger = app.get(Logger);
+        logger.warn('Failed to start DevConsole SRPC server', err);
+    }
+
+    // this hook seems to run before the router even outputs HTTP routes, which means
+    // anything we output is hard for the developer to see. thus, we will run dev tooling
+    // with a delay.
+    setTimeout(() => doDelayedDevPostAppStartup(app), 250);
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function doDelayedDevPostAppStartup(app: App<any>) {
+    const config = getAppConfig();
+
+    logRoutesWithoutReturnType(app);
+
+    if (isDevFeatureEnabled(config.ENABLE_OPENAPI_SCHEMA)) {
+        dumpOpenApiSchema(app);
+    }
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function logRoutesWithoutReturnType(app: App<any>) {
+    const router = app.get(HttpRouter);
+    const logger = app.get(Logger);
+    const routes = router.getRoutes();
+    for (const route of routes) {
+        if (!(route.action.module instanceof FrameworkModule)) {
+            if (!route.returnType || route.returnType.kind === ReflectionKind.any) {
+                let message = `No return type declared for ${route.httpMethods.join(',')} ${route.getFullPath()}`;
+                if (route.action.type === 'controller') {
+                    message += ` (${route.action.controller.name} -> ${route.action.methodName})`;
+                }
+                logger.warn(message);
+            } else if (route.returnType.typeName === 'RedirectResponse' && !route.responses.length) {
+                route.responses.push({ statusCode: 302, description: '' });
+            } else if (route.returnType.typeName === 'EmptyResponse' && !route.responses.length) {
+                route.responses.push({ statusCode: 202, description: '' });
+            }
+        }
+    }
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function serializeOpenApiSchema(app: App<any>) {
+    const router = app.get(HttpRouter);
+    const logger = app.get(Logger) as unknown as ScopedLogger;
+    const routes = router.getRoutes().filter(r => !r.getFullPath().startsWith('/_devconsole'));
+    const doc = new OpenAPIDocument(routes, logger, { contentTypes: ['application/json'] });
+    return doc.serializeDocument();
+}
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export async function dumpOpenApiSchema(app: App<any>) {
+    const logger = app.get(Logger);
+    try {
+        const result = serializeOpenApiSchema(app);
+        const yaml = stringify(result, {
+            aliasDuplicateObjects: false
+        });
+        const yamlPath = path.join(process.cwd(), 'openapi.yaml');
+        await writeFile(yamlPath, yaml);
+        logger.info(`OpenAPI schema written to: ${yamlPath}`);
+    } catch (err) {
+        logger.error(`Failed to write OpenAPI schema`, err);
+    }
+}

package/src/app/index.ts

@@ -0,0 +1,6 @@
+export * from './base';
+export { BaseAppConfig } from './config';
+export * from './const';
+export type { ApiName } from './openapi';
+export * from './resolver';
+export { onServerShutdownRequested } from './shutdown';

package/src/app/openapi.ts

@@ -0,0 +1,3 @@
+import { type Name } from 'deepkit-openapi-core';
+
+export type ApiName<T extends string> = Name<T>;

package/src/app/resolver.ts

@@ -0,0 +1,49 @@
+import { ClassType } from '@deepkit/core';
+import { globalState } from './state';
+import { BaseAppConfig } from './config';
+import { Injector, InjectorModule } from '@deepkit/injector';
+
+const resolveCache = new WeakMap();
+export function resolve<T>(type: ClassType<T>): T {
+    const cached = resolveCache.get(type);
+    if (cached) return cached;
+
+    const app = globalState.currentApp;
+    if (!app) throw new Error('No app initialized');
+    const resolved = app.get(type);
+    resolveCache.set(type, resolved);
+    return resolved as T;
+}
+
+export const r = resolve;
+
+export function resolveDeep<T>(type: ClassType<T>, fromModule: InjectorModule = getAppModule()): T | undefined {
+    if (fromModule.isProvided(type)) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return getOrCreateInjectorForModule(fromModule).get(type as any);
+    }
+
+    if (fromModule.imports?.length) {
+        for (const anImport of fromModule.imports) {
+            const result = resolveDeep(type, anImport);
+            if (result) return result;
+        }
+    }
+}
+
+export function getOrCreateInjectorForModule(module: InjectorModule): Injector {
+    return globalState.currentApp!.getInjectorContext().getInjector(module);
+}
+
+export function getApp() {
+    if (!globalState.currentApp) throw new Error('No app initialized');
+    return globalState.currentApp;
+}
+
+export function getAppModule() {
+    return getApp().appModule;
+}
+
+export function getAppConfig() {
+    return getAppModule().config as BaseAppConfig;
+}

