ecrs-auth-core 1.0.63 → 1.0.64

package/dist/auth.module.js

@@ -1,155 +1,152 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var AuthCoreModule_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthCoreModule = exports.AUTH_CORE_OPTIONS = void 0;
-const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
-const auth_service_1 = require("./auth.service");
-const auth_controller_1 = require("./auth.controller");
-const jwt_strategy_1 = require("./jwt/jwt.strategy");
-const jwt_guard_1 = require("./jwt/jwt.guard");
-const module_guard_1 = require("./guards/module.guard");
-const roles_guard_1 = require("./guards/roles.guard");
-const feature_guard_1 = require("./guards/feature.guard");
-const route_guard_1 = require("./guards/route.guard");
-const permission_guard_1 = require("./guards/permission.guard");
-const api_key_guard_1 = require("./guards/api-key.guard");
-const encryption_service_1 = require("./services/encryption.service");
-exports.AUTH_CORE_OPTIONS = 'AUTH_CORE_OPTIONS';
-// @Global()
-// @Module({})
-// export class AuthCoreModule {
-//   static registerAsync(options: {
-//     inject: any[];
-//     useFactory: (...args: any[]) => Promise<AuthCoreOptions>;
-//   }): DynamicModule {
-//     const asyncProvider = {
-//       provide: AUTH_CORE_OPTIONS,
-//       inject: options.inject,
-//       useFactory: options.useFactory,
-//     };
-//     return {
-//       module: AuthCoreModule,
-//       imports: [
-//         JwtModule.registerAsync({
-//           inject: options.inject,
-//           useFactory: async (...args: any[]) => {
-//             const config = await options.useFactory(...args);
-//             console.log("🔐 JWT Secret from AUTH_CORE_OPTIONS:", config.jwtSecret);
-//             console.log("⏳ JWT Expiry:", config.jwtExpiresIn);
-//             return {
-//               secret: config.jwtSecret,
-//               signOptions: { expiresIn: config.jwtExpiresIn },
-//             };
-//           },
-//         }),
-//       ],
-//       providers: [
-//         asyncProvider,
-//         {
-//           provide: 'MODULE_CONFIG',
-//           useFactory: (options: AuthCoreOptions) => options.moduleConfig || {},
-//           inject: [AUTH_CORE_OPTIONS],
-//         },
-//         AuthService,
-//         JwtStrategy,
-//         JwtAuthGuard,
-//         ModuleGuard,
-//         RolesGuard,
-//         FeatureGuard,
-//         RouteGuard,
-//         PermissionGuard,
-//       ],
-//       controllers: [AuthController],
-//       exports: [
-//         AuthService,
-//         JwtStrategy,
-//         JwtAuthGuard,
-//         ModuleGuard,
-//         RolesGuard,
-//         FeatureGuard,
-//         RouteGuard,
-//         PermissionGuard,
-//         JwtModule,
-//       ],
-//     };
-//   }
-// }
-let AuthCoreModule = AuthCoreModule_1 = class AuthCoreModule {
-    static registerAsync(options) {
-        const asyncProvider = {
-            provide: exports.AUTH_CORE_OPTIONS,
-            inject: options.inject,
-            useFactory: options.useFactory,
-        };
-        return {
-            module: AuthCoreModule_1,
-            imports: [
-                jwt_1.JwtModule.registerAsync({
-                    inject: options.inject,
-                    useFactory: async (...args) => {
-                        const config = await options.useFactory(...args);
-                        console.log('🔐 JWT Secret from AUTH_CORE_OPTIONS:', config.jwtSecret);
-                        console.log('⏳ JWT Expiry:', config.jwtExpiresIn);
-                        return {
-                            secret: config.jwtSecret,
-                            signOptions: { expiresIn: config.jwtExpiresIn },
-                        };
-                    },
-                }),
-            ],
-            providers: [
-                asyncProvider,
-                {
-                    provide: 'MODULE_CONFIG',
-                    useFactory: (opts) => opts.moduleConfig || {},
-                    inject: [exports.AUTH_CORE_OPTIONS],
-                },
-                {
-                    provide: 'API_KEY_REPOSITORY',
-                    useFactory: (opts) => opts.repositories?.apiKeyRepo || null,
-                    inject: [exports.AUTH_CORE_OPTIONS],