package/src/app/shutdown.ts

@@ -0,0 +1,55 @@
+import { EventDispatcher, EventToken, eventDispatcher } from '@deepkit/event';
+import { onServerBootstrapDone } from '@deepkit/framework';
+import { Logger } from '@deepkit/logger';
+
+export const onServerShutdownRequested = new EventToken('server.shutdown-requested');
+
+export class ShutdownListener {
+    private shutdownPromise: Promise<void> | undefined;
+
+    constructor(
+        private eventDispatcher: EventDispatcher,
+        private logger: Logger
+    ) {}
+
+    @eventDispatcher.listen(onServerBootstrapDone)
+    reconfigureShutdown(): void {
+        const sigtermListeners = process.listeners('SIGTERM');
+        const sigintListeners = process.listeners('SIGINT');
+        process.removeAllListeners('SIGTERM');
+        process.removeAllListeners('SIGINT');
+
+        process.on('SIGTERM', signal => {
+            this.handleShutdown()
+                .then(() => {
+                    for (const listener of sigtermListeners) {
+                        listener(signal);
+                    }
+                })
+                .catch(err => {
+                    this.logger.error('Error during shutdown', err as Error);
+                    process.exit(1);
+                });
+        });
+
+        process.on('SIGINT', signal => {
+            this.handleShutdown()
+                .then(() => {
+                    for (const listener of sigintListeners) {
+                        listener(signal);
+                    }
+                })
+                .catch(err => {
+                    this.logger.error('Error during shutdown', err as Error);
+                    process.exit(1);
+                });
+        });
+    }
+
+    async handleShutdown(): Promise<void> {
+        if (!this.shutdownPromise) {
+            this.shutdownPromise = this.eventDispatcher.dispatch(onServerShutdownRequested);
+        }
+        return this.shutdownPromise;
+    }
+}

package/src/app/state.ts

@@ -0,0 +1,19 @@
+import { App } from '@deepkit/app';
+import { ClassType } from '@deepkit/core';
+import { ReflectionClass, Type } from '@deepkit/type';
+
+import type { BaseDatabase } from '../database';
+
+export const globalState: {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    currentApp?: App<any>;
+    enableWorker?: boolean;
+    isCliService?: boolean;
+    dbClass?: ClassType<BaseDatabase>;
+    // oxlint-disable-next-line typescript/no-explicit-any
+    additionalEntities: (Type | ClassType | ReflectionClass<any>)[];
+} = { additionalEntities: [] };
+
+export class DBProvider {
+    constructor(public db: BaseDatabase) {}
+}

package/src/auth/index.ts

@@ -0,0 +1,2 @@
+export * from './jwt';
+export * from './provider';

package/src/auth/jwt.ts

@@ -0,0 +1,275 @@
+import { HttpRequest, HttpResponse } from '@deepkit/http';
+import { createPrivateKey, createPublicKey } from 'crypto';
+import { Algorithm, Bufferable, createDecoder, createSigner, createVerifier, SignerPayload, SignerSync, TokenError, VerifierSync } from 'fast-jwt';
+
+import { getAppConfig } from '../app/resolver';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+type JwtExtras = Record<string, any>;
+
+interface BaseJwtOptions {
+    issuer?: string;
+    audience?: string;
+}
+
+export interface JwtCookieOptions {
+    secure?: boolean;
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    domain?: string;
+}
+
+interface JwtGenerationOptions<T extends JwtExtras = object> extends BaseJwtOptions {
+    id?: string;
+    subject: string;
+    expiresAt?: Date | number;
+    expiryMins?: number;
+    payload?: T;
+}
+
+interface VerifierOptions extends BaseJwtOptions {
+    key: string | Buffer;
+    algorithm: Algorithm;
+}
+
+export class ParsedJwt<T extends JwtExtras = object> {
+    readonly isValid = true;
+    id?: string;
+    issuer!: string;
+    audience?: string;
+    subject!: string;
+    issuedAtMs!: number;
+    get issuedAt() {
+        return new Date(this.issuedAtMs * 1000);
+    }
+    expiresAtMs!: number;
+    get expiresAt() {
+        return new Date(this.expiresAtMs * 1000);
+    }
+    payload!: T;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    rawPayload!: Record<string, any>;
+}
+
+export interface InvalidJwtValidationResult {
+    isValid: false;
+    isDecodable: boolean;
+    isSignatureValid?: boolean;
+    isPayloadValid?: boolean;
+    isNotExpired?: boolean;
+}
+
+export type JwtValidationResult<T extends JwtExtras = object> = ParsedJwt<T> | InvalidJwtValidationResult;
+
+interface JWTState {
+    shouldVerify: boolean;
+    issuerName: string;
+    validityMins: number;
+    cookieName: string;
+    cookieRe: RegExp;
+    signer: typeof SignerSync<SignerPayload>;
+    verifier: typeof VerifierSync<Bufferable>;
+    decoder: ReturnType<typeof createDecoder>;
+}
+
+const TokenErrorClasses = {
+    decode: [TokenError.codes.invalidPayload, TokenError.codes.malformed, TokenError.codes.invalidType],
+    verify: [TokenError.codes.verifyError, TokenError.codes.invalidSignature, TokenError.codes.invalidAlgorithm],
+    payload: [TokenError.codes.invalidClaimType, TokenError.codes.invalidClaimValue, TokenError.codes.missingRequiredClaim],
+    expiry: [TokenError.codes.expired, TokenError.codes.inactive]
+};
+
+export class JWT {
+    private static _state?: JWTState;
+
+    private static get state() {
+        const appConfig = getAppConfig();
+        if (appConfig.AUTH_JWT_ENABLE_VERIFY) {
+            if (!appConfig.AUTH_JWT_SECRET && !appConfig.AUTH_JWT_SECRET_B64 && !appConfig.AUTH_JWT_ED_SECRET) {
+                throw new Error('AUTH_JWT_SECRET/AUTH_JWT_SECRET_B64/AUTH_JWT_ED_SECRET is not configured');
+            }
+            if (appConfig.AUTH_JWT_SECRET && appConfig.AUTH_JWT_SECRET_B64) {
+                throw new Error('AUTH_JWT_SECRET and AUTH_JWT_SECRET_B64 cannot both be configured');
+            }
+            if ((appConfig.AUTH_JWT_SECRET || appConfig.AUTH_JWT_SECRET_B64) && appConfig.AUTH_JWT_ED_SECRET) {
+                throw new Error('AUTH_JWT_SECRET/AUTH_JWT_SECRET_B64 and AUTH_JWT_ED_SECRET cannot both be configured');
+            }
+        }
+
+        const shouldVerify = appConfig.AUTH_JWT_ENABLE_VERIFY;
+        const cookieName = appConfig.AUTH_JWT_COOKIE_NAME ?? 'jwt';
+        const cookieRe = new RegExp('(^|;)[ ]*' + cookieName + '=([^;]+)');
+        const issuerName = appConfig.AUTH_JWT_ISSUER ?? 'app';
+        const validityMins = appConfig.AUTH_JWT_EXPIRATION_MINS ?? 60;
+        const getKey = () =>
+            appConfig.AUTH_JWT_SECRET_B64 ? Buffer.from(appConfig.AUTH_JWT_SECRET_B64, 'base64') : (appConfig.AUTH_JWT_SECRET ?? '');
+        const signer = createSigner(
+            appConfig.AUTH_JWT_ED_SECRET
+                ? { algorithm: 'EdDSA', key: `-----BEGIN PRIVATE KEY-----\n${appConfig.AUTH_JWT_ED_SECRET}\n-----END PRIVATE KEY-----` }
+                : { key: getKey() }
+        );
+        const verifier = createVerifier({
+            cache: true,
+            allowedIss: issuerName,
+            ...(appConfig.AUTH_JWT_ED_SECRET
+                ? { algorithms: ['EdDSA'], key: this.deriveEdPublicKey(appConfig.AUTH_JWT_ED_SECRET) }
+                : { key: getKey() })
+        });
+        const decoder = createDecoder();
+        this._state = { shouldVerify, issuerName, validityMins, cookieName, cookieRe, signer, verifier, decoder };
+
+        Object.defineProperty(this, 'state', { value: this._state });
+
+        return this._state;
+    }
+
+    private static deriveEdPublicKey(privateKey: string) {
+        const privateKeyObj = createPrivateKey({
+            key: `-----BEGIN PRIVATE KEY-----\n${privateKey}\n-----END PRIVATE KEY-----`,
+            format: 'pem',
+            type: 'pkcs8'
+        });
+        const publicKeyObj = createPublicKey({
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            key: privateKeyObj as any
+        });
+        return publicKeyObj.export({ type: 'spki', format: 'pem' });
+    }
+
+    static async generate<T extends JwtExtras>(options: JwtGenerationOptions<T>): Promise<string> {
+        return this.state.signer({
+            ...(options.id ? { jti: options.id } : {}),
+            iss: options.issuer ?? this.state.issuerName,
+            aud: options.audience,
+            sub: options.subject,