-                },
-                encryption_service_1.EncryptionService,
-                auth_service_1.AuthService,
-                jwt_strategy_1.JwtStrategy,
-                jwt_guard_1.JwtAuthGuard,
-                module_guard_1.ModuleGuard,
-                roles_guard_1.RolesGuard,
-                feature_guard_1.FeatureGuard,
-                route_guard_1.RouteGuard,
-                permission_guard_1.PermissionGuard,
-                api_key_guard_1.ApiKeyGuard,
-            ],
-            controllers: [auth_controller_1.AuthController],
-            exports: [
-                // ⬇️ export these so Superadmin can resolve guard deps
-                exports.AUTH_CORE_OPTIONS,
-                'MODULE_CONFIG',
-                'API_KEY_REPOSITORY',
-                jwt_1.JwtModule,
-                auth_service_1.AuthService,
-                encryption_service_1.EncryptionService,
-                jwt_strategy_1.JwtStrategy,
-                jwt_guard_1.JwtAuthGuard,
-                module_guard_1.ModuleGuard,
-                roles_guard_1.RolesGuard,
-                feature_guard_1.FeatureGuard,
-                route_guard_1.RouteGuard,
-                permission_guard_1.PermissionGuard,
-                api_key_guard_1.ApiKeyGuard,
-            ],
-        };
-    }
-};
-exports.AuthCoreModule = AuthCoreModule;
-exports.AuthCoreModule = AuthCoreModule = AuthCoreModule_1 = __decorate([
-    (0, common_1.Global)(),
-    (0, common_1.Module)({})
-], AuthCoreModule);
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthCoreModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthCoreModule = exports.AUTH_CORE_OPTIONS = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const auth_service_1 = require("./auth.service");
+const auth_controller_1 = require("./auth.controller");
+const jwt_strategy_1 = require("./jwt/jwt.strategy");
+const jwt_guard_1 = require("./jwt/jwt.guard");
+const module_guard_1 = require("./guards/module.guard");
+const roles_guard_1 = require("./guards/roles.guard");
+const feature_guard_1 = require("./guards/feature.guard");
+const route_guard_1 = require("./guards/route.guard");
+const permission_guard_1 = require("./guards/permission.guard");
+const api_key_guard_1 = require("./guards/api-key.guard");
+exports.AUTH_CORE_OPTIONS = 'AUTH_CORE_OPTIONS';
+// @Global()
+// @Module({})
+// export class AuthCoreModule {
+//   static registerAsync(options: {
+//     inject: any[];
+//     useFactory: (...args: any[]) => Promise<AuthCoreOptions>;
+//   }): DynamicModule {
+//     const asyncProvider = {
+//       provide: AUTH_CORE_OPTIONS,
+//       inject: options.inject,
+//       useFactory: options.useFactory,
+//     };
+//     return {
+//       module: AuthCoreModule,
+//       imports: [
+//         JwtModule.registerAsync({
+//           inject: options.inject,
+//           useFactory: async (...args: any[]) => {
+//             const config = await options.useFactory(...args);
+//             console.log("🔐 JWT Secret from AUTH_CORE_OPTIONS:", config.jwtSecret);
+//             console.log("⏳ JWT Expiry:", config.jwtExpiresIn);
+//             return {
+//               secret: config.jwtSecret,
+//               signOptions: { expiresIn: config.jwtExpiresIn },
+//             };
+//           },
+//         }),
+//       ],
+//       providers: [
+//         asyncProvider,
+//         {
+//           provide: 'MODULE_CONFIG',
+//           useFactory: (options: AuthCoreOptions) => options.moduleConfig || {},
+//           inject: [AUTH_CORE_OPTIONS],
+//         },
+//         AuthService,
+//         JwtStrategy,
+//         JwtAuthGuard,
+//         ModuleGuard,
+//         RolesGuard,
+//         FeatureGuard,
+//         RouteGuard,
+//         PermissionGuard,
+//       ],
+//       controllers: [AuthController],
+//       exports: [
+//         AuthService,
+//         JwtStrategy,
+//         JwtAuthGuard,
+//         ModuleGuard,
+//         RolesGuard,
+//         FeatureGuard,
+//         RouteGuard,
+//         PermissionGuard,
+//         JwtModule,
+//       ],
+//     };
+//   }
+// }
+let AuthCoreModule = AuthCoreModule_1 = class AuthCoreModule {
+    static registerAsync(options) {
+        const asyncProvider = {
+            provide: exports.AUTH_CORE_OPTIONS,
+            inject: options.inject,
+            useFactory: options.useFactory,
+        };
+        return {
+            module: AuthCoreModule_1,
+            imports: [
+                jwt_1.JwtModule.registerAsync({
+                    inject: options.inject,
+                    useFactory: async (...args) => {
+                        const config = await options.useFactory(...args);
+                        console.log('🔐 JWT Secret from AUTH_CORE_OPTIONS:', config.jwtSecret);
+                        console.log('⏳ JWT Expiry:', config.jwtExpiresIn);
+                        return {
+                            secret: config.jwtSecret,
+                            signOptions: { expiresIn: config.jwtExpiresIn },
+                        };
+                    },
+                }),
+            ],
+            providers: [
+                asyncProvider,
+                {
+                    provide: 'MODULE_CONFIG',
+                    useFactory: (opts) => opts.moduleConfig || {},
+                    inject: [exports.AUTH_CORE_OPTIONS],
+                },
+                {
+                    provide: 'API_KEY_REPOSITORY',
+                    useFactory: (opts) => opts.repositories?.apiKeyRepo || null,
+                    inject: [exports.AUTH_CORE_OPTIONS],
+                },
+                auth_service_1.AuthService,
+                jwt_strategy_1.JwtStrategy,
+                jwt_guard_1.JwtAuthGuard,
+                module_guard_1.ModuleGuard,
+                roles_guard_1.RolesGuard,
+                feature_guard_1.FeatureGuard,
+                route_guard_1.RouteGuard,
+                permission_guard_1.PermissionGuard,
+                api_key_guard_1.ApiKeyGuard,
+            ],
+            controllers: [auth_controller_1.AuthController],
+            exports: [
+                // ⬇️ export these so Superadmin can resolve guard deps
+                exports.AUTH_CORE_OPTIONS,
+                'MODULE_CONFIG',
+                'API_KEY_REPOSITORY',
+                jwt_1.JwtModule,
+                auth_service_1.AuthService,
+                jwt_strategy_1.JwtStrategy,
+                jwt_guard_1.JwtAuthGuard,
+                module_guard_1.ModuleGuard,
+                roles_guard_1.RolesGuard,
+                feature_guard_1.FeatureGuard,
+                route_guard_1.RouteGuard,
+                permission_guard_1.PermissionGuard,
+                api_key_guard_1.ApiKeyGuard,
+            ],
+        };
+    }
+};
+exports.AuthCoreModule = AuthCoreModule;
+exports.AuthCoreModule = AuthCoreModule = AuthCoreModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], AuthCoreModule);

package/dist/guards/api-key.guard.d.ts

@@ -1,17 +1,15 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { Repository } from 'typeorm';
-import { ApiKeyEntity } from '../entities/api-key.entity';
-import { EncryptionService } from '../services/encryption.service';
-export declare class ApiKeyGuard implements CanActivate {
-    private readonly reflector;
-    private readonly encryptionService;
-    private apiKeyRepo;
-    private rateLimitMap;
-    constructor(reflector: Reflector, encryptionService: EncryptionService, apiKeyRepository?: Repository<ApiKeyEntity>);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractApiKey;
-    private validateApiKey;
-    private getClientIp;
-    private checkRateLimit;
-}
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Repository } from 'typeorm';
+import { ApiKeyEntity } from '../entities/api-key.entity';
+export declare class ApiKeyGuard implements CanActivate {
+    private readonly reflector;
+    private apiKeyRepo;
+    private rateLimitMap;
+    constructor(reflector: Reflector, apiKeyRepository?: Repository<ApiKeyEntity>);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private extractApiKey;
+    private validateApiKey;
+    private getClientIp;
+    private checkRateLimit;
+}

package/dist/guards/api-key.guard.js

@@ -1,195 +1,182 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApiKeyGuard = void 0;
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const typeorm_1 = require("typeorm");
-const encryption_service_1 = require("../services/encryption.service");