+            exp: this.getExpirationTs(options),
+            ...options.payload
+        });
+        // todo: ID
+    }
+
+    static async generateCookie<T extends JwtExtras>(options: JwtGenerationOptions<T>, response: HttpResponse, cookieOptions?: JwtCookieOptions) {
+        const payload = await this.generate(options);
+        response.setHeader('set-cookie', `${this.state.cookieName}=${payload}; ${this.buildCookieAttributes(cookieOptions)}`);
+    }
+
+    static async clearCookie(response: HttpResponse, cookieOptions?: JwtCookieOptions) {
+        response.setHeader(
+            'set-cookie',
+            `${this.state.cookieName}=invalid; Expires=Thu, 01 Jan 1970 00:00:00 GMT; ${this.buildCookieAttributes(cookieOptions)}`
+        );
+    }
+
+    private static buildCookieAttributes(options?: JwtCookieOptions): string {
+        const parts = ['Path=/; HttpOnly'];
+        if (options?.secure !== false) parts.push('Secure');
+        parts.push(`SameSite=${options?.sameSite ?? 'Lax'}`);
+        if (options?.domain) parts.push(`Domain=${options.domain}`);
+        return parts.join('; ');
+    }
+
+    static createVerifier<T extends JwtExtras = object>(options: VerifierOptions): (token: string) => Promise<JwtValidationResult<T>> {
+        const verifier = createVerifier({
+            cache: true,
+            allowedIss: options.issuer,
+            allowedAud: options.audience,
+            algorithms: [options.algorithm],
+            key:
+                typeof options.key === 'string' && !options.key.startsWith('-----BEGIN PUBLIC KEY-----') && options.algorithm === 'EdDSA'
+                    ? `-----BEGIN PUBLIC KEY-----\n${options.key}\n-----END PUBLIC KEY-----`
+                    : options.key
+        });
+        return async (token: string) => this.verify(token, verifier);
+    }
+
+    static async verify<T extends JwtExtras = object>(token: string, verifier?: JWTState['verifier']): Promise<JwtValidationResult<T>> {
+        try {
+            verifier = verifier ?? this.state.verifier;
+            const result = await verifier(token);
+            return this.formatJwtResult<T>(result);
+        } catch (err) {
+            return this.formatJwtError(err);
+        }
+    }
+
+    static async decode<T extends JwtExtras = object>(token: string): Promise<JwtValidationResult<T>> {
+        try {
+            const result = await this.state.decoder(token);
+            return this.formatJwtResult<T>(result);
+        } catch (err) {
+            return this.formatJwtError(err);
+        }
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    private static formatJwtResult<T extends JwtExtras = object>(result: any): JwtValidationResult<T> {
+        const formatted = new ParsedJwt<T>();
+        const { jti, sub, iss, aud, iat, exp, ...payload } = result;
+        Object.assign(formatted, {
+            id: jti,
+            subject: sub,
+            issuer: iss,
+            audience: aud,
+            issuedAtMs: iat,
+            expiresAtMs: exp,
+            payload,
+            rawPayload: result
+        });
+        return formatted;
+    }
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    private static formatJwtError(err: any): InvalidJwtValidationResult {
+        if (err instanceof TokenError) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            if (TokenErrorClasses.decode.includes(err.code as any)) {
+                return { isValid: false, isDecodable: false };
+            }
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            if (TokenErrorClasses.verify.includes(err.code as any)) {
+                return { isValid: false, isDecodable: true, isSignatureValid: false };
+            }
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            if (TokenErrorClasses.payload.includes(err.code as any)) {
+                return { isValid: false, isDecodable: true, isSignatureValid: true, isPayloadValid: false };
+            }
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            if (TokenErrorClasses.expiry.includes(err.code as any)) {
+                return { isValid: false, isDecodable: true, isSignatureValid: true, isPayloadValid: true, isNotExpired: false };
+            }
+        }
+        throw err;
+    }
+
+    static async process(token: string) {
+        return this.state.shouldVerify ? this.verify(token) : this.decode(token);
+    }
+
+    static async processWithRequest(request: HttpRequest): Promise<JwtValidationResult | null> {
+        if (request.headers.authorization) {
+            if (request.headers.authorization.startsWith('Bearer ')) {
+                const result = await this.process(request.headers.authorization.substring(7));
+                if (result.isValid) {
+                    return result;
+                }
+            }
+        }
+
+        if (request.headers.cookie) {
+            const matches = request.headers.cookie.match(this.state.cookieRe);
+            if (matches) {
+                const result = await this.process(matches[2]);
+                if (result.isValid) {
+                    return result;
+                }
+            }
+        }
+
+        return null;
+    }
+
+    private static getExpirationTs(options: JwtGenerationOptions) {
+        const expiresMsIn = options.expiresAt instanceof Date ? options.expiresAt.getTime() : options.expiresAt;
+        const expiresMs = expiresMsIn ?? Date.now() + (options.expiryMins ?? this.state.validityMins) * 60 * 1000;
+        return Math.floor(expiresMs / 1000);
+    }
+}