-let ApiKeyGuard = class ApiKeyGuard {
-    constructor(reflector, encryptionService, apiKeyRepository) {
-        this.reflector = reflector;
-        this.encryptionService = encryptionService;
-        this.rateLimitMap = new Map();
-        if (apiKeyRepository) {
-            this.apiKeyRepo = apiKeyRepository;
-        }
-    }
-    async canActivate(context) {
-        const options = this.reflector.get('api_key_options', context.getHandler());
-        // If no @ApiKey decorator is present, skip this guard
-        if (!options) {
-            return true;
-        }
-        const request = context.switchToHttp().getRequest();
-        const apiKey = this.extractApiKey(request);
-        if (!apiKey) {
-            throw new common_1.UnauthorizedException('API key is missing');
-        }
-        // Validate API key
-        const validation = await this.validateApiKey(apiKey, request, options);
-        if (!validation.valid) {
-            throw new common_1.UnauthorizedException(validation.message || 'Invalid API key');
-        }
-        // Attach API key info to request for downstream use
-        request.apiKey = validation.apiKey;
-        request.apiKeyClient = {
-            id: validation.apiKey?.id,
-            clientName: validation.apiKey?.clientName,
-            scope: validation.apiKey?.scope,
-        };
-        return true;
-    }
-    extractApiKey(request) {
-        // Check 'X-API-Key' header
-        const headerKey = request.headers['x-api-key'];
-        if (headerKey) {
-            return headerKey;
-        }
-        // Check 'api_key' query parameter
-        if (request.query?.api_key) {
-            return request.query.api_key;
-        }
-        // Check Authorization header (format: 'ApiKey <key>')
-        const authHeader = request.headers.authorization;
-        if (authHeader && authHeader.startsWith('ApiKey ')) {
-            return authHeader.substring(7);
-        }
-        return null;
-    }
-    async validateApiKey(apiKey, request, options) {
-        if (!this.apiKeyRepo) {
-            return { valid: false, message: 'API key validation not configured' };
-        }
-        // Find all active API keys and compare hashes
-        const records = await this.apiKeyRepo.find({
-            where: { isActive: true },
-        });
-        let record = null;
-        // Compare incoming key with hashed keys in database
-        for (const dbRecord of records) {
-            const isMatch = await this.encryptionService.compareKey(apiKey, dbRecord.key);
-            if (isMatch) {
-                record = dbRecord;
-                break;
-            }
-        }
-        if (!record) {
-            return { valid: false, message: 'API key not found or inactive' };
-        }
-        // Check scope
-        const requiredScope = options.scope || 'common';
-        if (record.scope !== 'common' && record.scope !== requiredScope) {
-            return {
-                valid: false,
-                message: `API key scope '${record.scope}' does not match required scope '${requiredScope}'`,
-            };
-        }
-        // Check IP whitelist
-        if (record.allowedIps) {
-            const clientIp = this.getClientIp(request);
-            const allowedIps = record.allowedIps.split(',').map((ip) => ip.trim());
-            if (!allowedIps.includes(clientIp)) {
-                return {
-                    valid: false,
-                    message: `Client IP '${clientIp}' is not whitelisted`,
-                };
-            }
-        }
-        // Check endpoint restriction
-        if (record.allowedEndpoints) {
-            const requestEndpoint = `${request.method} ${request.path}`;
-            const allowedEndpoints = record.allowedEndpoints
-                .split(',')
-                .map((ep) => ep.trim());
-            const isAllowed = allowedEndpoints.some((ep) => {
-                // Support wildcard matching (e.g., 'GET /spot/*')
-                if (ep.includes('*')) {
-                    const pattern = ep.replace(/\*/g, '.*');
-                    return new RegExp(`^${pattern}$`).test(requestEndpoint);
-                }
-                return ep === requestEndpoint;
-            });
-            if (!isAllowed) {
-                return {
-                    valid: false,
-                    message: `Endpoint '${requestEndpoint}' is not allowed for this API key`,
-                };
-            }
-        }
-        // Check rate limit
-        if (record.rateLimit) {
-            const isRateLimited = this.checkRateLimit(apiKey, record.rateLimit);
-            if (isRateLimited) {
-                return {
-                    valid: false,
-                    message: `Rate limit exceeded (${record.rateLimit} requests per minute)`,
-                };
-            }
-        }
-        // Update last used timestamp
-        if (this.apiKeyRepo) {
-            await this.apiKeyRepo.update(record.id, {
-                lastUsedAt: Date.now(),
-            });
-        }
-        return { valid: true, apiKey: record };
-    }
-    getClientIp(request) {
-        // Support common proxy headers
-        const xForwardedFor = request.headers['x-forwarded-for'];
-        if (xForwardedFor) {
-            return xForwardedFor.split(',')[0].trim();
-        }
-        const xRealIp = request.headers['x-real-ip'];
-        if (xRealIp) {
-            return xRealIp;
-        }
-        return request.ip || request.connection.remoteAddress || 'unknown';
-    }
-    checkRateLimit(apiKey, rateLimit) {
-        const now = Date.now();
-        const limitData = this.rateLimitMap.get(apiKey);
-        if (!limitData) {
-            // First request, initialize
-            this.rateLimitMap.set(apiKey, {
-                count: 1,
-                resetTime: now + 60000, // 1 minute
-            });
-            return false;
-        }
-        if (now > limitData.resetTime) {
-            // Reset window expired
-            this.rateLimitMap.set(apiKey, {
-                count: 1,
-                resetTime: now + 60000,
-            });
-            return false;
-        }
-        // Still within window
-        if (limitData.count >= rateLimit) {
-            return true;
-        }
-        limitData.count++;
-        return false;
-    }
-};
-exports.ApiKeyGuard = ApiKeyGuard;
-exports.ApiKeyGuard = ApiKeyGuard = __decorate([
-    (0, common_1.Injectable)(),
-    __param(2, (0, common_1.Inject)('API_KEY_REPOSITORY')),
-    __metadata("design:paramtypes", [core_1.Reflector,
-        encryption_service_1.EncryptionService,
-        typeorm_1.Repository])
-], ApiKeyGuard);
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const typeorm_1 = require("typeorm");
+let ApiKeyGuard = class ApiKeyGuard {
+    constructor(reflector, apiKeyRepository) {
+        this.reflector = reflector;
+        this.rateLimitMap = new Map();
+        if (apiKeyRepository) {
+            this.apiKeyRepo = apiKeyRepository;
+        }
+    }
+    async canActivate(context) {
+        const options = this.reflector.get('api_key_options', context.getHandler());
+        // If no @ApiKey decorator is present, skip this guard
+        if (!options) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const apiKey = this.extractApiKey(request);
+        if (!apiKey) {
+            throw new common_1.UnauthorizedException('API key is missing');
+        }
+        // Validate API key
+        const validation = await this.validateApiKey(apiKey, request, options);
+        if (!validation.valid) {
+            throw new common_1.UnauthorizedException(validation.message || 'Invalid API key');
+        }
+        // Attach API key info to request for downstream use
+        request.apiKey = validation.apiKey;
+        request.apiKeyClient = {
+            id: validation.apiKey?.id,
+            clientName: validation.apiKey?.clientName,
+            scope: validation.apiKey?.scope,
+        };
+        return true;
+    }
+    extractApiKey(request) {
+        // Check 'X-API-Key' header
+        const headerKey = request.headers['x-api-key'];
+        if (headerKey) {
+            return headerKey;
+        }
+        // Check 'api_key' query parameter
+        if (request.query?.api_key) {
+            return request.query.api_key;
+        }
+        // Check Authorization header (format: 'ApiKey <key>')
+        const authHeader = request.headers.authorization;
+        if (authHeader && authHeader.startsWith('ApiKey ')) {
+            return authHeader.substring(7);
+        }
+        return null;
+    }
+    async validateApiKey(apiKey, request, options) {
+        if (!this.apiKeyRepo) {
+            return { valid: false, message: 'API key validation not configured' };
+        }
+        const record = await this.apiKeyRepo.findOne({
+            where: { key: apiKey, isActive: true },
+        });
+        if (!record) {
+            return { valid: false, message: 'API key not found or inactive' };
+        }
+        // Check scope
+        const requiredScope = options.scope || 'common';
+        if (record.scope !== 'common' && record.scope !== requiredScope) {
+            return {
+                valid: false,
+                message: `API key scope '${record.scope}' does not match required scope '${requiredScope}'`,
+            };
+        }
+        // Check IP whitelist
+        if (record.allowedIps) {
+            const clientIp = this.getClientIp(request);
+            const allowedIps = record.allowedIps.split(',').map((ip) => ip.trim());
+            if (!allowedIps.includes(clientIp)) {
+                return {
+                    valid: false,
+                    message: `Client IP '${clientIp}' is not whitelisted`,
+                };
+            }
+        }
+        // Check endpoint restriction
+        if (record.allowedEndpoints) {
+            const requestEndpoint = `${request.method} ${request.path}`;
+            const allowedEndpoints = record.allowedEndpoints
+                .split(',')
+                .map((ep) => ep.trim());
+            const isAllowed = allowedEndpoints.some((ep) => {
+                // Support wildcard matching (e.g., 'GET /spot/*')
+                if (ep.includes('*')) {
+                    const pattern = ep.replace(/\*/g, '.*');
+                    return new RegExp(`^${pattern}$`).test(requestEndpoint);
+                }
+                return ep === requestEndpoint;
+            });
+            if (!isAllowed) {
+                return {
+                    valid: false,
+                    message: `Endpoint '${requestEndpoint}' is not allowed for this API key`,
+                };
+            }
+        }
+        // Check rate limit
+        if (record.rateLimit) {
+            const isRateLimited = this.checkRateLimit(apiKey, record.rateLimit);
+            if (isRateLimited) {
+                return {
+                    valid: false,
+                    message: `Rate limit exceeded (${record.rateLimit} requests per minute)`,
+                };
+            }
+        }
+        // Update last used timestamp
+        if (this.apiKeyRepo) {
+            await this.apiKeyRepo.update(record.id, {
+                lastUsedAt: Date.now(),
+            });
+        }
+        return { valid: true, apiKey: record };
+    }
+    getClientIp(request) {
+        // Support common proxy headers
+        const xForwardedFor = request.headers['x-forwarded-for'];
+        if (xForwardedFor) {
+            return xForwardedFor.split(',')[0].trim();
+        }
+        const xRealIp = request.headers['x-real-ip'];
+        if (xRealIp) {
+            return xRealIp;
+        }
+        return request.ip || request.connection.remoteAddress || 'unknown';
+    }
+    checkRateLimit(apiKey, rateLimit) {
+        const now = Date.now();
+        const limitData = this.rateLimitMap.get(apiKey);
+        if (!limitData) {
+            // First request, initialize
+            this.rateLimitMap.set(apiKey, {
+                count: 1,
+                resetTime: now + 60000, // 1 minute
+            });
+            return false;
+        }
+        if (now > limitData.resetTime) {
+            // Reset window expired
+            this.rateLimitMap.set(apiKey, {
+                count: 1,
+                resetTime: now + 60000,
+            });
+            return false;
+        }
+        // Still within window
+        if (limitData.count >= rateLimit) {
+            return true;
+        }
+        limitData.count++;
+        return false;
+    }
+};
+exports.ApiKeyGuard = ApiKeyGuard;
+exports.ApiKeyGuard = ApiKeyGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)('API_KEY_REPOSITORY')),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        typeorm_1.Repository])
+], ApiKeyGuard);

package/dist/index.d.ts

@@ -1,29 +1,28 @@
-export * from './auth.module';
-export * from './auth.service';
-export * from './dtos/login.dto';
-export * from './dtos/login-response.dto';
-export * from './decorators/current-user.decorator';
-export * from './decorators/feature.decorator';
-export * from './decorators/has-permission.decorator';
-export * from './decorators/roles.decorator';
-export * from './decorators/route-permission.decorator';
-export * from './decorators/api-key.decorator';
-export * from './guards/module.guard';
-export * from './guards/roles.guard';
-export * from './guards/feature.guard';
-export * from './guards/route.guard';
-export * from './guards/permission.guard';
-export * from './guards/api-key.guard';
-export * from './jwt/jwt.guard';
-export * from './jwt/jwt.strategy';
-export * from './services/encryption.service';
-export * from './interfaces/auth-core-options.interface';
-export * from './entities/user.entity';
-export * from './entities/role.entity';
-export * from './entities/module.entity';
-export * from './entities/feature.entity';
-export * from './entities/module-route.entity';
-export * from './entities/user-feature-access.entity';
-export * from './entities/user-module-access.entity';
-export * from './entities/module-screen-permission.entity';
-export * from './entities/api-key.entity';
+export * from './auth.module';
+export * from './auth.service';
+export * from './dtos/login.dto';
+export * from './dtos/login-response.dto';
+export * from './decorators/current-user.decorator';
+export * from './decorators/feature.decorator';
+export * from './decorators/has-permission.decorator';
+export * from './decorators/roles.decorator';
+export * from './decorators/route-permission.decorator';
+export * from './decorators/api-key.decorator';
+export * from './guards/module.guard';
+export * from './guards/roles.guard';
+export * from './guards/feature.guard';
+export * from './guards/route.guard';
+export * from './guards/permission.guard';
+export * from './guards/api-key.guard';
+export * from './jwt/jwt.guard';
+export * from './jwt/jwt.strategy';
+export * from './interfaces/auth-core-options.interface';
+export * from './entities/user.entity';
+export * from './entities/role.entity';
+export * from './entities/module.entity';
+export * from './entities/feature.entity';
+export * from './entities/module-route.entity';
+export * from './entities/user-feature-access.entity';
+export * from './entities/user-module-access.entity';
+export * from './entities/module-screen-permission.entity';
+export * from './entities/api-key.entity';

package/dist/index.js

@@ -1,53 +1,51 @@
-"use strict";
-// src/index.ts
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./auth.module"), exports);
-__exportStar(require("./auth.service"), exports);
-// DTOs
-__exportStar(require("./dtos/login.dto"), exports);
-__exportStar(require("./dtos/login-response.dto"), exports);
-// Decorators
-__exportStar(require("./decorators/current-user.decorator"), exports);
-__exportStar(require("./decorators/feature.decorator"), exports);
-__exportStar(require("./decorators/has-permission.decorator"), exports);
-__exportStar(require("./decorators/roles.decorator"), exports);
-__exportStar(require("./decorators/route-permission.decorator"), exports);
-__exportStar(require("./decorators/api-key.decorator"), exports);
-// Guards
-__exportStar(require("./guards/module.guard"), exports);
-__exportStar(require("./guards/roles.guard"), exports);
-__exportStar(require("./guards/feature.guard"), exports);
-__exportStar(require("./guards/route.guard"), exports);
-__exportStar(require("./guards/permission.guard"), exports);
-__exportStar(require("./guards/api-key.guard"), exports);
-// JWT
-__exportStar(require("./jwt/jwt.guard"), exports);
-__exportStar(require("./jwt/jwt.strategy"), exports);
-// Services
-__exportStar(require("./services/encryption.service"), exports);
-// Interfaces
-__exportStar(require("./interfaces/auth-core-options.interface"), exports);
-// ✅ Entities
-__exportStar(require("./entities/user.entity"), exports);
-__exportStar(require("./entities/role.entity"), exports);
-__exportStar(require("./entities/module.entity"), exports);
-__exportStar(require("./entities/feature.entity"), exports);
-__exportStar(require("./entities/module-route.entity"), exports);
-__exportStar(require("./entities/user-feature-access.entity"), exports);
-__exportStar(require("./entities/user-module-access.entity"), exports);
-__exportStar(require("./entities/module-screen-permission.entity"), exports);
-__exportStar(require("./entities/api-key.entity"), exports);
+"use strict";
+// src/index.ts
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.module"), exports);
+__exportStar(require("./auth.service"), exports);
+// DTOs
+__exportStar(require("./dtos/login.dto"), exports);
+__exportStar(require("./dtos/login-response.dto"), exports);
+// Decorators
+__exportStar(require("./decorators/current-user.decorator"), exports);
+__exportStar(require("./decorators/feature.decorator"), exports);
+__exportStar(require("./decorators/has-permission.decorator"), exports);
+__exportStar(require("./decorators/roles.decorator"), exports);
+__exportStar(require("./decorators/route-permission.decorator"), exports);
+__exportStar(require("./decorators/api-key.decorator"), exports);
+// Guards
+__exportStar(require("./guards/module.guard"), exports);
+__exportStar(require("./guards/roles.guard"), exports);
+__exportStar(require("./guards/feature.guard"), exports);
+__exportStar(require("./guards/route.guard"), exports);
+__exportStar(require("./guards/permission.guard"), exports);
+__exportStar(require("./guards/api-key.guard"), exports);
+// JWT
+__exportStar(require("./jwt/jwt.guard"), exports);
+__exportStar(require("./jwt/jwt.strategy"), exports);
+// Interfaces
+__exportStar(require("./interfaces/auth-core-options.interface"), exports);
+// ✅ Entities
+__exportStar(require("./entities/user.entity"), exports);
+__exportStar(require("./entities/role.entity"), exports);
+__exportStar(require("./entities/module.entity"), exports);
+__exportStar(require("./entities/feature.entity"), exports);
+__exportStar(require("./entities/module-route.entity"), exports);
+__exportStar(require("./entities/user-feature-access.entity"), exports);
+__exportStar(require("./entities/user-module-access.entity"), exports);
+__exportStar(require("./entities/module-screen-permission.entity"), exports);
+__exportStar(require("./entities/api-key.entity"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecrs-auth-core",
-  "version": "1.0.63",
+  "version": "1.0.64",
   "description": "Centralized authentication and authorization module for ECRS apps",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/services/encryption.service.d.ts

@@ -1,16 +0,0 @@
-export declare class EncryptionService {
-    private readonly saltRounds;
-    /**
-     * Hash an API key using bcrypt
-     * @param plainKey - The plain text API key
-     * @returns Hashed key
-     */
-    hashKey(plainKey: string): Promise<string>;
-    /**
-     * Compare plain key with hashed key
-     * @param plainKey - The plain text API key
-     * @param hashedKey - The hashed key from database
-     * @returns True if keys match, false otherwise
-     */
-    compareKey(plainKey: string, hashedKey: string): Promise<boolean>;
-}

package/dist/services/encryption.service.js

@@ -1,70 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EncryptionService = void 0;
-const common_1 = require("@nestjs/common");
-const bcrypt = __importStar(require("bcrypt"));
-let EncryptionService = class EncryptionService {
-    constructor() {
-        this.saltRounds = 10;
-    }
-    /**
-     * Hash an API key using bcrypt
-     * @param plainKey - The plain text API key
-     * @returns Hashed key
-     */
-    async hashKey(plainKey) {
-        return bcrypt.hash(plainKey, this.saltRounds);
-    }
-    /**
-     * Compare plain key with hashed key
-     * @param plainKey - The plain text API key
-     * @param hashedKey - The hashed key from database
-     * @returns True if keys match, false otherwise
-     */
-    async compareKey(plainKey, hashedKey) {
-        return bcrypt.compare(plainKey, hashedKey);
-    }
-};
-exports.EncryptionService = EncryptionService;
-exports.EncryptionService = EncryptionService = __decorate([
-    (0, common_1.Injectable)()
-], EncryptionService);